last executing test programs: 27.815341875s ago: executing program 0 (id=6713): socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x80100, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) socket$kcm(0x10, 0x400000002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400000001ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$kcm(0x10, 0x400000002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b87, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0x5, 0x43a1bd76, 0x1, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000000000000240000000000e00000000000070000009404000044108800000000000000000000000000000000001100000000000000000000c2"], 0x98}, 0x0) 27.515779444s ago: executing program 0 (id=6720): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x3a, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x10801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0, 0x10, &(0x7f00000003c0), &(0x7f0000000440), 0x8, 0x86, 0x8, 0x0, 0x0}}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r1}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000080000000000000064ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r2, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffd}}, 0x10) 25.164880837s ago: executing program 0 (id=6725): perf_event_open(&(0x7f0000000480)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffefffffffc}, 0xc001, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x8}, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000500)={0x0, 0x80, 0x28, 0x6, 0x0, 0x8, 0x0, 0x4009, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2, @perf_bp={0x0, 0x3}, 0x8200, 0x5, 0x2, 0x7, 0x9, 0x6, 0x2, 0x0, 0xfffffffc, 0x0, 0x2009}, 0x0, 0x3, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)=@in6={0xa, 0xeffd, 0x80000000, @mcast2}, 0x80, 0x0}, 0x4804) r1 = socket$kcm(0xa, 0x2, 0x73) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002b40)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000004000000020000000000001103000000ffffffff000000000000000901000000020000000000000802000000000061"], 0x0, 0x44}, 0x28) sendmsg$inet(r1, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, &(0x7f00000011c0)=ANY=[@ANYBLOB="440000000000000000000000070000004404dc63440200440cf1130a01010100000004830f50ffffffffffffffffac141418830fd9ac14141a0a0101020a010100000000000000001100000000000000290000000400000000000000000000001c000000000000000000000008000000", @ANYBLOB="ffffffffac141421000000ef94d23897cd6c154dbe7fa1261e01ef144001486bfdaef26af18d22b44a5e55f2407ab966945349272920b1628d62a0dd4dbaa27aed85ecb0588eae3163f8d5abc5d4edf7a1e3a1f4c9cc2ea9cdb2298210ab9af56b0310cc6ebbed65665c92cd6a425c9fa899e57a3d6f4902eccbc246adc7a71137721bd13819079c94ceea1b0e31b11e8196183347b7d4b276a09b1aee07000000000000004eb9b70ad4016b52754e94ee677f61f5ba9a51c13f68fe6ef47493c25d65145837149582eced3ef1b4915c45b419b64c0f9bd024b924ae311fe0117e65a2f4"], 0x80}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x100808, 0x0, 0x8000, 0x0, 0x0, 0x3, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8937, &(0x7f0000000000)={'bridge_slave_1\x00', @random="010000201000"}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x74, 0x0, &(0x7f0000001b00)="c8ea2f8a5e2f0338051bd60db11da78ee0a0ff8a0a78c91a0657cf0ac85d7b9740796a35a8a1630d37644522ad5579cf79c38e1e695d780dfd5856a80d218cc4c10096f3fc3594f1fc95934fb6866d67089ef21cf2c6db8ca265e50f126e9a964fb6c2ceb3cc76dacc9f16312b4ffcc52f53cf8b", 0x0, 0x2f, 0xe8034000, 0x0, 0x0, 0x0, 0x0, 0x5dc, 0x0, 0x9}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000240)={'ip6_vti0\x00', 0x2}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x24142, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x71ab}, 0x0, 0x6, 0x0, 0x0, 0xfffffffffff7bbfe, 0x0, 0x0, 0x0, 0xffffffff}, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001040)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x50}], 0x1, 0x0, 0xfffffffffffffe21, 0x1f00c00e}, 0x20000000) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001140)='memory.events\x00', 0x0, 0x0) recvmsg$unix(r5, 0x0, 0x10060) write$cgroup_devices(r5, &(0x7f0000000940)=ANY=[@ANYBLOB="63202a442a2072000937c697c69702c3b5bc28d986ee642c23846b6b12f402d7af76f0222661052e2f7f9688e3757875076bee6712c0f471f410a883231d6c84f9bdf1af086f68b27791feed613c72cf2a31eb1678a3bc42720343820619edecb6fde6463b4f7a252e758abb790e237713a7f322ad24d16d252375a29068bc68c53ec793409d2ab8c9bad1106002effecba93acc5fa868d66c8e90d3d9346b93f1852b589cf40078339d0255dc1f6882df2c2568c6b780119b805c4e505eea8599"], 0x8) recvmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000d00)=""/242, 0xfffffd63}, {&(0x7f0000001340)=""/190, 0xcd}, {&(0x7f0000000380)=""/210, 0xd2}, {&(0x7f00000006c0)=""/188, 0xc9}, {&(0x7f0000000f40)=""/213, 0xd5}, {&(0x7f0000002100)=""/4077, 0xfee}, {&(0x7f00000007c0)=""/208, 0xd3}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000000480)=""/176, 0xb0}, {&(0x7f0000000c00)=""/208, 0xd0}], 0xa}, 0x40012100) recvmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff1f}, 0x0) perf_event_open(0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000a40)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x2, 0x644b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x2}, 0x111c, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000300)=@generic={&(0x7f00000002c0)='./file0\x00', 0x0, 0x18}, 0x18) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 24.888665535s ago: executing program 2 (id=6728): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f7e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c662003"], &(0x7f0000000100)='GPL\x00'}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000080), &(0x7f0000000200)=r2}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)={@ifindex, r0, 0x9, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000030000000200000002"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x7, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$kcm(0x2, 0x1, 0x84) r6 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x20000, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r7) r8 = socket$kcm(0x2, 0x922000000001, 0x106) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x5452, &(0x7f0000000280)='\x02;\xe5\b\x00\x14\x96)]\xa3\xcdB!\xf7\xe5\fc\xe9\x00\x9c\x00\x00\x00\x00\x00\x00') sendmsg$inet(r8, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x24000800) setsockopt$sock_attach_bpf(r5, 0x1, 0x3c, &(0x7f0000000000), 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000002d40)={0x0, 0x0, 0x0}, 0x0) r10 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0, 0xc00e}, 0x40800) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703340000001f00000000000000040014000d000a00140000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 24.823647727s ago: executing program 3 (id=6729): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x9, 0x1, 0xb8}]}, &(0x7f0000000040)='GPL\x00', 0x2}, 0x90) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fb, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x1, 0x2020007, 0xec49, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r0 = socket$kcm(0xa, 0x2, 0x73) setsockopt$sock_attach_bpf(r0, 0x29, 0x19, 0x0, 0xfcd8) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x600000, 0x0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'pimreg\x00', 0x200}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x9, 0x1, 0xb8}]}, &(0x7f0000000040)='GPL\x00', 0x2}, 0x90) (async) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fb, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x1, 0x2020007, 0xec49, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) (async) socket$kcm(0xa, 0x2, 0x73) (async) setsockopt$sock_attach_bpf(r0, 0x29, 0x19, 0x0, 0xfcd8) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x600000, 0x0) (async) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'pimreg\x00', 0x200}) (async) 24.641289793s ago: executing program 1 (id=6730): socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x80100, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) socket$kcm(0x10, 0x400000002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400000001ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$kcm(0x10, 0x400000002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b87, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0x5, 0x43a1bd76, 0x1, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000380), 0xff7a}], 0x1, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000000000000240000000000640000000000070000009404000044108800000000000000000000000000000000001100000000000000000000c2d63c67000000000000000000"], 0x98}, 0x0) 24.571799695s ago: executing program 3 (id=6731): r0 = socket$kcm(0x10, 0x2, 0x4) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) recvmsg(r4, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x120) sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000c40)="02", 0x1}], 0x1}, 0x408c4) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0xffffff82, &(0x7f0000000340)=[{&(0x7f0000000bc0)="5c00000013006b000040017ea608601602f36504000102009ee517c356a3b0251e616878a76e807c857e21bea297bff435cf01c937e78ba6ed9c232d786c35000000000000740000edffffffffffffff00003e9b9d8c1eb18b48ca4ac32d8243ca209cf8ce820b7afabd4d968859ae248e4f4a995b456286f9c59553cca571", 0x5c}, {&(0x7f00000002c0)="e2"}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) perf_event_open(&(0x7f0000000c80)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x10000, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x21, 0x2, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r6 = openat$cgroup_devices(r5, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r6, &(0x7f0000000280)={'c', ' *:* ', 'rwm\x00'}, 0xa) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="d80000001c0081044e81f782db44b904021d080201000000000018a118000c000600142603600e1208000f0100810401a8001600200001400300600803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c13223e3f52a98516277ce06bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg(r1, &(0x7f0000000b80)={&(0x7f0000000140)=@nl=@proc={0x10, 0x0, 0x25dfdbfc, 0x1}, 0x80, &(0x7f0000000880)=[{&(0x7f00000001c0)="059f67bcb9d7bf45e84ca7a9a70b1a3e0237b3c505e3a544cfe25fd30924c7e61106b8c37462162f583fb09ff82aad31d3242deabc82ead73c87374bde928c97254adb7dfe3971991aa4871b82b6e295fdc5e11016ac0164b1f95064cae8a359bcc917afdff5d7f3766b7ba8bc0a4648cf879574b0f5f76e1e920551638d6338c9fa2a9a00475d1165e4", 0x8a}, {&(0x7f0000000480)="5883b11d203727f58c59e8492098b8a52e41e58932acc133add59ec6ca315861aae71973989acc73126dabb09b4a2fb4d6a41891b1a74280808f811cce140bbea797d2bec3527fec2477d2faccbd3c36b1893ddcadabccf8a63ded4cb8a3c16f6fb26f1a4420bdc396347c3a772c420cb7c0c2da13a65f371c2e93307fe9be8e29", 0x81}, {&(0x7f0000000540)="05fc6e3a335ca701cb0c0d1f2e0bd2eebc50a0d8bd08d53a7b2d81b272f354abbd24c9b221a4e0d48843c13b4bfb8ea0e1cda601cf2dd93582fe77ed58a7f6ee4ae7c1a76e183068b1c5ee3d8c2fa5680b043f9fc6bedd736301fa567ab71332a83640fdb554bbd2a49b", 0x6a}, {&(0x7f0000000640)="314a0ccb8de5e0c58ffb2eb36aec1a3b52a197fa6afb3b4ecd73deb2287e2270214b1aacd28f2a14de41ae51acb6bace366227ba7331f5093d14411df861d571f38d66b0c10d6251435f2e879477f32231c964f9615598b98d4caf115d2c36861303db6aaca2a4a109a634d890b71b8ca040da71149ab21b7d5454c4a7685b9449f1b25e83ab2fbf23674777612784989e051042c5b88d3861a75bbb3354", 0x9e}, {&(0x7f0000000700)="0a6cf9c50d769566ee6096572851096988abfeae7b930272f5e282814e5b79ff18e3726ddd33d7494e9233a1815f294d123e50110621e6274d7dd8c8d88b0ae2ac965506a09866b4007c0f5a6cfa57cb32dc1bd10922440b8ec0d2370b1f1e60c919eb6caa", 0x65}, {&(0x7f0000000780)="adfa83439399f5cf046e3ab64a68cb9ccc8365fe487fa7d377ec73786935ace8e81765ceaa3504051f11fcbce93b2c788f3affb6779e5d27f32c3f695327ccfcb47fbcc5b46c1cb9c215fc25720359bf62f233d9f705575afac38f93619cf6cbf331efebde85ba3730241392a12efd8952c6cd9035e65d722a738732474787b9431f861d091342aebc8a4c2af6be9c6bd40291a716fd28b030b6b78445391dba7d7670c7f2fccf8d24cdbf78b231ee6761ba1dd28dd9da46463557caa621d1f0bfae8543f0be0de9195c03303073675383c5bf75ae3920ec2725e4b04822507957cc669656", 0xe5}], 0x6, &(0x7f0000000980)=[{0xe0, 0x109, 0x7, "891c7a9b052abaee2cbca9c62a1a4509ed54e97d13720c863eb41fcc47f4b9363d447fdf94836fe63be1b81a95a4d24f81ddeba1269ec1c2d3341fd74ddd5099dd530b3764a96d2b153b5caffa0aebf33bfa0cf15671599b638067097c87cf581b2b0d529d66c68ea2e205379355ee155c20f33257f8f2f52e8acfb06a6aa9a6596e0d4ea70551dcf6a2bdb50c3f38a473834b041cc099e4e6b82750859bfb6017e7f37a06d0146d4b5a8c4701fc995c96099b382ff11529170d1dffc769698fd39dfe780fd3698f7a611c"}, {0x90, 0x112, 0x8, "1b21b749f17cc29e25458456ee9f8507fe9b77e0af5ff097cf9afb27e6fa46d725fc69eb9c3e8184f7d51200bbcf1167c98c46779f3ad63ae36e4c23b16e83048ed6b89da84fac3920fcc78a3caf637d2b557ef31be7f6159686edd7bfa4a82ca6c1c0f741029e41e321aa175a68f584d33416c874cd868c4d5a"}, {0x70, 0x6, 0x81, "a1ba88cabe2a47192b521f8a45080d237bee2982529cafc50322a1d50144ed4ad1d45fd95414a5a09b05cfe4656d97bf7c9852810e7404a31154c6164e99dfdee92e9c79385aea22a92b0fedd94d39dff44d391bb826cc530f34c9e51192"}, {0x20, 0x114, 0x4, "f2932ab5a5bd79a914cabb9b597a"}], 0x200}, 0x4000) 24.570150095s ago: executing program 2 (id=6732): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x80000001, 0x7, 0x6, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) close(0xffffffffffffffff) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="110000000400000004000000"], 0x48) socket$kcm(0x2c, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b0000000500000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b708000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r6, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000008000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r7) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b11d25a806c8c6f94f90424fc601000407a0a000600053582c137153e37000c11802f2ff4072f00", 0x33fe0}], 0x1, 0x0, 0x0, 0x35}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0xfdef) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, &(0x7f00000001c0)=0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000240)={r4, &(0x7f0000000200)}, 0x20) close(r1) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1000000000000000, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x3}, 0x80000, 0xca, 0x9, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[], 0x17) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYRES8=r1], 0x9a) 24.433609229s ago: executing program 1 (id=6733): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='freezer.parent_freezing\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) unlink(0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$inet(r1, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000000000000240000000000000000000000070000009404000044108800600000000000000000000000000000001100000000000000000000c2"], 0x98}, 0x0) 24.210005146s ago: executing program 0 (id=6734): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='freezer.parent_freezing\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) sendmsg$inet(r1, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000064000000240000000000000000000000070000009404000044108800000000000000000000000000000000001100000000000000000000c2"], 0x98}, 0x0) 24.08349488s ago: executing program 3 (id=6735): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b7050000000000007910a800000000005d0a0000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79, 0x0, 0xffffffffffffffff, 0x51}, 0x2a) r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="140000002a000b6c8cff00f90429fc60010f5ddf", 0x14}], 0x1}, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="140000002a000b6c8cff00f90429fc60010f5ddf", 0x14}], 0x1}, 0x0) 23.881799467s ago: executing program 1 (id=6736): perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000007feffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed000072030000001200001d44410000000000db0a00fee10000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 23.880191787s ago: executing program 0 (id=6737): perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x5, 0x90, 0x7, 0x7f, 0x0, 0xfffffffffffffff6, 0x28010, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x8, 0x1, @perf_config_ext={0xff, 0x5}, 0x508, 0x6, 0x3d, 0x9, 0xffffffff, 0x1, 0x1, 0x0, 0x3d2af391, 0x0, 0xf}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x6e, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x8, 0xb}, 0x50) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x5, 0x4, 0x8, 0xb}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000800000085000000b000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@bloom_filter={0x1e, 0x1, 0x6, 0x2, 0x40000, r1, 0x5, '\x00', 0x0, r2, 0x3, 0x2, 0x0, 0xb}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r3, r0, 0x5}, 0x10) close(r0) (async) close(r0) socket$kcm(0x2, 0x2, 0x0) (async) socket$kcm(0x2, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x4, 0x0, 0x0, 0x7}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x29, 0x0, 0x1}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x4, 0x0, 0x0, 0x7}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x29, 0x0, 0x1}, 0x28) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{r3}, &(0x7f0000000480), &(0x7f00000004c0)=r0}, 0x20) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{r3}, &(0x7f0000000440), &(0x7f0000000540)='%ps \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{r3}, &(0x7f0000000440), &(0x7f0000000540)='%ps \x00'}, 0x20) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={0x1}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={0x1}, 0x4) close(r5) (async) close(r5) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r6, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b70500000800e00085000000a50000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x4, 0x1005, &(0x7f00000014c0)=""/4101, 0x0, 0xc}, 0x22) write$cgroup_devices(r4, &(0x7f0000000140)=ANY=[@ANYBLOB="1e032800008c71ef288563"], 0xffdd) 23.879588857s ago: executing program 2 (id=6738): socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x80100, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400000001ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$kcm(0x10, 0x400000002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b87, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0x5, 0x43a1bd76, 0x1, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, 0x0, 0x0) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/112, 0x70}, 0x42) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1f, 0x14, &(0x7f00000010c0)=ANY=[@ANYBLOB="180000000000000000000000fdffffff18010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000800000085000000b000000018114100", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000163b00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1fffff}, 0x94) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)=@o_path={0x0}, 0x18) r2 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x29, 0x30, 0x0, 0x0) 23.876888277s ago: executing program 1 (id=6739): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r3, &(0x7f00000010c0)={&(0x7f0000000140)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000480)='\\', 0x1}], 0x1}, 0x4000040) r4 = socket$kcm(0x2, 0x5, 0x84) sendmsg$kcm(r4, &(0x7f0000000600)={&(0x7f0000000100)=@in={0x2, 0x4e23, @remote}, 0x80, &(0x7f0000000000)=[{&(0x7f00000006c0)='@', 0x56}], 0x1, &(0x7f0000000040)=[{0x20, 0x84, 0x8, "eeb4fe8ba15e3999ef"}], 0x20}, 0x4045) sendmsg$inet(r3, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000180)="84", 0x1}], 0x1}, 0x8040) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) r6 = socket$kcm(0x1e, 0x1, 0x0) recvmsg$kcm(r6, &(0x7f00000002c0)={&(0x7f00000003c0)=@qipcrtr, 0xfffffd5e, &(0x7f0000000d00)=[{&(0x7f0000000440)=""/103, 0xffffffd5}, {&(0x7f0000000640)=""/207, 0xcf}, {&(0x7f0000001080)=""/247, 0xee}, {&(0x7f0000000740)=""/116, 0x74}, {&(0x7f0000001980)=""/4096, 0x1000}, {&(0x7f0000000c80)=""/116, 0x74}], 0x6, &(0x7f0000002980)=""/4096, 0x1000}, 0x100) ioctl$sock_kcm_SIOCKCMUNATTACH(r5, 0x89e1, &(0x7f00000000c0)={r6}) r7 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="1800000068007f089e", 0x9}, {&(0x7f0000000640)="68cabf2dfb58fc021d6b689866f05d", 0xf}], 0x2}, 0x0) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r8 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r8, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r9 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r9, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r9, &(0x7f0000000040)=ANY=[], 0xfdef) recvmsg(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)=[{0x0}], 0x1}, 0x101a0) close(r3) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@map, r0, 0xa, 0x2028}, 0x20) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x3}, 0x828, 0x0, 0x0, 0x7, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 23.876585827s ago: executing program 3 (id=6740): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f7e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c662003"], &(0x7f0000000100)='GPL\x00'}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000080), &(0x7f0000000200)=r2}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)={@ifindex, r0, 0x9, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000030000000200000002"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x7, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$kcm(0x2, 0x1, 0x84) r6 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x20000, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r7) r8 = socket$kcm(0x2, 0x922000000001, 0x106) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x5452, &(0x7f0000000280)='\x02;\xe5\b\x00\x14\x96)]\xa3\xcdB!\xf7\xe5\fc\xe9\x00\x9c\x00\x00\x00\x00\x00\x00') sendmsg$inet(r8, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x24000800) setsockopt$sock_attach_bpf(r5, 0x1, 0x3c, &(0x7f0000000000), 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000002d40)={0x0, 0x0, 0x0}, 0x0) r10 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0, 0xc00e}, 0x40800) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703340000001f00000000000000040014000d000a00140000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 23.579272216s ago: executing program 2 (id=6741): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x40, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80102, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={0x0, 0x2}, 0x8000, 0x0, 0x465e, 0x4, 0x3fe, 0x80000000, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000004100000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x86dd, 0x12, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 23.522011088s ago: executing program 1 (id=6742): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x110028, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x4, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="19000000040000000800000001"], 0x50) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0x1, 0x58}, 0x10) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x2a040, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x2a040, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x4, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000005c0), 0x12) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$kcm(0xa, 0x2, 0x88) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={r0, 0x58, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$inet(r3, &(0x7f0000000000)={&(0x7f0000001340)={0x2, 0x2, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @dev={0xac, 0x14, 0x14, 0x16}, @multicast1}}}], 0x20}, 0x800) sendmsg$inet(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000040)}, 0x88c0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000002c0)={0x0, 0x6000, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000010008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000100020400bf050005001201", 0x67}], 0x1}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000006c0)="2e00000010008188e6b62aa73f72cc9f0ba1f848140000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 20.25655856s ago: executing program 2 (id=6743): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000940)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x1640, 0x2, 0x0, 0x3, 0x0, 0x4, 0x20, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) openat$cgroup_devices(r0, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001040)={0x1b, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x4}, 0x50) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpu.stat\x00', 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x69, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000e40)=[{0x0}, {0x0}, {&(0x7f0000000b00)=""/222, 0xde}, {0x0}, {&(0x7f00000009c0)=""/217, 0xd9}], 0x5}, 0x40012100) recvmsg$kcm(r1, 0x0, 0x21) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r6 = syz_clone(0x200, &(0x7f0000000580)="70f74bb727ecd4340b76fcf2778aac3abbad1b656424822eee406734bcb9873e0f3ad64f1baa47aaf0ac262c1b0e454d48529f447d4b988de7c803b4a8125dac1b16e1ab737ce2ff4c8dded3c57c91877a4d8e3865029f91285e833a44ed9e5a3f1b827f7b70b523225fdab058547f6e6e30fb77ab87a0e2ddeccb82d2cbd913a83a57c8856a3cd4dfeb7c8aa08345108c4800606c4798527e21c035bc47c3c8c0d6cb302218791e7144f5be9c4faa9c3e17455c7a726ed745de3fbce916c1f62a9aa9e8780b7c0a49", 0xc9, &(0x7f0000000680), &(0x7f00000006c0), &(0x7f0000000700)="5f40de60178df0d27bbeb5b866b92f2e1c37010a3ad0ed8f6001240d2894a6eb9d105643ada4dd6ec3e879943634d662b969b4c4494e8b00adfb653d4304b4e3478830f91394447880400c645ecbd8a0a58fe33c0aa888b87360334751") r7 = socket$kcm(0x1e, 0x1, 0x0) sendmsg$kcm(r7, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@id, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000300)="d5", 0x1}], 0x1}, 0x0) recvmsg(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000007c0)=""/239, 0xef}], 0x1, &(0x7f0000000640)=""/8, 0x8}, 0x61) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38dd, 0x2, @perf_config_ext={0x76, 0x1ef7}, 0x10ff2, 0x5, 0x98, 0x6, 0x2, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$unix(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000140)="e2745d7813390d281dd8aa88bedaecda5cefac7b950ad0d08a297f66bfbf5ed333fe25bd2ef15e21e4fa5968a9d383575cf8105840394ffb1196904d754b347ba83844278afe", 0x46}, {&(0x7f00000002c0)="b7478eba61cbcde7b44f774493d39ad41e347ab09f5756c76e4b234efba24bd2e95b48ccb7afe99da7973480922ca3f92dfe666f23c72dc7c618ce74d21816ef3591", 0x42}, {&(0x7f0000000340)="5e29c9c1c795d373582680f73eaa62121987594f610bb016eced4c07f3139df9dca3489a28e8c58bc946e781dcae2eb99bbc05391898ad23d200a6c72c29300f8048a9258f4f629371b3f920af1f8550a1d33262a986312b19e5301d1fbac38f0bda6af1048f45b06fb6a8493055db0a6cd7a5090340c05f286e5b5541d6a39f52c377f60396", 0x86}], 0x3, &(0x7f0000000440)=[@cred={{0x1c, 0x1, 0x2, {r6, 0xee00, 0xffffffffffffffff}}}, @rights={{0x18, 0x1, 0x1, [r2, r7]}}, @cred={{0x1c, 0x1, 0x2, {r8, 0x0, 0xffffffffffffffff}}}], 0x58, 0x4000040}, 0x41841) ioctl$SIOCSIFHWADDR(r5, 0x8b26, &(0x7f0000001200)={'wlan1\x00', @random="f7280200e700"}) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xb5, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x1, @perf_config_ext={0xfffffffffffffff7, 0x4}, 0x3442, 0x0, 0x0, 0xd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(0xffffffffffffffff, 0x0, 0x8000) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6tnl0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) 18.590814251s ago: executing program 0 (id=6744): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffff0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x3}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{0x1, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x2, 0x9, 0x6, 0x4, 0x41304, 0xffffffffffffffff, 0x480, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x3}, 0x50) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r3, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0x1}, 0x4) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0x0, 0x6, 0x10}, 0xc) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000740)=@bpf_tracing={0x1a, 0x16, &(0x7f0000000880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @map_fd={0x18, 0x2, 0x1, 0x0, r2}, @call={0x85, 0x0, 0x0, 0x8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000005c0)='GPL\x00', 0x20, 0x0, 0x0, 0x41000, 0x14, '\x00', r4, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x3, 0x2}, 0x8, 0x10, &(0x7f0000000640)={0x1, 0xe, 0x9, 0x100}, 0x10, 0x2d03f, 0xffffffffffffffff, 0x0, &(0x7f0000000700), 0x0, 0x10, 0xfffffffa}, 0x94) r6 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r5}, 0x8) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f0000000440)="2e00000024008f866b29924a6f130000005e14060800000000000000f1ffffff000280a71802dd0000", 0x29}, {&(0x7f00000010c0)="018d4561b6", 0x5}], 0x2}, 0x0) r8 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r8, &(0x7f0000000840)={&(0x7f0000000000)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000040)}, 0x0) close(r6) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r5, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x280, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd98, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000940)={r11, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r9, 0x401054d5, &(0x7f0000000040)={0x6, &(0x7f0000000180)=[{0xff, 0x0, 0x2, 0x60f27e95}, {0x2ccd, 0x0, 0x6, 0x8001}, {0x5, 0x3, 0x2, 0x7}, {0x59f3, 0x9, 0xc, 0x80000001}, {0x6, 0xe, 0x5, 0x1}, {0xb514, 0x9, 0x5, 0x10}]}) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r3) r12 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r12) 18.590209121s ago: executing program 3 (id=6745): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='freezer.parent_freezing\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) unlink(0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$inet(r1, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000000000000240000000000000000000000070000009404000044108800970000000000000000000000000000001100000000000000000000c2"], 0x98}, 0x0) 18.581452062s ago: executing program 1 (id=6746): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x4, 0x520, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0xa99, 0x3}, 0x8500, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x2000000020000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$kcm(0xa, 0x2, 0x73) socket$kcm(0x2a, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4004, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0x8}, 0x1000d7, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x10, 0xd8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="1804000000000000000000000001000018010000202070250000000000202020db1af8ffa0000000bda100000000000007010000f8ffffffb702000008000000b70300000000000085000000a00000009500"], &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="2700002cf847721d26709ebb", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) socketpair$unix(0x1, 0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3) r5 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r5, &(0x7f00000000c0)={0x0, 0xfe, &(0x7f0000000000)=[{&(0x7f0000000040)="0207000902000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) sendmsg$inet(r3, &(0x7f0000001180)={&(0x7f0000001300)={0xa, 0x0, @empty=0x48000000}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)}, {&(0x7f0000001040)}], 0x2, &(0x7f00000010c0)=[@ip_tos_u8={{0x11, 0x29, 0x3}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @rand_addr=0x64010102, @empty}}}], 0x38}, 0x40) socketpair$unix(0x1, 0x5, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x8020) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x3f, 0x0, 0x9, 0x20010, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x0, 0xc222}, 0x8000, 0x5, 0x43a1bd73, 0x7, 0x9, 0x6, 0xffff, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x8a72, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) perf_event_open(0x0, 0xffffffffffffffff, 0x6, r1, 0x4) perf_event_open(0x0, 0x0, 0x2, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r6, 0x1, 0x28, &(0x7f0000000040), 0x4) socket$kcm(0x11, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 18.345442769s ago: executing program 3 (id=6747): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x80000001, 0x7, 0x6, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) close(0xffffffffffffffff) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="110000000400000004000000"], 0x48) socket$kcm(0x2c, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b0000000500000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b708000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r6, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000008000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r7) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b11d25a806c8c6f94f90424fc601000407a0a000600053582c137153e37000c11802f2ff4072f00", 0x33fe0}], 0x1, 0x0, 0x0, 0x35}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0xfdef) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, &(0x7f00000001c0)=0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000240)={r4, &(0x7f0000000200)}, 0x20) close(r1) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1000000000000000, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x3}, 0x80000, 0xca, 0x9, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[], 0x17) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYRES8=r1], 0x9a) 18.344155499s ago: executing program 2 (id=6755): socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x80100, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) socket$kcm(0x10, 0x400000002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400000001ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$kcm(0x10, 0x400000002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b87, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0x5, 0x43a1bd76, 0x1, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000000000000240000000000006400000000070000009404000044108800000000000000000000000000000000001100000000000000000000c2"], 0x98}, 0x0) 3.478941532s ago: executing program 32 (id=6744): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffff0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x3}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{0x1, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x2, 0x9, 0x6, 0x4, 0x41304, 0xffffffffffffffff, 0x480, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x3}, 0x50) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r3, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0x1}, 0x4) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0x0, 0x6, 0x10}, 0xc) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000740)=@bpf_tracing={0x1a, 0x16, &(0x7f0000000880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @map_fd={0x18, 0x2, 0x1, 0x0, r2}, @call={0x85, 0x0, 0x0, 0x8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000005c0)='GPL\x00', 0x20, 0x0, 0x0, 0x41000, 0x14, '\x00', r4, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x3, 0x2}, 0x8, 0x10, &(0x7f0000000640)={0x1, 0xe, 0x9, 0x100}, 0x10, 0x2d03f, 0xffffffffffffffff, 0x0, &(0x7f0000000700), 0x0, 0x10, 0xfffffffa}, 0x94) r6 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r5}, 0x8) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f0000000440)="2e00000024008f866b29924a6f130000005e14060800000000000000f1ffffff000280a71802dd0000", 0x29}, {&(0x7f00000010c0)="018d4561b6", 0x5}], 0x2}, 0x0) r8 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r8, &(0x7f0000000840)={&(0x7f0000000000)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000040)}, 0x0) close(r6) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r5, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x280, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd98, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000940)={r11, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r9, 0x401054d5, &(0x7f0000000040)={0x6, &(0x7f0000000180)=[{0xff, 0x0, 0x2, 0x60f27e95}, {0x2ccd, 0x0, 0x6, 0x8001}, {0x5, 0x3, 0x2, 0x7}, {0x59f3, 0x9, 0xc, 0x80000001}, {0x6, 0xe, 0x5, 0x1}, {0xb514, 0x9, 0x5, 0x10}]}) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r3) r12 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r12) 3.260802958s ago: executing program 33 (id=6746): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, &(0x7f0000001700)=""/53}, 0x20) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0xc045d6e08e8aad4e, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x4, 0x520, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0xa99, 0x3}, 0x8500, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x2000000020000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$kcm(0xa, 0x2, 0x73) socket$kcm(0x2a, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4004, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0x8}, 0x1000d7, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x10, 0xd8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="1804000000000000000000000001000018010000202070250000000000202020db1af8ffa0000000bda100000000000007010000f8ffffffb702000008000000b70300000000000085000000a00000009500"], &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="2700002cf847721d26709ebb", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) socketpair$unix(0x1, 0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3) r5 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r5, &(0x7f00000000c0)={0x0, 0xfe, &(0x7f0000000000)=[{&(0x7f0000000040)="0207000902000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) sendmsg$inet(r3, &(0x7f0000001180)={&(0x7f0000001300)={0xa, 0x0, @empty=0x48000000}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)}, {&(0x7f0000001040)}], 0x2, &(0x7f00000010c0)=[@ip_tos_u8={{0x11, 0x29, 0x3}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @rand_addr=0x64010102, @empty}}}], 0x38}, 0x40) socketpair$unix(0x1, 0x5, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x8020) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x3f, 0x0, 0x9, 0x20010, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x0, 0xc222}, 0x8000, 0x5, 0x43a1bd73, 0x7, 0x9, 0x6, 0xffff, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x8a72, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) perf_event_open(0x0, 0xffffffffffffffff, 0x6, r1, 0x4) perf_event_open(0x0, 0x0, 0x2, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r6, 0x1, 0x28, &(0x7f0000000040), 0x4) socket$kcm(0x11, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 0s ago: executing program 34 (id=6755): socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x80100, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) socket$kcm(0x10, 0x400000002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400000001ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$kcm(0x10, 0x400000002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b87, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0x5, 0x43a1bd76, 0x1, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000000000000240000000000006400000000070000009404000044108800000000000000000000000000000000001100000000000000000000c2"], 0x98}, 0x0) kernel console output (not intermixed with test programs): ring): (slave bond_slave_1): Releasing backup interface [ 626.075955][T16500] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 626.104073][T16500] bond0 (unregistering): (slave veth1_to_bridge): Releasing backup interface [ 626.325439][T16500] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 626.379847][T16500] bond0 (unregistering): Released all slaves [ 626.567251][T17567] 8021q: adding VLAN 0 to HW filter on device bond0 [ 626.777729][T17567] 8021q: adding VLAN 0 to HW filter on device team0 [ 626.803025][ T962] bridge0: port 1(bridge_slave_0) entered blocking state [ 626.810184][ T962] bridge0: port 1(bridge_slave_0) entered forwarding state [ 626.832972][ T962] bridge0: port 2(bridge_slave_1) entered blocking state [ 626.840172][ T962] bridge0: port 2(bridge_slave_1) entered forwarding state [ 626.974834][T17746] netlink: 'syz.0.4474': attribute type 1 has an invalid length. [ 627.009642][T17746] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.4474'. [ 627.030584][T14820] Bluetooth: hci3: command tx timeout [ 627.400277][T17567] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 627.554404][T17567] veth0_vlan: entered promiscuous mode [ 627.572917][T17567] veth1_vlan: entered promiscuous mode [ 627.657102][T17567] veth0_macvtap: entered promiscuous mode [ 627.682175][T17567] veth1_macvtap: entered promiscuous mode [ 627.706029][T17567] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 627.723012][T17567] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 627.754698][T17567] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 627.777627][T17567] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 627.806318][T17567] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 627.828611][T17776] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4484'. [ 627.854228][T17567] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 627.880423][T17567] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 627.905394][T17567] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 627.918699][T17567] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 627.929565][T17567] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 627.940576][T17567] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 627.958776][T17567] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 627.973141][T17567] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.986832][T17567] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.996660][T17567] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 628.011120][T17567] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 628.157977][T17779] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4485'. [ 628.303094][T16485] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 628.324295][T16485] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 628.428436][T16485] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 628.437953][T16485] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 628.635838][T17805] netlink: 'syz.0.4493': attribute type 10 has an invalid length. [ 628.718663][T17805] team0: Port device geneve1 added [ 628.826460][T17811] macsec0: entered promiscuous mode [ 628.833652][T17811] macsec0: entered allmulticast mode [ 628.839164][T17811] veth1_macvtap: entered allmulticast mode [ 629.006955][T17815] netlink: 'syz.1.4498': attribute type 39 has an invalid length. [ 629.032335][T17815] veth0_macvtap: left promiscuous mode [ 630.373301][T17854] netlink: 'syz.2.4515': attribute type 10 has an invalid length. [ 630.395218][T17854] netlink: 168 bytes leftover after parsing attributes in process `syz.2.4515'. [ 630.497873][T17862] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4518'. [ 630.845795][T17876] netlink: 'syz.2.4523': attribute type 2 has an invalid length. [ 630.874939][T17876] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.4523'. [ 630.920994][T17881] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4523'. [ 630.947928][T17881] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4523'. [ 631.714631][T17908] netlink: 'syz.0.4537': attribute type 2 has an invalid length. [ 631.730590][T17908] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.4537'. [ 631.788430][T17911] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4537'. [ 631.802882][T17911] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4537'. [ 632.655605][T17929] netlink: 'syz.0.4546': attribute type 21 has an invalid length. [ 632.773172][T17933] netlink: 'syz.0.4546': attribute type 5 has an invalid length. [ 632.975994][T17937] netlink: 'syz.3.4549': attribute type 2 has an invalid length. [ 632.985922][T17937] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.4549'. [ 633.053075][T17935] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4549'. [ 633.401801][T17956] netlink: 'syz.1.4562': attribute type 2 has an invalid length. [ 637.108892][T18017] __nla_validate_parse: 6 callbacks suppressed [ 637.108914][T18017] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.4578'. [ 638.919339][T18060] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.4592'. [ 641.771088][T18102] netlink: 'syz.1.4608': attribute type 10 has an invalid length. [ 641.809993][T18102] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4608'. [ 641.861751][T18102] batman_adv: batadv0: Adding interface: virt_wifi0 [ 641.878707][T18102] batman_adv: batadv0: Interface activated: virt_wifi0 [ 642.124655][T18095] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.4606'. [ 642.134895][T18110] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4610'. [ 643.620195][T18152] netlink: 'syz.1.4628': attribute type 3 has an invalid length. [ 643.638261][T18152] netlink: 'syz.1.4628': attribute type 6 has an invalid length. [ 643.659612][T18152] netlink: 144448 bytes leftover after parsing attributes in process `syz.1.4628'. [ 644.642962][T18174] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.4636'. [ 645.794690][T18201] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4647'. [ 649.808664][T18236] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4660'. [ 649.834930][T18237] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.4658'. [ 650.207692][T18243] skbuff: bad partial csum: csum=65535/127 headroom=178 headlen=65664 [ 650.238993][T18243] netlink: 763 bytes leftover after parsing attributes in process `syz.0.4663'. [ 652.934235][T18299] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4683'. [ 652.957901][T18301] netlink: 202920 bytes leftover after parsing attributes in process `syz.0.4684'. [ 653.012498][T18301] netlink: 14568 bytes leftover after parsing attributes in process `syz.0.4684'. [ 653.312799][T18313] netlink: 'syz.2.4690': attribute type 33 has an invalid length. [ 653.328558][T18313] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.4690'. [ 653.404976][T18321] netlink: 'syz.3.4692': attribute type 8 has an invalid length. [ 653.420529][T18321] netlink: 161700 bytes leftover after parsing attributes in process `syz.3.4692'. [ 655.058800][T18360] netlink: 'syz.0.4708': attribute type 2 has an invalid length. [ 655.088537][T18360] netlink: 'syz.0.4708': attribute type 1 has an invalid length. [ 655.117043][T18360] netlink: 198036 bytes leftover after parsing attributes in process `syz.0.4708'. [ 656.868190][T18393] netlink: 'syz.2.4723': attribute type 3 has an invalid length. [ 656.876562][T18393] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4723'. [ 657.296285][T14820] Bluetooth: hci0: unexpected subevent 0x0a length: 150 > 30 [ 658.358103][T18416] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4740'. [ 658.401144][T18416] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 658.442162][T18416] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 658.920142][T18424] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4735'. [ 659.167524][T18432] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4738'. [ 659.186139][T18435] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4742'. [ 659.749832][T18442] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4745'. [ 659.763438][T18442] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 659.780987][T18442] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 660.814540][T18462] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4752'. [ 663.059410][T18508] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.4771'. [ 664.299145][T18528] netlink: 'syz.0.4778': attribute type 4 has an invalid length. [ 664.307043][T18528] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4778'. [ 666.297970][T18553] netlink: 199824 bytes leftover after parsing attributes in process `syz.1.4788'. [ 666.818788][T18574] netlink: 14560 bytes leftover after parsing attributes in process `syz.0.4793'. [ 667.106161][T18578] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4794'. [ 668.699120][T14820] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 668.710182][T14820] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 668.720266][T14820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 668.738880][T14820] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 668.747048][T14820] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 668.756762][T14820] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 669.616435][T16505] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.752293][T16505] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.894947][T16505] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.917905][T18618] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4807'. [ 669.935674][T18598] chnl_net:caif_netlink_parms(): no params data found [ 669.984477][T16505] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.014843][T18622] can: request_module (can-proto-0) failed. [ 670.055216][T18625] can: request_module (can-proto-0) failed. [ 670.243007][T18598] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.250186][T18598] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.278275][T18598] bridge_slave_0: entered allmulticast mode [ 670.292235][T18598] bridge_slave_0: entered promiscuous mode [ 670.338373][T18598] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.345834][T18598] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.360892][T18598] bridge_slave_1: entered allmulticast mode [ 670.367923][T18643] FAULT_INJECTION: forcing a failure. [ 670.367923][T18643] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 670.371884][T18598] bridge_slave_1: entered promiscuous mode [ 670.425406][T18643] CPU: 1 PID: 18643 Comm: syz.0.4812 Not tainted syzkaller #0 [ 670.432930][T18643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 670.443009][T18643] Call Trace: [ 670.446308][T18643] [ 670.449268][T18643] dump_stack_lvl+0x18c/0x250 [ 670.453976][T18643] ? lock_chain_count+0x20/0x20 [ 670.458859][T18643] ? show_regs_print_info+0x20/0x20 [ 670.464085][T18643] ? load_image+0x420/0x420 [ 670.468622][T18643] ? lockdep_hardirqs_on+0x98/0x150 [ 670.473865][T18643] should_fail_ex+0x394/0x4c0 [ 670.478536][T18598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 670.487594][T18643] _copy_from_iter+0x1cd/0x1290 [ 670.492488][T18643] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 670.498682][T18643] ? copyout_mc+0x70/0x70 [ 670.503055][T18643] ? __check_object_size+0x4fc/0xa40 [ 670.508379][T18643] kernfs_fop_write_iter+0x19e/0x520 [ 670.513684][T18643] vfs_write+0x474/0x9a0 [ 670.517932][T18643] ? file_end_write+0x250/0x250 [ 670.522789][T18643] ? __fget_files+0x3fc/0x460 [ 670.527468][T18643] ? __fdget_pos+0x2a3/0x330 [ 670.532061][T18643] ? ksys_write+0x74/0x260 [ 670.536482][T18643] ksys_write+0x151/0x260 [ 670.540813][T18643] ? __ia32_sys_read+0x90/0x90 [ 670.545582][T18643] ? syscall_enter_from_user_mode+0x2e/0x80 [ 670.551480][T18643] do_syscall_64+0x55/0xb0 [ 670.555895][T18643] ? clear_bhb_loop+0x40/0x90 [ 670.560567][T18643] ? clear_bhb_loop+0x40/0x90 [ 670.565241][T18643] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 670.571147][T18643] RIP: 0033:0x7f15ca19ce59 [ 670.575563][T18643] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 670.595177][T18643] RSP: 002b:00007f15cb007028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 670.603593][T18643] RAX: ffffffffffffffda RBX: 00007f15ca415fa0 RCX: 00007f15ca19ce59 [ 670.611563][T18643] RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000009 [ 670.619529][T18643] RBP: 00007f15cb007090 R08: 0000000000000000 R09: 0000000000000000 [ 670.627496][T18643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 670.635479][T18643] R13: 00007f15ca416038 R14: 00007f15ca415fa0 R15: 00007fff6e0ee8e8 [ 670.643475][T18643] [ 670.682633][T18598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 670.789752][T18598] team0: Port device team_slave_0 added [ 670.795828][ T5778] Bluetooth: hci2: command tx timeout [ 670.820079][T18598] team0: Port device team_slave_1 added [ 671.102498][T18598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 671.122763][T18598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 671.158866][T18598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 671.235881][T18598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 671.270503][T18598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 671.340996][T18598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 671.912292][T18598] hsr_slave_0: entered promiscuous mode [ 671.933015][T18598] hsr_slave_1: entered promiscuous mode [ 672.031721][T18689] netlink: 'syz.3.4824': attribute type 29 has an invalid length. [ 672.067064][T18687] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4822'. [ 672.077734][T18689] netlink: 'syz.3.4824': attribute type 29 has an invalid length. [ 672.192522][T18689] netlink: 209588 bytes leftover after parsing attributes in process `syz.3.4824'. [ 672.866770][T18706] netlink: 'syz.1.4829': attribute type 21 has an invalid length. [ 672.880896][T18706] netlink: 'syz.1.4829': attribute type 1 has an invalid length. [ 672.888793][ T5778] Bluetooth: hci2: command tx timeout [ 672.931712][T18706] netlink: 15998 bytes leftover after parsing attributes in process `syz.1.4829'. [ 673.421666][T18720] FAULT_INJECTION: forcing a failure. [ 673.421666][T18720] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 673.470260][T18720] CPU: 1 PID: 18720 Comm: syz.0.4832 Not tainted syzkaller #0 [ 673.477779][T18720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 673.487827][T18720] Call Trace: [ 673.491100][T18720] [ 673.494024][T18720] dump_stack_lvl+0x18c/0x250 [ 673.498694][T18720] ? show_regs_print_info+0x20/0x20 [ 673.503886][T18720] ? load_image+0x420/0x420 [ 673.508375][T18720] ? __lock_acquire+0x7d80/0x7d80 [ 673.513386][T18720] ? snprintf+0xe9/0x140 [ 673.517640][T18720] should_fail_ex+0x394/0x4c0 [ 673.522332][T18720] _copy_to_user+0x2f/0xa0 [ 673.526762][T18720] simple_read_from_buffer+0xe7/0x150 [ 673.532132][T18720] proc_fail_nth_read+0x1e8/0x260 [ 673.537151][T18720] ? proc_fault_inject_write+0x360/0x360 [ 673.542782][T18720] ? fsnotify_perm+0x271/0x5e0 [ 673.547561][T18720] ? proc_fault_inject_write+0x360/0x360 [ 673.553186][T18720] vfs_read+0x298/0x990 [ 673.557334][T18720] ? kernel_read+0x1e0/0x1e0 [ 673.561911][T18720] ? __fget_files+0x28/0x460 [ 673.566489][T18720] ? __fget_files+0x3fc/0x460 [ 673.571189][T18720] ? __fdget_pos+0x2a3/0x330 [ 673.575801][T18720] ? ksys_read+0x74/0x260 [ 673.580162][T18720] ksys_read+0x151/0x260 [ 673.584438][T18720] ? vfs_write+0x9a0/0x9a0 [ 673.588885][T18720] ? lockdep_hardirqs_on+0x98/0x150 [ 673.594118][T18720] do_syscall_64+0x55/0xb0 [ 673.598561][T18720] ? clear_bhb_loop+0x40/0x90 [ 673.603251][T18720] ? clear_bhb_loop+0x40/0x90 [ 673.607918][T18720] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 673.613802][T18720] RIP: 0033:0x7f15ca15d68e [ 673.618204][T18720] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 673.637802][T18720] RSP: 002b:00007f15cafe5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 673.646204][T18720] RAX: ffffffffffffffda RBX: 00007f15cafe66c0 RCX: 00007f15ca15d68e [ 673.654167][T18720] RDX: 000000000000000f RSI: 00007f15cafe60a0 RDI: 0000000000000009 [ 673.662147][T18720] RBP: 00007f15cafe6090 R08: 0000000000000000 R09: 0000000000000000 [ 673.670127][T18720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 673.678102][T18720] R13: 00007f15ca416128 R14: 00007f15ca416090 R15: 00007fff6e0ee8e8 [ 673.686116][T18720] [ 674.313863][T16505] veth0_to_bridge: left allmulticast mode [ 674.330848][T16505] veth0_to_bridge: left promiscuous mode [ 674.346391][T16505] Ÿë: port 1(veth0_to_bridge) entered disabled state [ 674.406642][T16505] hsr_slave_0: left promiscuous mode [ 674.430607][T16505] hsr_slave_1: left promiscuous mode [ 674.447725][T16505] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 674.468823][T16505] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 674.498407][T16505] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 674.508453][T16505] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 674.587959][T16505] veth1_macvtap: left allmulticast mode [ 674.599435][T16505] veth1_macvtap: left promiscuous mode [ 674.611608][T16505] veth0_macvtap: left promiscuous mode [ 674.626545][T16505] veth1_vlan: left promiscuous mode [ 674.950543][ T5778] Bluetooth: hci2: command tx timeout [ 676.503116][T18758] netlink: 212912 bytes leftover after parsing attributes in process `syz.3.4844'. [ 676.513388][T18758] openvswitch: netlink: IP tunnel dst address not specified [ 676.658138][T16505] team0 (unregistering): Port device team_slave_1 removed [ 676.733524][T16505] team0 (unregistering): Port device team_slave_0 removed [ 676.798590][T16505] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 677.008951][T16505] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 677.041916][ T5778] Bluetooth: hci2: command tx timeout [ 677.070575][T16505] .` (unregistering): (slave bridge_slave_1): Releasing backup interface [ 677.374445][T16505] .` (unregistering): Released all slaves [ 677.581217][T18598] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 677.621137][T18598] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 677.660043][T18598] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 677.717585][T18598] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 677.890289][T18783] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4853'. [ 678.055878][T18598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 678.100193][T18598] 8021q: adding VLAN 0 to HW filter on device team0 [ 678.145342][T16497] bridge0: port 1(bridge_slave_0) entered blocking state [ 678.152782][T16497] bridge0: port 1(bridge_slave_0) entered forwarding state [ 678.206285][T16497] bridge0: port 2(bridge_slave_1) entered blocking state [ 678.213509][T16497] bridge0: port 2(bridge_slave_1) entered forwarding state [ 678.749590][T18598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 678.916816][T18598] veth0_vlan: entered promiscuous mode [ 678.966900][T18598] veth1_vlan: entered promiscuous mode [ 679.052150][T18598] veth0_macvtap: entered promiscuous mode [ 679.108329][T18598] veth1_macvtap: entered promiscuous mode [ 679.149620][T18598] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.184937][T18598] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.212764][T18598] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.237460][T18598] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.255515][T18598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 679.289088][T18598] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.309882][T18598] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.330854][T18598] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.359701][T18598] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.422114][T18598] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.450763][T18598] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.484416][T18598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 679.552400][T18598] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.571784][T18598] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.600630][T18598] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.609407][T18598] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.881347][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.882556][T18838] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.4863'. [ 679.889239][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.988144][T18838] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.4863'. [ 680.033416][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 680.055253][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 680.584555][T18864] netlink: 'syz.0.4866': attribute type 2 has an invalid length. [ 680.605226][T18864] netlink: 'syz.0.4866': attribute type 1 has an invalid length. [ 680.631873][T18864] netlink: 198036 bytes leftover after parsing attributes in process `syz.0.4866'. [ 680.767918][T18871] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4869'. [ 680.888368][T18876] netlink: 'syz.3.4870': attribute type 3 has an invalid length. [ 680.930931][T18876] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.4870'. [ 681.593792][T14820] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 681.609953][T14820] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 681.618672][T14820] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 681.639227][T14820] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 681.651685][T14820] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 681.661295][T14820] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 682.022283][T16486] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.195897][T16486] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.573278][T16486] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.762810][T16486] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.120871][T18894] chnl_net:caif_netlink_parms(): no params data found [ 683.519642][T18947] netlink: 'syz.3.4886': attribute type 6 has an invalid length. [ 683.539312][T18947] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.4886'. [ 683.763459][T14820] Bluetooth: hci0: command tx timeout [ 685.830596][T14820] Bluetooth: hci0: command tx timeout [ 686.082438][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.090670][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.330572][T18946] netlink: 'syz.3.4886': attribute type 2 has an invalid length. [ 686.338626][T18946] netlink: 51 bytes leftover after parsing attributes in process `syz.3.4886'. [ 686.463687][T18894] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.505973][T18894] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.514195][T18894] bridge_slave_0: entered allmulticast mode [ 686.536168][T18894] bridge_slave_0: entered promiscuous mode [ 686.569728][T18894] bridge0: port 2(bridge_slave_1) entered blocking state [ 686.587344][T18894] bridge0: port 2(bridge_slave_1) entered disabled state [ 686.604961][T18894] bridge_slave_1: entered allmulticast mode [ 686.625208][T18894] bridge_slave_1: entered promiscuous mode [ 686.858202][T18894] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 686.886330][T18984] netlink: 'syz.3.4895': attribute type 14 has an invalid length. [ 686.894796][T18984] netlink: 56815 bytes leftover after parsing attributes in process `syz.3.4895'. [ 686.936295][T18894] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 687.082924][T18995] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4896'. [ 687.186125][T18894] team0: Port device team_slave_0 added [ 687.198213][T18894] team0: Port device team_slave_1 added [ 687.298588][T18894] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 687.336130][T18894] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 687.395907][T18894] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 687.447274][T18894] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 687.470580][T18894] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 687.512951][T18894] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 687.910767][T14820] Bluetooth: hci0: command tx timeout [ 688.090550][T18999] sit0: entered promiscuous mode [ 688.098179][T18999] sit0: entered allmulticast mode [ 688.311126][T18894] hsr_slave_0: entered promiscuous mode [ 688.321788][T18894] hsr_slave_1: entered promiscuous mode [ 688.334830][T18894] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 688.345315][T18894] Cannot create hsr debugfs directory [ 688.609926][T19031] can: request_module (can-proto-3) failed. [ 688.631732][T19027] can: request_module (can-proto-3) failed. [ 689.220189][T16486] hsr_slave_0: left promiscuous mode [ 689.236109][T16486] hsr_slave_1: left promiscuous mode [ 689.262868][T16486] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 689.280003][T16486] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 689.327010][T16486] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 689.343942][T16486] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 689.360133][T16486] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 689.376928][T16486] batman_adv: batadv0: Removing interface: virt_wifi0 [ 689.406599][T16486] veth1_macvtap: left allmulticast mode [ 689.413010][T16486] veth1_macvtap: left promiscuous mode [ 689.990806][T14820] Bluetooth: hci0: command tx timeout [ 690.677501][T16486] team0 (unregistering): Port device team_slave_1 removed [ 690.727003][T16486] team0 (unregistering): Port device team_slave_0 removed [ 690.773762][T16486] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 690.819078][T16486] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 690.885236][T16486] bond0 (unregistering): (slave veth1_to_bridge): Releasing backup interface [ 691.071953][T16486] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 691.148051][T16486] bond0 (unregistering): (slave team0): Releasing backup interface [ 691.181761][T16486] bond0 (unregistering): Released all slaves [ 691.577904][T19079] netlink: 'syz.2.4910': attribute type 3 has an invalid length. [ 691.593596][T19079] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.4910'. [ 692.437446][T18894] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 692.495391][T18894] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 692.524562][T18894] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 692.697143][T18894] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 692.929302][T18894] 8021q: adding VLAN 0 to HW filter on device bond0 [ 692.931390][T19116] netlink: 'syz.2.4921': attribute type 3 has an invalid length. [ 692.965501][T19116] netlink: 'syz.2.4921': attribute type 1 has an invalid length. [ 692.971991][T18894] 8021q: adding VLAN 0 to HW filter on device team0 [ 692.991473][T19116] netlink: 60387 bytes leftover after parsing attributes in process `syz.2.4921'. [ 692.995623][T16497] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.007956][T16497] bridge0: port 1(bridge_slave_0) entered forwarding state [ 693.079862][T16497] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.087121][T16497] bridge0: port 2(bridge_slave_1) entered forwarding state [ 693.602854][T18894] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 693.803237][T18894] veth0_vlan: entered promiscuous mode [ 693.836841][T18894] veth1_vlan: entered promiscuous mode [ 693.965607][T18894] veth0_macvtap: entered promiscuous mode [ 693.989091][T18894] veth1_macvtap: entered promiscuous mode [ 694.006171][T19160] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:0603:0000:0023 with DS=0x3f [ 694.036492][T18894] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 694.060206][T18894] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 694.090519][T18894] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 694.140535][T18894] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 694.173039][T18894] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 694.223798][T18894] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 694.270580][T18894] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 694.303109][T18894] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 694.352780][T18894] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 694.375231][T18894] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 694.386153][T18894] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 694.402923][T18894] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 694.433950][T18894] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.456404][T18894] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.488665][T18894] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.534210][T18894] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.808809][ T962] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 694.848357][ T962] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 695.059369][T16483] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 695.089771][T16483] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 695.809147][T19204] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4944'. [ 696.577274][ T5778] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 696.587363][ T5778] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 696.596054][ T5778] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 696.605472][ T5778] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 696.614563][ T5778] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 696.622288][ T5778] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 697.359269][T19210] chnl_net:caif_netlink_parms(): no params data found [ 698.711440][T14820] Bluetooth: hci4: command tx timeout [ 698.753722][T19234] syzkaller0: refused to change device tx_queue_len [ 698.997894][T16501] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.139324][T19210] bridge0: port 1(bridge_slave_0) entered blocking state [ 699.172922][T19210] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.208869][T19210] bridge_slave_0: entered allmulticast mode [ 699.228998][T19210] bridge_slave_0: entered promiscuous mode [ 699.340317][T19221] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4947'. [ 699.375915][T16501] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.390106][T19210] bridge0: port 2(bridge_slave_1) entered blocking state [ 699.397939][T19210] bridge0: port 2(bridge_slave_1) entered disabled state [ 699.405373][T19210] bridge_slave_1: entered allmulticast mode [ 699.413470][T19210] bridge_slave_1: entered promiscuous mode [ 699.523664][T16501] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.550279][T19210] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 699.646116][T16501] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.663662][T19210] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 699.751595][T19210] team0: Port device team_slave_0 added [ 699.773474][T19210] team0: Port device team_slave_1 added [ 700.642376][T19210] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 700.649561][T19210] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 700.679288][T19210] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 700.713897][T19210] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 700.721572][T19210] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 700.747987][T19210] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 700.770324][T19257] macsec0: entered promiscuous mode [ 700.776529][T19257] macsec0: entered allmulticast mode [ 700.782879][T19257] veth1_macvtap: entered allmulticast mode [ 700.793096][T14820] Bluetooth: hci4: command tx timeout [ 700.935805][T19210] hsr_slave_0: entered promiscuous mode [ 700.975932][T19210] hsr_slave_1: entered promiscuous mode [ 700.995501][T19210] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 701.014147][T19210] Cannot create hsr debugfs directory [ 701.131840][T19275] netlink: 10 bytes leftover after parsing attributes in process `syz.2.4965'. [ 702.870871][T14820] Bluetooth: hci4: command tx timeout [ 703.884340][T19327] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4978'. [ 703.925021][T19327] openvswitch: netlink: Tunnel attr 2548 out of range max 16 [ 704.107281][T19328] netlink: 'syz.1.4978': attribute type 11 has an invalid length. [ 704.141839][T19328] netlink: 'syz.1.4978': attribute type 1 has an invalid length. [ 704.172352][T19328] netlink: 'syz.1.4978': attribute type 1 has an invalid length. [ 704.201728][T19328] netlink: 'syz.1.4978': attribute type 2 has an invalid length. [ 704.231475][T19328] netlink: 198100 bytes leftover after parsing attributes in process `syz.1.4978'. [ 704.586184][T19210] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 704.701453][T19210] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 704.890679][T19210] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 704.924461][T19210] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 704.950993][T14820] Bluetooth: hci4: command tx timeout [ 706.147241][T16501] hsr_slave_0: left promiscuous mode [ 706.182209][T16501] hsr_slave_1: left promiscuous mode [ 706.191571][T16501] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 706.205555][T16501] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 706.223284][T16501] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 706.234321][T16501] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 706.290807][T16501] veth1_macvtap: left allmulticast mode [ 706.300143][T16501] veth1_macvtap: left promiscuous mode [ 706.330602][T16501] veth0_macvtap: left promiscuous mode [ 706.336324][T16501] veth1_vlan: left promiscuous mode [ 706.343747][T16501] veth0_vlan: left promiscuous mode [ 706.524713][T16501] team0 (unregistering): Port device geneve1 removed [ 707.018639][T16501] team0 (unregistering): Port device team_slave_1 removed [ 707.065226][T16501] team0 (unregistering): Port device team_slave_0 removed [ 707.107854][T16501] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 707.149988][T16501] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 707.475085][T16501] bond0 (unregistering): Released all slaves [ 707.517387][T19373] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.4988'. [ 707.631121][T19210] 8021q: adding VLAN 0 to HW filter on device bond0 [ 707.688821][T19382] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.4993'. [ 707.703628][T19210] 8021q: adding VLAN 0 to HW filter on device team0 [ 707.802727][T16476] bridge0: port 1(bridge_slave_0) entered blocking state [ 707.809966][T16476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 707.869964][T16505] bridge0: port 2(bridge_slave_1) entered blocking state [ 707.877211][T16505] bridge0: port 2(bridge_slave_1) entered forwarding state [ 708.597526][T19210] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 708.736794][T19210] veth0_vlan: entered promiscuous mode [ 708.759422][T19210] veth1_vlan: entered promiscuous mode [ 708.877668][T19210] veth0_macvtap: entered promiscuous mode [ 708.916087][T19210] veth1_macvtap: entered promiscuous mode [ 708.984721][T19210] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 709.015800][T19210] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.037429][T19210] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 709.062901][T19210] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.090648][T19210] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 709.107932][T19210] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.143319][T19210] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 709.209378][T19210] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 709.236485][T19210] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.267508][T19210] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 709.297423][T19210] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.345810][T19210] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 709.387986][T19210] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 709.428797][T19210] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 709.492634][T19210] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.516735][T19210] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.546044][T19210] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.571258][T19210] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.292922][ T962] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 710.320546][ T962] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 710.418219][ T962] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 710.431038][ T962] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 710.884557][T19451] macsec0: entered promiscuous mode [ 710.912048][T19451] macsec0: entered allmulticast mode [ 710.917508][T19451] veth1_macvtap: entered allmulticast mode [ 710.985734][T19460] netlink: 'syz.0.5004': attribute type 6 has an invalid length. [ 711.013870][T19460] netlink: 'syz.0.5004': attribute type 3 has an invalid length. [ 711.076428][T19460] netlink: 153952 bytes leftover after parsing attributes in process `syz.0.5004'. [ 711.096692][T19465] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5006'. [ 713.333453][T19513] netlink: 'syz.2.5024': attribute type 39 has an invalid length. [ 713.977174][T19517] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5026'. [ 714.372581][T19523] netlink: 'syz.1.5028': attribute type 10 has an invalid length. [ 714.479149][T19523] team0: Device ipvlan1 failed to register rx_handler [ 717.578030][T19548] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 720.423895][T19634] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5068'. [ 720.764576][T19642] netlink: 'syz.1.5071': attribute type 19 has an invalid length. [ 721.356827][T16483] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.507630][T16483] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.998326][T16483] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.010022][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 722.050673][ T5778] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 722.070966][ T5778] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 722.087332][ T5778] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 722.096008][ T5778] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 722.105086][ T5778] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 722.157926][T16483] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 723.196693][T19667] chnl_net:caif_netlink_parms(): no params data found [ 723.572306][T19704] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5092'. [ 723.697130][T19712] netlink: 'syz.1.5091': attribute type 1 has an invalid length. [ 723.895267][T19708] netlink: 'syz.1.5091': attribute type 21 has an invalid length. [ 724.151470][T14820] Bluetooth: hci1: command tx timeout [ 724.301070][T19667] bridge0: port 1(bridge_slave_0) entered blocking state [ 724.308529][T19667] bridge0: port 1(bridge_slave_0) entered disabled state [ 724.320659][T19667] bridge_slave_0: entered allmulticast mode [ 724.332336][T19667] bridge_slave_0: entered promiscuous mode [ 724.358798][T19667] bridge0: port 2(bridge_slave_1) entered blocking state [ 724.376268][T19667] bridge0: port 2(bridge_slave_1) entered disabled state [ 724.390894][T19667] bridge_slave_1: entered allmulticast mode [ 724.410534][T19667] bridge_slave_1: entered promiscuous mode [ 724.863004][T19667] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 725.094194][T19667] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 725.316816][T19667] team0: Port device team_slave_0 added [ 725.382588][T19667] team0: Port device team_slave_1 added [ 725.580114][T19667] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 725.599899][T19667] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 725.728420][T19667] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 725.802923][T19667] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 725.837292][T19667] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 725.950124][T19667] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 726.230745][T14820] Bluetooth: hci1: command tx timeout [ 726.438404][T16483] hsr_slave_0: left promiscuous mode [ 726.446489][T16483] hsr_slave_1: left promiscuous mode [ 726.464056][T16483] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 726.480335][T16483] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 726.496266][T16483] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 726.510890][T16483] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 726.518956][T16483] bridge_slave_1: left allmulticast mode [ 726.532556][T16483] bridge_slave_1: left promiscuous mode [ 726.538348][T16483] bridge0: port 2(bridge_slave_1) entered disabled state [ 726.566740][T16483] bridge_slave_0: left allmulticast mode [ 726.572650][T16483] bridge_slave_0: left promiscuous mode [ 726.579125][T16483] bridge0: port 1(bridge_slave_0) entered disabled state [ 726.638170][T16483] veth1_macvtap: left allmulticast mode [ 726.654705][T16483] veth1_macvtap: left promiscuous mode [ 726.660305][T16483] veth0_macvtap: left promiscuous mode [ 726.685151][T16483] veth1_vlan: left promiscuous mode [ 726.690841][T16483] veth0_vlan: left promiscuous mode [ 727.478080][T16483] team0 (unregistering): Port device team_slave_1 removed [ 727.530849][T16483] team0 (unregistering): Port device team_slave_0 removed [ 727.575424][T16483] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 727.629101][T16483] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 727.995168][T16483] bond0 (unregistering): Released all slaves [ 728.132759][T19667] hsr_slave_0: entered promiscuous mode [ 728.153270][T19667] hsr_slave_1: entered promiscuous mode [ 728.171434][T19667] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 728.179062][T19667] Cannot create hsr debugfs directory [ 728.317284][T14820] Bluetooth: hci1: command tx timeout [ 729.188954][T19804] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.5117'. [ 729.476299][T19809] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5118'. [ 729.880863][T19667] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 729.901735][T19667] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 729.926386][T19667] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 729.961572][T19667] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 730.218374][T19667] 8021q: adding VLAN 0 to HW filter on device bond0 [ 730.261430][T19667] 8021q: adding VLAN 0 to HW filter on device team0 [ 730.281539][T16483] bridge0: port 1(bridge_slave_0) entered blocking state [ 730.288740][T16483] bridge0: port 1(bridge_slave_0) entered forwarding state [ 730.324455][T16483] bridge0: port 2(bridge_slave_1) entered blocking state [ 730.331642][T16483] bridge0: port 2(bridge_slave_1) entered forwarding state [ 730.391043][T14820] Bluetooth: hci1: command tx timeout [ 730.909225][T19667] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 730.993678][T19859] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.5133'. [ 731.036038][T19859] netlink: 'syz.2.5133': attribute type 10 has an invalid length. [ 731.070713][T19859] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 731.113844][T19859] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 731.146702][T19859] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 731.195335][T19667] veth0_vlan: entered promiscuous mode [ 731.220116][T19667] veth1_vlan: entered promiscuous mode [ 731.258526][T19667] veth0_macvtap: entered promiscuous mode [ 731.269481][T19667] veth1_macvtap: entered promiscuous mode [ 731.319702][T19667] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 731.336625][T19667] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.355877][T19667] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 731.368406][T19667] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.388195][T19667] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 731.427629][T19667] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 731.455647][T19667] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.480062][T19667] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 731.504248][T19667] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.527484][T19667] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 731.551139][T19667] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.572785][T19667] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 731.605625][T19667] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.631063][T19667] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.644454][T19667] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.654217][T19667] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.801675][ T962] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.809536][ T962] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 731.880611][T16497] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.902919][T16497] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 731.960042][T19891] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5138'. [ 734.081241][T19957] macsec0: entered promiscuous mode [ 734.102230][T19957] macsec0: entered allmulticast mode [ 734.107719][T19957] veth1_macvtap: entered allmulticast mode [ 735.851645][T20011] macsec0: entered promiscuous mode [ 735.875485][T20011] macsec0: entered allmulticast mode [ 735.881897][T20011] veth1_macvtap: entered allmulticast mode [ 736.173980][T20027] netlink: 'syz.1.5185': attribute type 2 has an invalid length. [ 736.252661][T20027] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.5185'. [ 736.507753][T20033] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.5188'. [ 736.822407][T20047] netlink: 'syz.2.5194': attribute type 3 has an invalid length. [ 736.984304][T20050] syzkaller0: entered promiscuous mode [ 736.989866][T20050] syzkaller0: entered allmulticast mode [ 738.494775][T20109] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.5216'. [ 738.798420][T20118] FAULT_INJECTION: forcing a failure. [ 738.798420][T20118] name failslab, interval 1, probability 0, space 0, times 0 [ 738.830686][T20118] CPU: 1 PID: 20118 Comm: syz.0.5220 Not tainted syzkaller #0 [ 738.838226][T20118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 738.848317][T20118] Call Trace: [ 738.851611][T20118] [ 738.854558][T20118] dump_stack_lvl+0x18c/0x250 [ 738.859268][T20118] ? show_regs_print_info+0x20/0x20 [ 738.864479][T20118] ? load_image+0x420/0x420 [ 738.869006][T20118] ? __might_sleep+0xe0/0xe0 [ 738.873620][T20118] ? __lock_acquire+0x7d80/0x7d80 [ 738.878666][T20118] should_fail_ex+0x394/0x4c0 [ 738.883367][T20118] should_failslab+0x9/0x20 [ 738.887877][T20118] slab_pre_alloc_hook+0x59/0x300 [ 738.892917][T20118] ? tomoyo_encode+0x2ad/0x570 [ 738.897690][T20118] ? tomoyo_encode+0x2ad/0x570 [ 738.902477][T20118] __kmem_cache_alloc_node+0x53/0x250 [ 738.907868][T20118] ? tomoyo_encode+0x2ad/0x570 [ 738.912636][T20118] __kmalloc+0xa7/0x240 [ 738.916806][T20118] tomoyo_encode+0x2ad/0x570 [ 738.921409][T20118] tomoyo_realpath_from_path+0x57c/0x5c0 [ 738.927051][T20118] ? tomoyo_domain+0xd6/0x120 [ 738.931750][T20118] tomoyo_path_number_perm+0x248/0x5e0 [ 738.937215][T20118] ? tomoyo_path_number_perm+0x217/0x5e0 [ 738.942863][T20118] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 738.948330][T20118] ? ksys_write+0x1d2/0x260 [ 738.952896][T20118] ? __fget_files+0x28/0x460 [ 738.957519][T20118] security_file_ioctl+0x70/0xa0 [ 738.962473][T20118] __se_sys_ioctl+0x48/0x170 [ 738.967082][T20118] do_syscall_64+0x55/0xb0 [ 738.971510][T20118] ? clear_bhb_loop+0x40/0x90 [ 738.976196][T20118] ? clear_bhb_loop+0x40/0x90 [ 738.980882][T20118] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 738.986787][T20118] RIP: 0033:0x7f348439ce59 [ 738.991213][T20118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 739.010837][T20118] RSP: 002b:00007f348520f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 739.019262][T20118] RAX: ffffffffffffffda RBX: 00007f3484615fa0 RCX: 00007f348439ce59 [ 739.027245][T20118] RDX: 0000200000000080 RSI: 00000000000089f3 RDI: 0000000000000005 [ 739.035227][T20118] RBP: 00007f348520f090 R08: 0000000000000000 R09: 0000000000000000 [ 739.043205][T20118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 739.051190][T20118] R13: 00007f3484616038 R14: 00007f3484615fa0 R15: 00007ffd2024a648 [ 739.059198][T20118] [ 739.071281][T20118] ERROR: Out of memory at tomoyo_realpath_from_path. [ 739.677791][T20145] netlink: 'syz.0.5232': attribute type 2 has an invalid length. [ 739.701430][T20145] netlink: 'syz.0.5232': attribute type 8 has an invalid length. [ 739.709227][T20145] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5232'. [ 740.108559][T20157] FAULT_INJECTION: forcing a failure. [ 740.108559][T20157] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 740.128965][T20157] CPU: 1 PID: 20157 Comm: syz.0.5238 Not tainted syzkaller #0 [ 740.136504][T20157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 740.146598][T20157] Call Trace: [ 740.149908][T20157] [ 740.152869][T20157] dump_stack_lvl+0x18c/0x250 [ 740.157583][T20157] ? show_regs_print_info+0x20/0x20 [ 740.162806][T20157] ? load_image+0x420/0x420 [ 740.167349][T20157] ? __might_fault+0xaa/0x120 [ 740.172047][T20157] ? __lock_acquire+0x7d80/0x7d80 [ 740.177100][T20157] should_fail_ex+0x394/0x4c0 [ 740.181807][T20157] _copy_from_user+0x2f/0xe0 [ 740.186415][T20157] get_user_ifreq+0x6b/0x180 [ 740.191033][T20157] sock_ioctl+0x6f1/0x7e0 [ 740.195382][T20157] ? sock_poll+0x3e0/0x3e0 [ 740.199827][T20157] ? bpf_lsm_file_ioctl+0x9/0x10 [ 740.204775][T20157] ? security_file_ioctl+0x80/0xa0 [ 740.209895][T20157] ? sock_poll+0x3e0/0x3e0 [ 740.214323][T20157] __se_sys_ioctl+0xfd/0x170 [ 740.218950][T20157] do_syscall_64+0x55/0xb0 [ 740.223376][T20157] ? clear_bhb_loop+0x40/0x90 [ 740.228059][T20157] ? clear_bhb_loop+0x40/0x90 [ 740.232749][T20157] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 740.238659][T20157] RIP: 0033:0x7f348439ce59 [ 740.243089][T20157] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 740.262713][T20157] RSP: 002b:00007f348520f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 740.271144][T20157] RAX: ffffffffffffffda RBX: 00007f3484615fa0 RCX: 00007f348439ce59 [ 740.279128][T20157] RDX: 0000200000000080 RSI: 00000000000089f3 RDI: 0000000000000005 [ 740.287112][T20157] RBP: 00007f348520f090 R08: 0000000000000000 R09: 0000000000000000 [ 740.295094][T20157] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.303096][T20157] R13: 00007f3484616038 R14: 00007f3484615fa0 R15: 00007ffd2024a648 [ 740.311108][T20157] [ 742.492150][T20186] bridge_slave_1: left allmulticast mode [ 742.497869][T20186] bridge_slave_1: left promiscuous mode [ 742.522218][T20186] bridge0: port 2(bridge_slave_1) entered disabled state [ 742.571563][T20186] bridge_slave_0: left allmulticast mode [ 742.577276][T20186] bridge_slave_0: left promiscuous mode [ 742.589471][T20186] bridge0: port 1(bridge_slave_0) entered disabled state [ 742.991265][T20188] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5249'. [ 743.137180][T20204] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5256'. [ 743.175604][T20208] netlink: 'syz.0.5258': attribute type 29 has an invalid length. [ 743.184333][T20208] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5258'. [ 744.569992][T20223] netlink: 'syz.0.5262': attribute type 10 has an invalid length. [ 744.621299][T20223] netlink: 55 bytes leftover after parsing attributes in process `syz.0.5262'. [ 744.832142][T20231] bridge_slave_1: left allmulticast mode [ 744.840236][T20231] bridge_slave_1: left promiscuous mode [ 744.871304][T20231] bridge0: port 2(bridge_slave_1) entered disabled state [ 745.029099][T20231] bridge_slave_0: left allmulticast mode [ 745.051414][T20231] bridge_slave_0: left promiscuous mode [ 745.083014][T20231] bridge0: port 1(bridge_slave_0) entered disabled state [ 745.623200][T20227] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5265'. [ 746.058681][T20254] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5274'. [ 747.174480][T20275] FAULT_INJECTION: forcing a failure. [ 747.174480][T20275] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 747.233955][T20275] CPU: 0 PID: 20275 Comm: syz.1.5281 Not tainted syzkaller #0 [ 747.241502][T20275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 747.251684][T20275] Call Trace: [ 747.254983][T20275] [ 747.257921][T20275] dump_stack_lvl+0x18c/0x250 [ 747.262629][T20275] ? show_regs_print_info+0x20/0x20 [ 747.267849][T20275] ? load_image+0x420/0x420 [ 747.272371][T20275] ? __lock_acquire+0x7d80/0x7d80 [ 747.277435][T20275] should_fail_ex+0x394/0x4c0 [ 747.282135][T20275] _copy_to_user+0x2f/0xa0 [ 747.286568][T20275] put_user_ifreq+0x78/0xb0 [ 747.291090][T20275] sock_ioctl+0x77b/0x7e0 [ 747.295438][T20275] ? sock_poll+0x3e0/0x3e0 [ 747.299887][T20275] ? bpf_lsm_file_ioctl+0x9/0x10 [ 747.304840][T20275] ? security_file_ioctl+0x80/0xa0 [ 747.309965][T20275] ? sock_poll+0x3e0/0x3e0 [ 747.314411][T20275] __se_sys_ioctl+0xfd/0x170 [ 747.319023][T20275] do_syscall_64+0x55/0xb0 [ 747.323457][T20275] ? clear_bhb_loop+0x40/0x90 [ 747.328144][T20275] ? clear_bhb_loop+0x40/0x90 [ 747.332833][T20275] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 747.338743][T20275] RIP: 0033:0x7f87aa19ce59 [ 747.343167][T20275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 747.362790][T20275] RSP: 002b:00007f87ab015028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 747.371218][T20275] RAX: ffffffffffffffda RBX: 00007f87aa415fa0 RCX: 00007f87aa19ce59 [ 747.379196][T20275] RDX: 0000200000000080 RSI: 00000000000089f3 RDI: 0000000000000005 [ 747.387177][T20275] RBP: 00007f87ab015090 R08: 0000000000000000 R09: 0000000000000000 [ 747.395156][T20275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 747.403128][T20275] R13: 00007f87aa416038 R14: 00007f87aa415fa0 R15: 00007ffc95cb4db8 [ 747.411147][T20275] [ 747.515331][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.530789][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.712807][T20289] netlink: 16098 bytes leftover after parsing attributes in process `syz.2.5288'. [ 747.968110][T20295] syzkaller0: entered promiscuous mode [ 747.973929][T20295] syzkaller0: entered allmulticast mode [ 751.654685][T20336] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5306'. [ 751.984500][T20351] netlink: 212912 bytes leftover after parsing attributes in process `syz.1.5310'. [ 752.006789][T20351] openvswitch: netlink: IP tunnel dst address not specified [ 752.717127][T20374] netlink: 'syz.1.5319': attribute type 3 has an invalid length. [ 752.735304][T20374] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.5319'. [ 753.723685][T20387] netlink: 212912 bytes leftover after parsing attributes in process `syz.2.5322'. [ 753.760826][T20387] openvswitch: netlink: IP tunnel dst address not specified [ 754.062063][T20390] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5323'. [ 754.705517][T20410] netlink: 212912 bytes leftover after parsing attributes in process `syz.3.5335'. [ 754.733852][T20410] openvswitch: netlink: IP tunnel dst address not specified [ 755.499662][T20435] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5346'. [ 755.557509][T20434] syzkaller0: entered promiscuous mode [ 755.565350][T20434] syzkaller0: entered allmulticast mode [ 755.598436][T20439] netlink: 'syz.1.5348': attribute type 21 has an invalid length. [ 755.621421][T20439] netlink: 'syz.1.5348': attribute type 6 has an invalid length. [ 755.640947][T20439] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5348'. [ 756.626533][T20489] syzkaller0: entered promiscuous mode [ 756.636124][T20489] syzkaller0: entered allmulticast mode [ 756.660720][T20486] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5366'. [ 758.713112][T20510] netlink: 'syz.0.5374': attribute type 10 has an invalid length. [ 758.916280][T20510] macvlan0: entered promiscuous mode [ 758.932518][T20510] macvlan0: entered allmulticast mode [ 758.969734][T20510] veth1_vlan: entered allmulticast mode [ 759.007781][T20510] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 759.542572][T20527] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5382'. [ 761.266458][T20563] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5393'. [ 761.407214][T20566] netlink: 'syz.3.5396': attribute type 17 has an invalid length. [ 762.542452][T20586] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5405'. [ 763.536614][T20610] netlink: 'syz.3.5413': attribute type 10 has an invalid length. [ 763.566527][T20610] netlink: 2 bytes leftover after parsing attributes in process `syz.3.5413'. [ 763.584773][T20610] hsr0: entered promiscuous mode [ 763.628695][T20610] bridge0: port 3(hsr0) entered blocking state [ 763.636079][T20610] bridge0: port 3(hsr0) entered disabled state [ 763.657998][T20610] hsr0: entered allmulticast mode [ 763.670025][T20610] hsr_slave_0: entered allmulticast mode [ 763.690286][T20610] hsr_slave_1: entered allmulticast mode [ 763.718676][T20610] bridge0: port 3(hsr0) entered blocking state [ 763.725060][T20610] bridge0: port 3(hsr0) entered forwarding state [ 764.152070][T20619] netlink: 'syz.1.5415': attribute type 10 has an invalid length. [ 764.181369][T20619] team0: Device ipvlan1 failed to register rx_handler [ 765.889119][T20661] netlink: 'syz.3.5435': attribute type 49 has an invalid length. [ 766.220416][T20666] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5437'. [ 766.585731][T20672] netlink: 'syz.0.5439': attribute type 10 has an invalid length. [ 766.597875][T20672] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 767.751488][T20674] netlink: 'syz.0.5439': attribute type 39 has an invalid length. [ 768.525265][T20691] netlink: 'syz.1.5446': attribute type 10 has an invalid length. [ 768.546302][T20691] netlink: 2 bytes leftover after parsing attributes in process `syz.1.5446'. [ 768.589056][T20691] hsr0: entered promiscuous mode [ 769.343255][T20717] netlink: 'syz.2.5456': attribute type 27 has an invalid length. [ 769.361154][T20717] netlink: 2418 bytes leftover after parsing attributes in process `syz.2.5456'. [ 769.676664][T20714] netlink: 'syz.3.5455': attribute type 10 has an invalid length. [ 769.717463][T20714] team0: Device ipvlan1 failed to register rx_handler [ 770.070009][T20739] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5463'. [ 770.350991][T20737] can: request_module (can-proto-0) failed. [ 772.264581][T20788] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5479'. [ 773.183294][T20799] netlink: 'syz.1.5484': attribute type 3 has an invalid length. [ 773.217546][T20799] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.5484'. [ 773.314762][T20799] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5484'. [ 774.882384][T20829] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5495'. [ 775.345326][T20848] netlink: 160 bytes leftover after parsing attributes in process `syz.3.5502'. [ 775.378842][T20848] netlink: 6 bytes leftover after parsing attributes in process `syz.3.5502'. [ 777.102780][T20869] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5510'. [ 779.218407][T20902] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5524'. [ 783.078945][T20996] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5557'. [ 784.304321][T21043] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.5573'. [ 787.877269][T21058] netlink: 152 bytes leftover after parsing attributes in process `syz.0.5584'. [ 788.708424][T21069] netlink: 'syz.3.5582': attribute type 10 has an invalid length. [ 788.927007][T21069] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 788.982227][T21069] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 789.001551][T21080] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5586'. [ 789.393456][T21089] netlink: 'syz.2.5590': attribute type 9 has an invalid length. [ 789.402589][T21089] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.5590'. [ 789.660847][T21098] netlink: 192436 bytes leftover after parsing attributes in process `syz.3.5594'. [ 789.693517][T21098] openvswitch: netlink: Message has 20476 unknown bytes. [ 789.788717][T21105] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5596'. [ 790.368759][T21119] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5602'. [ 790.771028][T21123] netlink: 703 bytes leftover after parsing attributes in process `syz.3.5604'. [ 790.935980][T21133] FAULT_INJECTION: forcing a failure. [ 790.935980][T21133] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 790.980522][T21133] CPU: 1 PID: 21133 Comm: syz.2.5608 Not tainted syzkaller #0 [ 790.988053][T21133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 790.998218][T21133] Call Trace: [ 791.001520][T21133] [ 791.004466][T21133] dump_stack_lvl+0x18c/0x250 [ 791.009174][T21133] ? show_regs_print_info+0x20/0x20 [ 791.014386][T21133] ? load_image+0x420/0x420 [ 791.018897][T21133] ? __might_fault+0xaa/0x120 [ 791.023577][T21133] ? __lock_acquire+0x7d80/0x7d80 [ 791.028607][T21133] should_fail_ex+0x394/0x4c0 [ 791.033290][T21133] _copy_from_user+0x2f/0xe0 [ 791.037885][T21133] __sys_bpf+0x23e/0x890 [ 791.042132][T21133] ? bpf_link_show_fdinfo+0x390/0x390 [ 791.047520][T21133] ? lock_chain_count+0x20/0x20 [ 791.052378][T21133] __x64_sys_bpf+0x7c/0x90 [ 791.056789][T21133] do_syscall_64+0x55/0xb0 [ 791.061202][T21133] ? clear_bhb_loop+0x40/0x90 [ 791.065877][T21133] ? clear_bhb_loop+0x40/0x90 [ 791.070551][T21133] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 791.076447][T21133] RIP: 0033:0x7f536f59ce59 [ 791.080877][T21133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 791.100501][T21133] RSP: 002b:00007f537040b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 791.108919][T21133] RAX: ffffffffffffffda RBX: 00007f536f815fa0 RCX: 00007f536f59ce59 [ 791.116892][T21133] RDX: 0000000000000094 RSI: 0000200000000200 RDI: 0000000000000005 [ 791.124866][T21133] RBP: 00007f537040b090 R08: 0000000000000000 R09: 0000000000000000 [ 791.132838][T21133] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 791.140808][T21133] R13: 00007f536f816038 R14: 00007f536f815fa0 R15: 00007ffe063c8248 [ 791.148809][T21133] [ 795.065979][T21192] netlink: 'syz.2.5629': attribute type 1 has an invalid length. [ 795.080554][T21192] netlink: 'syz.2.5629': attribute type 4 has an invalid length. [ 795.097419][T21192] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.5629'. [ 795.673555][ T5778] Bluetooth: hci2: command 0x0406 tx timeout [ 796.569882][T21240] netlink: 'syz.2.5646': attribute type 10 has an invalid length. [ 796.591171][T21240] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5646'. [ 796.706839][T21240] batman_adv: batadv0: Adding interface: virt_wifi0 [ 796.719920][T21240] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 796.770117][T21240] batman_adv: batadv0: Interface activated: virt_wifi0 [ 796.861092][T21246] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.5650'. [ 796.896891][T21243] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5649'. [ 798.215133][T21278] netlink: 'syz.3.5663': attribute type 10 has an invalid length. [ 798.241041][T21278] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5663'. [ 798.397178][T21278] batman_adv: batadv0: Adding interface: virt_wifi0 [ 798.411008][T21278] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 798.498747][T21278] batman_adv: batadv0: Interface activated: virt_wifi0 [ 798.604270][T21282] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5665'. [ 798.952400][T21295] netlink: 'syz.1.5670': attribute type 27 has an invalid length. [ 798.971986][T21295] netlink: 164 bytes leftover after parsing attributes in process `syz.1.5670'. [ 799.454479][T21305] netlink: 'syz.2.5673': attribute type 10 has an invalid length. [ 799.529053][T21306] netlink: 'syz.2.5673': attribute type 9 has an invalid length. [ 799.561091][T21306] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.5673'. [ 800.348928][T21305] team0 (unregistering): Port device team_slave_0 removed [ 800.405954][T21305] team0 (unregistering): Port device team_slave_1 removed [ 800.606772][T21316] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 800.614527][T21316] IPv6: NLM_F_CREATE should be set when creating new route [ 800.622802][T21316] IPv6: NLM_F_CREATE should be set when creating new route [ 800.630674][T21316] IPv6: NLM_F_CREATE should be set when creating new route [ 801.403551][T21323] netlink: 'syz.1.5679': attribute type 10 has an invalid length. [ 801.466170][T21323] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5679'. [ 801.570057][T21323] batman_adv: batadv0: Adding interface: virt_wifi0 [ 801.592619][T21323] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 801.647576][T21323] batman_adv: batadv0: Interface activated: virt_wifi0 [ 802.194018][T21345] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5686'. [ 803.238527][T21365] netlink: 'syz.0.5695': attribute type 10 has an invalid length. [ 803.265537][T21365] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5695'. [ 803.334360][T21365] batman_adv: batadv0: Adding interface: virt_wifi0 [ 803.350162][T21365] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 803.391260][T21365] batman_adv: batadv0: Interface activated: virt_wifi0 [ 803.684061][T21372] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5699'. [ 804.409286][T21393] netlink: 'syz.0.5708': attribute type 10 has an invalid length. [ 804.450994][T21393] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5708'. [ 804.633134][T21397] netlink: 'syz.0.5710': attribute type 11 has an invalid length. [ 804.689014][T21402] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5712'. [ 804.841414][T21405] netlink: 16410 bytes leftover after parsing attributes in process `syz.2.5713'. [ 805.175785][T21415] netlink: 'syz.3.5718': attribute type 10 has an invalid length. [ 805.199607][T21415] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5718'. [ 805.860086][T21444] netlink: 'syz.0.5728': attribute type 10 has an invalid length. [ 805.870087][T21444] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5728'. [ 805.910653][ T5778] Bluetooth: hci0: command 0x0406 tx timeout [ 806.060081][T21451] netlink: 'syz.0.5732': attribute type 3 has an invalid length. [ 806.068423][T21451] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.5732'. [ 806.589258][T21478] netlink: 15743 bytes leftover after parsing attributes in process `syz.1.5745'. [ 806.602065][T21476] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5743'. [ 808.958750][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.966679][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.102469][T21506] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 809.396310][T21535] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5767'. [ 810.466637][T21570] netlink: 'syz.2.5783': attribute type 21 has an invalid length. [ 810.499618][T21571] netlink: 'syz.2.5783': attribute type 21 has an invalid length. [ 810.621744][T21572] netlink: 'syz.2.5783': attribute type 1 has an invalid length. [ 810.833038][T21578] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5785'. [ 811.125281][T21591] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5792'. [ 811.138217][T21590] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 811.148335][T21590] pim6reg0: persist enabled [ 811.468811][T21599] netlink: 'syz.0.5795': attribute type 10 has an invalid length. [ 811.494893][T21599] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5795'. [ 811.771113][T21610] netlink: 'syz.3.5799': attribute type 39 has an invalid length. [ 812.094018][T21617] netlink: 'syz.2.5802': attribute type 2 has an invalid length. [ 812.102406][T21617] netlink: 119 bytes leftover after parsing attributes in process `syz.2.5802'. [ 812.127602][T21621] netlink: 'syz.0.5803': attribute type 10 has an invalid length. [ 812.573892][T21621] team0: Device wg1 is of different type [ 812.683293][T21622] mac80211_hwsim hwsim40 wlan0: entered promiscuous mode [ 812.690414][T21622] mac80211_hwsim hwsim40 wlan0: entered allmulticast mode [ 812.706765][T21625] netlink: 'syz.3.5805': attribute type 10 has an invalid length. [ 812.733357][T21625] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 813.499977][T21655] syzkaller0: entered promiscuous mode [ 813.506051][T21655] syzkaller0: entered allmulticast mode [ 813.521030][T21658] netlink: 'syz.3.5818': attribute type 10 has an invalid length. [ 813.529656][T21658] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5818'. [ 813.558626][T21657] netlink: 'syz.2.5817': attribute type 10 has an invalid length. [ 813.572817][T21657] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5817'. [ 813.858645][T21668] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode [ 813.876961][T21668] mac80211_hwsim hwsim38 wlan0: entered allmulticast mode [ 813.899330][T21667] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5821'. [ 814.025075][T21671] pim6reg1: tun_chr_ioctl cmd 1074025677 [ 814.031864][T21671] pim6reg1: linktype set to 776 [ 816.443417][T21688] validate_nla: 1 callbacks suppressed [ 816.443429][T21688] netlink: 'syz.3.5829': attribute type 10 has an invalid length. [ 816.457167][T21688] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5829'. [ 816.583107][T21694] netlink: 'syz.1.5831': attribute type 10 has an invalid length. [ 816.594605][T21694] netlink: 152 bytes leftover after parsing attributes in process `syz.1.5831'. [ 816.630285][T21694] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.5831'. [ 816.658795][T21694] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 817.029236][T21701] netlink: 'syz.0.5833': attribute type 13 has an invalid length. [ 817.059512][T21701] netlink: 172 bytes leftover after parsing attributes in process `syz.0.5833'. [ 817.959151][T21721] netlink: 'syz.0.5841': attribute type 10 has an invalid length. [ 817.990429][T21721] netlink: 55 bytes leftover after parsing attributes in process `syz.0.5841'. [ 818.038110][T21721] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 818.352507][T21721] batman_adv: batadv0: Removing interface: virt_wifi0 [ 819.062457][T21734] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5845'. [ 819.273708][T21738] netlink: 'syz.2.5840': attribute type 10 has an invalid length. [ 819.315237][T21738] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5840'. [ 819.527988][T21744] netlink: 'syz.3.5848': attribute type 9 has an invalid length. [ 819.536511][T21744] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.5848'. [ 820.127087][T21765] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5856'. [ 820.405788][T21769] netlink: 'syz.0.5858': attribute type 10 has an invalid length. [ 820.414955][T21769] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5858'. [ 821.007746][T21802] netlink: 'syz.0.5869': attribute type 3 has an invalid length. [ 821.017433][T21802] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.5869'. [ 821.273450][T21739] Bluetooth: hci4: command 0x0406 tx timeout [ 821.653776][T21811] netlink: 'syz.1.5872': attribute type 10 has an invalid length. [ 821.681225][T21811] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5872'. [ 822.267245][T21830] netlink: 'syz.0.5878': attribute type 10 has an invalid length. [ 822.276641][T21830] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5878'. [ 822.364575][T21829] netlink: 'syz.0.5878': attribute type 10 has an invalid length. [ 822.385588][T21829] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5878'. [ 822.446804][T21818] sit0: entered allmulticast mode [ 822.717572][T21837] netlink: 'syz.3.5882': attribute type 39 has an invalid length. [ 822.896102][T21837] hsr_slave_1 (unregistering): left promiscuous mode [ 822.960065][T21839] netlink: 'syz.3.5882': attribute type 21 has an invalid length. [ 822.979662][T21844] netlink: 'syz.0.5883': attribute type 10 has an invalid length. [ 823.010629][T21844] __nla_validate_parse: 1 callbacks suppressed [ 823.010646][T21844] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5883'. [ 823.144860][T21848] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5885'. [ 825.295716][T21884] netlink: 'syz.0.5895': attribute type 10 has an invalid length. [ 825.383445][T21884] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 825.403672][T21884] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 825.460971][T21889] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5898'. [ 825.802996][T21886] netlink: 'syz.2.5896': attribute type 10 has an invalid length. [ 825.852354][T21886] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5896'. [ 825.947343][T21900] netlink: 55631 bytes leftover after parsing attributes in process `syz.3.5899'. [ 825.961114][T21900] netlink: 6320 bytes leftover after parsing attributes in process `syz.3.5899'. [ 825.981092][T21900] tc_dump_action: action bad kind [ 826.191496][T21905] netlink: 'syz.0.5904': attribute type 49 has an invalid length. [ 826.211227][T21905] netlink: set zone limit has 8 unknown bytes [ 827.232731][T21927] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5912'. [ 827.653529][T21938] netlink: 168 bytes leftover after parsing attributes in process `syz.0.5917'. [ 828.789115][T21976] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5929'. [ 828.849816][T21975] netlink: 192436 bytes leftover after parsing attributes in process `syz.3.5930'. [ 828.861577][T21975] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 828.939516][T21980] netlink: 'syz.0.5931': attribute type 21 has an invalid length. [ 828.980634][T21980] netlink: 168 bytes leftover after parsing attributes in process `syz.0.5931'. [ 830.742348][T22005] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 830.865369][T22016] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5946'. [ 830.994638][T22018] netlink: 16399 bytes leftover after parsing attributes in process `syz.0.5948'. [ 831.523517][T22047] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5960'. [ 832.525269][T22084] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5976'. [ 832.949126][T22097] netlink: 'syz.2.5980': attribute type 10 has an invalid length. [ 833.012702][T22097] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 833.028415][T22097] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 833.296977][T22102] netlink: 'syz.0.5982': attribute type 10 has an invalid length. [ 833.306786][T22102] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5982'. [ 833.551230][T22104] netlink: 'syz.2.5983': attribute type 10 has an invalid length. [ 833.559961][T22104] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5983'. [ 835.102062][T22136] netlink: 'syz.0.5996': attribute type 10 has an invalid length. [ 835.112731][T22136] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5996'. [ 835.891491][T22168] netlink: 156 bytes leftover after parsing attributes in process `syz.0.6007'. [ 836.494610][T22180] netlink: 'syz.3.6011': attribute type 10 has an invalid length. [ 836.532060][T22180] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6011'. [ 836.632704][T22188] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6015'. [ 836.899348][T22198] netlink: 'syz.1.6019': attribute type 10 has an invalid length. [ 837.082970][T22198] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 837.297253][T22209] netlink: 'syz.2.6022': attribute type 10 has an invalid length. [ 838.163374][T22241] netlink: 'syz.3.6034': attribute type 10 has an invalid length. [ 838.176734][T22241] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6034'. [ 838.703580][T22267] netlink: 192436 bytes leftover after parsing attributes in process `syz.1.6048'. [ 838.719919][T22267] openvswitch: netlink: IP tunnel attribute has 20476 unknown bytes. [ 838.982319][T22270] netlink: 'syz.2.6049': attribute type 10 has an invalid length. [ 838.998799][T22270] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6049'. [ 840.290844][T22315] netlink: 'syz.2.6066': attribute type 21 has an invalid length. [ 840.300756][T22315] IPv6: NLM_F_CREATE should be specified when creating new route [ 840.366063][T22310] netlink: 'syz.0.6064': attribute type 10 has an invalid length. [ 840.382095][T22310] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6064'. [ 840.892607][T22338] netlink: 2 bytes leftover after parsing attributes in process `syz.1.6075'. [ 840.934094][T22339] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.6075'. [ 840.969529][T22338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 840.991096][T22338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 841.014797][T22338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 841.040678][T22338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 841.061657][T22338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 841.090562][T22338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 841.111680][T22338] batadv_slave_1: entered promiscuous mode [ 841.494532][T22347] netlink: 'syz.2.6080': attribute type 10 has an invalid length. [ 841.513070][T22347] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6080'. [ 841.638938][T22361] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6084'. [ 841.968604][T22371] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 842.205792][T22380] netdevsim netdevsim0 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 842.416531][T22380] syzkaller0: entered promiscuous mode [ 842.431912][T22380] syzkaller0: entered allmulticast mode [ 842.455747][T22385] netlink: 'syz.2.6095': attribute type 10 has an invalid length. [ 842.470748][T22385] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6095'. [ 846.259671][T22404] netlink: 'syz.3.6101': attribute type 10 has an invalid length. [ 846.267632][T22404] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6101'. [ 846.403474][T22424] netlink: 'syz.3.6108': attribute type 10 has an invalid length. [ 846.866972][T22447] netlink: 'syz.2.6118': attribute type 21 has an invalid length. [ 846.876873][T14820] Bluetooth: hci1: command 0x0406 tx timeout [ 846.885038][T22447] netlink: 'syz.2.6118': attribute type 6 has an invalid length. [ 846.895915][T22447] netlink: 'syz.2.6118': attribute type 64 has an invalid length. [ 847.052867][T22456] netlink: 'syz.0.6121': attribute type 10 has an invalid length. [ 847.688045][T22462] netlink: 'syz.2.6125': attribute type 1 has an invalid length. [ 847.733117][T22462] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.6125'. [ 848.379665][T22483] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 848.668768][T22499] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6141'. [ 849.154753][T22519] netlink: 'syz.2.6147': attribute type 29 has an invalid length. [ 849.163262][T22519] netlink: 'syz.2.6147': attribute type 29 has an invalid length. [ 849.173276][T22519] netlink: 'syz.2.6147': attribute type 29 has an invalid length. [ 849.363273][T22520] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 850.069757][T22546] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6159'. [ 850.144010][T22550] netlink: 196 bytes leftover after parsing attributes in process `syz.1.6161'. [ 850.502493][T22550] dvmrp1: tun_chr_ioctl cmd 1074025675 [ 850.550671][T22550] dvmrp1: persist disabled [ 851.044567][T22576] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 851.098384][T22576] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.6171'. [ 851.153374][T22582] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6172'. [ 851.323799][T22584] validate_nla: 5 callbacks suppressed [ 851.323816][T22584] netlink: 'syz.3.6171': attribute type 10 has an invalid length. [ 851.358885][T22581] netlink: 'syz.3.6171': attribute type 9 has an invalid length. [ 851.390688][T22581] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.6171'. [ 851.468734][T22584] bond0: (slave veth1_to_bridge): Enslaving as an active interface with an up link [ 851.950285][T22612] netlink: 'syz.0.6182': attribute type 1 has an invalid length. [ 852.013159][T22612] netlink: 191376 bytes leftover after parsing attributes in process `syz.0.6182'. [ 853.156838][T22630] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6191'. [ 854.103830][T22668] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6205'. [ 854.173221][T22672] netlink: 188 bytes leftover after parsing attributes in process `syz.3.6204'. [ 855.509827][T22697] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6218'. [ 855.552724][T22702] netlink: 209592 bytes leftover after parsing attributes in process `syz.1.6220'. [ 855.772175][T22710] syzkaller0: entered promiscuous mode [ 855.781382][T22710] syzkaller0: entered allmulticast mode [ 855.941935][T22708] netlink: 'syz.2.6226': attribute type 10 has an invalid length. [ 855.957243][T22708] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6226'. [ 856.167143][T22722] netlink: 16410 bytes leftover after parsing attributes in process `syz.2.6229'. [ 856.243425][T22722] netlink: 'syz.2.6229': attribute type 21 has an invalid length. [ 856.399570][T22726] netlink: 201392 bytes leftover after parsing attributes in process `syz.0.6239'. [ 856.415827][T22726] netlink: zone id is out of range [ 856.422503][T22726] netlink: zone id is out of range [ 856.428051][T22726] netlink: zone id is out of range [ 856.448699][T22731] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.6239'. [ 856.470058][T22726] netlink: zone id is out of range [ 856.490654][T22726] netlink: zone id is out of range [ 856.506495][T22726] netlink: zone id is out of range [ 856.528318][T22726] netlink: zone id is out of range [ 856.540793][T22726] netlink: zone id is out of range [ 856.546407][T22726] netlink: zone id is out of range [ 856.561021][T22726] netlink: zone id is out of range [ 856.643610][T22734] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6234'. [ 856.702565][T22736] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.6233'. [ 856.963981][T22744] netlink: 'syz.2.6237': attribute type 10 has an invalid length. [ 856.977085][T22744] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6237'. [ 857.292012][T22760] netlink: 188 bytes leftover after parsing attributes in process `syz.3.6245'. [ 857.326060][T22764] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6247'. [ 857.636643][T22777] netlink: 'syz.2.6252': attribute type 10 has an invalid length. [ 857.665134][T22777] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6252'. [ 858.316811][T22790] bridge0: port 4(syz_tun) entered blocking state [ 858.337795][T22790] bridge0: port 4(syz_tun) entered disabled state [ 858.391579][T22790] syz_tun: entered allmulticast mode [ 858.398325][T22790] syz_tun: entered promiscuous mode [ 858.424000][T22790] bridge0: port 4(syz_tun) entered blocking state [ 858.430641][T22790] bridge0: port 4(syz_tun) entered forwarding state [ 858.479452][T22800] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.6259'. [ 859.138739][T22817] netlink: 'syz.1.6266': attribute type 10 has an invalid length. [ 859.164184][T22817] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6266'. [ 859.349131][T22823] netlink: 'syz.3.6268': attribute type 21 has an invalid length. [ 859.368048][T22823] netlink: 'syz.3.6268': attribute type 1 has an invalid length. [ 859.380506][T22823] netlink: 15998 bytes leftover after parsing attributes in process `syz.3.6268'. [ 859.432679][T22825] netlink: 'syz.3.6268': attribute type 21 has an invalid length. [ 859.449559][T22825] netlink: 'syz.3.6268': attribute type 1 has an invalid length. [ 860.412806][T22872] netlink: 'syz.1.6288': attribute type 17 has an invalid length. [ 860.444534][T22872] netlink: 'syz.1.6288': attribute type 16 has an invalid length. [ 861.236611][T22894] netlink: 'syz.1.6295': attribute type 10 has an invalid length. [ 861.452730][T22894] veth1_macvtap (unregistering): left allmulticast mode [ 861.837633][T22900] __nla_validate_parse: 6 callbacks suppressed [ 861.837670][T22900] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6296'. [ 861.871932][T22901] netlink: 188 bytes leftover after parsing attributes in process `syz.2.6297'. [ 862.070035][T22911] netlink: 'syz.0.6301': attribute type 29 has an invalid length. [ 862.239974][T22911] netlink: 'syz.0.6301': attribute type 29 has an invalid length. [ 862.255403][T22912] netlink: 'syz.0.6301': attribute type 29 has an invalid length. [ 862.627274][T22913] netlink: 'syz.0.6301': attribute type 29 has an invalid length. [ 862.651968][T22911] netlink: 'syz.0.6301': attribute type 29 has an invalid length. [ 862.710688][T22922] netlink: 'syz.0.6301': attribute type 29 has an invalid length. [ 862.783843][T22925] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 862.839225][T22925] netlink: 'syz.3.6304': attribute type 10 has an invalid length. [ 863.266860][T22938] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6310'. [ 863.286406][T22943] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6311'. [ 863.406142][T22949] netlink: 'syz.0.6313': attribute type 2 has an invalid length. [ 863.415658][T22949] netlink: 'syz.0.6313': attribute type 8 has an invalid length. [ 863.429470][T22949] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6313'. [ 863.489772][T22953] netlink: 'syz.0.6313': attribute type 11 has an invalid length. [ 863.898889][T22968] bridge0: port 3(syz_tun) entered blocking state [ 863.919281][T22968] bridge0: port 3(syz_tun) entered disabled state [ 863.935666][T22968] syz_tun: entered allmulticast mode [ 863.944419][T22968] syz_tun: entered promiscuous mode [ 863.950175][T22968] bridge0: port 3(syz_tun) entered blocking state [ 863.956797][T22968] bridge0: port 3(syz_tun) entered forwarding state [ 864.713286][T22979] netlink: 168864 bytes leftover after parsing attributes in process `syz.3.6321'. [ 864.759385][T22979] netlink: 1 bytes leftover after parsing attributes in process `syz.3.6321'. [ 865.248186][T22991] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6326'. [ 865.838534][T23012] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6335'. [ 865.970116][T23021] netlink: 198036 bytes leftover after parsing attributes in process `syz.3.6336'. [ 866.441202][T23034] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 866.865207][T23048] __nla_validate_parse: 3 callbacks suppressed [ 866.865242][T23048] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6348'. [ 866.932153][T23049] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.6347'. [ 867.443660][T23060] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6353'. [ 867.545727][T23064] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6355'. [ 867.567769][T23064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.595538][T23064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.619711][T23064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.635195][T23064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.648365][T23064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.660331][T23064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.671208][T23064] batadv_slave_1: entered promiscuous mode [ 867.696895][T23069] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6357'. [ 868.363594][T23088] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 868.399469][T23088] validate_nla: 9 callbacks suppressed [ 868.399606][T23088] netlink: 'syz.2.6363': attribute type 10 has an invalid length. [ 868.518776][T23096] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6365'. [ 868.906723][T23108] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6371'. [ 869.078811][T23116] FAULT_INJECTION: forcing a failure. [ 869.078811][T23116] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 869.127772][T23116] CPU: 1 PID: 23116 Comm: syz.0.6375 Not tainted syzkaller #0 [ 869.135300][T23116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 869.145380][T23116] Call Trace: [ 869.148677][T23116] [ 869.151625][T23116] dump_stack_lvl+0x18c/0x250 [ 869.156334][T23116] ? show_regs_print_info+0x20/0x20 [ 869.161558][T23116] ? load_image+0x420/0x420 [ 869.166084][T23116] ? __might_fault+0xaa/0x120 [ 869.170782][T23116] ? __lock_acquire+0x7d80/0x7d80 [ 869.175843][T23116] should_fail_ex+0x394/0x4c0 [ 869.180548][T23116] _copy_from_user+0x2f/0xe0 [ 869.185161][T23116] __sys_bpf+0x23e/0x890 [ 869.189427][T23116] ? bpf_link_show_fdinfo+0x390/0x390 [ 869.194842][T23116] ? lock_chain_count+0x20/0x20 [ 869.199721][T23116] __x64_sys_bpf+0x7c/0x90 [ 869.204160][T23116] do_syscall_64+0x55/0xb0 [ 869.208605][T23116] ? clear_bhb_loop+0x40/0x90 [ 869.213309][T23116] ? clear_bhb_loop+0x40/0x90 [ 869.218008][T23116] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 869.223929][T23116] RIP: 0033:0x7f348439ce59 [ 869.228362][T23116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 869.248076][T23116] RSP: 002b:00007f348520f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 869.256516][T23116] RAX: ffffffffffffffda RBX: 00007f3484615fa0 RCX: 00007f348439ce59 [ 869.264506][T23116] RDX: 0000000000000048 RSI: 0000200000000780 RDI: 000000000000000a [ 869.272495][T23116] RBP: 00007f348520f090 R08: 0000000000000000 R09: 0000000000000000 [ 869.280485][T23116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 869.288463][T23116] R13: 00007f3484616038 R14: 00007f3484615fa0 R15: 00007ffd2024a648 [ 869.296442][T23116] [ 870.081028][T23129] netlink: 'syz.1.6379': attribute type 10 has an invalid length. [ 870.169867][T23129] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 870.213777][T23129] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 870.441775][T23136] netlink: 201392 bytes leftover after parsing attributes in process `syz.3.6381'. [ 870.471350][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.478214][T23136] net_ratelimit: 216 callbacks suppressed [ 870.478316][T23136] netlink: zone id is out of range [ 870.489414][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.520044][T23136] netlink: zone id is out of range [ 870.531545][T23136] netlink: zone id is out of range [ 870.560336][T23136] netlink: zone id is out of range [ 870.573054][T23136] netlink: zone id is out of range [ 870.589875][T23136] netlink: zone id is out of range [ 870.599996][T23136] netlink: zone id is out of range [ 870.616733][T23136] netlink: zone id is out of range [ 870.630574][T23136] netlink: zone id is out of range [ 870.884686][T23148] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6385'. [ 871.427826][T23163] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 871.504854][T23163] netlink: 'syz.3.6391': attribute type 10 has an invalid length. [ 875.622738][T23181] syzkaller0: entered promiscuous mode [ 875.632200][T23181] syzkaller0: entered allmulticast mode [ 877.527496][T23190] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6399'. [ 877.537668][T23192] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6400'. [ 877.547698][T23194] netlink: 17279 bytes leftover after parsing attributes in process `syz.3.6400'. [ 877.867340][T23204] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 877.897008][T23204] netlink: 'syz.0.6404': attribute type 10 has an invalid length. [ 878.226846][T23211] netlink: 'syz.3.6408': attribute type 10 has an invalid length. [ 878.249017][T23211] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6408'. [ 879.082378][T23233] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.6416'. [ 879.100655][T23233] tc_dump_action: action bad kind [ 879.321235][T23237] netlink: 'syz.3.6419': attribute type 10 has an invalid length. [ 879.354331][T23237] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6419'. [ 879.518408][T23247] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6422'. [ 879.937161][T23257] netlink: 'syz.0.6425': attribute type 6 has an invalid length. [ 879.957322][T23257] netlink: 164 bytes leftover after parsing attributes in process `syz.0.6425'. [ 880.045995][T23255] FAULT_INJECTION: forcing a failure. [ 880.045995][T23255] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 880.060059][T23255] CPU: 1 PID: 23255 Comm: syz.1.6426 Not tainted syzkaller #0 [ 880.067558][T23255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 880.077633][T23255] Call Trace: [ 880.080924][T23255] [ 880.083872][T23255] dump_stack_lvl+0x18c/0x250 [ 880.088574][T23255] ? show_regs_print_info+0x20/0x20 [ 880.093810][T23255] ? load_image+0x420/0x420 [ 880.098331][T23255] ? __might_fault+0xaa/0x120 [ 880.103027][T23255] ? __lock_acquire+0x7d80/0x7d80 [ 880.108076][T23255] should_fail_ex+0x394/0x4c0 [ 880.112778][T23255] _copy_to_user+0x2f/0xa0 [ 880.117218][T23255] bpf_test_finish+0x25a/0x650 [ 880.122001][T23255] ? bpf_test_run+0x174/0x870 [ 880.126691][T23255] ? convert_skb_to___skb+0x420/0x420 [ 880.132083][T23255] bpf_prog_test_run_skb+0x1135/0x18f0 [ 880.137598][T23255] ? cpu_online+0x60/0x60 [ 880.141941][T23255] bpf_prog_test_run+0x31f/0x390 [ 880.146892][T23255] __sys_bpf+0x49d/0x890 [ 880.152989][T23255] ? bpf_link_show_fdinfo+0x390/0x390 [ 880.158445][T23255] ? lock_chain_count+0x20/0x20 [ 880.163331][T23255] __x64_sys_bpf+0x7c/0x90 [ 880.167873][T23255] do_syscall_64+0x55/0xb0 [ 880.172337][T23255] ? clear_bhb_loop+0x40/0x90 [ 880.177040][T23255] ? clear_bhb_loop+0x40/0x90 [ 880.181744][T23255] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 880.187661][T23255] RIP: 0033:0x7f87aa19ce59 [ 880.192086][T23255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 880.211726][T23255] RSP: 002b:00007f87ab015028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 880.220154][T23255] RAX: ffffffffffffffda RBX: 00007f87aa415fa0 RCX: 00007f87aa19ce59 [ 880.228137][T23255] RDX: 0000000000000048 RSI: 0000200000000780 RDI: 000000000000000a [ 880.236118][T23255] RBP: 00007f87ab015090 R08: 0000000000000000 R09: 0000000000000000 [ 880.244104][T23255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 880.252089][T23255] R13: 00007f87aa416038 R14: 00007f87aa415fa0 R15: 00007ffc95cb4db8 [ 880.260103][T23255] [ 880.678630][T23277] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.6434'. [ 880.690581][T23277] netlink: 6320 bytes leftover after parsing attributes in process `syz.2.6434'. [ 880.707451][T23278] netlink: 'syz.1.6432': attribute type 10 has an invalid length. [ 881.242212][T23289] FAULT_INJECTION: forcing a failure. [ 881.242212][T23289] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 881.288359][T23289] CPU: 0 PID: 23289 Comm: syz.0.6439 Not tainted syzkaller #0 [ 881.295890][T23289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 881.305970][T23289] Call Trace: [ 881.309267][T23289] [ 881.312209][T23289] dump_stack_lvl+0x18c/0x250 [ 881.316914][T23289] ? show_regs_print_info+0x20/0x20 [ 881.322143][T23289] ? load_image+0x420/0x420 [ 881.326695][T23289] ? __might_fault+0xaa/0x120 [ 881.331390][T23289] ? __lock_acquire+0x7d80/0x7d80 [ 881.336423][T23289] should_fail_ex+0x394/0x4c0 [ 881.341105][T23289] _copy_to_user+0x2f/0xa0 [ 881.345517][T23289] bpf_test_finish+0x4e7/0x650 [ 881.350281][T23289] ? bpf_test_run+0x174/0x870 [ 881.354958][T23289] ? convert_skb_to___skb+0x420/0x420 [ 881.360340][T23289] bpf_prog_test_run_skb+0x1135/0x18f0 [ 881.365818][T23289] ? cpu_online+0x60/0x60 [ 881.370145][T23289] bpf_prog_test_run+0x31f/0x390 [ 881.375081][T23289] __sys_bpf+0x49d/0x890 [ 881.379319][T23289] ? bpf_link_show_fdinfo+0x390/0x390 [ 881.384702][T23289] ? lock_chain_count+0x20/0x20 [ 881.389641][T23289] __x64_sys_bpf+0x7c/0x90 [ 881.394057][T23289] do_syscall_64+0x55/0xb0 [ 881.398471][T23289] ? clear_bhb_loop+0x40/0x90 [ 881.403152][T23289] ? clear_bhb_loop+0x40/0x90 [ 881.407825][T23289] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 881.413721][T23289] RIP: 0033:0x7f348439ce59 [ 881.418146][T23289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 881.437753][T23289] RSP: 002b:00007f348520f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 881.446163][T23289] RAX: ffffffffffffffda RBX: 00007f3484615fa0 RCX: 00007f348439ce59 [ 881.454158][T23289] RDX: 0000000000000048 RSI: 0000200000000780 RDI: 000000000000000a [ 881.462144][T23289] RBP: 00007f348520f090 R08: 0000000000000000 R09: 0000000000000000 [ 881.470110][T23289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 881.478081][T23289] R13: 00007f3484616038 R14: 00007f3484615fa0 R15: 00007ffd2024a648 [ 881.486060][T23289] [ 881.534649][T23284] netlink: 'syz.3.6437': attribute type 3 has an invalid length. [ 882.119288][T23313] netlink: 'syz.1.6447': attribute type 10 has an invalid length. [ 882.678619][T23328] __nla_validate_parse: 6 callbacks suppressed [ 882.678635][T23328] netlink: 209820 bytes leftover after parsing attributes in process `syz.1.6454'. [ 882.698002][T23331] netlink: 'syz.3.6456': attribute type 10 has an invalid length. [ 882.778598][T23331] team0: Port device geneve1 added [ 885.873932][T23342] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6459'. [ 886.840123][T23370] netlink: 'syz.1.6468': attribute type 10 has an invalid length. [ 887.447603][T23382] netlink: 'syz.2.6474': attribute type 10 has an invalid length. [ 887.465660][T23382] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6474'. [ 887.794144][T23393] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 887.814081][T23393] netlink: 'syz.0.6479': attribute type 10 has an invalid length. [ 888.066534][T23404] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6485'. [ 888.354728][T23411] netlink: 'syz.3.6484': attribute type 28 has an invalid length. [ 888.386387][T23411] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6484'. [ 888.717809][T23417] netlink: 'syz.2.6488': attribute type 10 has an invalid length. [ 888.727070][T23417] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6488'. [ 889.098710][T23433] mac80211_hwsim hwsim45 €Â: renamed from wlan1 (while UP) [ 889.186572][T23433] netlink: 'syz.0.6496': attribute type 3 has an invalid length. [ 889.219894][T23433] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6496'. [ 889.283866][T23434] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 889.366706][T23440] netlink: 'syz.3.6494': attribute type 10 has an invalid length. [ 889.678897][T23445] netlink: 128 bytes leftover after parsing attributes in process `syz.0.6500'. [ 890.568395][T23453] netlink: 'syz.0.6502': attribute type 10 has an invalid length. [ 890.584197][T23453] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6502'. [ 890.941124][T23465] team_slave_1: entered promiscuous mode [ 890.946994][T23465] team_slave_1: entered allmulticast mode [ 891.033132][T23464] netlink: 'syz.3.6506': attribute type 153 has an invalid length. [ 891.133201][T23464] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.6506'. [ 891.359155][T23474] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 891.425407][T23479] netlink: 'syz.2.6511': attribute type 3 has an invalid length. [ 892.547980][T23497] validate_nla: 2 callbacks suppressed [ 892.548075][T23497] netlink: 'syz.0.6517': attribute type 10 has an invalid length. [ 892.595888][T23497] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6517'. [ 892.771251][T23499] syzkaller0: entered promiscuous mode [ 892.777315][T23499] syzkaller0: entered allmulticast mode [ 892.800401][T23505] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 892.829380][T23508] netlink: 'syz.2.6520': attribute type 10 has an invalid length. [ 892.988722][T23510] team_slave_1: entered promiscuous mode [ 893.006373][T23510] team_slave_1: entered allmulticast mode [ 894.608357][T23517] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6524'. [ 895.008648][T23529] netlink: 'syz.2.6529': attribute type 10 has an invalid length. [ 895.028091][T23529] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6529'. [ 895.317159][T23540] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 895.345211][T23540] netlink: 'syz.3.6532': attribute type 10 has an invalid length. [ 895.642668][T23543] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6533'. [ 895.870361][T23551] team_slave_1: entered promiscuous mode [ 895.878597][T23551] team_slave_1: entered allmulticast mode [ 896.529602][T23577] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.6544'. [ 896.598035][T23579] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 896.676665][T23579] netlink: 'syz.3.6545': attribute type 10 has an invalid length. [ 896.822621][T23586] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6547'. [ 898.155744][T23631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 898.219028][T23639] netlink: 'syz.2.6556': attribute type 10 has an invalid length. [ 898.249650][T23638] netlink: 'syz.0.6558': attribute type 10 has an invalid length. [ 898.292685][T23638] 8021q: adding VLAN 0 to HW filter on device team0 [ 898.322938][T23638] bond0: (slave team0): Enslaving as an active interface with an up link [ 898.521414][T23647] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6559'. [ 898.587138][T23651] netlink: 'syz.0.6561': attribute type 11 has an invalid length. [ 898.605341][T23651] netlink: 184116 bytes leftover after parsing attributes in process `syz.0.6561'. [ 899.349887][T23672] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 899.386002][T23672] netlink: 'syz.1.6568': attribute type 10 has an invalid length. [ 899.764826][T23684] netlink: 63503 bytes leftover after parsing attributes in process `syz.1.6573'. [ 899.801223][T23684] netlink: 'syz.1.6573': attribute type 4 has an invalid length. [ 899.829130][T23684] netlink: 152 bytes leftover after parsing attributes in process `syz.1.6573'. [ 899.926356][T23685] netlink: 'syz.1.6573': attribute type 29 has an invalid length. [ 900.697085][T23685] netlink: 'syz.1.6573': attribute type 29 has an invalid length. [ 900.722303][T23689] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6574'. [ 900.751681][T23688] netlink: 'syz.1.6573': attribute type 29 has an invalid length. [ 901.073448][T23695] netlink: 'syz.3.6576': attribute type 10 has an invalid length. [ 901.103276][T23695] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6576'. [ 901.837818][T23718] netlink: 'syz.1.6585': attribute type 29 has an invalid length. [ 901.880856][T23718] netlink: 'syz.1.6585': attribute type 29 has an invalid length. [ 902.805110][T23726] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6587'. [ 903.009695][T23733] syz.1.6590[23733] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 903.009838][T23733] syz.1.6590[23733] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 903.044218][T23733] ƒ: renamed from tunl0 (while UP) [ 903.176445][T23732] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6589'. [ 903.188152][T23735] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.6592'. [ 903.312288][T23735] validate_nla: 4 callbacks suppressed [ 903.312322][T23735] netlink: 'syz.3.6592': attribute type 9 has an invalid length. [ 903.352610][T23735] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.6592'. [ 904.078105][T23764] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6600'. [ 904.094532][T23764] netlink: del zone limit has 4 unknown bytes [ 904.169786][T23769] mac80211_hwsim hwsim39 ..ãc¤±: renamed from wlan1 (while UP) [ 904.456249][T23771] netlink: 'syz.3.6603': attribute type 10 has an invalid length. [ 904.469732][T23771] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6603'. [ 905.074178][T23792] netlink: 'syz.0.6610': attribute type 5 has an invalid length. [ 905.392435][T23801] netlink: 'syz.3.6616': attribute type 10 has an invalid length. [ 905.410950][T23801] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6616'. [ 905.583937][T23809] netlink: 'syz.3.6620': attribute type 21 has an invalid length. [ 905.908095][T23816] netlink: 'syz.0.6623': attribute type 2 has an invalid length. [ 905.923331][T23816] netlink: 'syz.0.6623': attribute type 1 has an invalid length. [ 905.943519][T23816] netlink: 'syz.0.6623': attribute type 33 has an invalid length. [ 905.962353][T23816] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6623'. [ 905.991710][T23823] netlink: 188 bytes leftover after parsing attributes in process `syz.3.6626'. [ 906.254163][T23830] netlink: 'syz.1.6628': attribute type 10 has an invalid length. [ 906.264741][T23830] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6628'. [ 906.543794][T23832] netlink: 'syz.3.6630': attribute type 1 has an invalid length. [ 906.576645][T23832] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.6630'. [ 906.996106][T23856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 910.045680][T23860] validate_nla: 2 callbacks suppressed [ 910.045720][T23860] netlink: 'syz.3.6640': attribute type 10 has an invalid length. [ 910.092366][T23860] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6640'. [ 910.222866][T23869] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6643'. [ 910.719811][T23884] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.6649'. [ 910.737314][T23884] netlink: 'syz.1.6649': attribute type 29 has an invalid length. [ 910.746450][T23884] netlink: 'syz.1.6649': attribute type 29 has an invalid length. [ 910.813086][T23885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 910.836941][T23885] netlink: 'syz.0.6650': attribute type 10 has an invalid length. [ 911.143087][T23892] netlink: 'syz.1.6653': attribute type 10 has an invalid length. [ 911.160560][T23892] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6653'. [ 914.287377][T23915] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 914.315969][T23915] netlink: 'syz.3.6662': attribute type 10 has an invalid length. [ 914.412879][T23920] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6663'. [ 914.445563][T23920] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6663'. [ 914.523477][T23920] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6663'. [ 914.562369][T23920] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6663'. [ 914.659238][T23927] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6665'. [ 922.157950][T24012] syz_tun: left allmulticast mode [ 922.183987][T24012] syz_tun: left promiscuous mode [ 922.199575][T24012] bridge0: port 4(syz_tun) entered disabled state [ 922.213138][T24012] hsr0: left allmulticast mode [ 922.223284][T24012] hsr_slave_0: left allmulticast mode [ 922.229018][T24012] bridge0: port 3(hsr0) entered disabled state [ 922.249097][T24012] bridge_slave_1: left allmulticast mode [ 922.256513][T24012] bridge_slave_1: left promiscuous mode [ 922.270839][T24012] bridge0: port 2(bridge_slave_1) entered disabled state [ 922.321309][T24012] bridge_slave_0: left allmulticast mode [ 922.333795][T24012] bridge_slave_0: left promiscuous mode [ 922.340164][T24012] bridge0: port 1(bridge_slave_0) entered disabled state [ 922.782075][T24035] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.6705'. [ 926.366959][T24070] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 926.409204][T24070] netlink: 'syz.3.6721': attribute type 10 has an invalid length. [ 928.998488][T24090] netlink: 'syz.2.6728': attribute type 10 has an invalid length. [ 929.007852][T24090] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6728'. [ 929.246760][T24101] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.6732'. [ 929.285389][T21739] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 929.339185][T24101] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 929.380869][T24108] netlink: 'syz.3.6731': attribute type 12 has an invalid length. [ 929.392242][T24108] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6731'. [ 929.747959][T24112] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 929.915422][T24117] syzkaller0: entered promiscuous mode [ 929.921167][T24117] syzkaller0: entered allmulticast mode [ 931.350692][T21739] Bluetooth: hci2: command 0x0406 tx timeout [ 931.839785][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.847890][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 933.559191][T24132] netlink: 'syz.2.6743': attribute type 29 has an invalid length. [ 935.038441][T24125] netlink: 'syz.3.6740': attribute type 10 has an invalid length. [ 935.046463][T24125] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6740'. [ 935.058314][T24129] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 935.067765][T24130] netlink: 'syz.1.6742': attribute type 10 has an invalid length. [ 935.096192][T24132] netlink: 'syz.2.6743': attribute type 29 has an invalid length. [ 935.108321][T24133] netlink: 'syz.2.6743': attribute type 29 has an invalid length. [ 935.158092][T24139] netlink: 10 bytes leftover after parsing attributes in process `syz.0.6744'. [ 935.455306][T24148] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.6747'. [ 935.501642][T21739] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 938.140600][T21739] Bluetooth: hci1: command 0x0406 tx timeout [ 951.199719][T14820] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 951.209855][T14820] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 951.218065][T14820] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 951.227263][T14820] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 951.235249][T14820] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 951.243642][T14820] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 951.363802][T21739] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 951.373585][T21739] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 951.387309][T21739] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 951.396534][T21739] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 951.412721][T21739] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 951.424658][T21739] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 952.456379][T14820] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 952.469169][T14820] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 952.484808][T14820] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 952.495126][T14820] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 952.507639][T14820] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 952.525800][T14820] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 952.603173][T21739] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 952.612966][T21739] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 952.621459][T21739] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 952.634787][T21739] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 952.642832][T21739] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 952.650265][T21739] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 953.270777][T14820] Bluetooth: hci3: command tx timeout [ 953.510780][T14820] Bluetooth: hci5: command tx timeout [ 954.550634][T14820] Bluetooth: hci6: command tx timeout [ 954.711219][T14820] Bluetooth: hci7: command tx timeout [ 955.350748][T14820] Bluetooth: hci3: command tx timeout [ 955.590649][T14820] Bluetooth: hci5: command tx timeout [ 956.630633][T14820] Bluetooth: hci6: command tx timeout [ 956.791067][T14820] Bluetooth: hci7: command tx timeout [ 957.435518][T14820] Bluetooth: hci3: command tx timeout [ 957.670676][T14820] Bluetooth: hci5: command tx timeout [ 958.710725][T14820] Bluetooth: hci6: command tx timeout [ 958.871120][T14820] Bluetooth: hci7: command tx timeout [ 959.510791][T14820] Bluetooth: hci3: command tx timeout [ 959.750575][T14820] Bluetooth: hci5: command tx timeout [ 960.790674][T14820] Bluetooth: hci6: command tx timeout [ 960.953752][T14820] Bluetooth: hci7: command tx timeout [ 993.301831][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.308287][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1017.112278][T21739] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1017.122903][T21739] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1017.133123][T21739] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1017.173763][T21739] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1017.189211][T21739] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 1017.197619][T21739] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1017.355380][ T5778] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1017.380760][ T5778] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1017.389059][ T5778] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1017.398362][ T5778] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1017.406318][ T5778] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 1017.414320][ T5778] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1018.751916][T21739] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1018.769680][T21739] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1018.778109][T21739] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1018.787412][T21739] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1018.795618][T21739] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3 [ 1018.803226][T21739] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1019.111720][T21739] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1019.126507][T21739] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1019.135977][T21739] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1019.161139][T21739] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1019.169198][T21739] Bluetooth: hci11: unexpected cc 0x0c25 length: 249 > 3 [ 1019.179819][T21739] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1019.280640][T21739] Bluetooth: hci8: command tx timeout [ 1019.520913][T21739] Bluetooth: hci9: command tx timeout [ 1020.970637][T21739] Bluetooth: hci10: command tx timeout [ 1021.271015][T21739] Bluetooth: hci11: command tx timeout [ 1021.350600][T21739] Bluetooth: hci8: command tx timeout [ 1021.590615][T21739] Bluetooth: hci9: command tx timeout [ 1023.030921][T21739] Bluetooth: hci10: command tx timeout [ 1023.351075][T21739] Bluetooth: hci11: command tx timeout [ 1023.430708][T21739] Bluetooth: hci8: command tx timeout [ 1023.671073][T21739] Bluetooth: hci9: command tx timeout [ 1025.110694][T21739] Bluetooth: hci10: command tx timeout [ 1025.430895][T21739] Bluetooth: hci11: command tx timeout [ 1025.510697][T21739] Bluetooth: hci8: command tx timeout [ 1025.752955][T21739] Bluetooth: hci9: command tx timeout [ 1027.190753][T21739] Bluetooth: hci10: command tx timeout [ 1027.511212][T21739] Bluetooth: hci11: command tx timeout [ 1041.590476][ C0] rcu: INFO: rcu_preempt self-detected stall on CPU [ 1041.597129][ C0] rcu: 0-....: (10342 ticks this GP) idle=d3ac/1/0x4000000000000000 softirq=91735/91771 fqs=4636 [ 1041.608865][ C0] rcu: hardirqs softirqs csw/system [ 1041.615260][ C0] rcu: number: 1216998 0 0 [ 1041.621651][ C0] rcu: cputime: 19549 32909 35 ==> 52470(ms) [ 1041.629455][ C0] rcu: (t=10501 jiffies g=119121 q=2268 ncpus=2) [ 1041.635875][ C0] CPU: 0 PID: 24143 Comm: syz.1.6746 Not tainted syzkaller #0 [ 1041.643329][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1041.653380][ C0] RIP: 0010:ieee80211_scan_rx+0x0/0x8a0 [ 1041.659026][ C0] Code: f9 80 e1 07 fe c1 38 c1 0f 8c 38 fc ff ff 4c 89 ff e8 e4 1b ea f7 e9 2b fc ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <66> 0f 1f 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 38 48 89 f3 48 [ 1041.678640][ C0] RSP: 0018:ffffc900000079b8 EFLAGS: 00000246 [ 1041.684796][ C0] RAX: ffffffff89fe64f7 RBX: 0000000000000000 RCX: ffff88805c710000 [ 1041.692768][ C0] RDX: 0000000000000100 RSI: ffff888061a688c0 RDI: ffff88805d1b0e80 [ 1041.700735][ C0] RBP: ffffc90000007c10 R08: ffff88805c710000 R09: 0000000000000003 [ 1041.708700][ C0] R10: 0000000000000080 R11: 0000000000000100 R12: ffff888061a688c0 [ 1041.716664][ C0] R13: 1ffff92000000f4c R14: 0000000000000080 R15: 0000000000000080 [ 1041.724626][ C0] FS: 00007f87ab0156c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1041.733545][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1041.740119][ C0] CR2: 0000200000007940 CR3: 000000005cd79000 CR4: 00000000003506f0 [ 1041.748083][ C0] DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000008d24 [ 1041.756045][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1041.764011][ C0] Call Trace: [ 1041.767283][ C0] [ 1041.770118][ C0] ieee80211_rx_list+0x249b/0x3240 [ 1041.775332][ C0] ? ieee80211_check_fast_rx_iface+0x210/0x210 [ 1041.781493][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 1041.786690][ C0] ? read_lock_is_recursive+0x20/0x20 [ 1041.792066][ C0] ? ieee80211_rx_napi+0xd2/0x3c0 [ 1041.797190][ C0] ieee80211_rx_napi+0x1ae/0x3c0 [ 1041.802143][ C0] ? ieee80211_rx_list+0x3240/0x3240 [ 1041.807443][ C0] ? skb_dequeue+0x124/0x160 [ 1041.812043][ C0] ieee80211_handle_queued_frames+0x105/0x190 [ 1041.818196][ C0] ? ieee80211_reconfig_filter+0x20/0x20 [ 1041.823826][ C0] tasklet_action_common+0x2d4/0x460 [ 1041.829113][ C0] ? net_tx_action+0x950/0x950 [ 1041.833968][ C0] ? trace_raw_output_tasklet+0xc0/0xc0 [ 1041.839514][ C0] handle_softirqs+0x27d/0x820 [ 1041.844272][ C0] ? read_tsc+0x9/0x20 [ 1041.848354][ C0] ? ktime_get+0x24b/0x280 [ 1041.852768][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 1041.857524][ C0] ? do_softirq+0x1a0/0x1a0 [ 1041.862039][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 1041.867259][ C0] __irq_exit_rcu+0xd3/0x190 [ 1041.871862][ C0] ? irq_exit_rcu+0x20/0x20 [ 1041.876375][ C0] irq_exit_rcu+0x9/0x20 [ 1041.880609][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1041.886241][ C0] [ 1041.889164][ C0] [ 1041.892088][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1041.898071][ C0] RIP: 0010:preempt_schedule_irq+0xba/0x150 [ 1041.903984][ C0] Code: 00 00 43 c6 44 37 04 f8 74 0b 0f 0b 48 f7 03 08 00 00 00 74 6f bf 01 00 00 00 e8 01 48 d0 f6 e8 3c 34 01 f7 fb bf 01 00 00 00 31 b4 ff ff 43 c6 44 37 08 00 48 c7 44 24 40 00 00 00 00 9c 8f [ 1041.923585][ C0] RSP: 0018:ffffc90003327d60 EFLAGS: 00000286 [ 1041.929646][ C0] RAX: 3bc684face46fa00 RBX: 0000000000000000 RCX: 3bc684face46fa00 [ 1041.937610][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: 0000000000000001 [ 1041.945574][ C0] RBP: ffffc90003327e10 R08: ffffffff8e8ae5ef R09: 1ffffffff1d15cbd [ 1041.953537][ C0] R10: dffffc0000000000 R11: fffffbfff1d15cbe R12: 0000000000000000 [ 1041.961500][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000664fac [ 1041.969474][ C0] ? preempt_schedule_notrace+0x110/0x110 [ 1041.975197][ C0] ? lock_chain_count+0x20/0x20 [ 1041.980050][ C0] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 1041.985855][ C0] irqentry_exit+0x67/0x70 [ 1041.990269][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1041.996250][ C0] RIP: 0010:exit_to_user_mode_loop+0x40/0x110 [ 1042.002317][ C0] Code: fb eb 1d e8 02 49 10 09 65 48 8b 05 0a 14 90 7e 4c 8b 30 41 f7 c6 0e 30 02 00 0f 84 c4 00 00 00 e8 c5 af 19 00 fb 41 f6 c6 08 <74> 05 e8 19 76 18 09 41 f7 c6 00 10 00 00 74 08 48 89 df e8 b8 a0 [ 1042.021919][ C0] RSP: 0018:ffffc90003327ed0 EFLAGS: 00000246 [ 1042.027977][ C0] RAX: 3bc684face46fa00 RBX: ffffc90003327f58 RCX: 3bc684face46fa00 [ 1042.035937][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1c7be0 [ 1042.043903][ C0] RBP: ffffc90003327f48 R08: ffffffff8e8ae5ef R09: 1ffffffff1d15cbd [ 1042.051867][ C0] R10: dffffc0000000000 R11: fffffbfff1d15cbe R12: 0000000000000000 [ 1042.059826][ C0] R13: 0000000000000000 R14: 0000000000004002 R15: ffff88805c710000 [ 1042.067802][ C0] exit_to_user_mode_prepare+0xee/0x180 [ 1042.073373][ C0] syscall_exit_to_user_mode+0x1a/0x50 [ 1042.078834][ C0] do_syscall_64+0x61/0xb0 [ 1042.083241][ C0] ? clear_bhb_loop+0x40/0x90 [ 1042.087908][ C0] ? clear_bhb_loop+0x40/0x90 [ 1042.092574][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1042.098463][ C0] RIP: 0033:0x7f87aa19ce59 [ 1042.102869][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1042.122467][ C0] RSP: 002b:00007f87ab015028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1042.130872][ C0] RAX: ffffffffffffffea RBX: 00007f87aa415fa0 RCX: 00007f87aa19ce59 [ 1042.138835][ C0] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 1042.146804][ C0] RBP: 00007f87aa232e6f R08: 0000000000000000 R09: 0000000000000000 [ 1042.154767][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1042.162736][ C0] R13: 00007f87aa416038 R14: 00007f87aa415fa0 R15: 00007ffc95cb4db8 [ 1042.170715][ C0]