last executing test programs: 3.148925293s ago: executing program 4 (id=3371): perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x5, 0x111, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ff, 0x2, @perf_bp={&(0x7f0000002000), 0x8}, 0x9246, 0xa, 0xfffffffe, 0x0, 0x0, 0x0, 0x3000, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000280)={'wlan0\x00', @multicast}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000811000001"], 0x50) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x1c00, 0x4, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xa2}, 0x0, 0xaffffff7ffffffff, 0xffffffffffffffff, 0x7) bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="08000000040000000400000022bf000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000015009e00000000010000000000000000009cfdf0924994ad25d500000000000000006ee7480d5a09fdc6844e5e4b7dd3dd28293572f4ae4141d5586ddeb5789ac76f624e8a2e9a0501bb84f0cf"], 0x50) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000780)={0x4, &(0x7f0000000600)=[{0x45, 0x0, 0x2, 0xffffffff}, {0x2d}, {0x2}, {0x6}]}) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="00010000000000001000001ccea006a5d089d80030c6e220a6c63eb618c2eabbeff1745a8eb18b462c77acb6dc49f9aed55e1449782161a5154369b79fff19be9d24be6e07945d5bbf27101c22d550dd4b09cd631a36ef87809f5e6249bf15953c869563", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r6}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x4, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000045090200000300006e00000000000000b7020000000000007b9af0ff00000000c509000000000000c3aaf0ff00000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb60200000800000018220000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)=@abs, 0x6e, &(0x7f0000000200)=[{&(0x7f0000001000)=""/4096, 0x1000}, {&(0x7f0000000080)}, {&(0x7f00000000c0)=""/105, 0x69}, {&(0x7f0000000140)=""/179, 0xb3}], 0x4, &(0x7f00000003c0)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x70}, 0x160) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000002240)="d8000000120081414e81f782db010000001d080b01088100e8fb55a1010115000600142651d60e120800040000001101a80012000500014006000d3051d9bf7976ea094ca661c1d67f6f94007134cf6ea0e408e8d8ef6aa985400000006bba020017cbec040000000000000000001fb791643a5ee4ce1b14d62f30dfe1d9d322fe7c9f8775730d16a4688df216265e5dbf66f282ac027812cfbd3f1aeb4edbb57a7025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0b5c53f6c1a02f89fd5de6ccd40d000000", 0xd8}], 0x1}, 0x400c005) recvmsg(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f00000001c0)=""/238, 0xee}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/180, 0xb4}, {&(0x7f0000000080)=""/28, 0x1c}, {&(0x7f0000000380)=""/103, 0x67}], 0x5}, 0x20) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], &(0x7f0000000240)=""/252, 0x37, 0xfc, 0x1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=ANY=[@ANYBLOB="850000000000000007000000000000009500007083000000"], &(0x7f0000000040)='GPL\x00', 0x2, 0x1000, &(0x7f0000014000)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback, r9, 0x14, &(0x7f00000000c0), 0xfffffffffffffe78, 0x10, &(0x7f0000000000), 0xa, 0x0, 0xffffffffffffffff, 0x4c}, 0x70) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@hci={0x1f, 0xdd86, 0x8}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000080)="27030200f00f00000600002fb9088965c7297a05a2019e6bafedef4e39ffffffffe1053742e0e4650058f7000000", 0x2e}, {0x0}, {0x0}, {0x0}], 0x4}, 0x0) close(r4) r10 = openat$cgroup_devices(r4, &(0x7f0000002040)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r10, &(0x7f00000005c0)=ANY=[@ANYBLOB="6220323a2ac0006d00"], 0x9) 3.092656597s ago: executing program 1 (id=3372): socket$kcm(0x2, 0x200000000000001, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000d000000000000000850000002f000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @dev, 0x6, 0x10400}, 0x80, 0x0}, 0xd0a0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 2.836130492s ago: executing program 1 (id=3376): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x7, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x110010, 0x0, 0x0, 0x0, 0xf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe49, 0x2, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='memory.swap.events\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) socket$kcm(0xa, 0x922000000003, 0x11) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) close(r2) syz_open_procfs$namespace(0x0, &(0x7f0000000d00)='ns/ipc\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e}, 0x94) socket$kcm(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x50}, 0x40000062) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000080)) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="65a02bb6db910b5d0000000000000000e2ff00"/28], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0xc, &(0x7f0000001480)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x50) 2.733554838s ago: executing program 3 (id=3377): socketpair(0x1, 0x20000000000001, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8942, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x8}, 0x100c, 0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x12c74435}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f00000002c0)={0x2, 0x80, 0x5, 0x2, 0x0, 0x0, 0x0, 0x800000009, 0x400, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0xaf1d, 0x4, @perf_config_ext={0x3, 0x101}, 0xc58, 0x200, 0x5, 0x0, 0x9, 0x9, 0xfffb, 0x0, 0x0, 0x0, 0x4042}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000003c0)={0x0, 0x80, 0x96, 0x3, 0xc, 0x0, 0x0, 0x2, 0x22c44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_bp={0x0, 0xd72a2f32930a7ffb}, 0x10480, 0x1, 0x0, 0x0, 0x5, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xfffffffffffffeff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='cgroup.events\x00', 0x3f, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000640)={'batadv_slave_1\x00'}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={r2, 0xe0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a80), &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xae, &(0x7f0000000700)=[{}], 0x8, 0x0, 0x0, &(0x7f00000008c0), 0x8, 0xbf, 0x8, 0x8, &(0x7f0000000900)}}, 0x10) r5 = openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f00000001c0), 0x12) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x30, 0x0, 0x0, 0x3, 0x80000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3ff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={0x0, 0x2}, 0x8100, 0xc8, 0xffffffff, 0x0, 0x0, 0x341}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@bloom_filter={0x1e, 0x8, 0xfff, 0x4, 0x100, r2, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x4}, 0x50) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r8, &(0x7f00000006c0)=ANY=[@ANYBLOB="8f03000000000060007538e486dd630ace2212102f00fe80000000000000875a65059ff57b0000000000000000000000000000000001"], 0xfdef) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000440)='cgroup.procs\x00', 0x2, 0x0) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r10, 0x0, 0x0) write$cgroup_int(r10, &(0x7f00000000c0), 0x12) 2.500263132s ago: executing program 1 (id=3380): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4802c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x6606, 0x40, 0x7, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x95, 0x2, 0x0, 0x0, 0x0, 0x0, 0x481, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x7baf376a, 0x3, 0x0, 0x0, 0x2}, 0x0, 0xfffffffbffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r3, &(0x7f0000001140)={0x0, 0x2, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x0, 0x808e}, 0x40000100) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) recvmsg$kcm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000440)=""/4096, 0x1000}], 0x1}, 0x100) socketpair(0x2c, 0x1, 0xf3d, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8971, &(0x7f0000001f40)='lo:\x96o8\x14d\xa1\xe3\xd7\\b}\x1f\xa1Y\xad4\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\xf5\a\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xbaUn\x04\'5\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\x06\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\r\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc5\xdcZ\xb9\xd7Z\x88\x9b\xdff[\x90\xfa\x9a{b\xf4Dq') write$cgroup_devices(r2, &(0x7f00000005c0)=ANY=[], 0xfffffeff) 2.499787762s ago: executing program 3 (id=3381): r0 = socket$kcm(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r0, 0x1, 0x28, &(0x7f0000000000), 0x4) r1 = socket$kcm(0xa, 0x5, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000002dc0)={&(0x7f0000001580)=@l2tp6={0xa, 0x0, 0xffffffff, @loopback, 0x2, 0xff000000}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000001480)="89", 0x1}], 0x1}, 0x20000054) 2.404077737s ago: executing program 3 (id=3383): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0xc4}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xa000000}, 0x80) 2.35615594s ago: executing program 2 (id=3384): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0xc05}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x5, 0x80, 0x4, 0x7, 0x8, 0x42, 0x0, 0x3ff, 0x0, 0x6, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x2, @perf_bp={0x0, 0x1}, 0x2000, 0x2, 0x800, 0x2, 0xc, 0x1, 0x2, 0x0, 0xc05, 0x0, 0x4e9c}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000380)={0x0, 0x86, 0x0, 0x0, 0x0, 0x9, 0x0, 0x6fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={&(0x7f00000000c0), 0x8}, 0x8100, 0xc8, 0xffffffff, 0x3, 0x0, 0x341, 0x0, 0x0, 0x8933, 0x0, 0x800000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xa, 0x6, 0x3, 0x9, 0x42}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)='%-010d \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000800)={{r2}, &(0x7f0000000780)=0x40000000, &(0x7f00000007c0)='%pS \x00', 0x2}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz0\x00', 0x200002, 0x0) openat$cgroup_type(r5, &(0x7f0000000140), 0x2, 0x0) close(r4) recvmsg$unix(r3, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="8f03000000000060007538e486dd630ace5198a46700fe80000008f50000875a65059ff57b00000000000000000000000000ac1414aa"], 0xcfa4) r7 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e000000000000"], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x890b, &(0x7f0000000000)) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000001340)={0x2, 0x6, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @multicast1}}}], 0x20}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000094d21c961146c00000000000500ffff000000009500000002000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x3b, 0x10, 0x0, 0x1800}, 0x48) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) 2.284804625s ago: executing program 3 (id=3386): sendmsg$inet(0xffffffffffffffff, 0x0, 0x240048c1) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x7, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="01000000080000000200000004"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000000000000000ffffff1f000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000080000850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = socket$kcm(0xa, 0x3, 0x3a) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x9) socket$kcm(0x2b, 0x3, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000440)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @dev, 0x6, 0x10400}, 0x80, &(0x7f0000000300)=[{0x0}, {&(0x7f00000001c0)="f00bea23922f31940e000000000000a1e5db", 0x12}], 0x2}, 0xd0a0) 2.242071727s ago: executing program 2 (id=3387): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0xd, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x94) r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="364000001a0091"], 0x82d7) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) recvmsg(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r0, &(0x7f0000001340)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a000140060011001f6010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e02360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e8a9b", 0xd8}], 0x1}, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x8, 0x4}, 0x24, 0x0, 0x0, 0x0, 0x0, 0x1, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x4) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000780)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea6f464160af36514001ac00800020004000200060003000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_to_bond\x00', 0x200}) socketpair(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000080)) 2.132163093s ago: executing program 3 (id=3388): openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x0, 0x80, 0xf2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x30024, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x4, @perf_bp={0x0, 0xa}, 0x0, 0x400000000000, 0x3, 0x2}, 0x0, 0xf7ffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d2f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r2 = socket$kcm(0x1e, 0x5, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1}, 0x0) sendmsg$kcm(r2, &(0x7f00000014c0)={&(0x7f0000001540)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, 0x0}, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0xfffffcc1}, 0x94) sendmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0), 0x0, &(0x7f00000015c0)=ANY=[], 0x11f0}, 0x10008014) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x18, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000050000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4908a0d411a9872971c7c46f0979bd10b97163c066d0e196bf02f46c7953ab1abdaf9de9ca3c00cb9bf4e418d076feafa22f0610a70f2bdf4000200000066b60d00b0c2c1254f0963f63223b7b80197aa3161f45346b100000000000000000089e399f6609876b5887437a172ebc02a740694298b79dc194e533583412dff048fc21f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be033c9d2f972cc93c1c13caec04a367c24a9fb6a6991ddb737d527d6acb15426415b6e8b14f822e86067a5e991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a3000000005dc2ed0e0b29e98fa883c71949a34d84030323e3d54f45b29d27643453ad9211e3550ee5520211d9370175133f260c6882a146880b9387f1beb5418618bc83a3becf9bb57da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb7830a246c3b2f60000fc4d"], 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="090000000400000006000000ff0000"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, &(0x7f0000000080), 0x619, r3}, 0x38) ioctl$SIOCSIFHWADDR(r1, 0x8917, &(0x7f0000000040)={'wg1\x00', @random="0200ac7f7f00"}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x1, 0x41, 0x2, 0x0, 0x0, 0x0, 0x0, 0x91c, 0x4156, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xfffffffffffffff8, 0x1}, 0x12640, 0x0, 0xfffffffe, 0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x400, 0xb6101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_config_ext={0x8001, 0x8001}, 0x80, 0x0, 0x0, 0x6, 0x7, 0x10, 0x0, 0x0, 0xd2, 0x0, 0x3}, 0x0, 0xffefffffffffffff, r0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x2, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000066aef4a000000000000000004000000bf7f1a006601feff000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x93, &(0x7f00000005c0)=""/147, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x61e5cc96}, 0x4c) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007311420000000000851000000200000085000000af00000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) openat$tun(0xffffffffffffff9c, 0x0, 0x20f42, 0x0) bpf$MAP_DELETE_ELEM(0x15, 0x0, 0x0) socket$kcm(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0200000004000000fd0300000100000014010000", @ANYRES32, @ANYRES32=0x0, @ANYRES32], 0x50) 2.131771103s ago: executing program 4 (id=3389): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)=""/249, 0xf9}, {&(0x7f00000017c0)=""/4041, 0xfc9}, {&(0x7f0000000780)=""/4112, 0x1010}, {&(0x7f00000002c0)=""/127, 0x7f}], 0x4}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 2.064330238s ago: executing program 1 (id=3390): perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x800, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x1000000}, 0x28) r1 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r1, &(0x7f0000000700)={&(0x7f0000000280)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="280000000000000000000000070000000717a87f000001ac141400e0000001ac1e0001ac1414bb011c000000000000ffd300000008000000", @ANYRES64=r1], 0x48}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=ANY=[@ANYBLOB="1b0000020000000000c40e478ea55fa72de55c34ac66073435000000000000cdad0a948a587392dbde9a8ce594a50454ae83be256e59f22c0000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESOCT=r0, @ANYBLOB='\x00'/14], 0x48) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="d800000019008111e00212ba0d810504020a0200ffe6040b067c55a1bc000100b8000699f3ffffff15000500fe808178a800150003000140020024f89a27c8d889cb591401ba86000901ac040000d67f6f94007100a007a290457f0189b316277ce06bbaca8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025cccb262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecba4b1583a1fc5f49af6ee5de6ccd40dd6e4edef3d93452a92387f0000", 0xd8}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000580)={@ifindex, 0x32, 0x1, 0x4, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0], 0x0}, 0x40) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000740)=@generic={&(0x7f0000000600)='./file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000005c0)={@map=r2, r4, 0x9, 0xc, 0x0, @void, @value=r6, @void, @void, r5}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x1f, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000004000000020000000000000f04"], 0x0, 0x28}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000080)) 1.723804648s ago: executing program 2 (id=3391): perf_event_open(&(0x7f0000000280)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10b0c0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x5, 0x0) r1 = perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x78}, 0x10010}, 0x0, 0x0, 0xffffffffffffffff, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001ac0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169b740ac03d7c64cee49ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d54f45a24effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c7724e9e7e7babf61fe358ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261ed1d4515f46290d5c6579b63358fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f13dff7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db000000000000e6ed75ca8fcda7ef3ee336189fef3b3ffb9f38fefc5ff39c4e69e3fa1f8b10ee97123e99b61eba065b1ad67530e7c4f11f9da7ae000002000000610101ad7f79cb9bbf64a0fc109f49fe8799fe266e2ccac80fefe750151f5ddfe51833ec65ece70e07ce8ab5d97db47da8f80000664dc0b86ae2b3ff9d4e220752a6b2f3ea9f793612386496dca5af7b8952aafa796ea7b156d19612297c63e774e940bfeb0de83f42fd565a299f741f9b00be4e8fcaf4ec85daceb16d9e8a438e3eb2556570e381b03d9e3c245728648ed9ff22dc963ed105c851c3481125b4c0c8a08a0c9930190902af109fc56b64cc952f298ebe73d7b18052e0147356228ca171b06274a871e2cf9609e0b4cdad36c3250bc8f56f95a6ed"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000014006b03004e21000af32c6e020675f800250002400100000017d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x6000, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000010008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000100020400bf050005001201", 0x67}], 0x1}, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000033000b0fd25a806c8c6f94f91024fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r4, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x20) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) sendmsg$kcm(r5, &(0x7f0000000400)={&(0x7f0000000100)=@ethernet={0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)="4d2482cf83205152663213a0391b906bdcc72c657a71016379d1b2d6db065c9c8be9a004f0ffe82993120baf79436329541165b9d1938117ad5da21c29566808e5f1213da1e6433fc106b3dcf516f8f154a87225b2608bf784196c4e85ca9f7c5f1ae42d1835d2e1b2f19cd7824d3789321ef925b7940b6221", 0x79}, {&(0x7f0000000340)="7299bb6eb0f8463e29a99d7c19b0438403cd1ce784ea40826d9946cea37cd6613c5761fc3eff4dfd9a4ceb762885b0cc06c1fd7dfb5a451091ee5b886ddef6822dea7662fe4ce26513f59c2c9434b30da18494dd1937f25b25c21426b05c3997ec458faec18a72892ed5107a2d0748a1d8a5353b4ae9457c391fe45579a98b72ce7ad2652bc28bb9132bc468c4947aeef1309e552956510efac12a37361d3189d040f618aa89deef6e8b52f64bb661becb7049bd701c8fd3", 0xb8}, {&(0x7f0000000200)="d8f9df0d3766e71fe49a84ed56befdd13a702d63a2abcca9f337b29045c4588c8764e4deb39ef18ade799a155a12ea2160c0141cbe63208d76219c47ff68", 0x3e}], 0x3}, 0x4000000) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r5) r6 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22041800f3fe8000000000000000000000000000aafe8000000000000227bfa7b09303960e2f80"], 0xfdef) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071119300000000008510000002000000850000000500000095000000000000009500a50580000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) close(r8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000004c0)={'virt_wifi0\x00', @link_local}) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0x66) sendmsg$inet(r6, &(0x7f0000000180)={&(0x7f0000000080)={0x2, 0x4e24, @private=0xa010102}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)="b7", 0x1}], 0x1}, 0x20008050) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r9, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r6, 0x84, 0x10, &(0x7f0000000000)=r10, 0xc) 1.639990843s ago: executing program 4 (id=3392): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)=""/249, 0xf9}, {&(0x7f00000017c0)=""/4041, 0xfc9}, {&(0x7f0000000780)=""/4112, 0x1010}, {&(0x7f00000002c0)=""/127, 0x7f}], 0x4}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) (fail_nth: 3) 1.295871003s ago: executing program 0 (id=3393): r0 = getpid() r1 = perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x8601, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, 0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={r0, r1, 0x0, 0x3, &(0x7f0000000280)='\\{\x00'}, 0x12) r2 = socket$kcm(0x2b, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[], 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000007feffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed002072030000001200001d44000000000000db0a00fee10000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) setsockopt$sock_attach_bpf(r2, 0x6, 0x2, &(0x7f0000000200), 0x4) 1.295393103s ago: executing program 1 (id=3394): r0 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001860000000000000e9ff00000400000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000023"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x4, 0x2, 0x6, 0x0, 0x1, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x9}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x6, 0x6, 0x81, 0x20193, r2, 0x2, '\x00', r3, 0xffffffffffffffff, 0x4, 0x2, 0x4, 0xd}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x6, 0x6, 0x81, 0x20193, r2, 0x2, '\x00', r3, 0xffffffffffffffff, 0x4, 0x2, 0x4, 0xd}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) 617.112093ms ago: executing program 0 (id=3395): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000580)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x248, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x12004, 0xb, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a000000080000000200000fffffffff0e000000000000000300000007000000030000ca75ffffff00000000000000002e"], 0x0, 0x46, 0x0, 0x0, 0x0, 0x2e}, 0x20) 552.334787ms ago: executing program 4 (id=3396): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)="d80000001e0081054e81f78206000000000088f706007c095dd2466518000e800a00142603600e1208000f0000000406a80016c00800094014000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791433a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad909d5e1cace81ed0bffece0b42a9eca0200e6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x4000800) 472.360052ms ago: executing program 2 (id=3397): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x18000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x4000, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r0 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000003780)={0x0, 0x3000000, &(0x7f0000000080)=[{&(0x7f0000000040)="0202000902000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) r1 = syz_clone(0x20001000, 0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0) perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x15, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x101048, 0x4, 0x0, 0x3, 0x0, 0x4, 0xffff, 0x0, 0x2000, 0x0, 0xa}, r1, 0xc, 0xffffffffffffffff, 0x0) 460.799962ms ago: executing program 0 (id=3398): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x959, 0x0, 0x7, 0x0, 0x0, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) openat$tun(0xffffffffffffff9c, 0x0, 0x10000, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x13, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9, 0x0, 0x0, 0xffffffff}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0xa, 0xb0ff}, {}, {0x5, 0x0, 0xd, 0x0}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x5, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 367.023858ms ago: executing program 2 (id=3399): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0xffffff1f}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xf1000000, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 288.580952ms ago: executing program 0 (id=3400): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000080)="5c00000012006b08000000000000001c7be4406c1d0000007ea60864160af36508001dc0c302000000000000e5178294ff0051f60a84c9f472736f56d22e10278e66f46f0e57a7592267c5e73bbd000000000000fcff000000000063", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x48002) 265.956074ms ago: executing program 1 (id=3401): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="b60a0000ffffffff611124000000000018"], 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1400000000000000", @ANYRES16=r1], 0x18, 0x20000893}, 0x8810) close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0xa00}, {0x65, 0x0, 0x5}}, [@printk={@llx, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xc, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15, 0x0, 0x20}}], {{0x4, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$kcm(0x29, 0x2, 0x0) recvmsg$kcm(r4, &(0x7f0000000240)={&(0x7f0000000080)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000100)}, {&(0x7f0000000140)=""/101, 0x65}], 0x2, &(0x7f0000000200)=""/51, 0x33}, 0x40002021) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x22, 0x2e, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x5}, [@ringbuf_query, @tail_call, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x800}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @tail_call, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @exit, @alu={0x4, 0x1, 0x4, 0x5, 0x0, 0x31, 0x4}]}, &(0x7f0000000100)='GPL\x00', 0x10, 0x39, &(0x7f0000000280)=""/57, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000002c0)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000340)={0x2, 0x8, 0x400000, 0x2}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000380)=[0x1, 0x1, 0x1], &(0x7f00000005c0)=[{0x5, 0x4, 0x9}, {0x2, 0x3, 0x5, 0x9}, {0x4, 0x5, 0xd, 0x1}], 0x10, 0x201}, 0x94) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}, 0xc0012323) r5 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r5, 0x84, 0x7c, &(0x7f0000000000), 0xc) socket$kcm(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)) 237.775895ms ago: executing program 0 (id=3402): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r0, &(0x7f0000000000)="b90bd4b6d7570912a93c8a2f4ac8f4f4170bc24cba48cc9f841ac97ea24911cc35c255e6fdfb40c6c91a6791a13e1aae7217cb0cd4979943701ed138dece3960b9532ce725df008820b99c3757b8efd9b42072a7efeed9876f6c39cfec99bbf17e8cbc2c20c9021eea4638d7212321134c64f54aaac2d153d26804fc03505b4cd8a9"}, 0x20) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0xf9, 0xd6, &(0x7f0000000100)="c48a39a8b93022cbd16aa1772eb4465fb7299e52b204ae3902c8d77b4386570201b79fd9f08988f3600861d70c399c0532ccba551e155382b1a8fe90130f3b9044e368545788924f6a9468a82b392d736c6a30146135879e15aa0da22859d6dd0ae2dc6d2f30903f498e7cf753a9bc561bc36d74d6ad2a69638d9758a14cbcaf0c2fef7aa384cf6112cf6ce38b0f76251e4c3b6e69f8e56f3f837241a94074c53fb9813fd4105926a41dc52e272d683c85308eefabacfbd644aaeb2b21a03908d92d539bdd2dff4a75e5f2a75fa32e792d67f1d5474653039b45566d7347768abc13b873cf4fef09f1ffd2da09bbd6fa55e1191288f901a52a", &(0x7f0000000200)=""/214, 0x8000, 0x0, 0x34, 0xb7, &(0x7f0000000300)="e92de870c746d6b7d412351b1a1e611f3223e003058b9236137279a82b08c40da97b24ec47495849f1aff6cc80dd10fcf699aa1c", &(0x7f0000000340)="52c90befa01b64f6c28299c1bd7995ffece62a3652b088ebc52fac92d63ae9445c4da9600b19e8abd195cdbce8e7b6781b2513b65ed12f409602ddc157d5be316ab6f83f441fb2803c661b2c16bda931c86289e0c86e02b464ff1bf1efa3797e78e196469f0f6919ddfa362008ceddb9ec1767c11f630562800cb3a889e052cbe50fb488814b3bc55e2eb72f7840dda6bcb6380f666ead59ca7ab2aa910350a3a7bf8ab99ad093758c061b241726f1da94d54166a98a57", 0x3, 0x0, 0x100}, 0x50) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000500)={r1}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000440), 0x0, 0xa, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f0000002000)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff620af0fff8ffffff71a4f0ff0000000025040000000000003d400300000000007504000001ed000079110000000000006c440000000000007a0ab0fe000000007b13000000000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af05000000f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a715bc5181554a090f32050e436fe2719fa6d5b8f51fc5a535daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128c4e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d0800af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8ea8fcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d390dd65be2467b373eafd9aa58f2077184b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe9326a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c5da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b93d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6ffc3a15d96c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7cd86975023cb08cc7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b26f502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc988161000000000eb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c5538a294270a1ad10c80fef7c24c87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead35a655e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f05beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba5823a34a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27f2f9a6a8346962a350829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d0a874c74b777df005c55fc30511d00000000c85265b2bd83d64a532869d708000000000000007baa5b6a682b50f0937f778af083e055f6138a757ebd0ed91114a6b2974c1e5f743644f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a56edbd287eba77f35c35d91f3c62a0ca74836a640224de85f2b4a5fee500bbc584328a6a7a4628c46d8c9b71dff64075b74a740ebbdaa049f91e2c87dc6520ad0d2cccbcb08c0634ee74658d3e23bf511c8b2df1b69d2b3782b3f481c314e7bd4615dbbf24c06ac95bd639e68d0e6aa7f0d07bf69a93365f803f0144af37236ea133c2255b06138138a91d0ef4bf8ba1d538e06c2411e8d70053b712084fd0e313de9bb19266e49a3a2190cb039c6f89610acd896319b9c8d1b8aac2eaa5a4f8be7419a09e3fb5be3be2fcdadd2299839cc40e684e6e2b4e1385fde7a0babcb0be672110268a34dad364fddee69e564119cebb6940c6356ff83ca527c573d700000000000000c6299263e6d9097f225de969485bce3d7dc471c0669bb6a467cf0de54dfcc1857048fe22a19dbb1b3cb9babaa839f1f6e817a62d95a5b971ff96a5c66c338c6f2a2da4644519f40761402e9c81013d76c7152c95ba5efa24ce1930f23a2277f057ffb6b0144f3b434a2adc456ef4d2fbdf7c6238c2bb00ffcf2d23d68cb9b027f30146ec4e09b089f7956b66c5692b46ea03abb6a404c8ccceaa4ba4161409fcb54b86eaca26b255af219c5bdd7b4309b512b36abadc4a1fac48833de5ab4bb15fecb5c935c7bcae154cdc37934d7ef50d5d63d2f6a6f9878874b45811fdf812beec1ceac104aabc181d64711a8c48e1b57be04783c85da3a4709565778e4c7127a78d07ddb105e456251df0fbd2076f5b9fdd2908d7564fb868820000000439baaffb37a34e41fdcb15b4e653b22f61e5d27b28c194033f577074c807431c7ea67f620dad8ad30b8e72034fb645a3c999a8a20b9b5076329e69e4afd67d01cb18591a76f7f4296bea32dcf5bd9b1e14b7badcae4a5e5a9c8920c45086aa938a3a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r3 = socket$kcm(0x10, 0x2, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[], 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=""/103, &(0x7f0000000600), &(0x7f0000001b40), 0x80, r4, 0x0, 0x7}, 0x38) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030022003505d25a806f8c6394f97e24fc6004030e000a740100053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x74000000}, 0x0) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @private=0xa010102}, 0x10, 0x0}, 0x4000010) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000540)={0x1, 0x0, 0x0}, 0x10) sendmsg$inet(r5, &(0x7f0000002d00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002b00)=[@ip_retopts={{0x30, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x14, 0xab, 0x3, 0x0, [{@remote, 0x6}, {@remote, 0x3}]}, @timestamp_addr={0x44, 0xc, 0xd8, 0x1, 0x1, [{@empty, 0x4}]}]}}}], 0x30}, 0x24040800) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x4, 0x1c, &(0x7f0000000640)=ANY=[@ANYBLOB="1808000000000000000000000600000018110000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000070000b7020000000000007b9a00fe000000006609000003000000dbaaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffff670000000800000018290000", @ANYRES16, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000007e9200000000000056080000010000008500000007000000b70000000000000095", @ANYRESHEX=0x0, @ANYRES32=r0], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0xd, '\x00', 0x0, @fallback=0xa, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 180.431329ms ago: executing program 4 (id=3403): close(0xffffffffffffffff) socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) close(0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffdfffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x5}, 0xc05, 0x0, 0x0, 0x6, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x100000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x35}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x4100, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) socket$kcm(0x10, 0x2, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x746}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) perf_event_open(0x0, 0x0, 0x9, 0xffffffffffffffff, 0x9) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)='hugetlb.1GB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x8000) 173.81059ms ago: executing program 2 (id=3404): socket$kcm(0x2, 0x3, 0x84) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)='cpuset.mem_hardwall\x00', 0x2, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32], 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="0000000000ffffffffff000016ffc305000000002c5bb928cb5b182e97ff73c27a6fc582ad161bce60979b6633c06deb47b87fc700b28010b8b73264f8e3c2d660ffe77bb9cfe33c30ab5d515196c7a95c56f4225acc577f2f01991aa9fbcc3c7c70dafc2d9253b6b114a8b4a3ba5cb9cca5b8ef194c76afd48ea1167ae467eccc2cf06f9cb1e0", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000fcffffff00"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x3}, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x48, 0x48, 0x9, [@volatile={0x0, 0x0, 0x0, 0x9, 0x5}, @var={0x7, 0x0, 0x0, 0xe, 0x1}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x2, [{}]}, @func_proto, @union={0x21, 0x0, 0x0, 0x2}]}, {0x0, [0x61, 0x0, 0x0, 0x0, 0x0, 0x2e, 0x61]}}, 0x0, 0x69}, 0x28) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000181200", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000209000085"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x200, 0x9}, 0x100808, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r3, 0x4008240b, &(0x7f0000000180)={0x0, 0x80, 0x2, 0x4, 0x7f, 0x0, 0x0, 0xfffffffffffffffc, 0x886, 0xa, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffc, 0x2, @perf_config_ext={0x1d38, 0xffffffffffff8000}, 0x4, 0x10, 0x9, 0x3, 0x5, 0x5b, 0xfffd, 0x0, 0x80000001, 0x0, 0xe9a}) socket$kcm(0x2, 0x5, 0x84) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="180000006a00132400000000000000000000000702000000", 0x18}], 0x1}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xcb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x180) openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={0x0}, 0x200, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, r3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r5, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) recvmsg(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r5, &(0x7f0000001340)={0x0, 0x0, 0x0}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000540)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e02360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e8a9b", 0xd8}], 0x1}, 0x0) 148.177871ms ago: executing program 3 (id=3405): syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/net\x00') socketpair(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2c, 0x3, 0x0) (async) socket$kcm(0x2c, 0x3, 0x0) r0 = socket$kcm(0x25, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="08000000040000000400000008"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="08000000040000000400000008"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2}, &(0x7f0000000200), &(0x7f0000000240)=r1}, 0x20) setsockopt$sock_attach_bpf(r0, 0x29, 0x23, 0x0, 0x39) (async) setsockopt$sock_attach_bpf(r0, 0x29, 0x23, 0x0, 0x39) sendmsg(0xffffffffffffffff, &(0x7f0000002f80)={&(0x7f0000000340)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x3, 0x2, 0x2, 0x2, {0xa, 0x4e22, 0x10000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1}}}, 0x80, 0x0, 0x0, &(0x7f0000001600)=ANY=[], 0x15d0}, 0x0) (async) sendmsg(0xffffffffffffffff, &(0x7f0000002f80)={&(0x7f0000000340)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x3, 0x2, 0x2, 0x2, {0xa, 0x4e22, 0x10000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1}}}, 0x80, 0x0, 0x0, &(0x7f0000001600)=ANY=[], 0x15d0}, 0x0) socketpair(0x1, 0x20000000000001, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x1, 0x1, 0x0, 0x0, 0x10000, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11548, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xfbffffffffffffff, 0xffffffffffffffff, 0xb) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x9, 0x1, 0x7fe2, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r5) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0xe) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0x10, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair(0x2, 0x1, 0x6, 0x0) (async) socketpair(0x2, 0x1, 0x6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'wg2\x00', @multicast}) syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000001c0)) 280.54µs ago: executing program 0 (id=3406): perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x5, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0x0, 0xa1, 0x7cc1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x10, &(0x7f0000000040), 0x4) sendmsg$inet(r1, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000000080000000000000000900850000006100000085000000a00000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0xc7, &(0x7f0000000140)=""/199}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000340)="7a7fa22c2aff88df53ef2a2d88a8", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$kcm(0x10, 0x100000000002, 0x4) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000440), &(0x7f00000003c0)='%pI4 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r5, 0xffffffffffffffff}, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r6, @ANYBLOB="c7dcd294ff0b29900ceed4ba99d1477627924f0000b70500"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r7, 0x0, 0xe, 0x48000000, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$kcm(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="364000001a00913a"], 0x82d7) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000002200)=""/4096, 0x1000}, {0x0}], 0x2}, 0x0) recvmsg(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 4 (id=3407): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3f}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x3000}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x40000000}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x1}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {}, {}, {0x4, 0x0, 0x7}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x6, 0x1, 0x7, 0x5}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): n1 added [ 546.641623][T10391] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 548.508392][T10428] ref_ctr_offset mismatch. inode: 0xa2f offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 548.579484][ T4255] wlan1: Trigger new scan to find an IBSS to join [ 548.753217][T10442] __nla_validate_parse: 3 callbacks suppressed [ 548.753259][T10442] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2277'. [ 549.037243][T10462] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2285'. [ 549.054113][T10462] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2285'. [ 549.067290][T10458] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2285'. [ 549.094154][T10458] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2285'. [ 549.146786][T10464] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2287'. [ 549.156815][T10467] netlink: 'syz.1.2288': attribute type 21 has an invalid length. [ 549.159966][T10458] netlink: 'syz.2.2285': attribute type 4 has an invalid length. [ 549.164990][T10467] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2288'. [ 549.176391][T10458] netlink: 128124 bytes leftover after parsing attributes in process `syz.2.2285'. [ 549.182361][T10467] netlink: 'syz.1.2288': attribute type 1 has an invalid length. [ 549.204772][T10464] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2287'. [ 549.226188][T10468] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2287'. [ 549.229621][T10467] netlink: 'syz.1.2288': attribute type 3 has an invalid length. [ 549.292611][T10474] netlink: 'syz.2.2290': attribute type 3 has an invalid length. [ 549.302665][T10474] netlink: 'syz.2.2290': attribute type 10 has an invalid length. [ 549.441162][T10481] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 550.782773][T10534] FAULT_INJECTION: forcing a failure. [ 550.782773][T10534] name failslab, interval 1, probability 0, space 0, times 0 [ 550.825648][T10534] CPU: 1 PID: 10534 Comm: syz.1.2313 Not tainted syzkaller #0 [ 550.833141][T10534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 550.843199][T10534] Call Trace: [ 550.846476][T10534] [ 550.849400][T10534] dump_stack_lvl+0x188/0x250 [ 550.854082][T10534] ? show_regs_print_info+0x20/0x20 [ 550.859283][T10534] ? load_image+0x400/0x400 [ 550.863786][T10534] ? __might_sleep+0xf0/0xf0 [ 550.868372][T10534] ? __lock_acquire+0x7d10/0x7d10 [ 550.873399][T10534] should_fail+0x38c/0x4c0 [ 550.877814][T10534] should_failslab+0x5/0x20 [ 550.882314][T10534] slab_pre_alloc_hook+0x51/0xc0 [ 550.887251][T10534] kmem_cache_alloc_node+0x47/0x2d0 [ 550.892438][T10534] ? __alloc_skb+0xf4/0x750 [ 550.896927][T10534] __alloc_skb+0xf4/0x750 [ 550.901271][T10534] pfkey_sendmsg+0x1a4/0x1080 [ 550.905937][T10534] ? __might_sleep+0xf0/0xf0 [ 550.910512][T10534] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 550.916474][T10534] ? pfkey_release+0x310/0x310 [ 550.921222][T10534] ? aa_sk_perm+0x7dc/0x910 [ 550.925709][T10534] ? aa_af_perm+0x340/0x340 [ 550.930190][T10534] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 550.936590][T10534] ? aa_sock_msg_perm+0x94/0x150 [ 550.941511][T10534] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 550.946777][T10534] ? security_socket_sendmsg+0x7c/0xa0 [ 550.952215][T10534] ? pfkey_release+0x310/0x310 [ 550.956957][T10534] ____sys_sendmsg+0x5b7/0x8f0 [ 550.961705][T10534] ? __sys_sendmsg_sock+0x30/0x30 [ 550.966717][T10534] ? import_iovec+0x6f/0xa0 [ 550.971201][T10534] ___sys_sendmsg+0x236/0x2e0 [ 550.975865][T10534] ? __sys_sendmsg+0x2a0/0x2a0 [ 550.980614][T10534] ? vfs_write+0x8b2/0xd60 [ 550.985024][T10534] __se_sys_sendmsg+0x1af/0x290 [ 550.989855][T10534] ? __x64_sys_sendmsg+0x80/0x80 [ 550.994779][T10534] ? syscall_enter_from_user_mode+0x2a/0x70 [ 551.000654][T10534] do_syscall_64+0x4c/0xa0 [ 551.005050][T10534] ? clear_bhb_loop+0x30/0x80 [ 551.009708][T10534] ? clear_bhb_loop+0x30/0x80 [ 551.014365][T10534] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 551.020237][T10534] RIP: 0033:0x7fec1e014eb9 [ 551.024637][T10534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.044224][T10534] RSP: 002b:00007fec1c270028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 551.052619][T10534] RAX: ffffffffffffffda RBX: 00007fec1e28ffa0 RCX: 00007fec1e014eb9 [ 551.060569][T10534] RDX: 0000000000000000 RSI: 0000200000003780 RDI: 0000000000000004 [ 551.068533][T10534] RBP: 00007fec1c270090 R08: 0000000000000000 R09: 0000000000000000 [ 551.076510][T10534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.084477][T10534] R13: 00007fec1e290038 R14: 00007fec1e28ffa0 R15: 00007ffc243aab98 [ 551.092450][T10534] [ 551.629391][ T7273] wlan1: Trigger new scan to find an IBSS to join [ 551.663987][T10569] FAULT_INJECTION: forcing a failure. [ 551.663987][T10569] name failslab, interval 1, probability 0, space 0, times 0 [ 551.693689][T10569] CPU: 0 PID: 10569 Comm: syz.3.2328 Not tainted syzkaller #0 [ 551.701178][T10569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 551.711234][T10569] Call Trace: [ 551.714513][T10569] [ 551.717443][T10569] dump_stack_lvl+0x188/0x250 [ 551.722127][T10569] ? show_regs_print_info+0x20/0x20 [ 551.727335][T10569] ? load_image+0x400/0x400 [ 551.731843][T10569] ? __might_sleep+0xf0/0xf0 [ 551.736433][T10569] ? __lock_acquire+0x7d10/0x7d10 [ 551.741447][T10569] should_fail+0x38c/0x4c0 [ 551.745851][T10569] should_failslab+0x5/0x20 [ 551.750333][T10569] slab_pre_alloc_hook+0x51/0xc0 [ 551.755251][T10569] __kmalloc+0x6b/0x330 [ 551.759384][T10569] ? bpf_test_init+0xf8/0x1b0 [ 551.764041][T10569] ? __lock_acquire+0x7d10/0x7d10 [ 551.769046][T10569] bpf_test_init+0xf8/0x1b0 [ 551.773537][T10569] bpf_prog_test_run_skb+0x181/0x1180 [ 551.778891][T10569] ? __fget_files+0x40f/0x480 [ 551.783551][T10569] ? cpu_online+0x60/0x60 [ 551.787861][T10569] bpf_prog_test_run+0x31e/0x390 [ 551.792780][T10569] __sys_bpf+0x5a5/0x6f0 [ 551.797007][T10569] ? bpf_link_show_fdinfo+0x380/0x380 [ 551.802371][T10569] ? vtime_user_exit+0x2c8/0x3e0 [ 551.807292][T10569] __x64_sys_bpf+0x78/0x90 [ 551.811694][T10569] do_syscall_64+0x4c/0xa0 [ 551.816092][T10569] ? clear_bhb_loop+0x30/0x80 [ 551.820749][T10569] ? clear_bhb_loop+0x30/0x80 [ 551.825404][T10569] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 551.831275][T10569] RIP: 0033:0x7f90ddd54eb9 [ 551.835692][T10569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.855275][T10569] RSP: 002b:00007f90dbfb0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 551.863669][T10569] RAX: ffffffffffffffda RBX: 00007f90ddfcffa0 RCX: 00007f90ddd54eb9 [ 551.871618][T10569] RDX: 0000000000000048 RSI: 0000200000000340 RDI: 000000000000000a [ 551.879620][T10569] RBP: 00007f90dbfb0090 R08: 0000000000000000 R09: 0000000000000000 [ 551.887572][T10569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.895533][T10569] R13: 00007f90ddfd0038 R14: 00007f90ddfcffa0 R15: 00007ffc6c2c2438 [ 551.904045][T10569] [ 552.628903][T10598] netlink: 'syz.2.2336': attribute type 46 has an invalid length. [ 553.073599][T10615] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 553.090784][T10605] delete_channel: no stack [ 553.108378][T10616] bridge0: port 1(bridge_slave_0) entered disabled state [ 553.501032][T10636] delete_channel: no stack [ 553.645851][T10650] netlink: 'syz.2.2360': attribute type 21 has an invalid length. [ 553.784920][T10659] __nla_validate_parse: 5 callbacks suppressed [ 553.784938][T10659] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2363'. [ 553.864490][T10657] netlink: 'syz.4.2365': attribute type 1 has an invalid length. [ 554.181337][T10681] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 554.227333][T10681] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 554.313423][T10686] netlink: 'syz.3.2374': attribute type 21 has an invalid length. [ 554.580056][ T4255] wlan1: Creating new IBSS network, BSSID 36:d1:2c:29:e6:65 [ 554.599870][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 556.013501][T10724] FAULT_INJECTION: forcing a failure. [ 556.013501][T10724] name failslab, interval 1, probability 0, space 0, times 0 [ 556.042729][T10724] CPU: 1 PID: 10724 Comm: syz.2.2388 Not tainted syzkaller #0 [ 556.050255][T10724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 556.060564][T10724] Call Trace: [ 556.063863][T10724] [ 556.066807][T10724] dump_stack_lvl+0x188/0x250 [ 556.071515][T10724] ? show_regs_print_info+0x20/0x20 [ 556.076740][T10724] ? load_image+0x400/0x400 [ 556.081275][T10724] ? __might_sleep+0xf0/0xf0 [ 556.085887][T10724] ? __lock_acquire+0x7d10/0x7d10 [ 556.090951][T10724] should_fail+0x38c/0x4c0 [ 556.095415][T10724] should_failslab+0x5/0x20 [ 556.099933][T10724] slab_pre_alloc_hook+0x51/0xc0 [ 556.104903][T10724] __kmalloc_node_track_caller+0x68/0x3a0 [ 556.110637][T10724] ? pfkey_sendmsg+0x1a4/0x1080 [ 556.115506][T10724] ? kmem_cache_alloc_node+0x162/0x2d0 [ 556.120983][T10724] ? __alloc_skb+0xf4/0x750 [ 556.125520][T10724] ? pfkey_sendmsg+0x1a4/0x1080 [ 556.130411][T10724] __alloc_skb+0x22c/0x750 [ 556.134867][T10724] pfkey_sendmsg+0x1a4/0x1080 [ 556.139588][T10724] ? __might_sleep+0xf0/0xf0 [ 556.144224][T10724] ? pfkey_release+0x310/0x310 [ 556.149033][T10724] ? aa_sk_perm+0x7dc/0x910 [ 556.153573][T10724] ? aa_af_perm+0x340/0x340 [ 556.158095][T10724] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 556.164552][T10724] ? aa_sock_msg_perm+0x94/0x150 [ 556.169525][T10724] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 556.174837][T10724] ? security_socket_sendmsg+0x7c/0xa0 [ 556.180324][T10724] ? pfkey_release+0x310/0x310 [ 556.185118][T10724] ____sys_sendmsg+0x5b7/0x8f0 [ 556.189924][T10724] ? __sys_sendmsg_sock+0x30/0x30 [ 556.195006][T10724] ? import_iovec+0x6f/0xa0 [ 556.199543][T10724] ___sys_sendmsg+0x236/0x2e0 [ 556.204276][T10724] ? __sys_sendmsg+0x2a0/0x2a0 [ 556.209104][T10724] ? trace_event_raw_event_lock+0x270/0x270 [ 556.215027][T10724] ? vfs_write+0x8b2/0xd60 [ 556.219545][T10724] __se_sys_sendmsg+0x1af/0x290 [ 556.224458][T10724] ? __x64_sys_sendmsg+0x80/0x80 [ 556.229413][T10724] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 556.235455][T10724] ? lockdep_hardirqs_on+0x94/0x140 [ 556.240706][T10724] do_syscall_64+0x4c/0xa0 [ 556.245143][T10724] ? clear_bhb_loop+0x30/0x80 [ 556.249835][T10724] ? clear_bhb_loop+0x30/0x80 [ 556.254539][T10724] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 556.260450][T10724] RIP: 0033:0x7f676a04feb9 [ 556.264883][T10724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 556.284507][T10724] RSP: 002b:00007f67682ab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 556.293563][T10724] RAX: ffffffffffffffda RBX: 00007f676a2cafa0 RCX: 00007f676a04feb9 [ 556.301559][T10724] RDX: 0000000000000000 RSI: 0000200000003780 RDI: 0000000000000004 [ 556.309549][T10724] RBP: 00007f67682ab090 R08: 0000000000000000 R09: 0000000000000000 [ 556.317537][T10724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 556.325526][T10724] R13: 00007f676a2cb038 R14: 00007f676a2cafa0 R15: 00007ffdb9edc028 [ 556.333569][T10724] [ 556.399319][T10730] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.2389'. [ 559.084426][T10791] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 559.649884][T10806] netlink: 'syz.4.2417': attribute type 39 has an invalid length. [ 562.227075][T10816] netlink: 'syz.3.2421': attribute type 21 has an invalid length. [ 562.261385][T10816] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2421'. [ 562.304316][T10818] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2422'. [ 562.360303][T10825] netlink: 'syz.1.2425': attribute type 1 has an invalid length. [ 562.669603][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.675944][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.454700][T10862] netlink: 143108 bytes leftover after parsing attributes in process `syz.0.2438'. [ 564.495329][T10862] netlink: 'syz.0.2438': attribute type 1 has an invalid length. [ 564.539290][T10862] device syzkaller0 entered promiscuous mode [ 565.996227][T10873] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.2443'. [ 566.241250][T10887] ref_ctr_offset mismatch. inode: 0xa62 offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 566.257675][T10885] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2447'. [ 566.314985][T10894] netlink: 'syz.3.2447': attribute type 2 has an invalid length. [ 566.362849][T10894] netlink: 119 bytes leftover after parsing attributes in process `syz.3.2447'. [ 566.487934][T10899] device wlan0 left promiscuous mode [ 566.547137][T10904] device wlan0 entered promiscuous mode [ 566.553458][T10893] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 566.684404][T10911] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2457'. [ 566.762922][T10919] netlink: 'syz.1.2461': attribute type 21 has an invalid length. [ 566.771009][T10919] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2461'. [ 566.812135][T10917] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 566.986026][T10934] netlink: 'syz.0.2464': attribute type 2 has an invalid length. [ 567.012997][T10934] netlink: 16386 bytes leftover after parsing attributes in process `syz.0.2464'. [ 567.057177][T10934] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.2464'. [ 567.167188][T10943] netlink: 'syz.1.2470': attribute type 2 has an invalid length. [ 567.724267][T10985] netlink: 'syz.4.2476': attribute type 28 has an invalid length. [ 567.759252][T10985] __nla_validate_parse: 2 callbacks suppressed [ 567.759265][T10985] netlink: 2 bytes leftover after parsing attributes in process `syz.4.2476'. [ 568.116030][T11009] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2485'. [ 568.787638][T11049] netlink: 212912 bytes leftover after parsing attributes in process `syz.1.2501'. [ 568.805018][T11048] netlink: 'syz.4.2502': attribute type 10 has an invalid length. [ 568.846197][T11049] device syzkaller0 entered promiscuous mode [ 569.590576][T11079] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2512'. [ 569.620729][T11078] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2512'. [ 569.889229][T11077] ref_ctr_offset mismatch. inode: 0x98b offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 573.226498][T11115] netlink: 'syz.3.2525': attribute type 21 has an invalid length. [ 573.275455][T11115] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2525'. [ 573.468632][T11125] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 578.190893][T11193] ref_ctr_offset mismatch. inode: 0x9c9 offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 580.327262][T11218] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2564'. [ 580.447782][T11222] netlink: 'syz.4.2567': attribute type 1 has an invalid length. [ 580.496098][T11222] netlink: 176 bytes leftover after parsing attributes in process `syz.4.2567'. [ 580.563345][T11226] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2568'. [ 580.988184][T11263] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2585'. [ 581.031690][T11263] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2585'. [ 581.073545][T11263] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2585'. [ 581.106422][T11263] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2585'. [ 581.267881][T11277] netlink: 'syz.1.2590': attribute type 25 has an invalid length. [ 581.296788][T11277] netlink: 'syz.1.2590': attribute type 1 has an invalid length. [ 581.328398][T11277] bridge0: port 1(bridge_slave_0) entered learning state [ 581.951252][T11305] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2599'. [ 582.231308][T11310] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 582.259947][T11310] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 582.305680][T11311] netlink: 'syz.0.2601': attribute type 10 has an invalid length. [ 582.326007][T11311] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2601'. [ 582.772506][T11332] tap0: tun_chr_ioctl cmd 1074025675 [ 582.780349][T11332] tap0: persist disabled [ 582.793308][T11332] tap0: tun_chr_ioctl cmd 1074025675 [ 582.816003][T11332] tap0: persist enabled [ 582.895795][T11340] ref_ctr_offset mismatch. inode: 0xafb offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 583.023864][T11347] netlink: 'syz.2.2614': attribute type 39 has an invalid length. [ 583.213980][T11351] netlink: 'syz.2.2616': attribute type 21 has an invalid length. [ 583.224555][T11351] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2616'. [ 584.310010][T11400] device syzkaller0 left promiscuous mode [ 584.604099][T11414] bridge0: port 2(bridge_slave_1) entered disabled state [ 584.611996][T11414] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.416234][T11433] netlink: 'syz.1.2649': attribute type 1 has an invalid length. [ 585.489527][T11437] netlink: 'syz.0.2650': attribute type 22 has an invalid length. [ 585.747181][T11450] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 585.842164][T11461] netlink: 'syz.3.2657': attribute type 3 has an invalid length. [ 585.872379][T11461] __nla_validate_parse: 6 callbacks suppressed [ 585.872394][T11461] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.2657'. [ 586.208808][T11490] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2667'. [ 586.347636][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.358128][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.370164][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.380315][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.391304][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.401964][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.414393][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.424595][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.435680][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 586.980062][ T4255] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 587.169393][T11517] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2676'. [ 587.199283][T11517] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 587.225514][T11519] netlink: 'syz.2.2677': attribute type 2 has an invalid length. [ 587.233447][T11519] netlink: 'syz.2.2677': attribute type 8 has an invalid length. [ 587.242631][T11519] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2677'. [ 587.269360][T11499] net_ratelimit: 7132 callbacks suppressed [ 587.269378][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.309240][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.328076][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.349948][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.369236][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.389252][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.431616][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.459239][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.464179][T11528] netlink: 'syz.2.2680': attribute type 40 has an invalid length. [ 587.489511][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 587.499392][T11499] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 588.997375][T11528] bridge0: port 2(bridge_slave_1) entered disabled state [ 589.212632][T11531] device syzkaller0 entered promiscuous mode [ 589.349482][T11540] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2686'. [ 589.358584][T11540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2686'. [ 589.390423][T11540] netlink: 33 bytes leftover after parsing attributes in process `syz.2.2686'. [ 589.417014][T11540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2686'. [ 589.437864][T11540] netlink: 33 bytes leftover after parsing attributes in process `syz.2.2686'. [ 589.507125][T11540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2686'. [ 592.423251][T11571] netlink: 'syz.3.2697': attribute type 1 has an invalid length. [ 592.872025][T11615] __nla_validate_parse: 2 callbacks suppressed [ 592.872041][T11615] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2708'. [ 592.907351][T11615] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 592.940491][T11615] net_ratelimit: 25878 callbacks suppressed [ 592.940509][T11615] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 592.971904][T11614] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2712'. [ 593.148062][T11638] netlink: 'syz.3.2720': attribute type 21 has an invalid length. [ 593.171966][T11638] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2720'. [ 593.321457][T11648] ref_ctr_offset mismatch. inode: 0xa4d offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 593.496679][T11652] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2726'. [ 593.584816][T11662] cgroup: fork rejected by pids controller in /syz0 [ 593.917249][T11689] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.2740'. [ 593.934480][T11688] netlink: 'syz.2.2740': attribute type 8 has an invalid length. [ 593.979724][T11688] netlink: 'syz.2.2740': attribute type 3 has an invalid length. [ 594.004800][T11688] netlink: 153952 bytes leftover after parsing attributes in process `syz.2.2740'. [ 594.034310][T11698] netlink: 'syz.1.2743': attribute type 3 has an invalid length. [ 594.042402][T11698] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2743'. [ 594.613506][T11718] chnl_net:caif_netlink_parms(): no params data found [ 594.654513][T11718] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.663966][T11718] bridge0: port 1(bridge_slave_0) entered disabled state [ 594.674439][T11718] device bridge_slave_0 entered promiscuous mode [ 594.684655][T11718] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.692759][T11718] bridge0: port 2(bridge_slave_1) entered disabled state [ 594.701560][T11718] device bridge_slave_1 entered promiscuous mode [ 594.727714][T11718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 594.768696][T11718] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 594.805560][ T4320] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.894489][T11718] team0: Port device team_slave_0 added [ 594.917312][T11718] team0: Port device team_slave_1 added [ 594.964987][T11718] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 594.979695][T11718] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 595.050789][T11718] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 595.093332][ T4320] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 595.108243][T11735] netlink: 'syz.3.2757': attribute type 1 has an invalid length. [ 595.127293][T11718] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 595.134593][T11718] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 595.161392][T11718] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 595.206351][ T4320] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 595.324725][ T4320] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 595.381743][T11718] device hsr_slave_0 entered promiscuous mode [ 595.395871][T11718] device hsr_slave_1 entered promiscuous mode [ 595.402866][T11718] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 595.411585][T11718] Cannot create hsr debugfs directory [ 595.424655][T11755] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2764'. [ 595.602817][T11767] ref_ctr_offset mismatch. inode: 0xad3 offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 595.709473][T11740] chnl_net:caif_netlink_parms(): no params data found [ 596.126739][T11740] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.155333][T11740] bridge0: port 1(bridge_slave_0) entered disabled state [ 596.164148][T11740] device bridge_slave_0 entered promiscuous mode [ 596.194330][T11740] bridge0: port 2(bridge_slave_1) entered blocking state [ 596.222077][T11740] bridge0: port 2(bridge_slave_1) entered disabled state [ 596.291017][T11740] device bridge_slave_1 entered promiscuous mode [ 596.590375][T10967] Bluetooth: hci5: command 0x0409 tx timeout [ 596.615210][T11810] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 596.926058][T11740] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 596.973603][T11740] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 597.092199][T11740] team0: Port device team_slave_0 added [ 597.139248][T10967] Bluetooth: hci0: command 0x0409 tx timeout [ 598.659723][T10968] Bluetooth: hci5: command 0x041b tx timeout [ 598.715848][T11740] team0: Port device team_slave_1 added [ 598.738240][T11824] netlink: 'syz.3.2780': attribute type 10 has an invalid length. [ 598.769326][T11824] team0: Cannot enslave team device to itself [ 598.776875][T11828] delete_channel: no stack [ 598.881698][T11740] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 598.904625][T11740] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 598.966576][T11740] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 598.995411][T11845] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2787'. [ 599.009990][T11740] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 599.023144][T11740] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 599.073279][T11740] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 599.196921][T11740] device hsr_slave_0 entered promiscuous mode [ 599.207747][T11740] device hsr_slave_1 entered promiscuous mode [ 599.214577][T11740] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 599.222498][T10967] Bluetooth: hci0: command 0x041b tx timeout [ 599.222897][T11740] Cannot create hsr debugfs directory [ 599.323406][T11718] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 599.353085][T11718] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 599.402119][T11718] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 599.431830][T11860] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 599.451721][T11860] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 599.476212][T11718] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 599.593451][T11877] netlink: 'syz.2.2794': attribute type 1 has an invalid length. [ 599.710029][T11740] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.827168][ T4320] device hsr_slave_0 left promiscuous mode [ 599.838120][ T4320] device hsr_slave_1 left promiscuous mode [ 599.845491][ T4320] device bridge_slave_1 left promiscuous mode [ 599.853855][ T4320] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.879894][ T4320] device bridge_slave_0 left promiscuous mode [ 599.899478][ T4320] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.947722][ T4320] device veth1_vlan left promiscuous mode [ 599.954751][ T4320] device veth0_vlan left promiscuous mode [ 600.491680][ T4320] team0 (unregistering): Port device geneve1 removed [ 600.707953][ T4320] team0 (unregistering): Port device team_slave_1 removed [ 600.727838][ T4320] team0 (unregistering): Port device team_slave_0 removed [ 600.747172][ T4320] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 600.757312][T10969] Bluetooth: hci5: command 0x040f tx timeout [ 600.776751][ T4320] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 600.832238][ T4320] bond0 (unregistering): Released all slaves [ 600.884186][T11740] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.912617][T11912] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2801'. [ 600.962695][T11740] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.023747][T11718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 601.074995][T11932] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2806'. [ 601.085719][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 601.097509][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 601.114625][T11718] 8021q: adding VLAN 0 to HW filter on device team0 [ 601.154250][T11740] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.178611][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 601.187280][T11937] ref_ctr_offset mismatch. inode: 0xb2a offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 601.188056][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 601.208463][ T900] bridge0: port 1(bridge_slave_0) entered blocking state [ 601.215587][ T900] bridge0: port 1(bridge_slave_0) entered forwarding state [ 601.237788][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 601.255093][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 601.270129][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 601.288932][ T900] bridge0: port 2(bridge_slave_1) entered blocking state [ 601.296047][ T900] bridge0: port 2(bridge_slave_1) entered forwarding state [ 601.305702][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 601.309345][T10969] Bluetooth: hci0: command 0x040f tx timeout [ 601.317328][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 601.365338][T11718] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 601.376579][T11718] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 601.398418][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 601.408877][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 601.421741][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 601.432165][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 601.443257][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 601.453943][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 601.466636][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 601.476534][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 601.487615][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 601.497666][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 601.516949][T11947] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2811'. [ 601.546266][T11947] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 601.583152][T11947] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 601.647975][T11951] netlink: 192 bytes leftover after parsing attributes in process `syz.2.2812'. [ 601.744891][T11740] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 601.788665][T11740] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 601.802474][T11740] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 601.813910][T11740] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 601.888911][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 601.912599][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 601.936835][T11718] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 601.995710][T11974] netlink: 'syz.4.2816': attribute type 39 has an invalid length. [ 602.031554][T11971] netlink: 192436 bytes leftover after parsing attributes in process `syz.3.2817'. [ 602.050605][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 602.064123][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 602.072484][T11971] openvswitch: netlink: Duplicate key (type 0). [ 602.096018][T11975] device syzkaller0 entered promiscuous mode [ 602.228362][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 602.246687][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 602.269293][T11718] device veth0_vlan entered promiscuous mode [ 602.286666][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 602.304839][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 602.327588][T11740] 8021q: adding VLAN 0 to HW filter on device bond0 [ 602.361616][T11718] device veth1_vlan entered promiscuous mode [ 602.379777][T11740] 8021q: adding VLAN 0 to HW filter on device team0 [ 602.402097][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 602.416510][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 602.439357][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 602.447458][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 602.466320][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 602.475959][ T4255] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.483087][ T4255] bridge0: port 1(bridge_slave_0) entered forwarding state [ 602.495152][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 602.530293][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 602.540042][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 602.556954][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 602.565979][ T4246] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.573101][ T4246] bridge0: port 2(bridge_slave_1) entered forwarding state [ 602.586801][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 602.596425][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 602.636701][T11982] netlink: 'syz.3.2820': attribute type 1 has an invalid length. [ 602.647615][T11982] netlink: 'syz.3.2820': attribute type 4 has an invalid length. [ 602.665979][T11982] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2820'. [ 602.677630][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 602.700434][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 602.731921][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 602.778584][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 602.800242][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 602.830882][T10966] Bluetooth: hci5: command 0x0419 tx timeout [ 602.865267][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 602.902925][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 602.916338][T11718] device veth0_macvtap entered promiscuous mode [ 602.933556][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 602.943787][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 602.953640][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 602.972052][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 602.988271][T11740] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 603.001793][T11718] device veth1_macvtap entered promiscuous mode [ 603.023893][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 603.102022][T11718] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 603.133576][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 603.155582][ T4246] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 603.201872][T11718] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 603.231224][T11718] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 603.251227][T11718] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 603.401914][T10967] Bluetooth: hci0: command 0x0419 tx timeout [ 603.668478][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 603.678414][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 603.690264][T11718] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.703574][T11718] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.714840][T11718] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.727122][T11718] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.855624][T12008] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2828'. [ 603.897408][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 603.906051][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 603.927636][T11740] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 603.944865][ T900] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 603.971583][ T900] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 603.991479][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 604.007472][T12012] netlink: 'syz.2.2829': attribute type 10 has an invalid length. [ 604.016175][T12012] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2829'. [ 604.028505][T12012] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 604.096092][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 604.114050][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 604.177336][T11740] device veth0_vlan entered promiscuous mode [ 604.184121][ T900] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 604.204326][ T900] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 604.229320][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 604.252342][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 604.278680][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 604.288683][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 604.300911][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 604.312310][T11740] device veth1_vlan entered promiscuous mode [ 604.384432][T12024] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2749'. [ 604.468112][T12026] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2831'. [ 604.549881][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 604.557964][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 604.568991][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 604.577820][ T4255] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 604.588134][T12024] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2749'. [ 604.597725][T12022] netlink: 'syz.3.2833': attribute type 1 has an invalid length. [ 604.608563][T12026] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2831'. [ 604.621982][T11740] device veth0_macvtap entered promiscuous mode [ 604.651697][T12025] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2749'. [ 604.674067][T11740] device veth1_macvtap entered promiscuous mode [ 604.710884][T12030] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2749'. [ 604.842441][T12041] netlink: 105120 bytes leftover after parsing attributes in process `syz.3.2834'. [ 604.957417][T11740] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 605.000109][T11740] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 605.022914][T11740] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 605.063251][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 605.089849][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 605.114332][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 605.150930][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 605.238831][T11740] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 605.250799][T11740] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 605.262123][T11740] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 605.274993][T11740] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 605.305278][T11740] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 605.323745][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 605.343356][ T900] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 605.360710][T12041] Â: renamed from pim6reg1 [ 605.382125][T11740] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.406578][T11740] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.417549][T11740] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.427401][T11740] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.631950][T12060] syz.2.2841 (12060) used obsolete PPPIOCDETACH ioctl [ 605.667526][T12059] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 605.674950][T12059] IPv6: NLM_F_CREATE should be set when creating new route [ 605.682464][T12059] IPv6: NLM_F_CREATE should be set when creating new route [ 605.689929][T12059] IPv6: NLM_F_CREATE should be set when creating new route [ 605.708233][T12060] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2841'. [ 605.771671][T12060] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 605.834242][T12060] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 605.853962][T12060] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 605.865263][T12060] bond0 (unregistering): Released all slaves [ 605.879195][T12062] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2843'. [ 605.897777][T12064] IPv6: Can't replace route, no match found [ 605.955403][ T7273] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 605.971574][ T7273] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 606.002029][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 606.068486][ T4253] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 606.080606][ T4253] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 606.105148][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 606.208555][T12091] netlink: 'syz.4.2852': attribute type 6 has an invalid length. [ 606.281603][T12096] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 606.297609][T12096] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 606.466533][ T4320] device hsr_slave_0 left promiscuous mode [ 606.474141][ T4320] device hsr_slave_1 left promiscuous mode [ 606.481153][ T4320] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 606.488822][ T4320] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 606.508084][ T4320] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 606.521843][ T4320] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 606.546484][ T4320] device bridge_slave_1 left promiscuous mode [ 606.555148][ T4320] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.567322][ T4320] device bridge_slave_0 left promiscuous mode [ 606.573668][ T4320] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.588453][ T4320] device veth1_macvtap left promiscuous mode [ 606.594685][ T4320] device veth0_macvtap left promiscuous mode [ 606.601199][ T4320] device veth1_vlan left promiscuous mode [ 606.607079][ T4320] device veth0_vlan left promiscuous mode [ 606.776588][ T4320] team0 (unregistering): Port device geneve1 removed [ 606.915084][ T4320] team0 (unregistering): Port device team_slave_1 removed [ 606.951961][ T4320] team0 (unregistering): Port device team_slave_0 removed [ 606.966338][ T4320] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 606.984332][ T4320] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 607.151499][ T4320] bond0 (unregistering): Released all slaves [ 607.210920][T12117] netlink: 'syz.1.2860': attribute type 21 has an invalid length. [ 607.498804][T12140] device syzkaller0 entered promiscuous mode [ 607.518372][T12146] netlink: 'syz.2.2871': attribute type 1 has an invalid length. [ 608.453054][T12196] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 609.243173][T12237] __nla_validate_parse: 10 callbacks suppressed [ 609.243203][T12237] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2904'. [ 609.975267][T12273] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2912'. [ 609.984540][T12273] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 610.001029][T12273] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 610.078825][T12278] netlink: 'syz.0.2916': attribute type 1 has an invalid length. [ 610.098196][T12278] netlink: 'syz.0.2916': attribute type 4 has an invalid length. [ 610.118040][T12278] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.2916'. [ 610.391190][T12297] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2919'. [ 610.758287][T12336] netlink: 'syz.4.2921': attribute type 39 has an invalid length. [ 610.932740][T12336] device hsr_slave_1 left promiscuous mode [ 611.315724][T12360] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 611.557721][T12375] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2934'. [ 611.633172][T12379] netlink: 'syz.2.2936': attribute type 1 has an invalid length. [ 611.646297][T12379] netlink: 'syz.2.2936': attribute type 4 has an invalid length. [ 611.698808][T12379] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.2936'. [ 612.491059][T12410] netlink: 'syz.1.2946': attribute type 39 has an invalid length. [ 613.890806][T12451] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2964'. [ 616.833194][T12470] netlink: 'syz.2.2971': attribute type 1 has an invalid length. [ 616.881990][T12470] netlink: 176 bytes leftover after parsing attributes in process `syz.2.2971'. [ 617.211900][T12481] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 617.251483][T12486] netlink: 'syz.0.2977': attribute type 21 has an invalid length. [ 617.319304][T12486] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2977'. [ 617.548296][T12497] netlink: 180 bytes leftover after parsing attributes in process `syz.0.2982'. [ 617.593719][T12500] netlink: 'syz.0.2982': attribute type 8 has an invalid length. [ 617.639445][T12500] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.2982'. [ 617.913044][T12515] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2988'. [ 618.008050][T12520] FAULT_INJECTION: forcing a failure. [ 618.008050][T12520] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 618.081692][T12520] CPU: 1 PID: 12520 Comm: syz.0.2990 Not tainted syzkaller #0 [ 618.089188][T12520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 618.099250][T12520] Call Trace: [ 618.102529][T12520] [ 618.105458][T12520] dump_stack_lvl+0x188/0x250 [ 618.110151][T12520] ? show_regs_print_info+0x20/0x20 [ 618.115347][T12520] ? load_image+0x400/0x400 [ 618.119858][T12520] ? __lock_acquire+0x7d10/0x7d10 [ 618.124892][T12520] should_fail+0x38c/0x4c0 [ 618.129317][T12520] _copy_to_user+0x2e/0x130 [ 618.133822][T12520] simple_read_from_buffer+0xe3/0x150 [ 618.139197][T12520] proc_fail_nth_read+0x1a6/0x220 [ 618.144234][T12520] ? proc_fault_inject_write+0x310/0x310 [ 618.149871][T12520] ? fsnotify_perm+0x254/0x560 [ 618.154639][T12520] ? proc_fault_inject_write+0x310/0x310 [ 618.160272][T12520] vfs_read+0x301/0xd60 [ 618.164436][T12520] ? kernel_read+0x1e0/0x1e0 [ 618.169024][T12520] ? __fget_files+0x40f/0x480 [ 618.173704][T12520] ? mutex_lock_nested+0x17/0x20 [ 618.178639][T12520] ? __fdget_pos+0x2bf/0x370 [ 618.183225][T12520] ? ksys_read+0x71/0x260 [ 618.187560][T12520] ksys_read+0x152/0x260 [ 618.191805][T12520] ? vfs_write+0xd60/0xd60 [ 618.196231][T12520] ? lockdep_hardirqs_on+0x94/0x140 [ 618.201432][T12520] do_syscall_64+0x4c/0xa0 [ 618.205846][T12520] ? clear_bhb_loop+0x30/0x80 [ 618.210519][T12520] ? clear_bhb_loop+0x30/0x80 [ 618.215198][T12520] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 618.221087][T12520] RIP: 0033:0x7f14536a578e [ 618.225511][T12520] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 618.245126][T12520] RSP: 002b:00007f145193ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 618.253547][T12520] RAX: ffffffffffffffda RBX: 00007f14519406c0 RCX: 00007f14536a578e [ 618.261516][T12520] RDX: 000000000000000f RSI: 00007f14519400a0 RDI: 0000000000000005 [ 618.269485][T12520] RBP: 00007f1451940090 R08: 0000000000000000 R09: 0000000000000000 [ 618.277458][T12520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 618.285435][T12520] R13: 00007f1453960038 R14: 00007f145395ffa0 R15: 00007ffee1c58828 [ 618.293421][T12520] [ 618.522184][T12540] netlink: 'syz.0.2996': attribute type 11 has an invalid length. [ 618.549114][T12540] netlink: 140 bytes leftover after parsing attributes in process `syz.0.2996'. [ 618.726044][T12547] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2997'. [ 618.751604][T12547] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 618.778964][T12547] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 620.334470][T12322] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 620.611687][T12559] netlink: 'syz.1.3001': attribute type 3 has an invalid length. [ 620.640076][T12559] netlink: 13435 bytes leftover after parsing attributes in process `syz.1.3001'. [ 620.922605][T12566] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3002'. [ 621.704418][T12578] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3007'. [ 621.758785][T12576] netlink: 'syz.0.3006': attribute type 1 has an invalid length. [ 622.295388][ T4320] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 624.103230][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.109672][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.189123][ T26] Bluetooth: hci2: command 0x0409 tx timeout [ 625.393375][ T4320] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.411547][T12609] netlink: 'syz.3.3018': attribute type 46 has an invalid length. [ 625.514997][ T4320] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.583780][T12593] chnl_net:caif_netlink_parms(): no params data found [ 625.724029][T12630] netlink: 'syz.0.3024': attribute type 3 has an invalid length. [ 625.747655][T12630] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3024'. [ 625.785068][ T4320] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.923254][T12593] bridge0: port 1(bridge_slave_0) entered blocking state [ 625.935540][T12593] bridge0: port 1(bridge_slave_0) entered disabled state [ 625.955666][T12593] device bridge_slave_0 entered promiscuous mode [ 626.038486][T12593] bridge0: port 2(bridge_slave_1) entered blocking state [ 626.047889][T12593] bridge0: port 2(bridge_slave_1) entered disabled state [ 626.100598][T12593] device bridge_slave_1 entered promiscuous mode [ 626.151774][T12643] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3028'. [ 626.268818][T10971] Bluetooth: hci2: command 0x041b tx timeout [ 626.442758][T12593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 626.491665][T12593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 626.627336][T12593] team0: Port device team_slave_0 added [ 626.693088][T12593] team0: Port device team_slave_1 added [ 626.826142][T12671] netlink: 'syz.4.3031': attribute type 9 has an invalid length. [ 626.854616][T12671] netlink: 209836 bytes leftover after parsing attributes in process `syz.4.3031'. [ 628.339162][T10971] Bluetooth: hci2: command 0x040f tx timeout [ 629.230907][T12668] device wlan0 left promiscuous mode [ 629.337424][T12665] device wlan0 entered promiscuous mode [ 629.440663][T12593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 629.455713][T12593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 629.539180][T12593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 629.571230][T12593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 629.578200][T12593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 629.649793][T12593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 629.686728][T12671] ieee80211 phy28: Failed to add default virtual iface [ 629.843085][T12593] device hsr_slave_0 entered promiscuous mode [ 629.863775][T12593] device hsr_slave_1 entered promiscuous mode [ 629.903942][T12593] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 629.949091][T12593] Cannot create hsr debugfs directory [ 630.152968][T12696] delete_channel: no stack [ 630.412282][ T4320] team0: Port device wlan1 removed [ 630.419138][T10966] Bluetooth: hci2: command 0x0419 tx timeout [ 630.685604][ T4320] device hsr_slave_0 left promiscuous mode [ 630.702494][ T4320] device hsr_slave_1 left promiscuous mode [ 630.721622][ T4320] device bridge_slave_1 left promiscuous mode [ 630.738897][ T4320] bridge0: port 2(bridge_slave_1) entered disabled state [ 630.763571][ T4320] device bridge_slave_0 left promiscuous mode [ 630.796623][ T4320] bridge0: port 1(bridge_slave_0) entered disabled state [ 630.848998][ T4320] device veth1_vlan left promiscuous mode [ 630.862607][ T4320] device veth0_vlan left promiscuous mode [ 631.179525][ T4320] team0 (unregistering): Port device geneve1 removed [ 631.242542][T12738] netlink: 209844 bytes leftover after parsing attributes in process `syz.4.3053'. [ 631.415076][ T4320] team0 (unregistering): Port device team_slave_1 removed [ 631.434506][ T4320] team0 (unregistering): Port device team_slave_0 removed [ 631.655621][T12731] netlink: 'syz.0.3051': attribute type 2 has an invalid length. [ 631.666908][T12731] netlink: 164 bytes leftover after parsing attributes in process `syz.0.3051'. [ 631.693399][T12743] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3055'. [ 631.801146][T12593] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 631.853512][T12593] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 631.885465][T12593] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 631.912457][T12593] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 632.215801][T12593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 632.278079][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 632.298786][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 632.325841][T12593] 8021q: adding VLAN 0 to HW filter on device team0 [ 632.365326][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 632.379719][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 632.409817][ T4253] bridge0: port 1(bridge_slave_0) entered blocking state [ 632.416895][ T4253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 632.480624][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 632.514745][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 632.539771][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 632.568614][ T4253] bridge0: port 2(bridge_slave_1) entered blocking state [ 632.575728][ T4253] bridge0: port 2(bridge_slave_1) entered forwarding state [ 632.604128][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 632.641561][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 632.684652][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 632.707325][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 632.719603][T12781] FAULT_INJECTION: forcing a failure. [ 632.719603][T12781] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 632.730856][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 632.746992][T12781] CPU: 1 PID: 12781 Comm: syz.4.3061 Not tainted syzkaller #0 [ 632.754475][T12781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 632.764531][T12781] Call Trace: [ 632.767808][T12781] [ 632.770732][T12781] dump_stack_lvl+0x188/0x250 [ 632.775410][T12781] ? show_regs_print_info+0x20/0x20 [ 632.780609][T12781] ? load_image+0x400/0x400 [ 632.785120][T12781] ? __lock_acquire+0x7d10/0x7d10 [ 632.790157][T12781] should_fail+0x38c/0x4c0 [ 632.794591][T12781] _copy_from_user+0x2e/0x170 [ 632.799279][T12781] iovec_from_user+0x142/0x370 [ 632.804058][T12781] __import_iovec+0x70/0x490 [ 632.808660][T12781] import_iovec+0x6f/0xa0 [ 632.813005][T12781] ___sys_sendmsg+0x1fd/0x2e0 [ 632.817693][T12781] ? __sys_sendmsg+0x2a0/0x2a0 [ 632.822493][T12781] ? vfs_write+0x8b2/0xd60 [ 632.826947][T12781] __se_sys_sendmsg+0x1af/0x290 [ 632.831811][T12781] ? __x64_sys_sendmsg+0x80/0x80 [ 632.836747][T12781] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 632.842746][T12781] ? lockdep_hardirqs_on+0x94/0x140 [ 632.847950][T12781] do_syscall_64+0x4c/0xa0 [ 632.852498][T12781] ? clear_bhb_loop+0x30/0x80 [ 632.857193][T12781] ? clear_bhb_loop+0x30/0x80 [ 632.861880][T12781] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 632.867779][T12781] RIP: 0033:0x7ffba8b1eeb9 [ 632.872199][T12781] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.891809][T12781] RSP: 002b:00007ffba6d7a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 632.900338][T12781] RAX: ffffffffffffffda RBX: 00007ffba8d99fa0 RCX: 00007ffba8b1eeb9 [ 632.908326][T12781] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000005 [ 632.916414][T12781] RBP: 00007ffba6d7a090 R08: 0000000000000000 R09: 0000000000000000 [ 632.924394][T12781] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.932370][T12781] R13: 00007ffba8d9a038 R14: 00007ffba8d99fa0 R15: 00007ffc90ea64f8 [ 632.940364][T12781] [ 632.970225][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 632.989998][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 633.003865][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 633.030062][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 633.038606][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 633.063867][T12593] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 633.087098][T12787] netlink: 'syz.3.3062': attribute type 10 has an invalid length. [ 633.178818][T12787] team0 (unregistering): Port device team_slave_0 removed [ 633.288888][T12787] team0 (unregistering): Port device team_slave_1 removed [ 633.389287][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 633.662037][T12801] netlink: 'syz.4.3063': attribute type 1 has an invalid length. [ 633.761458][T12808] netlink: 'syz.3.3064': attribute type 21 has an invalid length. [ 633.812179][T12808] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3064'. [ 633.849409][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 633.863591][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 633.906509][T12593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 634.000387][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 634.030405][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 634.145756][T12593] device veth0_vlan entered promiscuous mode [ 634.156474][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 634.169605][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 634.214030][T12593] device veth1_vlan entered promiscuous mode [ 634.231887][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 634.255980][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 634.280896][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 634.334964][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 634.365742][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 634.378899][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 634.408694][T12593] device veth0_macvtap entered promiscuous mode [ 634.423954][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 634.446528][T12593] device veth1_macvtap entered promiscuous mode [ 634.497342][T12593] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 634.526282][T12593] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 634.547941][T12593] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 634.576674][T12593] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 634.611122][T12593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 634.643576][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 634.674143][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 634.697177][T12593] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 634.718074][T12593] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 634.779126][T12593] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 634.799074][T12593] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 634.834979][T12593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 634.851452][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 634.863755][T12328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 634.886237][T12593] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.907485][T12593] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.928212][T12593] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.953884][T12593] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 635.186423][T12322] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 635.207366][T12322] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 635.293967][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 635.372213][T12324] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 635.399204][T12324] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 635.409222][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 636.115946][T12874] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 636.159395][T12874] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 636.712566][T12873] chnl_net:caif_netlink_parms(): no params data found [ 636.814682][T12328] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.647802][T12328] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.772477][T12328] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.840754][T12873] bridge0: port 1(bridge_slave_0) entered blocking state [ 637.879094][T12873] bridge0: port 1(bridge_slave_0) entered disabled state [ 637.900217][T12873] device bridge_slave_0 entered promiscuous mode [ 637.947600][T12873] bridge0: port 2(bridge_slave_1) entered blocking state [ 637.959224][T12873] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.967291][T12873] device bridge_slave_1 entered promiscuous mode [ 637.989807][T12908] tun0: tun_chr_ioctl cmd 1074025677 [ 637.995263][T12908] tun0: linktype set to 768 [ 638.026337][T12328] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.116083][T12873] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 638.143420][T12873] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 638.213645][T12873] team0: Port device team_slave_0 added [ 638.231204][T12873] team0: Port device team_slave_1 added [ 638.259191][ T5399] Bluetooth: hci4: command 0x0409 tx timeout [ 638.275970][T12873] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 638.310900][T12873] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 638.369181][T12873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 638.427407][T12873] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 638.465725][T12873] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 638.529154][T12873] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 638.580231][T12914] netlink: 'syz.3.3095': attribute type 10 has an invalid length. [ 638.592791][T12914] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3095'. [ 638.654289][T12914] bridge0: port 4(ipvlan1) entered blocking state [ 638.689713][T12914] bridge0: port 4(ipvlan1) entered disabled state [ 638.731296][T12914] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 638.971154][T12918] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 639.007545][T12918] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 639.039643][T12919] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3096'. [ 639.186720][T12873] device hsr_slave_0 entered promiscuous mode [ 639.200267][T12873] device hsr_slave_1 entered promiscuous mode [ 639.382444][T12926] netlink: 'syz.3.3098': attribute type 10 has an invalid length. [ 639.402894][T12926] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3098'. [ 640.005499][T12957] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.3105'. [ 640.139259][T12959] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3106'. [ 640.201601][T12873] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 640.244383][T12873] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 640.293577][T12873] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 640.339261][T10968] Bluetooth: hci4: command 0x041b tx timeout [ 640.363035][T12873] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 640.668859][T12981] netlink: 'syz.0.3111': attribute type 21 has an invalid length. [ 640.690931][T12981] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3111'. [ 640.838005][T12873] 8021q: adding VLAN 0 to HW filter on device bond0 [ 640.892537][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 640.921153][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 640.978781][T12873] 8021q: adding VLAN 0 to HW filter on device team0 [ 641.010020][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 641.031733][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 641.055229][T12322] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.062379][T12322] bridge0: port 1(bridge_slave_0) entered forwarding state [ 641.092574][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 641.115967][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 641.141284][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 641.171593][T12324] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.178724][T12324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 641.246293][T12328] device hsr_slave_0 left promiscuous mode [ 641.256639][T12328] device bridge_slave_1 left promiscuous mode [ 641.265302][T12328] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.276805][T12328] device bridge_slave_0 left promiscuous mode [ 641.285667][T12328] bridge0: port 1(bridge_slave_0) entered disabled state [ 641.567453][T12328] team0 (unregistering): Port device geneve1 removed [ 641.641156][T12328] team0 (unregistering): Port device team_slave_1 removed [ 641.669726][T12328] team0 (unregistering): Port device team_slave_0 removed [ 641.694799][T12328] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 641.718315][T12328] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 641.823085][T12328] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 641.837120][T12328] bond0 (unregistering): Released all slaves [ 641.894923][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 641.910351][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 641.955464][T13013] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.3119'. [ 642.046587][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 642.076881][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 642.107361][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 642.128997][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 642.160839][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 642.182183][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 642.216094][T12324] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 642.252767][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 642.270151][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 642.311502][T12873] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 642.419426][T10967] Bluetooth: hci4: command 0x040f tx timeout [ 642.678371][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 642.695622][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 642.729629][T12873] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 643.118662][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 643.129596][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 643.157603][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 643.167294][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 643.183916][T12873] device veth0_vlan entered promiscuous mode [ 643.195907][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 643.205556][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 643.223151][T12873] device veth1_vlan entered promiscuous mode [ 643.257848][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 643.267574][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 643.280688][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 643.289704][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 643.301399][T12873] device veth0_macvtap entered promiscuous mode [ 643.320301][T12873] device veth1_macvtap entered promiscuous mode [ 643.347092][T12873] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 643.362164][T12873] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 643.373938][T12873] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 643.388212][T12873] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 643.399325][T12873] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 643.413210][T12873] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 643.426376][T12873] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 643.438758][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 643.469860][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 643.504020][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 643.513174][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 643.531218][T12873] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 643.564255][T12873] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 643.583235][T12873] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 643.614694][T12873] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 643.642114][T12873] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 643.671216][T12873] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 643.701174][T12873] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 643.719628][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 643.728903][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 643.752719][T12873] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.761787][T12873] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.784800][T12873] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.805069][T12873] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.499233][T10971] Bluetooth: hci4: command 0x0419 tx timeout [ 645.368641][T12316] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 645.430261][T12316] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.473793][T12324] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 645.490797][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 645.498256][T12324] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.557415][T13049] delete_channel: no stack [ 645.562516][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 645.640629][T13056] netlink: 'syz.0.3132': attribute type 21 has an invalid length. [ 646.208519][T13074] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.3135'. [ 646.331035][T13078] netlink: 'syz.0.3136': attribute type 3 has an invalid length. [ 646.352190][T13078] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3136'. [ 646.627707][T13085] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3140'. [ 646.894391][T13077] chnl_net:caif_netlink_parms(): no params data found [ 647.134867][T13077] bridge0: port 1(bridge_slave_0) entered blocking state [ 647.148549][T13077] bridge0: port 1(bridge_slave_0) entered disabled state [ 647.184511][T13077] device bridge_slave_0 entered promiscuous mode [ 647.216401][T13077] bridge0: port 2(bridge_slave_1) entered blocking state [ 647.282975][T13077] bridge0: port 2(bridge_slave_1) entered disabled state [ 647.291743][T13077] device bridge_slave_1 entered promiscuous mode [ 647.366826][T13110] netlink: 'syz.4.3148': attribute type 21 has an invalid length. [ 647.414428][T13110] IPv6: NLM_F_CREATE should be specified when creating new route [ 647.494892][T13113] netlink: 'syz.1.3150': attribute type 3 has an invalid length. [ 647.507552][T13077] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 647.525845][T13113] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3150'. [ 647.580993][T13077] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 647.642688][T13115] netlink: 'syz.4.3151': attribute type 1 has an invalid length. [ 647.707780][T13077] team0: Port device team_slave_0 added [ 647.716437][T13077] team0: Port device team_slave_1 added [ 647.778937][T13077] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 647.814480][T13077] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 647.869155][T13077] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 647.893514][T13077] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 647.909902][T13077] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 648.056378][T13077] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 648.203811][T13077] device hsr_slave_0 entered promiscuous mode [ 648.247156][T13077] device hsr_slave_1 entered promiscuous mode [ 648.280239][T13077] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 648.304428][T13077] Cannot create hsr debugfs directory [ 648.377061][T13138] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 648.384437][T13138] IPv6: NLM_F_CREATE should be set when creating new route [ 648.391970][T13138] IPv6: NLM_F_CREATE should be set when creating new route [ 648.399392][T13138] IPv6: NLM_F_CREATE should be set when creating new route [ 648.419223][T10969] Bluetooth: hci1: command 0x0409 tx timeout [ 648.624650][T13149] netlink: 'syz.4.3162': attribute type 3 has an invalid length. [ 648.673069][T13149] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3162'. [ 648.703736][T13151] netlink: 'syz.0.3161': attribute type 21 has an invalid length. [ 648.737317][T13151] IPv6: NLM_F_CREATE should be specified when creating new route [ 648.829398][T13077] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 648.938685][T13077] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 649.133840][T13077] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 649.185146][T13167] netlink: 'syz.0.3168': attribute type 3 has an invalid length. [ 649.250398][T13167] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3168'. [ 649.322043][T13077] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 649.542518][T13077] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 649.589866][T13077] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 649.608853][T13077] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 649.618905][T13077] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 649.722721][T12328] bridge0: port 3(gretap0) entered disabled state [ 649.756978][T12328] device gretap0 left promiscuous mode [ 649.779098][T12328] bridge0: port 3(gretap0) entered disabled state [ 649.912148][T13193] netlink: 'syz.1.3175': attribute type 21 has an invalid length. [ 649.929372][T13193] IPv6: NLM_F_CREATE should be specified when creating new route [ 649.979219][T13198] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 650.013511][T13198] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 650.184630][T13077] 8021q: adding VLAN 0 to HW filter on device bond0 [ 650.246865][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 650.274368][ T4253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 650.326258][T13077] 8021q: adding VLAN 0 to HW filter on device team0 [ 650.365284][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 650.400755][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 650.455644][ T4320] bridge0: port 1(bridge_slave_0) entered blocking state [ 650.462767][ T4320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 650.499271][T11138] Bluetooth: hci1: command 0x041b tx timeout [ 650.545965][T13213] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3183'. [ 650.583901][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 650.623581][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 650.675121][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 650.695741][ T4320] bridge0: port 2(bridge_slave_1) entered blocking state [ 650.702876][ T4320] bridge0: port 2(bridge_slave_1) entered forwarding state [ 650.732047][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 650.743602][T13215] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3184'. [ 650.808326][T13215] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3184'. [ 650.853417][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 650.887333][T13216] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3184'. [ 650.905251][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 650.934349][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 650.957949][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 651.095186][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 651.127573][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 651.146349][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 651.158029][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 651.173223][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 651.197137][T13077] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 651.238029][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 651.510822][T12328] device vlan0 left promiscuous mode [ 651.516375][T12328] À: port 1(vlan0) entered disabled state [ 651.560300][T12328] device hsr_slave_0 left promiscuous mode [ 651.573324][T12328] device hsr_slave_1 left promiscuous mode [ 651.590475][T12328] device bridge_slave_1 left promiscuous mode [ 651.607788][T12328] bridge0: port 2(bridge_slave_1) entered disabled state [ 651.630386][T12328] device bridge_slave_0 left promiscuous mode [ 651.643275][T12328] bridge0: port 1(bridge_slave_0) entered disabled state [ 651.675928][T12328] device veth1_vlan left promiscuous mode [ 651.692252][T12328] device veth0_vlan left promiscuous mode [ 652.024430][T13247] __nla_validate_parse: 1 callbacks suppressed [ 652.024445][T13247] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3194'. [ 652.579268][ T26] Bluetooth: hci1: command 0x040f tx timeout [ 652.790064][T12328] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 652.828131][T12328] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 652.934169][T12328] bond0 (unregistering): Released all slaves [ 652.999299][T13239] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 653.024099][T13247] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3194'. [ 653.039350][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 653.064578][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 653.093982][T13077] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 653.142047][T13256] netlink: 'syz.4.3197': attribute type 4 has an invalid length. [ 653.169158][T13256] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.3197'. [ 653.178978][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 653.201193][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 653.254334][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 653.263680][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 653.274794][T13077] device veth0_vlan entered promiscuous mode [ 653.285654][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 653.322235][T12322] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 653.347050][T13077] device veth1_vlan entered promiscuous mode [ 653.522291][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 653.563137][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 653.582502][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 653.629516][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 653.651754][T13077] device veth0_macvtap entered promiscuous mode [ 653.720095][T13077] device veth1_macvtap entered promiscuous mode [ 653.785591][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 653.817200][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 653.848925][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 653.867102][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 653.877850][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 653.893776][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 653.906019][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 653.925733][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 653.986104][T13077] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 654.049390][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 654.057620][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 654.089863][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 654.098944][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 654.137525][T13274] FAULT_INJECTION: forcing a failure. [ 654.137525][T13274] name failslab, interval 1, probability 0, space 0, times 0 [ 654.187216][T13274] CPU: 0 PID: 13274 Comm: syz.1.3201 Not tainted syzkaller #0 [ 654.194710][T13274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 654.204761][T13274] Call Trace: [ 654.208037][T13274] [ 654.210964][T13274] dump_stack_lvl+0x188/0x250 [ 654.215650][T13274] ? show_regs_print_info+0x20/0x20 [ 654.220846][T13274] ? load_image+0x400/0x400 [ 654.225363][T13274] should_fail+0x38c/0x4c0 [ 654.229780][T13274] should_failslab+0x5/0x20 [ 654.234286][T13274] slab_pre_alloc_hook+0x51/0xc0 [ 654.239219][T13274] ? skb_clone+0x1bd/0x350 [ 654.243636][T13274] kmem_cache_alloc+0x3d/0x290 [ 654.248409][T13274] skb_clone+0x1bd/0x350 [ 654.252655][T13274] __netlink_deliver_tap+0x3cd/0x7c0 [ 654.257953][T13274] netlink_deliver_tap+0x16c/0x180 [ 654.263066][T13274] netlink_unicast+0x74f/0x920 [ 654.267836][T13274] netlink_sendmsg+0x8ba/0xbe0 [ 654.272603][T13274] ? netlink_getsockopt+0x570/0x570 [ 654.277798][T13274] ? aa_sock_msg_perm+0x94/0x150 [ 654.282744][T13274] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 654.288026][T13274] ? security_socket_sendmsg+0x7c/0xa0 [ 654.293483][T13274] ? netlink_getsockopt+0x570/0x570 [ 654.298683][T13274] ____sys_sendmsg+0x5b7/0x8f0 [ 654.303455][T13274] ? __sys_sendmsg_sock+0x30/0x30 [ 654.308481][T13274] ? import_iovec+0x6f/0xa0 [ 654.312986][T13274] ___sys_sendmsg+0x236/0x2e0 [ 654.317671][T13274] ? __sys_sendmsg+0x2a0/0x2a0 [ 654.322448][T13274] ? vfs_write+0x8b2/0xd60 [ 654.326880][T13274] __se_sys_sendmsg+0x1af/0x290 [ 654.331728][T13274] ? __x64_sys_sendmsg+0x80/0x80 [ 654.336659][T13274] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 654.342650][T13274] ? lockdep_hardirqs_on+0x94/0x140 [ 654.347853][T13274] do_syscall_64+0x4c/0xa0 [ 654.352264][T13274] ? clear_bhb_loop+0x30/0x80 [ 654.356932][T13274] ? clear_bhb_loop+0x30/0x80 [ 654.361610][T13274] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 654.367493][T13274] RIP: 0033:0x7f56f1f57eb9 [ 654.371900][T13274] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 654.391501][T13274] RSP: 002b:00007f56f01b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 654.399918][T13274] RAX: ffffffffffffffda RBX: 00007f56f21d2fa0 RCX: 00007f56f1f57eb9 [ 654.407891][T13274] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000005 [ 654.415860][T13274] RBP: 00007f56f01b3090 R08: 0000000000000000 R09: 0000000000000000 [ 654.423825][T13274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 654.431786][T13274] R13: 00007f56f21d3038 R14: 00007f56f21d2fa0 R15: 00007ffe22697d88 [ 654.439770][T13274] [ 654.489061][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 654.509053][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 654.518890][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 654.554282][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 654.583795][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 654.604427][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 654.617203][T13077] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 654.648321][T13077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 654.659281][ T5399] Bluetooth: hci1: command 0x0419 tx timeout [ 654.713020][T13077] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 654.752263][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 654.810461][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 654.831903][T13077] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.865073][T13077] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.900061][T13291] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3207'. [ 654.941782][T13077] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.961671][T13077] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.978775][T13293] netlink: 'syz.1.3206': attribute type 9 has an invalid length. [ 654.987825][T13293] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.3206'. [ 655.028040][T13291] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3207'. [ 655.130004][T13292] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3207'. [ 655.224219][T13294] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3207'. [ 655.335674][T13302] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 655.414897][T13302] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 655.476484][T13304] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3220'. [ 655.582469][T13304] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3220'. [ 655.607816][T12322] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.675066][T12322] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.685011][ T4253] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.710938][ T4253] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.742087][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 655.805360][T12316] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 656.038058][T13327] netlink: 'syz.1.3216': attribute type 29 has an invalid length. [ 656.087131][T13327] netlink: 'syz.1.3216': attribute type 29 has an invalid length. [ 656.300666][T13335] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 656.388083][T13335] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 656.784556][T13355] FAULT_INJECTION: forcing a failure. [ 656.784556][T13355] name failslab, interval 1, probability 0, space 0, times 0 [ 656.828228][T13355] CPU: 1 PID: 13355 Comm: syz.4.3227 Not tainted syzkaller #0 [ 656.835718][T13355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 656.845781][T13355] Call Trace: [ 656.849081][T13355] [ 656.852019][T13355] dump_stack_lvl+0x188/0x250 [ 656.856708][T13355] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 656.862876][T13355] ? show_regs_print_info+0x20/0x20 [ 656.868087][T13355] ? load_image+0x400/0x400 [ 656.872617][T13355] should_fail+0x38c/0x4c0 [ 656.877055][T13355] should_failslab+0x5/0x20 [ 656.881566][T13355] slab_pre_alloc_hook+0x51/0xc0 [ 656.886510][T13355] kmem_cache_alloc_node_trace+0x4a/0x300 [ 656.892229][T13355] ? __get_vm_area_node+0x119/0x2d0 [ 656.897430][T13355] __get_vm_area_node+0x119/0x2d0 [ 656.902466][T13355] __vmalloc_node_range+0xef/0x8b0 [ 656.907568][T13355] ? netlink_sendmsg+0x5ec/0xbe0 [ 656.912490][T13355] ? netlink_data_ready+0x10/0x10 [ 656.917509][T13355] ? netlink_sendmsg+0x5ec/0xbe0 [ 656.922441][T13355] vmalloc+0x75/0x80 [ 656.926324][T13355] ? netlink_sendmsg+0x5ec/0xbe0 [ 656.931244][T13355] netlink_sendmsg+0x5ec/0xbe0 [ 656.935998][T13355] ? netlink_getsockopt+0x570/0x570 [ 656.941181][T13355] ? aa_sock_msg_perm+0x94/0x150 [ 656.946108][T13355] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 656.951376][T13355] ? security_socket_sendmsg+0x7c/0xa0 [ 656.956818][T13355] sock_write_iter+0x2a6/0x3a0 [ 656.961569][T13355] ? sock_read_iter+0x380/0x380 [ 656.966413][T13355] ? memset+0x1e/0x40 [ 656.970384][T13355] ? iov_iter_init+0xb4/0x170 [ 656.975060][T13355] vfs_write+0x745/0xd60 [ 656.979314][T13355] ? file_end_write+0x250/0x250 [ 656.984171][T13355] ? __fget_files+0x40f/0x480 [ 656.988837][T13355] ? __fdget_pos+0x1e2/0x370 [ 656.993417][T13355] ? ksys_write+0x71/0x260 [ 656.997823][T13355] ksys_write+0x152/0x260 [ 657.002138][T13355] ? __ia32_sys_read+0x80/0x80 [ 657.006890][T13355] ? lockdep_hardirqs_on+0x94/0x140 [ 657.012078][T13355] do_syscall_64+0x4c/0xa0 [ 657.016475][T13355] ? clear_bhb_loop+0x30/0x80 [ 657.021136][T13355] ? clear_bhb_loop+0x30/0x80 [ 657.025798][T13355] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 657.031675][T13355] RIP: 0033:0x7fc25a5adeb9 [ 657.036076][T13355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 657.055664][T13355] RSP: 002b:00007fc258809028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 657.064070][T13355] RAX: ffffffffffffffda RBX: 00007fc25a828fa0 RCX: 00007fc25a5adeb9 [ 657.072025][T13355] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 000000000000000c [ 657.079989][T13355] RBP: 00007fc258809090 R08: 0000000000000000 R09: 0000000000000000 [ 657.087942][T13355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 657.095893][T13355] R13: 00007fc25a829038 R14: 00007fc25a828fa0 R15: 00007ffeff99bd78 [ 657.103866][T13355] [ 657.125667][T13355] syz.4.3227: vmalloc error: size 65408, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz4,mems_allowed=0-1 [ 657.157704][T13355] CPU: 1 PID: 13355 Comm: syz.4.3227 Not tainted syzkaller #0 [ 657.165193][T13355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 657.175241][T13355] Call Trace: [ 657.178508][T13355] [ 657.181423][T13355] dump_stack_lvl+0x188/0x250 [ 657.186095][T13355] ? rcu_lock_release+0x5/0x20 [ 657.190842][T13355] ? show_regs_print_info+0x20/0x20 [ 657.196026][T13355] ? load_image+0x400/0x400 [ 657.200522][T13355] warn_alloc+0x243/0x320 [ 657.204838][T13355] ? zone_watermark_ok_safe+0x240/0x240 [ 657.210367][T13355] ? kmem_cache_alloc_node_trace+0x16c/0x300 [ 657.216331][T13355] ? __get_vm_area_node+0x119/0x2d0 [ 657.221518][T13355] __vmalloc_node_range+0x2b1/0x8b0 [ 657.226699][T13355] ? netlink_data_ready+0x10/0x10 [ 657.231714][T13355] ? netlink_sendmsg+0x5ec/0xbe0 [ 657.236633][T13355] vmalloc+0x75/0x80 [ 657.240513][T13355] ? netlink_sendmsg+0x5ec/0xbe0 [ 657.245437][T13355] netlink_sendmsg+0x5ec/0xbe0 [ 657.250188][T13355] ? netlink_getsockopt+0x570/0x570 [ 657.255368][T13355] ? aa_sock_msg_perm+0x94/0x150 [ 657.260291][T13355] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 657.265565][T13355] ? security_socket_sendmsg+0x7c/0xa0 [ 657.271007][T13355] sock_write_iter+0x2a6/0x3a0 [ 657.275759][T13355] ? sock_read_iter+0x380/0x380 [ 657.280601][T13355] ? memset+0x1e/0x40 [ 657.284568][T13355] ? iov_iter_init+0xb4/0x170 [ 657.289231][T13355] vfs_write+0x745/0xd60 [ 657.293466][T13355] ? file_end_write+0x250/0x250 [ 657.298321][T13355] ? __fget_files+0x40f/0x480 [ 657.302989][T13355] ? __fdget_pos+0x1e2/0x370 [ 657.307557][T13355] ? ksys_write+0x71/0x260 [ 657.311955][T13355] ksys_write+0x152/0x260 [ 657.316618][T13355] ? __ia32_sys_read+0x80/0x80 [ 657.321386][T13355] ? lockdep_hardirqs_on+0x94/0x140 [ 657.326595][T13355] do_syscall_64+0x4c/0xa0 [ 657.331008][T13355] ? clear_bhb_loop+0x30/0x80 [ 657.335671][T13355] ? clear_bhb_loop+0x30/0x80 [ 657.340330][T13355] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 657.346216][T13355] RIP: 0033:0x7fc25a5adeb9 [ 657.350616][T13355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 657.370214][T13355] RSP: 002b:00007fc258809028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 657.378626][T13355] RAX: ffffffffffffffda RBX: 00007fc25a828fa0 RCX: 00007fc25a5adeb9 [ 657.386581][T13355] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 000000000000000c [ 657.394536][T13355] RBP: 00007fc258809090 R08: 0000000000000000 R09: 0000000000000000 [ 657.402492][T13355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 657.410445][T13355] R13: 00007fc25a829038 R14: 00007fc25a828fa0 R15: 00007ffeff99bd78 [ 657.418410][T13355] [ 657.588725][T13366] netlink: 'syz.0.3232': attribute type 16 has an invalid length. [ 657.629249][T13355] Mem-Info: [ 657.632407][T13355] active_anon:275 inactive_anon:5573 isolated_anon:0 [ 657.632407][T13355] active_file:17269 inactive_file:36242 isolated_file:0 [ 657.632407][T13355] unevictable:768 dirty:150 writeback:0 [ 657.632407][T13355] slab_reclaimable:20506 slab_unreclaimable:95201 [ 657.632407][T13355] mapped:29619 shmem:1629 pagetables:557 bounce:0 [ 657.632407][T13355] kernel_misc_reclaimable:0 [ 657.632407][T13355] free:1380990 free_pcp:6664 free_cma:0 [ 657.652377][T13366] __nla_validate_parse: 8 callbacks suppressed [ 657.652413][T13366] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3232'. [ 657.732196][T13355] Node 0 active_anon:1068kB inactive_anon:21984kB active_file:68876kB inactive_file:144968kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:118476kB dirty:600kB writeback:0kB shmem:4440kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11968kB pagetables:2328kB all_unreclaimable? no [ 657.766247][T13355] Node 1 active_anon:32kB inactive_anon:508kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2076kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB all_unreclaimable? no [ 657.858052][T13355] Node 0 DMA free:15360kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 657.860841][T13381] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3236'. [ 657.889773][T13355] lowmem_reserve[]: 0 2539 2540 2540 2540 [ 657.899672][T13355] Node 0 DMA32 free:1585920kB min:34784kB low:43480kB high:52176kB reserved_highatomic:0KB active_anon:1068kB inactive_anon:21984kB active_file:68876kB inactive_file:144968kB unevictable:1536kB writepending:600kB present:3129332kB managed:2606560kB mlocked:0kB bounce:0kB free_pcp:24560kB local_pcp:3792kB free_cma:0kB [ 657.930863][T13381] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3236'. [ 657.941609][T13355] lowmem_reserve[]: 0 0 0 0 0 [ 657.946339][T13355] Node 0 Normal free:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:660kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 657.978296][T13355] lowmem_reserve[]: 0 0 0 0 0 [ 657.983298][T13355] Node 1 Normal free:3922232kB min:55108kB low:68884kB high:82660kB reserved_highatomic:0KB active_anon:32kB inactive_anon:508kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4119672kB mlocked:0kB bounce:0kB free_pcp:2104kB local_pcp:1404kB free_cma:0kB [ 658.010227][T13382] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3236'. [ 658.017502][T13355] lowmem_reserve[]: 0 0 0 0 0 [ 658.027808][T13355] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 658.053982][T13355] Node 0 DMA32: 1970*4kB (UME) 3501*8kB (UME) 3852*16kB (UME) 3017*32kB (UME) 2247*64kB (UME) 1205*128kB (UME) 550*256kB (UME) 272*512kB (UM) 58*1024kB (UM) 22*2048kB (UM) 173*4096kB (M) = 1585232kB [ 658.079226][T13381] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3236'. [ 658.088398][T13355] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 658.108289][T13355] Node 1 Normal: 114*4kB (UME) 34*8kB (UME) 20*16kB (UME) 211*32kB (UME) 95*64kB (UME) 26*128kB (UE) 8*256kB (UME) 7*512kB (U) 2*1024kB (UE) 1*2048kB (M) 951*4096kB (M) = 3922232kB [ 658.128985][T13355] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 658.139129][T13355] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 658.148494][T13355] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 658.158681][T13355] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 658.186566][T13355] 55140 total pagecache pages [ 658.198193][T13355] 0 pages in swap cache [ 658.206518][T13355] Swap cache stats: add 217, delete 217, find 18/41 [ 658.215141][T13355] Free swap = 124472kB [ 658.221827][T13355] Total swap = 124996kB [ 658.226253][T13355] 2097051 pages RAM [ 658.231433][T13355] 0 pages HighMem/MovableOnly [ 658.236396][T13355] 411488 pages reserved [ 658.241583][T13355] 0 pages cma reserved [ 658.496181][T13396] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3240'. [ 660.005294][T13401] FAULT_INJECTION: forcing a failure. [ 660.005294][T13401] name failslab, interval 1, probability 0, space 0, times 0 [ 660.018702][T13401] CPU: 1 PID: 13401 Comm: syz.3.3243 Not tainted syzkaller #0 [ 660.026190][T13401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 660.036259][T13401] Call Trace: [ 660.039564][T13401] [ 660.042519][T13401] dump_stack_lvl+0x188/0x250 [ 660.047244][T13401] ? show_regs_print_info+0x20/0x20 [ 660.052557][T13401] ? load_image+0x400/0x400 [ 660.057135][T13401] should_fail+0x38c/0x4c0 [ 660.061597][T13401] should_failslab+0x5/0x20 [ 660.066116][T13401] slab_pre_alloc_hook+0x51/0xc0 [ 660.071076][T13401] ? skb_clone+0x1bd/0x350 [ 660.075512][T13401] kmem_cache_alloc+0x3d/0x290 [ 660.080311][T13401] skb_clone+0x1bd/0x350 [ 660.084576][T13401] ? dev_queue_xmit_nit+0x1df/0xb00 [ 660.089808][T13401] dev_queue_xmit_nit+0x2cc/0xb00 [ 660.094873][T13401] ? validate_xmit_skb+0x7b3/0xe40 [ 660.100028][T13401] dev_hard_start_xmit+0x13e/0x7e0 [ 660.105204][T13401] __dev_queue_xmit+0x1a78/0x2fd0 [ 660.110309][T13401] ? dev_queue_xmit+0x20/0x20 [ 660.115008][T13401] ? memcpy+0x3c/0x60 [ 660.119024][T13401] ? __copy_skb_header+0x3ba/0x4f0 [ 660.124167][T13401] ? __skb_clone+0x480/0x790 [ 660.128803][T13401] ? skb_clone+0x1f1/0x350 [ 660.133256][T13401] __netlink_deliver_tap+0x53e/0x7c0 [ 660.138607][T13401] netlink_deliver_tap+0x16c/0x180 [ 660.143741][T13401] netlink_unicast+0x74f/0x920 [ 660.148557][T13401] netlink_sendmsg+0x8ba/0xbe0 [ 660.153366][T13401] ? netlink_getsockopt+0x570/0x570 [ 660.158630][T13401] ? aa_sock_msg_perm+0x94/0x150 [ 660.163596][T13401] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 660.168918][T13401] ? security_socket_sendmsg+0x7c/0xa0 [ 660.174406][T13401] ? netlink_getsockopt+0x570/0x570 [ 660.179625][T13401] ____sys_sendmsg+0x5b7/0x8f0 [ 660.184436][T13401] ? __sys_sendmsg_sock+0x30/0x30 [ 660.189515][T13401] ? import_iovec+0x6f/0xa0 [ 660.194050][T13401] ___sys_sendmsg+0x236/0x2e0 [ 660.198775][T13401] ? __sys_sendmsg+0x2a0/0x2a0 [ 660.203601][T13401] ? trace_event_raw_event_lock+0x270/0x270 [ 660.209517][T13401] ? vfs_write+0x8b2/0xd60 [ 660.214026][T13401] __se_sys_sendmsg+0x1af/0x290 [ 660.218917][T13401] ? __x64_sys_sendmsg+0x80/0x80 [ 660.223878][T13401] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 660.229932][T13401] ? lockdep_hardirqs_on+0x94/0x140 [ 660.235160][T13401] do_syscall_64+0x4c/0xa0 [ 660.239591][T13401] ? clear_bhb_loop+0x30/0x80 [ 660.244288][T13401] ? clear_bhb_loop+0x30/0x80 [ 660.248995][T13401] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 660.254918][T13401] RIP: 0033:0x7fa724d08eb9 [ 660.259355][T13401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 660.278992][T13401] RSP: 002b:00007fa722f64028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 660.287440][T13401] RAX: ffffffffffffffda RBX: 00007fa724f83fa0 RCX: 00007fa724d08eb9 [ 660.295439][T13401] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000005 [ 660.303434][T13401] RBP: 00007fa722f64090 R08: 0000000000000000 R09: 0000000000000000 [ 660.311429][T13401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 660.319426][T13401] R13: 00007fa724f84038 R14: 00007fa724f83fa0 R15: 00007fffbd4257a8 [ 660.327464][T13401] [ 660.357056][T13404] netlink: 180 bytes leftover after parsing attributes in process `syz.0.3245'. [ 660.604976][T13423] netlink: 'syz.2.3250': attribute type 16 has an invalid length. [ 660.639386][T13423] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3250'. [ 663.016687][T13438] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 663.023973][T13438] IPv6: NLM_F_CREATE should be set when creating new route [ 663.031285][T13438] IPv6: NLM_F_CREATE should be set when creating new route [ 663.038508][T13438] IPv6: NLM_F_CREATE should be set when creating new route [ 663.188585][T13462] netlink: 'syz.1.3263': attribute type 1 has an invalid length. [ 663.221343][T13460] netlink: 'syz.4.3262': attribute type 3 has an invalid length. [ 663.262994][T13460] netlink: 13435 bytes leftover after parsing attributes in process `syz.4.3262'. [ 663.352728][T13472] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3267'. [ 663.489728][T13477] ref_ctr_offset mismatch. inode: 0x21a offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 663.681748][T13487] netlink: 'syz.4.3271': attribute type 16 has an invalid length. [ 663.703642][T13487] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3271'. [ 666.451898][T13531] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3288'. [ 666.590593][T13537] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 666.656224][T13540] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3291'. [ 666.785226][T13548] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 666.829963][T13548] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 669.359934][T13569] netlink: 'syz.3.3300': attribute type 21 has an invalid length. [ 669.379274][T13569] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3300'. [ 669.409157][T13574] netlink: 'syz.2.3302': attribute type 10 has an invalid length. [ 669.434446][T13574] device hsr0 entered promiscuous mode [ 669.462849][T13574] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 669.498294][T13574] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 669.522511][T13574] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 669.574459][T13574] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 669.770230][T13603] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3314'. [ 669.814129][T13603] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3314'. [ 669.864337][T13609] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3314'. [ 669.905010][T13603] FAULT_INJECTION: forcing a failure. [ 669.905010][T13603] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 669.978592][T13603] CPU: 0 PID: 13603 Comm: syz.3.3314 Not tainted syzkaller #0 [ 669.982164][T13615] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 669.986073][T13603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 670.003038][T13603] Call Trace: [ 670.006317][T13603] [ 670.009250][T13603] dump_stack_lvl+0x188/0x250 [ 670.013937][T13603] ? show_regs_print_info+0x20/0x20 [ 670.019140][T13603] ? load_image+0x400/0x400 [ 670.023657][T13603] ? __lock_acquire+0x7d10/0x7d10 [ 670.028689][T13603] should_fail+0x38c/0x4c0 [ 670.033115][T13603] _copy_from_user+0x2e/0x170 [ 670.037810][T13603] ___sys_recvmsg+0x173/0x5c0 [ 670.042489][T13603] ? __sys_recvmsg+0x280/0x280 [ 670.047258][T13603] ? __lock_acquire+0x7d10/0x7d10 [ 670.052312][T13603] __x64_sys_recvmsg+0x1f9/0x2c0 [ 670.057259][T13603] ? ___sys_recvmsg+0x5c0/0x5c0 [ 670.062115][T13603] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 670.068128][T13603] ? lockdep_hardirqs_on+0x94/0x140 [ 670.073330][T13603] do_syscall_64+0x4c/0xa0 [ 670.077745][T13603] ? clear_bhb_loop+0x30/0x80 [ 670.082432][T13603] ? clear_bhb_loop+0x30/0x80 [ 670.084908][T13615] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 670.087112][T13603] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 670.087135][T13603] RIP: 0033:0x7fa724d08eb9 [ 670.087153][T13603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 670.132094][T13603] RSP: 002b:00007fa722f64028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 670.140537][T13603] RAX: ffffffffffffffda RBX: 00007fa724f83fa0 RCX: 00007fa724d08eb9 [ 670.148516][T13603] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 670.156495][T13603] RBP: 00007fa722f64090 R08: 0000000000000000 R09: 0000000000000000 [ 670.164472][T13603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 670.172447][T13603] R13: 00007fa724f84038 R14: 00007fa724f83fa0 R15: 00007fffbd4257a8 [ 670.180441][T13603] [ 672.441201][T13679] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3340'. [ 672.512957][T13679] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3340'. [ 672.632348][T13681] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3340'. [ 673.143866][T13691] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 673.151357][T13691] IPv6: NLM_F_CREATE should be set when creating new route [ 673.159539][T13691] IPv6: NLM_F_CREATE should be set when creating new route [ 673.167008][T13691] IPv6: NLM_F_CREATE should be set when creating new route [ 673.576528][T13700] netlink: 'syz.1.3348': attribute type 1 has an invalid length. [ 673.599790][T13700] netlink: 'syz.1.3348': attribute type 1 has an invalid length. [ 673.620492][T13707] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.3351'. [ 673.624737][T13710] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3350'. [ 673.669957][T13710] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3350'. [ 673.709246][T13712] netlink: 'syz.0.3352': attribute type 1 has an invalid length. [ 673.723542][T13716] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 673.745164][T13716] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 673.775527][T13710] FAULT_INJECTION: forcing a failure. [ 673.775527][T13710] name failslab, interval 1, probability 0, space 0, times 0 [ 673.799362][T13710] CPU: 1 PID: 13710 Comm: syz.4.3350 Not tainted syzkaller #0 [ 673.806847][T13710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 673.816915][T13710] Call Trace: [ 673.820200][T13710] [ 673.823139][T13710] dump_stack_lvl+0x188/0x250 [ 673.827833][T13710] ? show_regs_print_info+0x20/0x20 [ 673.833043][T13710] ? load_image+0x400/0x400 [ 673.837554][T13710] ? __mutex_lock_common+0x155c/0x2400 [ 673.843027][T13710] should_fail+0x38c/0x4c0 [ 673.847457][T13710] should_failslab+0x5/0x20 [ 673.851961][T13710] slab_pre_alloc_hook+0x51/0xc0 [ 673.856998][T13710] kmem_cache_alloc_node+0x47/0x2d0 [ 673.862204][T13710] ? __alloc_skb+0xf4/0x750 [ 673.866721][T13710] __alloc_skb+0xf4/0x750 [ 673.871056][T13710] netlink_dump+0x19f/0xcf0 [ 673.875563][T13710] ? lockdep_hardirqs_on+0x94/0x140 [ 673.880768][T13710] ? slab_free_freelist_hook+0xea/0x170 [ 673.886317][T13710] ? netlink_lookup+0x1d0/0x1d0 [ 673.891176][T13710] netlink_recvmsg+0x672/0xe20 [ 673.895953][T13710] ? netlink_sendmsg+0xbe0/0xbe0 [ 673.900890][T13710] ? aa_sk_perm+0x7dc/0x910 [ 673.905408][T13710] ? aa_af_perm+0x340/0x340 [ 673.909930][T13710] ? bpf_lsm_socket_recvmsg+0x5/0x10 [ 673.915217][T13710] ? security_socket_recvmsg+0x85/0xb0 [ 673.920683][T13710] ? netlink_sendmsg+0xbe0/0xbe0 [ 673.925625][T13710] ____sys_recvmsg+0x2cd/0x5e0 [ 673.930403][T13710] ? __sys_recvmsg_sock+0x40/0x40 [ 673.935449][T13710] ? import_iovec+0x6f/0xa0 [ 673.939960][T13710] ___sys_recvmsg+0x21a/0x5c0 [ 673.944645][T13710] ? __sys_recvmsg+0x280/0x280 [ 673.949417][T13710] ? __lock_acquire+0x7d10/0x7d10 [ 673.954467][T13710] __x64_sys_recvmsg+0x1f9/0x2c0 [ 673.959408][T13710] ? ___sys_recvmsg+0x5c0/0x5c0 [ 673.964253][T13710] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 673.970242][T13710] ? lockdep_hardirqs_on+0x94/0x140 [ 673.975441][T13710] do_syscall_64+0x4c/0xa0 [ 673.979852][T13710] ? clear_bhb_loop+0x30/0x80 [ 673.984534][T13710] ? clear_bhb_loop+0x30/0x80 [ 673.989215][T13710] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 673.995100][T13710] RIP: 0033:0x7fc25a5adeb9 [ 673.999510][T13710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.019109][T13710] RSP: 002b:00007fc258809028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 674.027510][T13710] RAX: ffffffffffffffda RBX: 00007fc25a828fa0 RCX: 00007fc25a5adeb9 [ 674.035461][T13710] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 674.043412][T13710] RBP: 00007fc258809090 R08: 0000000000000000 R09: 0000000000000000 [ 674.051363][T13710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 674.059315][T13710] R13: 00007fc25a829038 R14: 00007fc25a828fa0 R15: 00007ffeff99bd78 [ 674.067292][T13710] [ 675.797064][T13777] device wlan0 entered promiscuous mode [ 675.808053][T13783] __nla_validate_parse: 9 callbacks suppressed [ 675.808069][T13783] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3374'. [ 675.879343][T13783] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3374'. [ 675.930044][T13788] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3374'. [ 676.304676][T13801] ref_ctr_offset mismatch. inode: 0xf5 offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 676.586321][T13817] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 676.760550][T13830] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3389'. [ 676.783144][T13833] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 676.813671][T13833] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 676.908521][T13830] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3389'. [ 676.933299][T13837] netlink: 'syz.1.3390': attribute type 1 has an invalid length. [ 676.979684][T13834] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3389'. [ 677.005129][T13836] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3389'. [ 677.244334][T13845] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3392'. [ 677.309622][T13845] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3392'. [ 677.388042][T13846] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3392'. [ 677.485518][T13847] FAULT_INJECTION: forcing a failure. [ 677.485518][T13847] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 677.571874][T13847] CPU: 1 PID: 13847 Comm: syz.4.3392 Not tainted syzkaller #0 [ 677.579379][T13847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 677.589446][T13847] Call Trace: [ 677.592726][T13847] [ 677.595650][T13847] dump_stack_lvl+0x188/0x250 [ 677.600330][T13847] ? show_regs_print_info+0x20/0x20 [ 677.605522][T13847] ? load_image+0x400/0x400 [ 677.610019][T13847] ? __kasan_slab_alloc+0xb3/0xd0 [ 677.615033][T13847] ? slab_post_alloc_hook+0x4c/0x380 [ 677.620305][T13847] ? kmem_cache_alloc_node+0x12d/0x2d0 [ 677.625754][T13847] ? __alloc_skb+0xf4/0x750 [ 677.630250][T13847] ? netlink_recvmsg+0x672/0xe20 [ 677.635176][T13847] ? ____sys_recvmsg+0x2cd/0x5e0 [ 677.640102][T13847] ? ___sys_recvmsg+0x21a/0x5c0 [ 677.644943][T13847] ? __x64_sys_recvmsg+0x1f9/0x2c0 [ 677.650053][T13847] should_fail+0x38c/0x4c0 [ 677.654478][T13847] prepare_alloc_pages+0x1e4/0x5f0 [ 677.659597][T13847] __alloc_pages+0x11b/0x480 [ 677.664187][T13847] ? zone_statistics+0x170/0x170 [ 677.669147][T13847] kmalloc_large_node+0x7d/0x190 [ 677.674086][T13847] __kmalloc_node_track_caller+0x22e/0x3a0 [ 677.679882][T13847] ? netlink_dump+0x19f/0xcf0 [ 677.684546][T13847] ? kmem_cache_alloc_node+0x162/0x2d0 [ 677.689991][T13847] ? __alloc_skb+0xf4/0x750 [ 677.694488][T13847] ? netlink_dump+0x19f/0xcf0 [ 677.699160][T13847] __alloc_skb+0x22c/0x750 [ 677.703578][T13847] netlink_dump+0x19f/0xcf0 [ 677.708075][T13847] ? lockdep_hardirqs_on+0x94/0x140 [ 677.713283][T13847] ? slab_free_freelist_hook+0xea/0x170 [ 677.718825][T13847] ? netlink_lookup+0x1d0/0x1d0 [ 677.723705][T13847] netlink_recvmsg+0x672/0xe20 [ 677.728478][T13847] ? netlink_sendmsg+0xbe0/0xbe0 [ 677.733404][T13847] ? aa_sk_perm+0x7dc/0x910 [ 677.737916][T13847] ? aa_af_perm+0x340/0x340 [ 677.742429][T13847] ? bpf_lsm_socket_recvmsg+0x5/0x10 [ 677.747715][T13847] ? security_socket_recvmsg+0x85/0xb0 [ 677.753168][T13847] ? netlink_sendmsg+0xbe0/0xbe0 [ 677.758098][T13847] ____sys_recvmsg+0x2cd/0x5e0 [ 677.762885][T13847] ? __sys_recvmsg_sock+0x40/0x40 [ 677.767934][T13847] ? import_iovec+0x6f/0xa0 [ 677.772448][T13847] ___sys_recvmsg+0x21a/0x5c0 [ 677.777129][T13847] ? __sys_recvmsg+0x280/0x280 [ 677.781900][T13847] ? __lock_acquire+0x7d10/0x7d10 [ 677.786974][T13847] __x64_sys_recvmsg+0x1f9/0x2c0 [ 677.791912][T13847] ? ___sys_recvmsg+0x5c0/0x5c0 [ 677.796748][T13847] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 677.802744][T13847] ? lockdep_hardirqs_on+0x94/0x140 [ 677.807943][T13847] do_syscall_64+0x4c/0xa0 [ 677.812346][T13847] ? clear_bhb_loop+0x30/0x80 [ 677.817014][T13847] ? clear_bhb_loop+0x30/0x80 [ 677.821684][T13847] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 677.827566][T13847] RIP: 0033:0x7fc25a5adeb9 [ 677.831978][T13847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 677.851595][T13847] RSP: 002b:00007fc2587c7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 677.860013][T13847] RAX: ffffffffffffffda RBX: 00007fc25a829180 RCX: 00007fc25a5adeb9 [ 677.867976][T13847] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 677.875936][T13847] RBP: 00007fc2587c7090 R08: 0000000000000000 R09: 0000000000000000 [ 677.883900][T13847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 677.891862][T13847] R13: 00007fc25a829218 R14: 00007fc25a829180 R15: 00007ffeff99bd78 [ 677.899858][T13847] [ 678.891567][ C1] [ 678.891579][ C1] ================================ [ 678.891584][ C1] WARNING: inconsistent lock state [ 678.891602][ C1] syzkaller #0 Not tainted [ 678.891612][ C1] -------------------------------- [ 678.891617][ C1] inconsistent {INITIAL USE} -> {IN-NMI} usage. [ 678.891624][ C1] syz.3.3405/13882 [HC1[1]:SC0[0]:HE0:SE1] takes: [ 678.891644][ C1] ffff8880629272a0 (&htab->lockdep_key){....}-{2:2}, at: htab_lru_map_delete_elem+0x1b1/0x640 [ 678.891688][ C1] {INITIAL USE} state was registered at: [ 678.891694][ C1] lock_acquire+0x19e/0x400 [ 678.891713][ C1] _raw_spin_lock_irqsave+0xb0/0x100 [ 678.891732][ C1] htab_lru_map_delete_elem+0x1b1/0x640 [ 678.891745][ C1] bpf_prog_2c29ac5cdc6b1842+0x3a/0x8c4 [ 678.891758][ C1] bpf_overflow_handler+0x1c2/0x4a0 [ 678.891775][ C1] __perf_event_overflow+0x364/0x530 [ 678.891788][ C1] perf_bp_event+0x276/0x320 [ 678.891801][ C1] hw_breakpoint_exceptions_notify+0x152/0x470 [ 678.891816][ C1] atomic_notifier_call_chain+0x15d/0x280 [ 678.891832][ C1] notify_die+0x141/0x1a0 [ 678.891846][ C1] notify_debug+0x20/0x30 [ 678.891861][ C1] noist_exc_debug+0x73/0x120 [ 678.891875][ C1] asm_exc_debug+0x2f/0x40 [ 678.891887][ C1] irq event stamp: 750 [ 678.891893][ C1] hardirqs last enabled at (749): [] syscall_enter_from_user_mode+0x21/0x70 [ 678.891915][ C1] hardirqs last disabled at (750): [] exc_debug+0x6e/0x130 [ 678.891933][ C1] softirqs last enabled at (494): [] bpf_prog_load+0x10f9/0x1510 [ 678.891958][ C1] softirqs last disabled at (492): [] bpf_ksym_add+0x29/0x340 [ 678.891980][ C1] [ 678.891980][ C1] other info that might help us debug this: [ 678.891985][ C1] Possible unsafe locking scenario: [ 678.891985][ C1] [ 678.891990][ C1] CPU0 [ 678.891993][ C1] ---- [ 678.891996][ C1] lock(&htab->lockdep_key); [ 678.892006][ C1] [ 678.892009][ C1] lock(&htab->lockdep_key); [ 678.892019][ C1] [ 678.892019][ C1] *** DEADLOCK *** [ 678.892019][ C1] [ 678.892022][ C1] no locks held by syz.3.3405/13882. [ 678.892029][ C1] [ 678.892029][ C1] stack backtrace: [ 678.892034][ C1] CPU: 1 PID: 13882 Comm: syz.3.3405 Not tainted syzkaller #0 [ 678.892049][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 678.892058][ C1] Call Trace: [ 678.892065][ C1] <#DB> [ 678.892071][ C1] dump_stack_lvl+0x188/0x250 [ 678.892091][ C1] ? show_regs_print_info+0x20/0x20 [ 678.892112][ C1] ? print_usage_bug+0x42a/0x690 [ 678.892127][ C1] ? verify_lock_unused+0x18/0x140 [ 678.892147][ C1] lock_acquire+0x2c3/0x400 [ 678.892163][ C1] ? rcu_lock_acquire+0x5/0x30 [ 678.892177][ C1] ? rcu_lock_release+0x5/0x40 [ 678.892193][ C1] ? htab_lru_map_delete_elem+0x1b1/0x640 [ 678.892208][ C1] ? read_lock_is_recursive+0x10/0x10 [ 678.892228][ C1] ? look_up_lock_class+0x71/0x110 [ 678.892244][ C1] ? verify_lock_unused+0x18/0x140 [ 678.892263][ C1] _raw_spin_lock_irqsave+0xb0/0x100 [ 678.892281][ C1] ? htab_lru_map_delete_elem+0x1b1/0x640 [ 678.892296][ C1] ? _raw_spin_lock+0x40/0x40 [ 678.892315][ C1] ? htab_map_hash+0x269/0x6d0 [ 678.892331][ C1] htab_lru_map_delete_elem+0x1b1/0x640 [ 678.892352][ C1] bpf_prog_2c29ac5cdc6b1842+0x3a/0x8c4 [ 678.892365][ C1] bpf_overflow_handler+0x1c2/0x4a0 [ 678.892383][ C1] ? perf_get_page_size+0x430/0x430 [ 678.892400][ C1] ? perf_event_switch_output+0x730/0x730 [ 678.892421][ C1] ? __perf_event_account_interrupt+0x187/0x280 [ 678.892439][ C1] __perf_event_overflow+0x364/0x530 [ 678.892459][ C1] perf_bp_event+0x276/0x320 [ 678.892477][ C1] ? perf_event_free_bpf_prog+0x110/0x110 [ 678.892512][ C1] ? rcu_lock_acquire+0x9/0x30 [ 678.892529][ C1] ? read_lock_is_recursive+0x10/0x10 [ 678.892551][ C1] hw_breakpoint_exceptions_notify+0x152/0x470 [ 678.892570][ C1] atomic_notifier_call_chain+0x15d/0x280 [ 678.892590][ C1] notify_die+0x141/0x1a0 [ 678.892607][ C1] ? srcu_init_notifier_head+0x90/0x90 [ 678.892626][ C1] ? exc_debug+0x6e/0x130 [ 678.892641][ C1] ? trace_hardirqs_off_finish+0x57/0x1f0 [ 678.892660][ C1] notify_debug+0x20/0x30 [ 678.892676][ C1] exc_debug+0xcf/0x130 [ 678.892692][ C1] asm_exc_debug+0x1a/0x40 [ 678.892706][ C1] RIP: 0010:__put_user_nocheck_4+0x5/0x11 [ 678.892726][ C1] Code: 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 90 90 90 90 90 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb 89 01 <31> c9 0f 01 ca c3 90 90 90 90 90 90 48 bb f9 ef ff ff ff 7f 00 00 [ 678.892740][ C1] RSP: 0018:ffffc9000338fe80 EFLAGS: 00040297 [ 678.892753][ C1] RAX: 0000000000000013 RBX: 00007fffffffeffd RCX: 0000200000000300 [ 678.892765][ C1] RDX: 0000000000000000 RSI: ffffffff8a2b3a20 RDI: ffffffff8a79f780 [ 678.892777][ C1] RBP: 0000000000000013 R08: ffffffff8d89d8af R09: 1ffffffff1b13b15 [ 678.892788][ C1] R10: dffffc0000000000 R11: fffffbfff1b13b16 R12: 0000000000000000 [ 678.892797][ C1] R13: 0000200000000300 R14: 0000000000000001 R15: 0000000000000001 [ 678.892812][ C1] [ 678.892817][ C1] [ 678.892821][ C1] __sys_socketpair+0xb4/0x540 [ 678.892841][ C1] __x64_sys_socketpair+0x97/0xb0 [ 678.892856][ C1] do_syscall_64+0x4c/0xa0 [ 678.892868][ C1] ? clear_bhb_loop+0x30/0x80 [ 678.892880][ C1] ? clear_bhb_loop+0x30/0x80 [ 678.892893][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 678.892906][ C1] RIP: 0033:0x7fa724d08eb9 [ 678.892918][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.892929][ C1] RSP: 002b:00007fa722f43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 678.892945][ C1] RAX: ffffffffffffffda RBX: 00007fa724f84090 RCX: 00007fa724d08eb9 [ 678.892957][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 678.892966][ C1] RBP: 00007fa724d76c1f R08: 0000000000000000 R09: 0000000000000000 [ 678.892976][ C1] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000000 [ 678.892986][ C1] R13: 00007fa724f84128 R14: 00007fa724f84090 R15: 00007fffbd4257a8 [ 678.893006][ C1] [ 678.893491][T13882] device wg2 entered promiscuous mode [ 679.685510][T13785] base_sock_release(ffff888070dd1200) sk=ffff888058796000 [ 679.705050][T13906] caif:caif_disconnect_client(): nothing to disconnect [ 679.819274][T13907] caif:caif_disconnect_client(): nothing to disconnect [ 685.540123][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.546416][ T1420] ieee802154 phy1 wpan1: encryption failed: -22