last executing test programs: 5.624400725s ago: executing program 1 (id=2487): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x20) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x401c5820, 0x0) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000f100711226000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94) 2.69038031s ago: executing program 1 (id=2503): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a, 0x0, 0x1}, 0x28) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x18}]}, &(0x7f0000000000)='syzkaller\x00'}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='rdma.current\x00', 0x26e1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x6, 0x804, 0x0, 0x7}, {0x10400002, 0x2, 0x0, 0x5}], 0x10, 0xfffffffd}, 0x94) r1 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) close(r1) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10, 0x0}, 0x40) r5 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r5, 0x84, 0x64, &(0x7f0000000000)=r8, 0x10) sendmsg$inet(r7, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x4e1f, @local}, 0x10, 0x0}, 0x8000) setsockopt$sock_attach_bpf(r1, 0x84, 0x64, &(0x7f0000000000)=r4, 0x10) sendmsg$inet(r1, &(0x7f0000000b40)={&(0x7f0000000140)={0x2, 0x4e20, @loopback=0xb09b5473}, 0x10, &(0x7f0000000940)=[{&(0x7f0000000680)='#', 0x1}], 0x1}, 0x44044) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046881f782db44b904021d080b01000000e8fe55a118001500060014ef030000120800040043000000a8001600a400014020", 0x39}], 0x1}, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x401, 0x20040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x117bd3, 0x4, 0x0, 0x1, 0x5, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[], 0xfe33) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 2.622690012s ago: executing program 0 (id=2505): r0 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfe103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x4, 0x8}, 0x2000, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a500850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xc, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r2, &(0x7f0000000000), 0x2a979d) 2.484201455s ago: executing program 2 (id=2506): socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffe}, 0x10c002, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200), 0x2, 0x0) write$cgroup_netprio_ifpriomap(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="6e9530323100"], 0x6) r4 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r2) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0xd, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000004000000000000009aaa000018150000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000807b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001d000000850000007d00000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xe, 0x4, 0x1, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000200000005"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00000000000000000000000000be76105acb2364262734a900000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x6, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f00000000c0)=r11, 0x4) sendmsg$unix(r10, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r6, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r0], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3d}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r12, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$kcm(0x10, 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020022003505d25a806f8c6394f97e24fc6004030e000a740100053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x74000000}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) 2.418358446s ago: executing program 3 (id=2508): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x0, @perf_bp={0x0}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0xfffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x20, 0x1, 0x0, 0xffdff036}]}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x8c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, @perf_bp={0x0}, 0x10800a, 0x6f5f, 0x8000, 0x0, 0x0, 0x1001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020039000b05d25a806f8c6394f90324fc602f00000008000100feff000037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) syz_clone(0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000580)={{0x1}, &(0x7f0000000440), &(0x7f0000000540)='%+9llu \x00'}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@bloom_filter={0x1e, 0x2, 0x1400000, 0x9, 0x20, 0x1, 0xffff8cb8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x4, 0xc}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)={0x1b, 0x0, 0x0, 0xa, 0x0, 0x1, 0xa81afd6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0) sendmsg$inet(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e0800000709000000000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4000000) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) 2.315878058s ago: executing program 1 (id=2509): bpf$ITER_CREATE(0x21, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r0, &(0x7f0000000000), 0x2a979d) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000940)=""/4108, 0x100c}, {&(0x7f0000001980)=""/4094, 0xffe}, {&(0x7f00000005c0)=""/240, 0xf0}, {&(0x7f0000000200)=""/217, 0xd9}, {&(0x7f0000000040)=""/59, 0x3b}], 0x5}, 0x0) recvmsg$kcm(r1, &(0x7f0000000900)={0x0, 0xffc3, 0x0}, 0x80) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) 2.26406922s ago: executing program 4 (id=2519): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x200, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x100}) ioctl$TUNSETLINK(r0, 0x400454cc, 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000500), 0x1}, 0x0, 0x0, 0xfffffffc, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000001340)=@hci={0x1f, 0xd00, 0xe}, 0x80, 0x0}, 0x4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc///\x00\x82q\xee\x00!\xbd\xc2\x98#YP\xee\x9c2G\xf0\x81x\x97'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1c, 0x3ff, 0x6d, 0x401, 0x201, 0x1, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x6, [@var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x61, 0x2e, 0x2e]}}, 0x0, 0x2e}, 0x28) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r5}, 0xc) socket$kcm(0xa, 0x5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b701000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r7, 0x29, 0x7, &(0x7f0000000000)=r6, 0x4) 1.913433057s ago: executing program 3 (id=2510): r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000180)="3c00000033000b12d25a80648c2594f90124fc60100c034002418000002000139215a2281cf6b820a735b16b6a44799406db26a57b35000000000000", 0x3c}], 0x1}, 0x0) r3 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x29, 0x43, &(0x7f0000000000), 0x4) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000ec0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB="42000008006de0e900"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000010000000500"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0xe, 0x2c, &(0x7f0000000640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0xe0}, {}, {}, [@map_val={0x18, 0x7, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x3}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @cb_func={0x18, 0x4, 0x4, 0x0, 0xfffffffffffffffb}, @call={0x85, 0x0, 0x0, 0x49}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x2}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xb4057a58ccd00c76}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000280)='syzkaller\x00', 0xa14a, 0x0, 0x0, 0x41100, 0x3c, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x8, &(0x7f0000000980)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000009c0)={0x1, 0x10, 0x9, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x7, &(0x7f0000001000)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff], &(0x7f0000001040)=[{0x1, 0x1, 0xc, 0x2}, {0x3, 0x4, 0x8}, {0x1, 0x1, 0x5, 0x9}, {0x5, 0x2, 0xc, 0x7}, {0x0, 0x5, 0xd, 0x7}, {0x5, 0x5, 0xc}, {0x3, 0x2, 0x0, 0x2}], 0x10, 0x80}, 0x94) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000560013f16ff28e036afc004a07"], 0xfe33) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001b80)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x5}, 0x94) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x7, 0x8, 0x9, 0x0, 0x0, 0xfffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000000fc0)={&(0x7f0000001340)=@hci={0x1f, 0x200, 0x31}, 0x80, &(0x7f0000000000)=[{&(0x7f0000001040)="b8b2cc1e00c1dba49dbb66ca3a66", 0xe}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r5) r7 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1b0000001a007f029e", 0x9}, {&(0x7f0000000200)="68cabf2dfb58fc0a01008888ffff0200258f", 0x12}], 0x2}, 0x0) r8 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000e8ffffffffffff05000000", @ANYRES32=0x1], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r8, 0x8916, &(0x7f0000000000)={r8}) 1.911651207s ago: executing program 2 (id=2521): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x0, @perf_bp={0x0}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0xfffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x20, 0x1, 0x0, 0xffdff036}]}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x8c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, @perf_bp={0x0}, 0x10800a, 0x6f5f, 0x8000, 0x0, 0x0, 0x1001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020039000b05d25a806f8c6394f90324fc602f00000008000100feff000037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) syz_clone(0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000580)={{0x1}, &(0x7f0000000440), &(0x7f0000000540)='%+9llu \x00'}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@bloom_filter={0x1e, 0x2, 0x1400000, 0x9, 0x20, 0x1, 0xffff8cb8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x4, 0xc}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0) sendmsg$inet(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e0800000709000000000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4000000) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) 1.900943358s ago: executing program 0 (id=2511): r0 = perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10}, 0x8, 0x8000000000ca, 0x0, 0x2, 0x0, 0x10, 0x153, 0x0, 0xffffff7e, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48283, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$kcm(0x11, 0x3, 0x300) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000340)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000040000"], 0x48) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000018000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32=r5, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000a4000000b7000000000000009500000000000000b7000000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r6, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) r7 = gettid() perf_event_open(&(0x7f0000000240)={0x5, 0x80, 0x80, 0x5, 0x81, 0xf, 0x0, 0x0, 0xc0000, 0xc, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x4, @perf_bp={&(0x7f0000000100), 0x6}, 0x400, 0x10, 0x8, 0xd31e89b2530caaa, 0x1, 0x10000, 0xffff, 0x0, 0x0, 0x0, 0x7fffffffffffffff}, r7, 0xd, r0, 0x1) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r3, &(0x7f0000000200)=ANY=[@ANYRES8=r2, @ANYRES8=r8], 0x12) ioctl$TUNGETFEATURES(r4, 0x800454cf, &(0x7f00000001c0)) 1.79903766s ago: executing program 4 (id=2512): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x7b64, &(0x7f0000000280)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d8fd8978f45225d9ee000000007ea60860160af36504000100080ec000000002009ee517c356a7b0251e61e659ad3af435cf01c937e786a6d0bdd7fcf50e4509c5cc68b7ed9c232d786c35fe0000000000", 0x5c}], 0x1, 0x0, 0x4c0, 0x1f00c00e}, 0x0) 1.502401786s ago: executing program 4 (id=2513): r0 = perf_event_open(&(0x7f0000000040)={0x4432fcd87498c384, 0x80, 0xf, 0x7, 0x7, 0x3, 0x0, 0x8, 0x12000, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x4, @perf_bp={&(0x7f0000000000), 0x1}, 0x4440, 0xffffffffffffffff, 0x4, 0x5, 0x8000000000000001, 0x80000000, 0x7, 0x0, 0x7, 0x0, 0x4}, 0x0, 0x2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000000c0)='C@/.\x00') r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x2b3c, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={&(0x7f0000000100)="71a6fe065a15b2351b3c783fc709bb915d0897ca0a5caff73d0e7e6104c2bfe5d8524fc22d11871daf122daa518ac7ea33b8386e482d5544c576d24c36", &(0x7f0000000140)=""/72, &(0x7f00000001c0)="bcd5e36c7cedbc35665028beb698dd4376edfb36597f09e7e44193f5788a459ef394d8da5e85e4100259eb0733e09a4d11d05192f8b542370e6be4a3d81b68aae4a49924a1dd032f0df6c59fd9af0dfc8cc4cc862be5241b8f3522b6bc554d3b1733473c237d429c34cb152e93719c655f24e04694ed358a", &(0x7f0000000240)="1a0ce4ac76bdec5b3354f319f57b7c71be787e8333fd7956559a7b693103d40b1490191e27ef", 0x1, r1}, 0x38) r2 = openat$cgroup_ro(r1, &(0x7f00000003c0)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x9, 0x8, 0x7, 0x2, 0x0, 0x81, 0xc01a2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x591, 0x0, @perf_config_ext={0x800, 0x6}, 0x88, 0x5, 0x1ff, 0x5, 0x1, 0x1ff, 0x0, 0x0, 0xd2, 0x0, 0x9}, 0x0, 0x10, r2, 0x3) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000400)={r2, 0xffffffffffffffff}, 0x4) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000004c0)={r2, &(0x7f0000000440)="9f36b37bdfad16ab889c5b79128cfc41f65e8a29dd9f3eefddcfac29b188b4f156363afd46ec57a3fcc71b6b7395e6", &(0x7f0000000480)=""/20}, 0x20) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000640)={r3, 0x58, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000700)={0xc00c, 0x0}, 0x8) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x7, &(0x7f0000000740)=@raw=[@map_idx_val={0x18, 0xfe781cd2cc7bfb2c, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4}, @ldst={0x3, 0x2, 0x1, 0x3, 0xa, 0xfffffffffffffe9c, 0x1}, @map_idx={0x18, 0xa, 0x5, 0x0, 0xf}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @call={0x85, 0x0, 0x0, 0x57}], &(0x7f0000000780)='syzkaller\x00', 0xe1, 0xcb, &(0x7f00000007c0)=""/203, 0x41000, 0xc, '\x00', 0x0, 0x25, r2, 0x8, &(0x7f00000008c0)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000900)={0x0, 0xf, 0x9, 0x5}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000940)=[r1, r1, r1, r2, r1, 0x1, r3], &(0x7f0000000980)=[{0x4, 0x5, 0x5, 0x2}, {0x4, 0x5, 0xf, 0x6}, {0x2, 0x4, 0xf, 0x8}, {0x0, 0x2, 0x4, 0x1}, {0x1, 0xb39, 0xb}, {0x4, 0x5, 0xa, 0xc}, {0x0, 0x2, 0xf, 0x7}, {0x3, 0x4, 0x7, 0xb}], 0x10, 0xec58}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x8, 0x7, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6}, [@map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xab2}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x2}]}, &(0x7f0000000580)='syzkaller\x00', 0x4ae662a1, 0x0, 0x0, 0x41000, 0x8, '\x00', r5, @fallback=0x14, r2, 0x8, &(0x7f0000000680)={0x7, 0x5}, 0x8, 0x10, &(0x7f00000006c0)={0x4, 0x1, 0x40, 0x9}, 0x10, r6, r7, 0x2, 0x0, &(0x7f0000000ac0)=[{0x1, 0x1, 0xb, 0x2}, {0x5, 0x1, 0x0, 0x2}], 0x10, 0x5}, 0x94) sendmsg$inet(r2, &(0x7f0000001000)={&(0x7f0000000bc0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3e}}, 0x10, &(0x7f0000000f00)=[{&(0x7f0000000c00)="c277b982ccfe15ebaeb54d3eebb609486ac4538256a7c0ad40712f25041c287865ea847ae8e3bef485df91dbe9d927031f86a34d5ba2193e15cca77e2fbb47b60985128e95e2c36c74a8062f68946193e031a150f1ed40aca0e8d56bd97083ae424674d0948b117ead51f4686e73e5e6b97a35b635791648ef055d2566", 0x7d}, {&(0x7f0000000c80)="bdb665a8deb39f3a401b9ee817cc82a7339928d8cbf1c3914e75535f8eeb820e36effcabb640387cdf684919bdb6481842039999e264c3635c55de709c7be63b23076aa10a9a7b0c2048889d056f7f239560d3c1d881155ef2bb86aaa9c88d01280be9527486122803114a61ce90c663ecbf479bcbbc054444c63543c4b073fd886716762891ddb39b2eb9e059f4a7fbeba91098faca97fe161ad0f7c225e6afbf2bfd4d811587b22429ce6ce0a5d8caf4c68aac643d088341b26bd21982c9f9793549b69ee50a5ef4081a0ae8aefb3f056d079d5ae5c2a7c80520241e7f2840218cf77e8076df95", 0xe8}, {&(0x7f0000000d80)="bffcb04049698f3c561decbd0c8020a6111c8e0f09d9631005496882685086280e1adaf1ef25722e3a370a802229a3ddea31ac05e562eaee82e214be0f0d0129eda00fe6b78487eec68d5a", 0x4b}, {&(0x7f0000000e00)="62c08a4f7b8cf1c87c4647ab3ef1d8284950fc40e24ba2353d51d87e9e0e0de0d577303de2f7cd3d2c34f64f2f3b13008af7162ef5295de009c96346545d35bee452225fc2c364eeb335fc191656108c990e36a440b678e6a58039277d676b287f7aac259c26ac5eae9f39a8b6d789dbc43d2bd2", 0x74}, {&(0x7f0000000e80)="58fb5abb782359d5a068169d62c65334076311cc237f9541c778b41597102c34bad59c998e917def795a9e28f7ec2cbdb7bfefd49c70d1705c15440bdb27c89305750f4e2540231f0783874fdc2528a533ed092439dce043eb11fb8fea44912f8f7cb06ba763a79835f80558ca62", 0x6e}], 0x5, &(0x7f0000000f80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @multicast1, @loopback}}}, @ip_retopts={{0x40, 0x0, 0x7, {[@timestamp_prespec={0x44, 0xc, 0x49, 0x3, 0x1, [{@local, 0x8}]}, @generic={0x16, 0x11, "fe327bc1c186e1de856fb60c69ca08"}, @rr={0x7, 0x13, 0x22, [@broadcast, @loopback, @local, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}], 0x60}, 0x20000800) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, &(0x7f0000001040)="4c1760dc79b3666a0aabb18b7cda7f50468bd3a38987b4b01d7f1ba4bfbb0c317077babe14ca44626ee6f36099c279424dce428a4b5ce7ebcae52e292a40f34fffdd8928c3d907fcbb79c50b0eb49bd14bc42a6b44191e323af81d9ee81766c757e99f336fe88b2c0c0630c2d788be02c29163adf34849d5ef67f5b5ef1d6cbd996e62416021f5", &(0x7f0000001100)=""/21, 0x4}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001400)={0x6, 0x1e, &(0x7f0000001180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@jmp={0x5, 0x0, 0xb, 0x3, 0x3, 0xc, 0x8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x45}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2ed, 0x0, 0x0, 0x0, 0xa}, @call={0x85, 0x0, 0x0, 0xa7}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001280)='GPL\x00', 0x2, 0x5f, &(0x7f00000012c0)=""/95, 0x40f00, 0x14, '\x00', r5, 0x25, r2, 0x8, &(0x7f0000001340)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x4, 0xf, 0x2, 0x4}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000013c0)=[{0x0, 0x4, 0x4, 0x2}], 0x10, 0x2}, 0x94) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000001500)={0x3, 0x80, 0x2, 0x6, 0x3, 0x3, 0x0, 0x1, 0x180, 0x4, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0xc, 0x1, @perf_bp={&(0x7f00000014c0)}, 0x0, 0x4, 0x2, 0xf, 0x12, 0x10001, 0x2, 0x0, 0x7fff, 0x0, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001580)) ioctl$PERF_EVENT_IOC_ID(r7, 0x80082407, &(0x7f00000015c0)) write$cgroup_subtree(r2, &(0x7f0000001600)={[{0x2d, 'perf_event'}, {0x2b, 'net_prio'}]}, 0x16) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r2) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001640)={0x3, 0x4, 0x4, 0xa, 0x0, r3, 0x9, '\x00', r5, r2, 0x5, 0x3}, 0x50) openat$cgroup_type(r2, &(0x7f00000016c0), 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001840)={&(0x7f0000001700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x9d, 0x9d, 0x9, [@const={0xe, 0x0, 0x0, 0xa, 0x2}, @typedef={0x9, 0x0, 0x0, 0x8, 0x2}, @float={0xf, 0x0, 0x0, 0x10, 0x10}, @ptr={0x0, 0x0, 0x0, 0x2, 0x2}, @datasec={0x7, 0x7, 0x0, 0xf, 0x1, [{0x5, 0xf2e, 0xa}, {0x1, 0x3, 0xa8d}, {0x2, 0x24, 0xd0}, {0x5, 0x80000001, 0x4}, {0x1, 0x4, 0x10001}, {0x4, 0x6, 0x7}, {0x2, 0x7fffffff, 0x101}], "db"}, @type_tag={0x8, 0x0, 0x0, 0x12, 0x5}]}, {0x0, [0x2e, 0x5f, 0x0, 0x2e, 0x51, 0x61, 0x5f]}}, &(0x7f0000001800)=""/55, 0xc1, 0x37, 0x1, 0x4}, 0x28) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001940)={r3, &(0x7f0000001880)="e31c9aee76786e8cff10be453d8ebb86bfbbc2643ca014050d6dee49b2b5d2498fae366f469624d73b80496ede6c96a762332953cd801d7dcb936bfc9b9ac8964204f05ead57365bf9bcfa8bfc50d18cd9fe60178c52c7e5862b6666b7daadf0be4b4df8be67f9e49006bef98815dfd1fde6a48312a8bfb7c80a4df1e670f8", &(0x7f0000001900)=""/27, 0x4}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001a80)={@cgroup=r4, 0x15, 0x1, 0x8, &(0x7f0000001980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f00000019c0)=[0x0, 0x0], &(0x7f0000001a00)=[0x0, 0x0, 0x0], &(0x7f0000001a40)=[0x0, 0x0, 0x0]}, 0x40) socketpair(0x26, 0x1, 0x0, &(0x7f0000001ac0)={0xffffffffffffffff}) recvmsg$unix(r8, &(0x7f0000001c80)={&(0x7f0000001b00), 0x6e, &(0x7f0000001c40)=[{&(0x7f0000001b80)=""/185, 0xb9}], 0x1}, 0x40002162) bpf$TOKEN_CREATE(0x24, &(0x7f0000001d00), 0x8) 1.500736706s ago: executing program 2 (id=2525): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x200, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x100}) ioctl$TUNSETLINK(r0, 0x400454cc, 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000500), 0x1}, 0x0, 0x0, 0xfffffffc, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000001340)=@hci={0x1f, 0xd00, 0xe}, 0x80, 0x0}, 0x4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc///\x00\x82q\xee\x00!\xbd\xc2\x98#YP\xee\x9c2G\xf0\x81x\x97'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1c, 0x3ff, 0x6d, 0x401, 0x201, 0x1, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x6, [@var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x61, 0x2e, 0x2e]}}, 0x0, 0x2e}, 0x28) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r5}, 0xc) socket$kcm(0xa, 0x5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b701000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r7, 0x29, 0x7, &(0x7f0000000000)=r6, 0x4) 1.499744786s ago: executing program 1 (id=2514): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x58c8, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9ffc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair(0x2, 0x2, 0x73, &(0x7f0000000000)) r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000047000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a876d839240d29c035055b67db3e6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7e8dc34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bb44b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334583239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bf4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc508afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd360000000000000000ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c97a088a22e8b15c3e233db00002e30d46a0024d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c29c5c0ed5bcdf510c3c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ced92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f68fa8d7c2dfb28e1f05e46b0933c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b19abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d588afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda6900002a070886df42b27098773b45198b4a34ac97febd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f0000000000f8e10238d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d63521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07afef12ef060cd4403a099f32468f658000b4082d43e12186195cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea209b53b230ef0f2ab85cbdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bd3339403004b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab900000000000000000000d71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdbf24a0c5441ce046078492b53467cfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89cb349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb15f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c00c57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137df47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b558982016b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8b49e3d0168bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85a3009a5d30f479e293a3302e11350ea857b37e76ca3f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c8ffe0d508dcee3070e8b42ac38545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f98117919472b61b20026d7e646174b55d251f7f8ca5ccc22a5efb33b217eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4444e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24000000000000000000000000000000000000cd3211b3842b68a4eddca2eae28529e97a98d7ec3fd902df1ba8fc2ad2377e72d4e7aeacbbccef5614cd965511558f40720025c022bc9c213e407f6bc4b673c55aa8e729299a37fd6339acd906ac861ba56c9fa9b8b12b5e68a3cdadb906355e1f1d336a243172affe50d0fb36c3718a7498eed3d398f405a34d494414e87ef1ce1845510d43d00171d6b4b762f89564c22d542a119878709cd6822c3a3eb47a849b0737929fe9e1eecd1bff5a2b9880e2a6d8a3b3b7e88a673c96cda4455eff1c530db0e6598a2686aa09aeaf0f1aed95aeb8b0a2cc5ca31c0f56285cc05f7090a0e0583cf540d18cd8817e685c7b4ff176178ac1234f23e54445ec20b2689832d78409897a0307e89ebcd5f4ba042a3d10237a5a8a9a6eda36d2f337dc54537b80e8433341b135b4c5bb0173ffde46ccd260e1d4f2c51e8b07bb256f1317912cb1fc9e491e0bb9109e475cc795c23ad9f4f0042c5e9c655a4d865bc4a266e6a1d3d2b7ee53be9efb33a98933b5ba74ee3ac8d34b6af8c1fdbffade3abc80842b74354162f5b994ab5254cb068bc5e2"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3e}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000011c0)={r1, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000001300), 0x0, 0xfe, 0x60000009, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xf, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000002000110850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xbb, 0xbb, 0x3, [@type_tag={0xe, 0x0, 0x0, 0x12, 0x1}, @datasec={0x2, 0x5, 0x0, 0xf, 0x2, [{0x4, 0x7, 0x533}, {0x2, 0x9d568317, 0x4}, {0x5, 0x62, 0x5}, {0x3, 0x5, 0x2}, {0x2, 0xb6e0, 0x3}], "401c"}, @var={0x7, 0x0, 0x0, 0xe, 0x3, 0x1}, @volatile={0xc, 0x0, 0x0, 0x9, 0x2}, @restrict={0xc, 0x0, 0x0, 0xb, 0x2}, @datasec={0xa, 0x4, 0x0, 0xf, 0x1, [{0x3, 0x596, 0x8}, {0x5, 0x5, 0x8}, {0x1, 0x9, 0x5}, {0x4, 0x3, 0x4}], "b3"}]}, {0x0, [0x2e]}}, &(0x7f00000001c0)=""/109, 0xd7, 0x6d, 0x1, 0x4, 0x10000}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, r3, 0x0, '\x00', 0x0, r5, 0x1, 0x0, 0x4}, 0x50) sendmsg$kcm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e0019000f000000028000001294", 0x2e}], 0x1}, 0x0) 1.463341067s ago: executing program 3 (id=2515): perf_event_open(&(0x7f0000000100)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x8000000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 1.37219164s ago: executing program 0 (id=2516): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext, 0x10c002, 0xa45d, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x14, &(0x7f0000000cc0)=ANY=[@ANYBLOB="18050000080000000000000003000000b7080000000000007b8af8ff00000000b70800000b5900007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="882f1242a03c3f98722780b605a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.31776909s ago: executing program 4 (id=2517): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x200, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x100}) ioctl$TUNSETLINK(r0, 0x400454cc, 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000500), 0x1}, 0x0, 0x0, 0xfffffffc, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000001340)=@hci={0x1f, 0xd00, 0xe}, 0x80, 0x0}, 0x4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc///\x00\x82q\xee\x00!\xbd\xc2\x98#YP\xee\x9c2G\xf0\x81x\x97'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1c, 0x3ff, 0x6d, 0x401, 0x201, 0x1, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x6, [@var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x61, 0x2e, 0x2e]}}, 0x0, 0x2e}, 0x28) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r5}, 0xc) socket$kcm(0xa, 0x5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b701000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r7, 0x29, 0x7, &(0x7f0000000000)=r6, 0x4) 1.238380372s ago: executing program 3 (id=2518): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000a80)="d80000001d0081044e81f777db44b904021d080201000000040000a1bc00010000ffffffef000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c16fb4007134cf6ee08000a0e408e8d8ef075c11503c6bbace801bcb090000001fb791", 0x69}, {&(0x7f0000000240)="54f6d4d87eb3f140c57ef85e5c797ead9c0983f5b458fc0a37df3849f5afe7c1f6cf21ccf78bd59324607a92475593b8b60f319d0c28b9070683764d7f1fd5b97245a5c88c3ef216f1054fa4ca6e8dda6c9e5a9aabbf1abf319bce020cddc4e18efa804ed7192e081e891cb8c0b95e", 0x6f}], 0x2, 0x0, 0x0, 0x7400}, 0x10) 1.147503144s ago: executing program 0 (id=2520): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a00000008000000e47f000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000500), &(0x7f0000000280)}, 0x20) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0xa}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000004040)=0xffffffffffffffff, 0x4) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={r0, &(0x7f0000000340), &(0x7f0000000780)=""/172}, 0x20) 1.132974745s ago: executing program 1 (id=2522): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x10000, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0x5}, 0x0, 0xc8, 0x0, 0x3, 0x0, 0x0, 0x6341, 0x0, 0xfffffffe, 0x0, 0xffffffffffffffff}, 0x0, 0xa, 0xffffffffffffffff, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = socket$kcm(0x10, 0x2, 0x4) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) sendmsg$inet(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="5c00000012006b000040017ea608601602f3650400010008000000000002009ee517c356a7b0251e616859ad3a78a76e807c857e21bea297bff435cf01c937e786a6d0bdc7fcf50e4509c5cc68b7ed9c232d786c3500000000000074", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x81, 0x8}, 0x0, 0x2, 0xffffffff, 0x8, 0x0, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f"], 0xfdef) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000080)={[{0x2b, 'net'}, {0x2b, 'rlimit'}, {0x2d, 'net_cls'}, {0x2d, 'hugetlb'}, {0x2d, 'pids'}, {0x2b, 'cpuacct'}, {0x2d, 'memory'}]}, 0x36) 1.042716386s ago: executing program 3 (id=2523): r0 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfe103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x4, 0x8}, 0x2000, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a500850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xc, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c25000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r2, &(0x7f0000000000), 0x2a979d) 1.031186047s ago: executing program 2 (id=2524): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x106080, 0x0, 0x4000000, 0x1}, 0x0, 0xfffffffdffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x0, 0x0, 0x6, 0x0, 0x1000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x3, r0, 0x2) socket$kcm(0xa, 0x2, 0x73) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB], &(0x7f0000000c00)='GPL\x00'}, 0x94) r1 = socket$kcm(0x10, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000003c0), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x2, 0x0, 0x0, 0x400000, 0x0, 0x400000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x0, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x23, 0x5, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="11000000040000000400000005"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000002f1007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xe, 0x0, &(0x7f0000000040)="25a688a800a34400000000000000", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7}, 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89ed, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1.000785357s ago: executing program 4 (id=2526): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x0, @perf_bp={0x0}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0xfffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x20, 0x1, 0x0, 0xffdff036}]}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x8c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, @perf_bp={0x0}, 0x10800a, 0x6f5f, 0x8000, 0x0, 0x0, 0x1001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020039000b05d25a806f8c6394f90324fc602f00000008000100feff000037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) syz_clone(0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000580)={{0x1}, &(0x7f0000000440), &(0x7f0000000540)='%+9llu \x00'}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@bloom_filter={0x1e, 0x2, 0x1400000, 0x9, 0x20, 0x1, 0xffff8cb8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x4, 0xc}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0) sendmsg$inet(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e0800000709000000000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4000000) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) 980.391608ms ago: executing program 0 (id=2527): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000001800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0xfffffffe, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x76}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x7, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000d0df00850000001b"], 0x0, 0xfffffffe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10}, [@ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x0, 0x50}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value=0x64}, 0x48) 865.06135ms ago: executing program 1 (id=2528): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000002940)=""/4082, 0xff2}, {&(0x7f0000000240)=""/166, 0xa6}, {&(0x7f0000000000)=""/52, 0x34}, {&(0x7f0000000f40)=""/126, 0x7e}], 0x4}, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], 0x0}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], 0x0}, 0x94) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x40003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x14084, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x40003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x14084, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05dd4242"], 0xfdef) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05dd4242"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000001440)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x2000009, 0x20, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, @perf_config_ext, 0x100080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x2000009, 0x20, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, @perf_config_ext, 0x100080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r3 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@o_path={&(0x7f0000000080)='./file0\x00', 0x0, 0xa0b6b70816647b0e, r1}, 0x18) bpf$TOKEN_CREATE(0x24, &(0x7f0000000100)={0x0, r2}, 0x8) (async) r4 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000100)={0x0, r2}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x7, &(0x7f0000000600)=ANY=[@ANYBLOB="18110000", @ANYRES32, @ANYBLOB="0000000000000000bfa20000000000008500000001000002550001000000000095000000000000009500000000000000"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x54, 0x54, 0x3, [@float={0x6, 0x0, 0x0, 0x10, 0x8}, @struct={0x10, 0x4, 0x0, 0x4, 0x1, 0x5, [{0xf, 0x0, 0x400}, {0x5, 0x5, 0x2}, {0x9, 0x2, 0x9}, {0xd, 0x1, 0x3}]}, @type_tag={0xd, 0x0, 0x0, 0x12, 0x2}]}, {0x0, [0x2e]}}, &(0x7f00000002c0)=""/62, 0x6f, 0x3e, 0x0, 0x4, 0x10000, @value=r4}, 0x28) (async) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x54, 0x54, 0x3, [@float={0x6, 0x0, 0x0, 0x10, 0x8}, @struct={0x10, 0x4, 0x0, 0x4, 0x1, 0x5, [{0xf, 0x0, 0x400}, {0x5, 0x5, 0x2}, {0x9, 0x2, 0x9}, {0xd, 0x1, 0x3}]}, @type_tag={0xd, 0x0, 0x0, 0x12, 0x2}]}, {0x0, [0x2e]}}, &(0x7f00000002c0)=""/62, 0x6f, 0x3e, 0x0, 0x4, 0x10000, @value=r4}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0x787, '\x00', 0x0, r5, 0x2, 0x5, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000010000000000000000000000711807000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @cgroup_sock_addr=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000940)={0x1e, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x24}, 0x94) 643.697196ms ago: executing program 0 (id=2529): openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x20a8, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1d, 0x2000000000000216, &(0x7f0000000440)=ANY=[], 0x0, 0xfbffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0xfffffffffffffe3e, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x1f00, 0xc}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xd}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x20, 0x10506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x1000000000000801, 0x1}, 0x7402, 0x0, 0x0, 0x9, 0x0, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x55}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80000000000000101000007f0600080000000000000071273fa7b49301641184a9"], 0xfdef) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0)={r0}, 0xfed0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x2, 0x0, &(0x7f00000002c0)) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) r2 = perf_event_open(&(0x7f0000001080)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7602, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001080)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7602, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001080)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7602, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb47, 0x4}, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x7}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001080)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x7602, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf6ffffff, @perf_bp={&(0x7f0000000080)}, 0x0, 0x100000000, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89a0, &(0x7f0000000080)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x31) 600.442086ms ago: executing program 2 (id=2530): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x8, &(0x7f0000000040)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x11, 0x30}, [@ldst={0x3, 0x1, 0x4, 0x0, 0x8, 0xffffffffffffffe0, 0xffffffffffffffff}, @call={0x85, 0x0, 0x0, 0x5}, @exit={0x95, 0x0, 0x33}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x4}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x6, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) 551.836067ms ago: executing program 3 (id=2531): socket$kcm(0x2, 0x922000000001, 0x106) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x604, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0xffffffff, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x3, 0x3a) close(0x3) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000850000002a000000180100002025642500000000002020207b1af8ff00000004bfa100000000000007010000f8ffffffb702000008000000b703000089cdc832850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$kcm(0x2, 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r3) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x1b, 0x80, 0x0, 0x0, 0x0, 0x0, 0x20000, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x1, @perf_config_ext={0x2000000, 0x3e}, 0x6040, 0x9, 0x8, 0x6, 0xfffffffffdf7bbfe, 0x0, 0x5, 0x0, 0xfffffffd, 0x0, 0x8}, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1}, 0x50) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, 0x0) 367.508922ms ago: executing program 2 (id=2532): socket$kcm(0xa, 0x3, 0x73) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x6}, 0x11504a, 0xac5d, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$kcm(0x21, 0x2, 0x2) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002ec0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e01f3440cee51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cad32b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337602d3e5a815232f5e16c1b30c3a6abc85018e5ff2c91018afc9ffc2cc788bee1b47683db012469398685211dfbbae3e2ed0a50e7393bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d300006aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7af22e30d46a9d26d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977fb536a9caab37d9ac4cfc1c7b400000000000007ffc826b956ba859ac8e3c177b91bd7d5e41ff83ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d000069a16203a967c1bbe09315c29877a308bcc87dc3addb08142bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8240000e3428d2129369ee1b85af9ffffff0d0df414b315f651c8412392191fa83ee830548f11be359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92000000000f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb74d4ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905de328c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a978ee56c83a3466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342e0eaf6f330e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea95ec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf81700cd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be3827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f969369de47422604e2fc5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293b6c833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b612272d40f522d8c98c879aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbe71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd46dbd61627a2e0a74b5e6aefb7eee403502734137ff47a57f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a125e3af1130d66a7b66837ae7e7123dde7404a067ad0a6a2d6bec9411b61cad4121be3c72ff3a04713042253d438e7becf8120de3895b8ce974958bde39cb8da3427a2e9e2de936431e67fed5ab5684db07de39083d8948cc4c8a2608100000000000000000000aecb8b0b7941088f971ce17427eec32a012295cc0cdd32955176b6ad5a4bb953e58ccfa9428f452cfb5a48a9fda26db3985c8be3c2f99827da074825b01c4a3a71fb59d5798100000000000000c76b05a45d2dd8c20d971e2f3e4369168f5cb83d6ff3a18733fec726034fbfa95624135bee374414b2c8c61f52357a520efd6a10aff244bc8a62ed367981fb4d5d77f7bc093958ff46527499957da4934cd4b370cf76f72dd05fa80cdfb68c836fd81be7a58532e041a87f9222f157610a4bcdc05b2a55308c8e7568b90f7a338557e816a16972aea79dff5becefa6f9c5ce6c58fb38da9e7532dc53cfdc2e789b76f7d32aca1bfea2aa62621b78dded30fc07171866bf3d552900000000a32dda61eeda1750e157c2d569b9d08f583c0ee28daec2e8bb85f3c8e91c4448096ee953def18dc73e55cb30f9cd069d8780b00eaba382f0c3ae391c30a5f1b0f36dd0c2193b791995d2890327a10d7abac76d1202f72e97f0105184d7aaaab8d3e29c9a8d263f076b55cf53c5bb9c0662a3d19a6722d7f83ae4331d3256f90af0857788b380ccc3b266c418e66d1d756d5df6423dd0cea67bc235d3776d22270fc19301ead09f156893e9"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xdf, 0x0, &(0x7f0000000100)="b9ff03316844268cb89e14f0080047e0ffff00124000632f77fbac14fe16e000030a07080403fe80000020006558845013f2325f1a3901050b038da1880b88481aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb", 0x0, 0x8024, 0x60000000, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}, 0x50) socket$kcm(0x11, 0xa, 0x300) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18020000feffffff00000000000000008500000053000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70600000000000085000000170000009500"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r2, 0x0, 0xe, 0x0, &(0x7f00000000c0)="c1b9545dd30a1d31677b2d0bfa91", 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 0s ago: executing program 4 (id=2533): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext, 0x10c002, 0xa45d, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x14, &(0x7f0000000cc0)=ANY=[@ANYBLOB="18050000080000000000000003000000b7080000000000007b8af8ff00000000b70800000b5900007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="882f1242a03c3f98722780b605a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): BSS network, BSSID 50:50:50:50:50:50 [ 76.207123][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 76.292059][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.308319][ T4298] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.322295][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.349060][ T4298] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.380240][ T4326] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 76.402476][ T4326] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 76.408337][ T4374] netlink: 'syz.4.5': attribute type 27 has an invalid length. [ 76.410537][ T4278] Bluetooth: hci1: command 0x0419 tx timeout [ 76.429515][ T4374] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 76.437341][ T4374] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5'. [ 76.476860][ T4298] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.492534][ T4278] Bluetooth: hci0: command 0x0419 tx timeout [ 76.498827][ T4284] Bluetooth: hci2: command 0x0419 tx timeout [ 76.504946][ T4298] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.570241][ T4284] Bluetooth: hci4: command 0x0419 tx timeout [ 76.576306][ T4284] Bluetooth: hci3: command 0x0419 tx timeout [ 76.617079][ T4298] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 77.084544][ T4389] netlink: 154788 bytes leftover after parsing attributes in process `syz.3.4'. [ 77.118809][ T4395] Zero length message leads to an empty skb [ 77.180868][ T4389] openvswitch: netlink: Message has 48126 unknown bytes. [ 77.218499][ T4390] netlink: 144 bytes leftover after parsing attributes in process `syz.2.13'. [ 77.256667][ T4394] netlink: 'syz.1.14': attribute type 10 has an invalid length. [ 77.266194][ T4394] netlink: 40 bytes leftover after parsing attributes in process `syz.1.14'. [ 77.285135][ T4394] device ipvlan1 entered promiscuous mode [ 77.306162][ T4394] bridge0: port 3(ipvlan1) entered blocking state [ 77.318383][ T4394] bridge0: port 3(ipvlan1) entered disabled state [ 77.377146][ T4394] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 77.399285][ T4396] IPv6: Can't replace route, no match found [ 77.552963][ T4394] syz.1.14 (4394) used greatest stack depth: 20624 bytes left [ 77.869990][ T4408] netlink: 152 bytes leftover after parsing attributes in process `syz.0.20'. [ 78.005151][ T4414] netlink: 'syz.4.19': attribute type 3 has an invalid length. [ 78.022289][ T4408] bond0: (slave bond_slave_0): Releasing backup interface [ 78.039252][ T4414] netlink: 132 bytes leftover after parsing attributes in process `syz.4.19'. [ 78.389246][ T4408] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 79.040569][ T4434] netlink: 154788 bytes leftover after parsing attributes in process `syz.2.30'. [ 79.062324][ T4434] openvswitch: netlink: Message has 48126 unknown bytes. [ 79.093217][ T4432] netlink: 'syz.4.28': attribute type 10 has an invalid length. [ 79.119294][ T4432] netlink: 40 bytes leftover after parsing attributes in process `syz.4.28'. [ 79.166158][ T4432] device ipvlan1 entered promiscuous mode [ 79.238104][ T4432] bridge0: port 3(ipvlan1) entered blocking state [ 79.287209][ T4432] bridge0: port 3(ipvlan1) entered disabled state [ 79.316120][ T4432] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 79.348744][ T4434] IPv6: Can't replace route, no match found [ 79.446933][ T4432] syz.4.28 (4432) used greatest stack depth: 20176 bytes left [ 80.159481][ T4452] netlink: 144 bytes leftover after parsing attributes in process `syz.4.34'. [ 80.373085][ T4456] netlink: 'syz.2.36': attribute type 3 has an invalid length. [ 80.405754][ T4456] netlink: 132 bytes leftover after parsing attributes in process `syz.2.36'. [ 80.574742][ T4460] bond0: (slave bond_slave_0): Releasing backup interface [ 80.699552][ T4460] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 81.483442][ T4498] __nla_validate_parse: 1 callbacks suppressed [ 81.483477][ T4498] netlink: 154788 bytes leftover after parsing attributes in process `syz.1.48'. [ 81.500526][ T4498] openvswitch: netlink: Message has 48126 unknown bytes. [ 81.554620][ T4500] netlink: 144 bytes leftover after parsing attributes in process `syz.0.50'. [ 81.567750][ T4501] IPv6: Can't replace route, no match found [ 81.662009][ T4496] netlink: 'syz.3.49': attribute type 3 has an invalid length. [ 81.686617][ T4496] netlink: 132 bytes leftover after parsing attributes in process `syz.3.49'. [ 82.565409][ T4513] syz.2.53 uses obsolete (PF_INET,SOCK_PACKET) [ 82.595700][ T4513] netlink: 'syz.2.53': attribute type 10 has an invalid length. [ 82.695352][ T4513] team0: Device nlmon0 is of different type [ 83.276513][ T4529] netlink: 'syz.0.61': attribute type 27 has an invalid length. [ 83.349155][ T4529] netlink: 'syz.0.61': attribute type 3 has an invalid length. [ 83.391945][ T4529] netlink: 132 bytes leftover after parsing attributes in process `syz.0.61'. [ 83.775261][ T4540] netlink: 'syz.0.66': attribute type 3 has an invalid length. [ 83.819150][ T4540] netlink: 132 bytes leftover after parsing attributes in process `syz.0.66'. [ 84.728441][ T4554] netlink: 144 bytes leftover after parsing attributes in process `syz.1.68'. [ 84.791400][ T4556] Driver unsupported XDP return value 0 on prog (id 40) dev N/A, expect packet loss! [ 85.294001][ T4569] netlink: 'syz.1.77': attribute type 27 has an invalid length. [ 85.316739][ T4569] netlink: 'syz.1.77': attribute type 3 has an invalid length. [ 85.333808][ T4569] netlink: 132 bytes leftover after parsing attributes in process `syz.1.77'. [ 86.144046][ T4600] netlink: 'syz.2.88': attribute type 10 has an invalid length. [ 86.165755][ T4600] netlink: 55 bytes leftover after parsing attributes in process `syz.2.88'. [ 86.523542][ T4619] netlink: 144 bytes leftover after parsing attributes in process `syz.4.93'. [ 86.733591][ T127] cfg80211: failed to load regulatory.db [ 87.098462][ T4636] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.99'. [ 87.140580][ T4636] netlink: 16399 bytes leftover after parsing attributes in process `syz.4.99'. [ 87.658276][ T4652] netlink: 'syz.1.105': attribute type 10 has an invalid length. [ 87.678161][ T4652] netlink: 40 bytes leftover after parsing attributes in process `syz.1.105'. [ 87.745988][ T4652] bridge0: port 3(ipvlan1) entered blocking state [ 87.763170][ T4652] bridge0: port 3(ipvlan1) entered disabled state [ 87.798870][ T4652] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 87.817285][ T4284] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 88.137621][ T4671] netlink: 128 bytes leftover after parsing attributes in process `syz.4.112'. [ 88.181289][ T4671] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 88.216937][ T4671] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 88.355293][ T4678] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.116'. [ 88.380883][ T4678] netlink: zone id is out of range [ 88.432623][ T4678] netlink: zone id is out of range [ 88.487100][ T4678] netlink: zone id is out of range [ 88.659631][ T4678] netlink: del zone limit has 4 unknown bytes [ 91.683453][ T4726] FAULT_INJECTION: forcing a failure. [ 91.683453][ T4726] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 91.723136][ T4725] sctp: [Deprecated]: syz.2.128 (pid 4725) Use of struct sctp_assoc_value in delayed_ack socket option. [ 91.723136][ T4725] Use struct sctp_sack_info instead [ 91.815751][ T4726] CPU: 0 PID: 4726 Comm: syz.3.127 Not tainted syzkaller #0 [ 91.823110][ T4726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.833217][ T4726] Call Trace: [ 91.836529][ T4726] [ 91.839478][ T4726] dump_stack_lvl+0x188/0x24e [ 91.844226][ T4726] ? show_regs_print_info+0x12/0x12 [ 91.849453][ T4726] ? load_image+0x410/0x410 [ 91.853984][ T4726] ? __lock_acquire+0x7c40/0x7c40 [ 91.859046][ T4726] should_fail_ex+0x390/0x4c0 [ 91.863747][ T4726] _copy_from_user+0x2c/0x170 [ 91.868444][ T4726] ___sys_sendmsg+0x1c3/0x360 [ 91.873176][ T4726] ? __sys_sendmsg+0x2a0/0x2a0 [ 91.878004][ T4726] ? __lock_acquire+0x7c40/0x7c40 [ 91.883070][ T4726] __se_sys_sendmsg+0x1c3/0x2b0 [ 91.887944][ T4726] ? __x64_sys_sendmsg+0x80/0x80 [ 91.892919][ T4726] ? lockdep_hardirqs_on+0x94/0x140 [ 91.898134][ T4726] do_syscall_64+0x4c/0xa0 [ 91.902566][ T4726] ? clear_bhb_loop+0x60/0xb0 [ 91.907258][ T4726] ? clear_bhb_loop+0x60/0xb0 [ 91.912041][ T4726] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.917954][ T4726] RIP: 0033:0x7f663fd9e159 [ 91.922394][ T4726] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.942011][ T4726] RSP: 002b:00007f6640ba1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 91.950439][ T4726] RAX: ffffffffffffffda RBX: 00007f6640026090 RCX: 00007f663fd9e159 [ 91.958418][ T4726] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 91.966394][ T4726] RBP: 00007f6640ba1090 R08: 0000000000000000 R09: 0000000000000000 [ 91.974372][ T4726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 91.982346][ T4726] R13: 00007f6640026128 R14: 00007f6640026090 R15: 00007ffc4bad4a48 [ 91.990341][ T4726] [ 92.020799][ T4731] netlink: 'syz.1.130': attribute type 10 has an invalid length. [ 93.392740][ T4731] team0: Device nlmon0 is of different type [ 93.627378][ T4744] FAULT_INJECTION: forcing a failure. [ 93.627378][ T4744] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 93.679141][ T4744] CPU: 1 PID: 4744 Comm: syz.1.133 Not tainted syzkaller #0 [ 93.686492][ T4744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.696565][ T4744] Call Trace: [ 93.699848][ T4744] [ 93.702777][ T4744] dump_stack_lvl+0x188/0x24e [ 93.707460][ T4744] ? show_regs_print_info+0x12/0x12 [ 93.712657][ T4744] ? load_image+0x410/0x410 [ 93.717159][ T4744] ? __lock_acquire+0x7c40/0x7c40 [ 93.722194][ T4744] should_fail_ex+0x390/0x4c0 [ 93.726872][ T4744] _copy_to_user+0x2c/0x130 [ 93.731394][ T4744] bpf_test_finish+0x266/0x600 [ 93.736161][ T4744] ? convert_skb_to___skb+0x420/0x420 [ 93.741540][ T4744] ? bpf_test_init+0x119/0x140 [ 93.746315][ T4744] bpf_prog_test_run_xdp+0x827/0xf80 [ 93.751597][ T4744] ? __lock_acquire+0x7c40/0x7c40 [ 93.756623][ T4744] ? dev_put+0x80/0x80 [ 93.760698][ T4744] ? dev_put+0x80/0x80 [ 93.764763][ T4744] bpf_prog_test_run+0x31c/0x390 [ 93.769700][ T4744] __sys_bpf+0x62b/0x780 [ 93.773941][ T4744] ? bpf_link_show_fdinfo+0x380/0x380 [ 93.779318][ T4744] ? lock_chain_count+0x20/0x20 [ 93.784176][ T4744] __x64_sys_bpf+0x78/0x90 [ 93.788586][ T4744] do_syscall_64+0x4c/0xa0 [ 93.793001][ T4744] ? clear_bhb_loop+0x60/0xb0 [ 93.797676][ T4744] ? clear_bhb_loop+0x60/0xb0 [ 93.802353][ T4744] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 93.808243][ T4744] RIP: 0033:0x7f9ecad9e159 [ 93.812651][ T4744] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.832249][ T4744] RSP: 002b:00007f9ecbc87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 93.840654][ T4744] RAX: ffffffffffffffda RBX: 00007f9ecb025fa0 RCX: 00007f9ecad9e159 [ 93.848619][ T4744] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 93.856601][ T4744] RBP: 00007f9ecbc87090 R08: 0000000000000000 R09: 0000000000000000 [ 93.864566][ T4744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 93.872528][ T4744] R13: 00007f9ecb026038 R14: 00007f9ecb025fa0 R15: 00007ffed3388b48 [ 93.880504][ T4744] [ 93.983493][ T4750] netlink: 'syz.3.137': attribute type 10 has an invalid length. [ 94.228512][ T4750] team0 (unregistering): Port device team_slave_0 removed [ 94.318167][ T4750] team0 (unregistering): Port device team_slave_1 removed [ 94.700934][ T4769] : port 1(ip6gretap0) entered blocking state [ 94.707502][ T4769] : port 1(ip6gretap0) entered disabled state [ 94.733020][ T4769] device ip6gretap0 entered promiscuous mode [ 94.867748][ T4771] device ip6gretap0 left promiscuous mode [ 94.890622][ T4771] : port 1(ip6gretap0) entered disabled state [ 96.282853][ T4801] netlink: 'syz.0.153': attribute type 10 has an invalid length. [ 96.295818][ T4801] netlink: 55 bytes leftover after parsing attributes in process `syz.0.153'. [ 96.349950][ T4798] netlink: 4 bytes leftover after parsing attributes in process `syz.3.151'. [ 96.477205][ T4798] netlink: 'syz.3.151': attribute type 2 has an invalid length. [ 96.912551][ T4816] netlink: 'syz.2.158': attribute type 1 has an invalid length. [ 98.124260][ T4830] netlink: 'syz.4.161': attribute type 153 has an invalid length. [ 98.153972][ T4830] netlink: 69544 bytes leftover after parsing attributes in process `syz.4.161'. [ 98.945087][ T4858] netlink: 12 bytes leftover after parsing attributes in process `syz.4.170'. [ 98.955007][ T4858] netlink: 152 bytes leftover after parsing attributes in process `syz.4.170'. [ 100.139154][ T4284] Bluetooth: hci3: unexpected event 0x12 length: 15 > 8 [ 100.357376][ T4888] netlink: 'syz.3.178': attribute type 10 has an invalid length. [ 100.465973][ T4888] netlink: 40 bytes leftover after parsing attributes in process `syz.3.178'. [ 100.526800][ T4888] device ipvlan1 entered promiscuous mode [ 100.645183][ T4888] bridge0: port 3(ipvlan1) entered blocking state [ 100.687546][ T4888] bridge0: port 3(ipvlan1) entered disabled state [ 100.795972][ T4888] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 101.343146][ T4891] netlink: 134056 bytes leftover after parsing attributes in process `syz.0.180'. [ 101.843470][ T4891] syz.0.180 (4891) used greatest stack depth: 17296 bytes left [ 102.282570][ T4924] netlink: 60 bytes leftover after parsing attributes in process `syz.2.190'. [ 102.355676][ T4924] netlink: 60 bytes leftover after parsing attributes in process `syz.2.190'. [ 102.435108][ T4931] netlink: 60 bytes leftover after parsing attributes in process `syz.2.190'. [ 102.451180][ T4932] netlink: 60 bytes leftover after parsing attributes in process `syz.2.190'. [ 103.978882][ T4956] netlink: 134056 bytes leftover after parsing attributes in process `syz.2.199'. [ 104.287712][ T4969] netlink: 56 bytes leftover after parsing attributes in process `syz.0.203'. [ 104.348375][ T4969] netlink: 56 bytes leftover after parsing attributes in process `syz.0.203'. [ 104.398881][ T4963] netlink: 'syz.3.201': attribute type 41 has an invalid length. [ 104.849403][ T4979] netlink: 2759 bytes leftover after parsing attributes in process `syz.3.205'. [ 105.119820][ T4989] FAULT_INJECTION: forcing a failure. [ 105.119820][ T4989] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 105.208813][ T4989] CPU: 0 PID: 4989 Comm: syz.1.208 Not tainted syzkaller #0 [ 105.216165][ T4989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.226240][ T4989] Call Trace: [ 105.229535][ T4989] [ 105.232479][ T4989] dump_stack_lvl+0x188/0x24e [ 105.237186][ T4989] ? show_regs_print_info+0x12/0x12 [ 105.242411][ T4989] ? load_image+0x410/0x410 [ 105.246943][ T4989] ? __lock_acquire+0x7c40/0x7c40 [ 105.252011][ T4989] should_fail_ex+0x390/0x4c0 [ 105.256722][ T4989] _copy_from_user+0x2c/0x170 [ 105.261424][ T4989] iovec_from_user+0x143/0x360 [ 105.266224][ T4989] __import_iovec+0x6c/0x510 [ 105.270851][ T4989] import_iovec+0x6f/0xa0 [ 105.275214][ T4989] ___sys_sendmsg+0x252/0x360 [ 105.279940][ T4989] ? __sys_sendmsg+0x2a0/0x2a0 [ 105.284812][ T4989] ? __lock_acquire+0x7c40/0x7c40 [ 105.289900][ T4989] __se_sys_sendmsg+0x1c3/0x2b0 [ 105.294783][ T4989] ? ct_nmi_exit+0x145/0x1c0 [ 105.299407][ T4989] ? __x64_sys_sendmsg+0x80/0x80 [ 105.304400][ T4989] ? lockdep_hardirqs_on+0x94/0x140 [ 105.309630][ T4989] do_syscall_64+0x4c/0xa0 [ 105.314077][ T4989] ? clear_bhb_loop+0x60/0xb0 [ 105.318779][ T4989] ? clear_bhb_loop+0x60/0xb0 [ 105.323489][ T4989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 105.329410][ T4989] RIP: 0033:0x7f9ecad9e159 [ 105.333846][ T4989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.353476][ T4989] RSP: 002b:00007f9ecbc66028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 105.361929][ T4989] RAX: ffffffffffffffda RBX: 00007f9ecb026090 RCX: 00007f9ecad9e159 [ 105.369903][ T4989] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 105.377881][ T4989] RBP: 00007f9ecbc66090 R08: 0000000000000000 R09: 0000000000000000 [ 105.385848][ T4989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 105.393836][ T4989] R13: 00007f9ecb026128 R14: 00007f9ecb026090 R15: 00007ffed3388b48 [ 105.401840][ T4989] [ 105.950210][ T4998] FAULT_INJECTION: forcing a failure. [ 105.950210][ T4998] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 105.984022][ T4998] CPU: 0 PID: 4998 Comm: syz.0.212 Not tainted syzkaller #0 [ 105.991376][ T4998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 106.001455][ T4998] Call Trace: [ 106.004753][ T4998] [ 106.007704][ T4998] dump_stack_lvl+0x188/0x24e [ 106.012417][ T4998] ? show_regs_print_info+0x12/0x12 [ 106.017646][ T4998] ? load_image+0x410/0x410 [ 106.022181][ T4998] ? __lock_acquire+0x7c40/0x7c40 [ 106.027241][ T4998] should_fail_ex+0x390/0x4c0 [ 106.031954][ T4998] _copy_to_user+0x2c/0x130 [ 106.036482][ T4998] bpf_test_finish+0x4a2/0x600 [ 106.041286][ T4998] ? convert_skb_to___skb+0x420/0x420 [ 106.046691][ T4998] ? bpf_test_init+0x119/0x140 [ 106.051483][ T4998] bpf_prog_test_run_xdp+0x827/0xf80 [ 106.056815][ T4998] ? __lock_acquire+0x7c40/0x7c40 [ 106.061888][ T4998] ? dev_put+0x80/0x80 [ 106.065987][ T4998] ? dev_put+0x80/0x80 [ 106.070081][ T4998] bpf_prog_test_run+0x31c/0x390 [ 106.075045][ T4998] __sys_bpf+0x62b/0x780 [ 106.079318][ T4998] ? bpf_link_show_fdinfo+0x380/0x380 [ 106.084818][ T4998] ? lock_chain_count+0x20/0x20 [ 106.089712][ T4998] __x64_sys_bpf+0x78/0x90 [ 106.094163][ T4998] do_syscall_64+0x4c/0xa0 [ 106.098604][ T4998] ? clear_bhb_loop+0x60/0xb0 [ 106.103308][ T4998] ? clear_bhb_loop+0x60/0xb0 [ 106.108024][ T4998] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 106.113948][ T4998] RIP: 0033:0x7f86ea39e159 [ 106.118385][ T4998] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.138016][ T4998] RSP: 002b:00007f86eb2d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 106.146463][ T4998] RAX: ffffffffffffffda RBX: 00007f86ea625fa0 RCX: 00007f86ea39e159 [ 106.154494][ T4998] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 106.162493][ T4998] RBP: 00007f86eb2d5090 R08: 0000000000000000 R09: 0000000000000000 [ 106.170489][ T4998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 106.174988][ T5001] netlink: 'syz.3.214': attribute type 10 has an invalid length. [ 106.178464][ T4998] R13: 00007f86ea626038 R14: 00007f86ea625fa0 R15: 00007ffc9becaf18 [ 106.178499][ T4998] [ 106.416145][ T5008] netlink: 134056 bytes leftover after parsing attributes in process `syz.1.215'. [ 107.362351][ T5038] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.224'. [ 107.562454][ T5051] netlink: 'syz.1.228': attribute type 10 has an invalid length. [ 107.574970][ T5051] netlink: 55 bytes leftover after parsing attributes in process `syz.1.228'. [ 107.597248][ T5050] netlink: 'syz.2.227': attribute type 11 has an invalid length. [ 107.621332][ T5050] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.227'. [ 107.915148][ T5060] delete_channel: no stack [ 107.924067][ T5060] delete_channel: no stack [ 107.933740][ T5055] netlink: 10 bytes leftover after parsing attributes in process `syz.2.227'. [ 107.976005][ T5059] netlink: 'syz.3.231': attribute type 25 has an invalid length. [ 107.981450][ T5046] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 108.037636][ T5059] netlink: 'syz.3.231': attribute type 9 has an invalid length. [ 108.095900][ T5059] netlink: 40 bytes leftover after parsing attributes in process `syz.3.231'. [ 108.887618][ T5098] device bridge_slave_1 left promiscuous mode [ 108.905798][ T5098] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.929669][ T5098] device bridge_slave_0 left promiscuous mode [ 108.936763][ T5098] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.286564][ T5104] netlink: 'syz.2.244': attribute type 10 has an invalid length. [ 110.295461][ T5104] netlink: 40 bytes leftover after parsing attributes in process `syz.2.244'. [ 110.310824][ T5104] device ipvlan1 entered promiscuous mode [ 110.329355][ T5104] bridge0: port 3(ipvlan1) entered blocking state [ 110.336087][ T5104] bridge0: port 3(ipvlan1) entered disabled state [ 110.356780][ T5104] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 110.394171][ T4284] Bluetooth: hci2: unexpected event 0x12 length: 15 > 8 [ 111.490514][ T5148] device bridge_slave_1 left promiscuous mode [ 111.510528][ T5148] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.088158][ T5148] device bridge_slave_0 left promiscuous mode [ 112.094819][ T5148] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.694106][ T5187] mac80211_hwsim hwsim6 »»»»»»: renamed from wlan0 [ 113.347875][ T5207] device bridge_slave_1 left promiscuous mode [ 113.361317][ T5207] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.640957][ T5211] netlink: 'syz.0.282': attribute type 11 has an invalid length. [ 113.690377][ T5211] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.282'. [ 114.296437][ T5207] device bridge_slave_0 left promiscuous mode [ 114.303404][ T5207] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.409626][ T5210] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 114.522274][ T5211] netlink: 10 bytes leftover after parsing attributes in process `syz.0.282'. [ 115.320154][ T5236] FAULT_INJECTION: forcing a failure. [ 115.320154][ T5236] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 115.406416][ T5236] CPU: 1 PID: 5236 Comm: syz.0.289 Not tainted syzkaller #0 [ 115.413780][ T5236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.423857][ T5236] Call Trace: [ 115.427150][ T5236] [ 115.430091][ T5236] dump_stack_lvl+0x188/0x24e [ 115.434804][ T5236] ? show_regs_print_info+0x12/0x12 [ 115.440062][ T5236] ? load_image+0x410/0x410 [ 115.444682][ T5236] ? __lock_acquire+0x7c40/0x7c40 [ 115.449744][ T5236] ? snprintf+0xe5/0x140 [ 115.454013][ T5236] should_fail_ex+0x390/0x4c0 [ 115.458725][ T5236] _copy_to_user+0x2c/0x130 [ 115.463259][ T5236] simple_read_from_buffer+0xe3/0x150 [ 115.468652][ T5236] proc_fail_nth_read+0x1a6/0x220 [ 115.473705][ T5236] ? proc_fault_inject_write+0x310/0x310 [ 115.479376][ T5236] ? fsnotify_perm+0x248/0x550 [ 115.484160][ T5236] ? proc_fault_inject_write+0x310/0x310 [ 115.489815][ T5236] vfs_read+0x2db/0x960 [ 115.494014][ T5236] ? kernel_read+0x1e0/0x1e0 [ 115.498639][ T5236] ? __fget_files+0x28/0x460 [ 115.503256][ T5236] ? __fget_files+0x3fc/0x460 [ 115.507965][ T5236] ? __fdget_pos+0x2ae/0x360 [ 115.512578][ T5236] ? ksys_read+0x70/0x260 [ 115.516933][ T5236] ksys_read+0x14d/0x260 [ 115.521200][ T5236] ? vfs_write+0x9a0/0x9a0 [ 115.525641][ T5236] ? lockdep_hardirqs_on+0x94/0x140 [ 115.530882][ T5236] do_syscall_64+0x4c/0xa0 [ 115.535330][ T5236] ? clear_bhb_loop+0x60/0xb0 [ 115.540029][ T5236] ? clear_bhb_loop+0x60/0xb0 [ 115.544735][ T5236] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.550651][ T5236] RIP: 0033:0x7f86ea35e98e [ 115.555079][ T5236] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 115.574707][ T5236] RSP: 002b:00007f86eb2d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 115.583157][ T5236] RAX: ffffffffffffffda RBX: 00007f86eb2d56c0 RCX: 00007f86ea35e98e [ 115.591182][ T5236] RDX: 000000000000000f RSI: 00007f86eb2d50a0 RDI: 0000000000000004 [ 115.599173][ T5236] RBP: 00007f86eb2d5090 R08: 0000000000000000 R09: 0000000000000000 [ 115.607171][ T5236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 115.615161][ T5236] R13: 00007f86ea626038 R14: 00007f86ea625fa0 R15: 00007ffc9becaf18 [ 115.623176][ T5236] [ 115.668183][ T5228] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 115.947784][ T5251] netlink: 'syz.0.293': attribute type 10 has an invalid length. [ 116.232888][ T5251] team0 (unregistering): Port device team_slave_0 removed [ 116.294459][ T5251] team0 (unregistering): Port device team_slave_1 removed [ 116.981009][ T5296] netlink: 'syz.3.299': attribute type 11 has an invalid length. [ 116.989269][ T5296] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.299'. [ 117.094785][ T5309] netlink: 'syz.2.309': attribute type 3 has an invalid length. [ 117.119161][ T5309] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.309'. [ 117.174302][ T5300] netlink: 'syz.2.309': attribute type 3 has an invalid length. [ 117.196715][ T5281] netlink: 'syz.2.309': attribute type 1 has an invalid length. [ 117.216327][ T5300] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.309'. [ 117.287723][ T5308] netlink: 10 bytes leftover after parsing attributes in process `syz.3.299'. [ 117.314277][ T5280] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 117.414562][ T5312] netlink: 'syz.0.301': attribute type 9 has an invalid length. [ 117.482734][ T5312] netlink: 'syz.0.301': attribute type 10 has an invalid length. [ 117.511210][ T5312] netlink: 'syz.0.301': attribute type 11 has an invalid length. [ 119.471375][ T5347] netlink: 134056 bytes leftover after parsing attributes in process `syz.2.314'. [ 119.826651][ T5353] netlink: 'syz.1.316': attribute type 11 has an invalid length. [ 119.835900][ T5355] netlink: 'syz.0.315': attribute type 29 has an invalid length. [ 119.852124][ T5353] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.316'. [ 119.983735][ T5355] netlink: 'syz.0.315': attribute type 29 has an invalid length. [ 120.574485][ T5350] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 120.595669][ T5356] netlink: 'syz.0.315': attribute type 29 has an invalid length. [ 120.677027][ T5353] netlink: 10 bytes leftover after parsing attributes in process `syz.1.316'. [ 120.986374][ T5376] netlink: 'syz.2.323': attribute type 2 has an invalid length. [ 121.015671][ T5376] netlink: 14 bytes leftover after parsing attributes in process `syz.2.323'. [ 121.957222][ T5394] netlink: 134056 bytes leftover after parsing attributes in process `syz.1.329'. [ 122.015627][ T4284] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 122.215074][ T5405] netlink: 10 bytes leftover after parsing attributes in process `syz.0.334'. [ 122.460101][ T5407] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 123.744350][ T5439] netlink: 'syz.3.346': attribute type 21 has an invalid length. [ 123.773841][ T5439] netlink: 164 bytes leftover after parsing attributes in process `syz.3.346'. [ 124.026841][ T5445] netlink: 10 bytes leftover after parsing attributes in process `syz.3.347'. [ 124.727928][ T5459] device syzkaller0 entered promiscuous mode [ 125.214816][ T5481] netlink: 'syz.4.360': attribute type 16 has an invalid length. [ 125.228825][ T5481] netlink: 'syz.4.360': attribute type 3 has an invalid length. [ 125.237288][ T5481] netlink: 132 bytes leftover after parsing attributes in process `syz.4.360'. [ 128.029958][ T5472] netlink: 10 bytes leftover after parsing attributes in process `syz.1.359'. [ 129.178244][ T5537] netlink: 'syz.3.376': attribute type 11 has an invalid length. [ 129.196362][ T5537] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.376'. [ 129.391317][ T5544] netlink: 10 bytes leftover after parsing attributes in process `syz.3.376'. [ 129.681242][ T5536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 130.398842][ T5571] netlink: 'syz.4.389': attribute type 10 has an invalid length. [ 130.433108][ T5571] team0: Device nlmon0 is of different type [ 130.727893][ T5584] netlink: 'syz.0.395': attribute type 11 has an invalid length. [ 130.770193][ T5584] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.395'. [ 130.884134][ T5584] netlink: 10 bytes leftover after parsing attributes in process `syz.0.395'. [ 131.103117][ T5583] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 131.989827][ T5614] netlink: 'syz.3.406': attribute type 1 has an invalid length. [ 132.026274][ T5614] netlink: 127868 bytes leftover after parsing attributes in process `syz.3.406'. [ 132.382560][ T5624] netlink: 'syz.3.411': attribute type 11 has an invalid length. [ 132.404363][ T5624] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.411'. [ 132.502183][ T5629] netlink: 10 bytes leftover after parsing attributes in process `syz.3.411'. [ 132.822557][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.828973][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.887658][ T5622] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 133.063707][ T4284] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 133.321091][ T5649] netlink: 10 bytes leftover after parsing attributes in process `syz.3.418'. [ 135.208901][ T5714] netlink: 'syz.4.422': attribute type 10 has an invalid length. [ 135.319505][ T5723] netlink: 'syz.3.428': attribute type 11 has an invalid length. [ 135.367780][ T5714] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 135.379994][ T5723] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.428'. [ 136.071323][ T5722] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.451135][ T5730] netlink: 10 bytes leftover after parsing attributes in process `syz.3.428'. [ 139.438128][ T5773] netlink: 'syz.3.448': attribute type 11 has an invalid length. [ 139.488715][ T5773] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.448'. [ 139.608363][ T5773] netlink: 10 bytes leftover after parsing attributes in process `syz.3.448'. [ 139.965497][ T5772] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.263344][ T5813] netlink: 134056 bytes leftover after parsing attributes in process `syz.0.461'. [ 141.503999][ T5819] netlink: 'syz.4.463': attribute type 3 has an invalid length. [ 141.541623][ T5819] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.463'. [ 141.743425][ T5824] netlink: 'syz.0.465': attribute type 11 has an invalid length. [ 141.775454][ T5824] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.465'. [ 141.910101][ T5829] netlink: 10 bytes leftover after parsing attributes in process `syz.0.465'. [ 142.116836][ T5823] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 143.139481][ T5852] netlink: 134056 bytes leftover after parsing attributes in process `syz.3.476'. [ 143.341372][ T5847] netlink: 'syz.0.474': attribute type 10 has an invalid length. [ 144.619703][ T5848] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 144.629240][ T5863] netlink: 10 bytes leftover after parsing attributes in process `syz.2.479'. [ 144.663389][ T5848] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 144.705494][ T5848] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 146.025809][ T5900] netlink: 'syz.3.491': attribute type 10 has an invalid length. [ 146.250221][ T5904] netlink: 'syz.2.493': attribute type 11 has an invalid length. [ 146.258859][ T5904] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.493'. [ 146.448409][ T5907] netlink: 134056 bytes leftover after parsing attributes in process `syz.1.494'. [ 146.958702][ T5905] netlink: 10 bytes leftover after parsing attributes in process `syz.2.493'. [ 146.970367][ T5902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 147.273571][ T5914] netlink: 'syz.2.497': attribute type 11 has an invalid length. [ 147.304558][ T5914] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.497'. [ 147.369323][ T5919] netlink: 'syz.3.499': attribute type 10 has an invalid length. [ 147.396413][ T5919] netlink: 55 bytes leftover after parsing attributes in process `syz.3.499'. [ 147.561099][ T5918] netlink: 10 bytes leftover after parsing attributes in process `syz.2.497'. [ 147.573404][ T5913] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 148.567211][ T5940] netlink: 'syz.2.507': attribute type 11 has an invalid length. [ 148.605919][ T5940] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.507'. [ 148.710106][ T5946] netlink: 10 bytes leftover after parsing attributes in process `syz.2.507'. [ 149.037379][ T5955] netlink: 134056 bytes leftover after parsing attributes in process `syz.4.511'. [ 149.074515][ T5939] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 149.848387][ T5981] netlink: 'syz.1.521': attribute type 11 has an invalid length. [ 149.873729][ T5981] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.521'. [ 150.046638][ T5982] netlink: 10 bytes leftover after parsing attributes in process `syz.1.521'. [ 150.378617][ T5980] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 150.636604][ T5991] netlink: 'syz.1.526': attribute type 11 has an invalid length. [ 150.681379][ T5991] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.526'. [ 150.781518][ T5991] netlink: 10 bytes leftover after parsing attributes in process `syz.1.526'. [ 150.903600][ T6002] netlink: 'syz.4.530': attribute type 1 has an invalid length. [ 150.905486][ T5990] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 150.986768][ T6008] netlink: 'syz.4.530': attribute type 16 has an invalid length. [ 151.024833][ T6008] netlink: 152 bytes leftover after parsing attributes in process `syz.4.530'. [ 151.079259][ T6008] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 151.540269][ T6022] netlink: 60 bytes leftover after parsing attributes in process `syz.1.534'. [ 151.919526][ T6025] netlink: 'syz.0.537': attribute type 11 has an invalid length. [ 152.010660][ T6029] netlink: 10 bytes leftover after parsing attributes in process `syz.0.537'. [ 152.097578][ T6025] netlink: 149476 bytes leftover after parsing attributes in process `syz.0.537'. [ 152.172197][ T6024] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 152.384063][ T6031] netlink: 'syz.1.539': attribute type 3 has an invalid length. [ 152.419260][ T6031] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.539'. [ 152.598915][ T6046] netlink: 'syz.3.544': attribute type 11 has an invalid length. [ 152.643508][ T6046] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.544'. [ 152.713034][ T6041] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 153.175056][ T5272] tipc: Subscription rejected, illegal request [ 153.985889][ T6077] netlink: 'syz.1.555': attribute type 16 has an invalid length. [ 154.206953][ T6083] netlink: 'syz.2.559': attribute type 11 has an invalid length. [ 154.641105][ T6082] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 155.321859][ T5272] tipc: Subscription rejected, illegal request [ 155.647796][ T6116] __nla_validate_parse: 5 callbacks suppressed [ 155.647831][ T6116] netlink: 1010 bytes leftover after parsing attributes in process `syz.1.570'. [ 155.784074][ T6129] netlink: 'syz.3.575': attribute type 11 has an invalid length. [ 155.824075][ T6129] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.575'. [ 155.959478][ T6130] netlink: 10 bytes leftover after parsing attributes in process `syz.3.575'. [ 156.216639][ T4284] Bluetooth: hci4: unexpected subevent 0x0a length: 150 > 30 [ 156.395151][ T6128] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 159.699565][ T6163] netlink: 132 bytes leftover after parsing attributes in process `syz.1.588'. [ 159.721158][ T6161] netlink: 'syz.2.585': attribute type 1 has an invalid length. [ 159.837623][ T6161] netlink: 'syz.2.585': attribute type 16 has an invalid length. [ 159.850604][ T6161] netlink: 152 bytes leftover after parsing attributes in process `syz.2.585'. [ 160.328326][ T6187] netlink: 'syz.4.594': attribute type 11 has an invalid length. [ 160.385132][ T6187] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.594'. [ 161.125554][ T6186] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 163.462340][ T6187] netlink: 10 bytes leftover after parsing attributes in process `syz.4.594'. [ 163.761197][ T6209] netlink: 'syz.3.600': attribute type 2 has an invalid length. [ 163.817327][ T6209] netlink: 'syz.3.600': attribute type 8 has an invalid length. [ 163.879066][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 163.925525][ T6209] netlink: 'syz.3.600': attribute type 2 has an invalid length. [ 163.944910][ T6209] netlink: 'syz.3.600': attribute type 8 has an invalid length. [ 163.978754][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 164.015991][ T6219] netlink: 'syz.0.604': attribute type 1 has an invalid length. [ 164.047675][ T6209] netlink: 'syz.3.600': attribute type 2 has an invalid length. [ 164.080615][ T6209] netlink: 'syz.3.600': attribute type 8 has an invalid length. [ 164.088470][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 164.111410][ T6209] netlink: 'syz.3.600': attribute type 2 has an invalid length. [ 164.131430][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 164.189355][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 164.236434][ T6223] netlink: 152 bytes leftover after parsing attributes in process `syz.0.604'. [ 164.262185][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 164.344863][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 164.397426][ T6209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.600'. [ 164.729652][ T6238] netlink: 'syz.0.612': attribute type 11 has an invalid length. [ 164.941029][ T6237] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 168.981266][ T6287] validate_nla: 60 callbacks suppressed [ 168.981284][ T6287] netlink: 'syz.1.629': attribute type 21 has an invalid length. [ 169.069188][ T6287] __nla_validate_parse: 29 callbacks suppressed [ 169.069203][ T6287] netlink: 16166 bytes leftover after parsing attributes in process `syz.1.629'. [ 172.151931][ T6317] netlink: 134056 bytes leftover after parsing attributes in process `syz.2.638'. [ 172.917285][ T6344] netlink: 'syz.4.644': attribute type 21 has an invalid length. [ 176.103903][ T6366] netlink: 'syz.0.651': attribute type 46 has an invalid length. [ 176.129150][ T6366] netlink: 36 bytes leftover after parsing attributes in process `syz.0.651'. [ 176.186986][ T6375] netlink: 134056 bytes leftover after parsing attributes in process `syz.1.655'. [ 176.209936][ T6368] netlink: 'syz.2.652': attribute type 10 has an invalid length. [ 176.238113][ T6370] netlink: 134056 bytes leftover after parsing attributes in process `syz.4.653'. [ 176.263257][ T6368] team0: Device nlmon0 is of different type [ 176.653849][ T6388] netlink: 134056 bytes leftover after parsing attributes in process `syz.0.658'. [ 180.258885][ T6415] netlink: 'syz.0.667': attribute type 21 has an invalid length. [ 180.647997][ T6435] FAULT_INJECTION: forcing a failure. [ 180.647997][ T6435] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 180.694055][ T6434] netlink: 134056 bytes leftover after parsing attributes in process `syz.4.670'. [ 180.736880][ T6438] netlink: 134056 bytes leftover after parsing attributes in process `syz.2.672'. [ 180.772775][ T6435] CPU: 0 PID: 6435 Comm: syz.0.671 Not tainted syzkaller #0 [ 180.780116][ T6435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 180.790200][ T6435] Call Trace: [ 180.793496][ T6435] [ 180.796450][ T6435] dump_stack_lvl+0x188/0x24e [ 180.801169][ T6435] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 180.807351][ T6435] ? show_regs_print_info+0x12/0x12 [ 180.812574][ T6435] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 180.818766][ T6435] should_fail_ex+0x390/0x4c0 [ 180.823471][ T6435] _copy_from_user+0x2c/0x170 [ 180.828168][ T6435] ___sys_sendmsg+0x1c3/0x360 [ 180.832878][ T6435] ? __sys_sendmsg+0x2a0/0x2a0 [ 180.837721][ T6435] __se_sys_sendmsg+0x1c3/0x2b0 [ 180.842600][ T6435] ? __x64_sys_sendmsg+0x80/0x80 [ 180.847586][ T6435] ? syscall_enter_from_user_mode+0x2a/0x80 [ 180.853503][ T6435] do_syscall_64+0x4c/0xa0 [ 180.857945][ T6435] ? clear_bhb_loop+0x60/0xb0 [ 180.862640][ T6435] ? clear_bhb_loop+0x60/0xb0 [ 180.867344][ T6435] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 180.873269][ T6435] RIP: 0033:0x7f86ea39e159 [ 180.877709][ T6435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.897345][ T6435] RSP: 002b:00007f86eb2d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 180.905798][ T6435] RAX: ffffffffffffffda RBX: 00007f86ea625fa0 RCX: 00007f86ea39e159 [ 180.913791][ T6435] RDX: 0000000004000000 RSI: 00002000000006c0 RDI: 0000000000000005 [ 180.921780][ T6435] RBP: 00007f86eb2d5090 R08: 0000000000000000 R09: 0000000000000000 [ 180.929755][ T6435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 180.937737][ T6435] R13: 00007f86ea626038 R14: 00007f86ea625fa0 R15: 00007ffc9becaf18 [ 180.945739][ T6435] [ 183.816939][ T6445] netlink: 134056 bytes leftover after parsing attributes in process `syz.3.675'. [ 184.485660][ T6464] netlink: 'syz.3.683': attribute type 21 has an invalid length. [ 185.054028][ T6473] netlink: 134056 bytes leftover after parsing attributes in process `syz.1.686'. [ 186.248011][ T6502] netlink: 60 bytes leftover after parsing attributes in process `syz.4.695'. [ 186.628478][ T6502] device syzkaller0 entered promiscuous mode [ 189.406988][ T6515] netlink: 134056 bytes leftover after parsing attributes in process `syz.0.700'. [ 191.210641][ T4288] Bluetooth: hci1: command 0x0406 tx timeout [ 191.216951][ T4284] Bluetooth: hci0: command 0x0406 tx timeout [ 191.217107][ T4278] Bluetooth: hci3: command 0x0406 tx timeout [ 191.223022][ T4284] Bluetooth: hci2: command 0x0406 tx timeout [ 191.229195][ T49] Bluetooth: hci4: command 0x0406 tx timeout [ 191.456444][ T6515] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 191.474938][ T6515] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 191.485801][ T6515] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 191.969738][ T6544] netlink: 134056 bytes leftover after parsing attributes in process `syz.1.710'. [ 194.263491][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.269994][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.036381][ T5284] tipc: Subscription rejected, illegal request [ 195.112789][ T6557] netlink: 'syz.2.713': attribute type 10 has an invalid length. [ 195.267269][ T6557] device veth0_vlan left promiscuous mode [ 195.297577][ T6557] device veth0_vlan entered promiscuous mode [ 195.357862][ T6557] team0: Device veth0_vlan failed to register rx_handler [ 195.786910][ T6582] netlink: 'syz.4.727': attribute type 21 has an invalid length. [ 195.803445][ T6582] netlink: 132 bytes leftover after parsing attributes in process `syz.4.727'. [ 195.829860][ T6582] netlink: 28 bytes leftover after parsing attributes in process `syz.4.727'. [ 196.155502][ T6593] FAULT_INJECTION: forcing a failure. [ 196.155502][ T6593] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 196.199637][ T6593] CPU: 0 PID: 6593 Comm: syz.4.730 Not tainted syzkaller #0 [ 196.206979][ T6593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 196.217043][ T6593] Call Trace: [ 196.220326][ T6593] [ 196.223261][ T6593] dump_stack_lvl+0x188/0x24e [ 196.227960][ T6593] ? show_regs_print_info+0x12/0x12 [ 196.233172][ T6593] ? load_image+0x410/0x410 [ 196.237689][ T6593] ? __lock_acquire+0x7c40/0x7c40 [ 196.242731][ T6593] should_fail_ex+0x390/0x4c0 [ 196.247429][ T6593] _copy_from_user+0x2c/0x170 [ 196.252120][ T6593] iovec_from_user+0x143/0x360 [ 196.256906][ T6593] __import_iovec+0x6c/0x510 [ 196.261526][ T6593] import_iovec+0x6f/0xa0 [ 196.265878][ T6593] ___sys_sendmsg+0x252/0x360 [ 196.270577][ T6593] ? __sys_sendmsg+0x2a0/0x2a0 [ 196.275362][ T6593] ? ct_nmi_exit+0x145/0x1c0 [ 196.279966][ T6593] ? ct_irq_exit_irqson+0x113/0x170 [ 196.285211][ T6593] __se_sys_sendmsg+0x1c3/0x2b0 [ 196.290075][ T6593] ? ct_nmi_exit+0x145/0x1c0 [ 196.294677][ T6593] ? __x64_sys_sendmsg+0x80/0x80 [ 196.299646][ T6593] ? lockdep_hardirqs_on+0x94/0x140 [ 196.304865][ T6593] do_syscall_64+0x4c/0xa0 [ 196.309297][ T6593] ? clear_bhb_loop+0x60/0xb0 [ 196.313990][ T6593] ? clear_bhb_loop+0x60/0xb0 [ 196.318686][ T6593] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 196.324590][ T6593] RIP: 0033:0x7ff5f479e159 [ 196.329011][ T6593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.348626][ T6593] RSP: 002b:00007ff5f55eb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 196.357051][ T6593] RAX: ffffffffffffffda RBX: 00007ff5f4a25fa0 RCX: 00007ff5f479e159 [ 196.365033][ T6593] RDX: 0000000004000000 RSI: 00002000000006c0 RDI: 0000000000000005 [ 196.373015][ T6593] RBP: 00007ff5f55eb090 R08: 0000000000000000 R09: 0000000000000000 [ 196.380993][ T6593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 196.388969][ T6593] R13: 00007ff5f4a26038 R14: 00007ff5f4a25fa0 R15: 00007ffd458749f8 [ 196.396961][ T6593] [ 199.582522][ T6620] syz.4.739[6620] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 199.582632][ T6620] syz.4.739[6620] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 199.912098][ T49] Bluetooth: hci3: unexpected event 0x12 length: 15 > 8 [ 203.102113][ T49] Bluetooth: hci2: SCO packet for unknown connection handle 0 [ 203.318695][ T6667] netlink: 'syz.0.757': attribute type 10 has an invalid length. [ 206.581087][ T6748] netlink: 'syz.1.790': attribute type 29 has an invalid length. [ 206.617041][ T6748] netlink: 'syz.1.790': attribute type 29 has an invalid length. [ 206.643162][ T6749] netlink: 'syz.1.790': attribute type 29 has an invalid length. [ 208.083287][ T6788] FAULT_INJECTION: forcing a failure. [ 208.083287][ T6788] name failslab, interval 1, probability 0, space 0, times 1 [ 208.152465][ T6788] CPU: 1 PID: 6788 Comm: syz.0.802 Not tainted syzkaller #0 [ 208.159825][ T6788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 208.169898][ T6788] Call Trace: [ 208.173186][ T6788] [ 208.176127][ T6788] dump_stack_lvl+0x188/0x24e [ 208.180838][ T6788] ? show_regs_print_info+0x12/0x12 [ 208.186067][ T6788] ? load_image+0x410/0x410 [ 208.190599][ T6788] ? __might_sleep+0xd0/0xd0 [ 208.195204][ T6788] ? __lock_acquire+0x7c40/0x7c40 [ 208.200272][ T6788] should_fail_ex+0x390/0x4c0 [ 208.204980][ T6788] should_failslab+0x5/0x20 [ 208.209501][ T6788] slab_pre_alloc_hook+0x59/0x300 [ 208.214545][ T6788] kmem_cache_alloc_node+0x5a/0x310 [ 208.219758][ T6788] ? __alloc_skb+0xf9/0x7d0 [ 208.224325][ T6788] __alloc_skb+0xf9/0x7d0 [ 208.228694][ T6788] netlink_sendmsg+0x654/0xbd0 [ 208.233489][ T6788] ? netlink_getsockopt+0x550/0x550 [ 208.238714][ T6788] ? apparmor_socket_sendmsg+0x8a/0x330 [ 208.244297][ T6788] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 208.249609][ T6788] ? security_socket_sendmsg+0x7c/0xa0 [ 208.255087][ T6788] ? netlink_getsockopt+0x550/0x550 [ 208.260306][ T6788] ____sys_sendmsg+0x5ed/0x9a0 [ 208.265107][ T6788] ? __sys_sendmsg_sock+0x30/0x30 [ 208.270154][ T6788] ? __import_iovec+0x306/0x510 [ 208.275032][ T6788] ? import_iovec+0x6f/0xa0 [ 208.279555][ T6788] ___sys_sendmsg+0x2a2/0x360 [ 208.284260][ T6788] ? __sys_sendmsg+0x2a0/0x2a0 [ 208.289061][ T6788] ? __lock_acquire+0x7c40/0x7c40 [ 208.294123][ T6788] __se_sys_sendmsg+0x1c3/0x2b0 [ 208.298996][ T6788] ? __x64_sys_sendmsg+0x80/0x80 [ 208.303978][ T6788] ? syscall_enter_from_user_mode+0x2a/0x80 [ 208.309903][ T6788] do_syscall_64+0x4c/0xa0 [ 208.314346][ T6788] ? clear_bhb_loop+0x60/0xb0 [ 208.319046][ T6788] ? clear_bhb_loop+0x60/0xb0 [ 208.323744][ T6788] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 208.329656][ T6788] RIP: 0033:0x7f86ea39e159 [ 208.334083][ T6788] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 208.353704][ T6788] RSP: 002b:00007f86eb2d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 208.362148][ T6788] RAX: ffffffffffffffda RBX: 00007f86ea625fa0 RCX: 00007f86ea39e159 [ 208.370143][ T6788] RDX: 0000000004000000 RSI: 00002000000006c0 RDI: 0000000000000005 [ 208.378138][ T6788] RBP: 00007f86eb2d5090 R08: 0000000000000000 R09: 0000000000000000 [ 208.386130][ T6788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 208.394117][ T6788] R13: 00007f86ea626038 R14: 00007f86ea625fa0 R15: 00007ffc9becaf18 [ 208.402116][ T6788] [ 208.473578][ T6795] netlink: 'syz.4.804': attribute type 10 has an invalid length. [ 208.518617][ T6795] team0: Device vxcan1 is of different type [ 208.577176][ T6797] netlink: 'syz.4.804': attribute type 10 has an invalid length. [ 208.590411][ T6797] team0: Device vxcan1 is of different type [ 209.446082][ T6831] netlink: 'syz.4.817': attribute type 21 has an invalid length. [ 209.485187][ T6831] netlink: 164 bytes leftover after parsing attributes in process `syz.4.817'. [ 211.025728][ T49] Bluetooth: hci2: unexpected event 0x12 length: 15 > 8 [ 211.893163][ T6893] netlink: 'syz.0.841': attribute type 10 has an invalid length. [ 211.920819][ T6893] netlink: 55 bytes leftover after parsing attributes in process `syz.0.841'. [ 212.202666][ T6902] netlink: 'syz.4.846': attribute type 11 has an invalid length. [ 212.259306][ T6902] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.846'. [ 212.363048][ T6902] netlink: 10 bytes leftover after parsing attributes in process `syz.4.846'. [ 212.403976][ T6901] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.298545][ T6926] netlink: 'syz.1.853': attribute type 10 has an invalid length. [ 213.396524][ T6926] team0: Device nlmon0 is of different type [ 214.365502][ T6947] netlink: 'syz.1.861': attribute type 11 has an invalid length. [ 214.440934][ T6947] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.861'. [ 214.570175][ T6947] netlink: 10 bytes leftover after parsing attributes in process `syz.1.861'. [ 214.694921][ T6946] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 215.133537][ T6966] device syzkaller0 entered promiscuous mode [ 216.786533][ T7000] netlink: 'syz.0.879': attribute type 11 has an invalid length. [ 216.809305][ T7000] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.879'. [ 217.547278][ T6999] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 217.779424][ T7000] netlink: 10 bytes leftover after parsing attributes in process `syz.0.879'. [ 218.156537][ T7007] netlink: 'syz.2.881': attribute type 11 has an invalid length. [ 218.194525][ T7007] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.881'. [ 218.306739][ T7007] netlink: 10 bytes leftover after parsing attributes in process `syz.2.881'. [ 218.357915][ T7006] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 218.914485][ T7028] netlink: 'syz.2.890': attribute type 11 has an invalid length. [ 218.973352][ T7028] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.890'. [ 219.098660][ T7028] netlink: 10 bytes leftover after parsing attributes in process `syz.2.890'. [ 219.182167][ T7027] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 220.535813][ T7074] netlink: 'syz.0.907': attribute type 11 has an invalid length. [ 220.562870][ T7074] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.907'. [ 220.674018][ T7074] netlink: 10 bytes leftover after parsing attributes in process `syz.0.907'. [ 220.834681][ T7072] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 221.876044][ T7124] netlink: 'syz.1.927': attribute type 11 has an invalid length. [ 221.889612][ T7124] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.927'. [ 222.009850][ T7134] netlink: 10 bytes leftover after parsing attributes in process `syz.1.927'. [ 222.119469][ T7122] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 222.799355][ T7160] tun0: tun_chr_ioctl cmd 2147767507 [ 223.135729][ T7175] netlink: 'syz.0.947': attribute type 11 has an invalid length. [ 223.179100][ T7175] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.947'. [ 223.207732][ T49] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 223.299133][ T7175] netlink: 10 bytes leftover after parsing attributes in process `syz.0.947'. [ 223.328789][ T7173] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 223.898146][ T7201] netlink: 'syz.0.956': attribute type 10 has an invalid length. [ 223.907017][ T7201] netlink: 55 bytes leftover after parsing attributes in process `syz.0.956'. [ 224.168516][ T7210] netlink: 8 bytes leftover after parsing attributes in process `syz.2.959'. [ 224.188272][ T7210] netlink: 4 bytes leftover after parsing attributes in process `syz.2.959'. [ 224.197685][ T7210] netlink: 33 bytes leftover after parsing attributes in process `syz.2.959'. [ 224.712682][ T7218] netlink: 'syz.3.963': attribute type 11 has an invalid length. [ 224.825651][ T7217] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 225.571597][ T7228] delete_channel: no stack [ 225.824913][ T7241] netlink: 'syz.3.971': attribute type 10 has an invalid length. [ 225.947105][ T7249] netlink: 'syz.4.974': attribute type 11 has an invalid length. [ 225.969293][ T7249] __nla_validate_parse: 7 callbacks suppressed [ 225.969329][ T7249] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.974'. [ 226.149551][ T7253] netlink: 10 bytes leftover after parsing attributes in process `syz.4.974'. [ 226.181054][ T7248] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 227.387241][ T7285] netlink: 'syz.4.988': attribute type 11 has an invalid length. [ 227.409264][ T7285] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.988'. [ 227.436677][ T7284] netlink: 'syz.2.987': attribute type 4 has an invalid length. [ 227.478281][ T7284] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.987'. [ 227.498843][ T7290] netlink: 10 bytes leftover after parsing attributes in process `syz.4.988'. [ 227.529488][ T7283] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 227.576989][ T7294] netlink: 'syz.3.990': attribute type 10 has an invalid length. [ 228.772680][ T7319] device wg2 entered promiscuous mode [ 228.842146][ T7327] netlink: 'syz.1.1002': attribute type 11 has an invalid length. [ 228.859033][ T7327] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1002'. [ 229.081091][ T7327] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1002'. [ 229.120424][ T7326] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 229.269803][ T7335] netlink: 125520 bytes leftover after parsing attributes in process `syz.2.1005'. [ 230.223713][ T7361] netlink: 'syz.4.1019': attribute type 11 has an invalid length. [ 230.252471][ T7361] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1019'. [ 230.343127][ T7361] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1019'. [ 230.363792][ T7358] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 231.355973][ T7398] netlink: 'syz.2.1028': attribute type 11 has an invalid length. [ 231.406626][ T7398] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1028'. [ 231.475085][ T7400] netlink: 'syz.0.1031': attribute type 11 has an invalid length. [ 231.498287][ T7400] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1031'. [ 231.504573][ T7398] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1028'. [ 231.564903][ T7404] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1031'. [ 231.581272][ T7399] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 231.585696][ T7397] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 231.681717][ T7413] ¥: port 1(team0) entered blocking state [ 231.707847][ T7413] ¥: port 1(team0) entered disabled state [ 231.763132][ T7413] device team0 entered promiscuous mode [ 231.768777][ T7413] device team_slave_0 entered promiscuous mode [ 231.811830][ T7413] device team_slave_1 entered promiscuous mode [ 231.873022][ T7408] device team0 left promiscuous mode [ 231.904695][ T7408] device team_slave_0 left promiscuous mode [ 231.974377][ T7408] device team_slave_1 left promiscuous mode [ 232.008989][ T7408] ¥: port 1(team0) entered disabled state [ 232.038135][ T7423] FAULT_INJECTION: forcing a failure. [ 232.038135][ T7423] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.079224][ T7423] CPU: 1 PID: 7423 Comm: syz.3.1039 Not tainted syzkaller #0 [ 232.086649][ T7423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.096703][ T7423] Call Trace: [ 232.099993][ T7423] [ 232.102941][ T7423] dump_stack_lvl+0x188/0x24e [ 232.107636][ T7423] ? show_regs_print_info+0x12/0x12 [ 232.112842][ T7423] ? load_image+0x410/0x410 [ 232.117351][ T7423] ? __lock_acquire+0x7c40/0x7c40 [ 232.122381][ T7423] should_fail_ex+0x390/0x4c0 [ 232.127062][ T7423] _copy_from_user+0x2c/0x170 [ 232.131739][ T7423] __sys_bpf+0x2ea/0x780 [ 232.135984][ T7423] ? bpf_link_show_fdinfo+0x380/0x380 [ 232.141362][ T7423] ? lock_chain_count+0x20/0x20 [ 232.146230][ T7423] __x64_sys_bpf+0x78/0x90 [ 232.150655][ T7423] do_syscall_64+0x4c/0xa0 [ 232.155066][ T7423] ? clear_bhb_loop+0x60/0xb0 [ 232.159738][ T7423] ? clear_bhb_loop+0x60/0xb0 [ 232.164414][ T7423] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 232.170302][ T7423] RIP: 0033:0x7f663fd9e159 [ 232.174717][ T7423] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.194351][ T7423] RSP: 002b:00007f6640bc2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 232.202758][ T7423] RAX: ffffffffffffffda RBX: 00007f6640025fa0 RCX: 00007f663fd9e159 [ 232.210724][ T7423] RDX: 0000000000000020 RSI: 00002000000003c0 RDI: 0000000000000001 [ 232.218687][ T7423] RBP: 00007f6640bc2090 R08: 0000000000000000 R09: 0000000000000000 [ 232.226650][ T7423] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 232.234611][ T7423] R13: 00007f6640026038 R14: 00007f6640025fa0 R15: 00007ffc4bad4a48 [ 232.242593][ T7423] [ 232.719856][ T7435] netlink: 'syz.3.1042': attribute type 10 has an invalid length. [ 232.732741][ T7435] netlink: 55 bytes leftover after parsing attributes in process `syz.3.1042'. [ 232.963632][ T7443] netlink: 'syz.3.1046': attribute type 11 has an invalid length. [ 233.002007][ T7443] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1046'. [ 233.020940][ T7442] netlink: 'syz.2.1047': attribute type 11 has an invalid length. [ 233.034937][ T7442] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1047'. [ 233.085215][ T7446] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1046'. [ 233.141837][ T7447] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1047'. [ 233.341809][ T7440] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 233.418063][ T7441] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 239.376165][ T7546] netlink: 'syz.3.1080': attribute type 21 has an invalid length. [ 239.393297][ T7546] netlink: 'syz.3.1080': attribute type 13 has an invalid length. [ 239.419358][ T7546] netlink: 6188 bytes leftover after parsing attributes in process `syz.3.1080'. [ 244.344217][ T49] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 244.729955][ T7617] netlink: 'syz.0.1109': attribute type 21 has an invalid length. [ 244.821400][ T7617] netlink: 16154 bytes leftover after parsing attributes in process `syz.0.1109'. [ 244.873908][ T7616] netlink: 'syz.0.1109': attribute type 21 has an invalid length. [ 244.916084][ T7616] netlink: 16154 bytes leftover after parsing attributes in process `syz.0.1109'. [ 245.408510][ T7640] device sit0 entered promiscuous mode [ 249.167388][ T7684] netlink: 'syz.2.1135': attribute type 5 has an invalid length. [ 254.209224][ T7748] device syzkaller0 entered promiscuous mode [ 255.696807][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.703258][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.355915][ T49] Bluetooth: hci1: unexpected event 0x12 length: 15 > 8 [ 258.644132][ T7795] netlink: 'syz.4.1175': attribute type 10 has an invalid length. [ 258.816182][ T7808] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1178'. [ 258.950726][ T7795] netlink: 'syz.4.1175': attribute type 4 has an invalid length. [ 259.217169][ T7820] netlink: 'syz.3.1183': attribute type 7 has an invalid length. [ 259.237151][ T7820] netlink: 140 bytes leftover after parsing attributes in process `syz.3.1183'. [ 260.158736][ T7843] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1191'. [ 261.623854][ T7875] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1203'. [ 262.360530][ T7894] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1211'. [ 262.485218][ T7894] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 262.505332][ T7894] bond0 (unregistering): Released all slaves [ 262.542057][ T7893] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1211'. [ 262.899326][ T7903] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1215'. [ 263.582059][ T7928] netlink: 'syz.2.1226': attribute type 10 has an invalid length. [ 263.613586][ T7928] netlink: 55 bytes leftover after parsing attributes in process `syz.2.1226'. [ 263.699874][ T7934] netlink: 'syz.1.1228': attribute type 21 has an invalid length. [ 263.951998][ T7943] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1230'. [ 264.302209][ T7952] device syzkaller0 entered promiscuous mode [ 264.393316][ T7952] netlink: 122896 bytes leftover after parsing attributes in process `syz.2.1234'. [ 264.502847][ T7952] debugfs: Directory '!!!' with parent 'ieee80211' already present! [ 267.134201][ T7974] netlink: 16098 bytes leftover after parsing attributes in process `syz.4.1242'. [ 267.895240][ T7988] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1244'. [ 268.007899][ T7991] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.015506][ T7991] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.581215][ T8013] netlink: 'syz.2.1255': attribute type 15 has an invalid length. [ 268.621719][ T8013] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1255'. [ 268.984894][ T8027] netlink: 'syz.2.1259': attribute type 3 has an invalid length. [ 269.003010][ T8027] netlink: 'syz.2.1259': attribute type 1 has an invalid length. [ 269.016330][ T8027] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.1259'. [ 269.735403][ T8039] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1261'. [ 270.431269][ T8066] netlink: 'syz.2.1270': attribute type 2 has an invalid length. [ 270.510153][ T8066] netlink: 119 bytes leftover after parsing attributes in process `syz.2.1270'. [ 271.825216][ T8089] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1277'. [ 272.280401][ T8101] netlink: 'syz.3.1283': attribute type 21 has an invalid length. [ 272.335902][ T8101] netlink: 'syz.3.1283': attribute type 12 has an invalid length. [ 272.375167][ T8101] netlink: 'syz.3.1283': attribute type 13 has an invalid length. [ 272.409374][ T8101] netlink: 'syz.3.1283': attribute type 14 has an invalid length. [ 272.482741][ T8101] netlink: 'syz.3.1283': attribute type 15 has an invalid length. [ 272.509128][ T8101] netlink: 'syz.3.1283': attribute type 16 has an invalid length. [ 272.549340][ T8101] netlink: 'syz.3.1283': attribute type 19 has an invalid length. [ 272.591273][ T8101] netlink: 9618 bytes leftover after parsing attributes in process `syz.3.1283'. [ 273.709806][ T8125] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1292'. [ 274.139703][ T8135] FAULT_INJECTION: forcing a failure. [ 274.139703][ T8135] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 274.190630][ T8135] CPU: 1 PID: 8135 Comm: syz.2.1295 Not tainted syzkaller #0 [ 274.198070][ T8135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 274.208164][ T8135] Call Trace: [ 274.211462][ T8135] [ 274.214409][ T8135] dump_stack_lvl+0x188/0x24e [ 274.219118][ T8135] ? show_regs_print_info+0x12/0x12 [ 274.224347][ T8135] ? load_image+0x410/0x410 [ 274.228888][ T8135] ? __lock_acquire+0x7c40/0x7c40 [ 274.233938][ T8135] ? mark_lock+0x94/0x320 [ 274.238301][ T8135] should_fail_ex+0x390/0x4c0 [ 274.243013][ T8135] _copy_from_user+0x2c/0x170 [ 274.247727][ T8135] kstrtouint_from_user+0xda/0x170 [ 274.252867][ T8135] ? kstrtol_from_user+0x190/0x190 [ 274.258008][ T8135] ? proc_fail_nth_write+0x6b/0x200 [ 274.263231][ T8135] proc_fail_nth_write+0x8b/0x200 [ 274.268274][ T8135] ? proc_fail_nth_read+0x220/0x220 [ 274.273493][ T8135] ? common_file_perm+0x171/0x1c0 [ 274.278552][ T8135] ? proc_fail_nth_read+0x220/0x220 [ 274.283775][ T8135] vfs_write+0x2dc/0x9a0 [ 274.288045][ T8135] ? file_end_write+0x250/0x250 [ 274.292924][ T8135] ? __fget_files+0x28/0x460 [ 274.297537][ T8135] ? __fget_files+0x3fc/0x460 [ 274.302251][ T8135] ? __fdget_pos+0x2ae/0x360 [ 274.306867][ T8135] ? ksys_write+0x70/0x260 [ 274.311311][ T8135] ksys_write+0x14d/0x260 [ 274.315672][ T8135] ? __ia32_sys_read+0x80/0x80 [ 274.320469][ T8135] ? syscall_enter_from_user_mode+0x2a/0x80 [ 274.326388][ T8135] do_syscall_64+0x4c/0xa0 [ 274.330831][ T8135] ? clear_bhb_loop+0x60/0xb0 [ 274.335530][ T8135] ? clear_bhb_loop+0x60/0xb0 [ 274.340234][ T8135] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 274.346152][ T8135] RIP: 0033:0x7fea0355e98e [ 274.350582][ T8135] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 274.370207][ T8135] RSP: 002b:00007fea017f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 274.378646][ T8135] RAX: ffffffffffffffda RBX: 00007fea017f66c0 RCX: 00007fea0355e98e [ 274.386642][ T8135] RDX: 0000000000000001 RSI: 00007fea017f60a0 RDI: 0000000000000006 [ 274.394638][ T8135] RBP: 00007fea017f6090 R08: 0000000000000000 R09: 0000000000000000 [ 274.402633][ T8135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.410623][ T8135] R13: 00007fea03826038 R14: 00007fea03825fa0 R15: 00007ffe1cc17938 [ 274.418634][ T8135] [ 274.836364][ T8142] device syzkaller0 entered promiscuous mode [ 274.915097][ T8142] netlink: 122896 bytes leftover after parsing attributes in process `syz.3.1298'. [ 274.927583][ T8142] debugfs: Directory '!!!' with parent 'ieee80211' already present! [ 276.486642][ T8157] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1304'. [ 279.422155][ T8254] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.1336'. [ 287.317332][ T8400] validate_nla: 1 callbacks suppressed [ 287.317348][ T8400] netlink: 'syz.3.1388': attribute type 21 has an invalid length. [ 288.464149][ T8441] netlink: 'syz.3.1403': attribute type 10 has an invalid length. [ 289.059397][ T8459] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1410'. [ 289.383595][ T49] Bluetooth: hci3: unexpected event 0x12 length: 15 > 8 [ 289.793579][ T8459] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 290.499508][ T8459] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 292.923445][ T8459] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 292.954882][ T8459] bond0 (unregistering): Released all slaves [ 293.243155][ T8491] netlink: 16083 bytes leftover after parsing attributes in process `syz.3.1419'. [ 293.533923][ T8500] netlink: 'syz.1.1425': attribute type 41 has an invalid length. [ 293.868436][ T8516] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1428'. [ 295.747736][ T8536] netlink: 15119 bytes leftover after parsing attributes in process `syz.3.1435'. [ 296.923058][ T8552] netlink: 'syz.0.1442': attribute type 41 has an invalid length. [ 297.837981][ T8588] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 297.935240][ T8587] netlink: 'syz.4.1455': attribute type 9 has an invalid length. [ 297.952467][ T8587] netlink: 61967 bytes leftover after parsing attributes in process `syz.4.1455'. [ 298.059497][ T8597] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1456'. [ 298.484237][ T8613] netlink: 'syz.1.1462': attribute type 2 has an invalid length. [ 298.551883][ T8610] netlink: 'syz.2.1461': attribute type 41 has an invalid length. [ 299.101941][ T8629] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1464'. [ 300.005855][ T8652] netlink: 'syz.3.1474': attribute type 41 has an invalid length. [ 300.149006][ T8658] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1475'. [ 300.261648][ T8665] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1478'. [ 301.162667][ T49] Bluetooth: hci2: unexpected event 0x12 length: 15 > 8 [ 301.457784][ T8698] netlink: 202920 bytes leftover after parsing attributes in process `syz.3.1489'. [ 301.598159][ T8703] netlink: 'syz.3.1489': attribute type 10 has an invalid length. [ 301.626771][ T8703] netlink: 55 bytes leftover after parsing attributes in process `syz.3.1489'. [ 301.682215][ T8705] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1491'. [ 301.979657][ T8713] netlink: 15998 bytes leftover after parsing attributes in process `syz.2.1494'. [ 302.831832][ T8727] netlink: 'syz.4.1501': attribute type 10 has an invalid length. [ 302.855202][ T8727] netlink: 55 bytes leftover after parsing attributes in process `syz.4.1501'. [ 302.896881][ T8727] device veth0_vlan left promiscuous mode [ 303.404909][ T8746] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1506'. [ 303.674590][ T8761] netlink: 125520 bytes leftover after parsing attributes in process `syz.1.1510'. [ 303.687506][ T8756] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1509'. [ 304.296292][ T8783] netlink: 'syz.3.1519': attribute type 29 has an invalid length. [ 304.382077][ T8783] netlink: 'syz.3.1519': attribute type 29 has an invalid length. [ 304.419261][ T8784] netlink: 'syz.3.1519': attribute type 29 has an invalid length. [ 304.462324][ T8789] netlink: 'syz.3.1519': attribute type 29 has an invalid length. [ 305.027428][ T8802] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1523'. [ 305.325019][ T8810] Dead loop on virtual device ip6_vti0, fix it urgently! [ 306.040699][ T8833] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1535'. [ 307.278728][ T49] Bluetooth: hci0: ISO packet for unknown connection handle 2622 [ 307.301164][ T8881] netlink: 'syz.0.1546': attribute type 10 has an invalid length. [ 307.414493][ T8886] netlink: 'syz.3.1549': attribute type 33 has an invalid length. [ 307.467523][ T8887] netlink: 154020 bytes leftover after parsing attributes in process `syz.3.1549'. [ 307.476693][ T8886] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1549'. [ 307.527587][ T8886] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 307.541590][ T8887] openvswitch: netlink: ufid size 48894 bytes exceeds the range (1, 16) [ 307.641921][ T8886] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 307.775868][ T8896] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1550'. [ 308.331802][ T8907] netlink: 'syz.1.1556': attribute type 1 has an invalid length. [ 308.376614][ T8907] netlink: 127868 bytes leftover after parsing attributes in process `syz.1.1556'. [ 309.161398][ T8934] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1565'. [ 309.464413][ T49] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 310.489864][ T8966] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1579'. [ 312.031129][ T9014] netlink: 'syz.0.1593': attribute type 29 has an invalid length. [ 312.065564][ T9015] netlink: 'syz.4.1594': attribute type 11 has an invalid length. [ 312.090564][ T9014] netlink: 'syz.0.1593': attribute type 29 has an invalid length. [ 312.121526][ T9015] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1594'. [ 312.137047][ T9016] netlink: 'syz.0.1593': attribute type 29 has an invalid length. [ 312.158503][ T9017] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1594'. [ 312.190721][ T9013] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 312.554231][ T9026] netlink: 'syz.0.1598': attribute type 10 has an invalid length. [ 312.603773][ T9031] netlink: 'syz.0.1598': attribute type 7 has an invalid length. [ 312.650840][ T9031] netlink: 191184 bytes leftover after parsing attributes in process `syz.0.1598'. [ 312.708160][ T9034] netlink: 'syz.0.1598': attribute type 7 has an invalid length. [ 312.799144][ T9034] netlink: 191184 bytes leftover after parsing attributes in process `syz.0.1598'. [ 313.189542][ T9044] Ÿë: port 1(ip6gretap0) entered blocking state [ 313.199129][ T9044] Ÿë: port 1(ip6gretap0) entered disabled state [ 313.220652][ T9044] device ip6gretap0 entered promiscuous mode [ 313.555106][ T9052] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1607'. [ 313.732354][ T9059] netlink: 'syz.2.1610': attribute type 11 has an invalid length. [ 313.754946][ T9059] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1610'. [ 313.775956][ T9062] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1610'. [ 313.801015][ T9058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 314.099255][ T9071] netlink: 'syz.4.1613': attribute type 10 has an invalid length. [ 314.121663][ T9071] netlink: 'syz.4.1613': attribute type 11 has an invalid length. [ 314.130548][ T9071] netlink: 5081 bytes leftover after parsing attributes in process `syz.4.1613'. [ 314.140694][ T9072] netlink: 'syz.4.1613': attribute type 10 has an invalid length. [ 314.153732][ T9072] netlink: 'syz.4.1613': attribute type 11 has an invalid length. [ 314.168678][ T9072] netlink: 5081 bytes leftover after parsing attributes in process `syz.4.1613'. [ 314.796081][ T9099] netlink: 'syz.2.1624': attribute type 11 has an invalid length. [ 314.852710][ T9099] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1624'. [ 314.898532][ T9103] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1624'. [ 314.947223][ T9098] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 316.060799][ T9139] netlink: 'syz.1.1638': attribute type 11 has an invalid length. [ 316.071964][ T9140] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1638'. [ 316.114711][ T9138] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 316.777833][ T49] Bluetooth: hci2: unexpected event 0x12 length: 15 > 8 [ 317.044236][ T9169] netlink: 'syz.0.1652': attribute type 11 has an invalid length. [ 317.100798][ T9168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 317.135270][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.141656][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.051644][ T9201] __nla_validate_parse: 3 callbacks suppressed [ 318.051661][ T9201] netlink: 55631 bytes leftover after parsing attributes in process `syz.3.1663'. [ 318.109617][ T9201] netlink: 5304 bytes leftover after parsing attributes in process `syz.3.1663'. [ 318.152345][ T9201] netlink: 802 bytes leftover after parsing attributes in process `syz.3.1663'. [ 318.327357][ T9209] netlink: 'syz.4.1666': attribute type 11 has an invalid length. [ 318.362573][ T9209] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1666'. [ 318.413064][ T9214] validate_nla: 8 callbacks suppressed [ 318.413093][ T9214] netlink: 'syz.3.1668': attribute type 29 has an invalid length. [ 318.438518][ T9209] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1666'. [ 318.492408][ T9214] netlink: 'syz.3.1668': attribute type 29 has an invalid length. [ 318.493516][ T9207] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.567860][ T9217] netlink: 'syz.3.1668': attribute type 29 has an invalid length. [ 318.657573][ T9216] netlink: 'syz.3.1668': attribute type 29 has an invalid length. [ 318.765248][ T9221] netlink: 'syz.0.1670': attribute type 16 has an invalid length. [ 318.791851][ T9221] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1670'. [ 319.660495][ T9251] netlink: 'syz.3.1681': attribute type 11 has an invalid length. [ 319.705187][ T9251] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1681'. [ 319.783053][ T9251] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1681'. [ 319.850356][ T9250] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 320.384057][ T9270] netlink: 'syz.0.1688': attribute type 29 has an invalid length. [ 320.436184][ T9270] netlink: 'syz.0.1688': attribute type 29 has an invalid length. [ 320.460142][ T9272] netlink: 'syz.0.1688': attribute type 29 has an invalid length. [ 320.471042][ T9270] netlink: 'syz.0.1688': attribute type 29 has an invalid length. [ 321.287183][ T9303] netlink: 'syz.2.1697': attribute type 11 has an invalid length. [ 321.319205][ T9303] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1697'. [ 321.355166][ T9304] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1697'. [ 321.446297][ T9296] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.704220][ T9318] device bridge_slave_1 left promiscuous mode [ 321.737035][ T9318] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.901489][ T9318] device bridge_slave_0 left promiscuous mode [ 321.908540][ T9318] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.245010][ T9335] netlink: 'syz.3.1708': attribute type 16 has an invalid length. [ 324.149404][ T49] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 326.245497][ T9451] netlink: 'syz.4.1749': attribute type 11 has an invalid length. [ 326.287156][ T9456] __nla_validate_parse: 1 callbacks suppressed [ 326.287171][ T9456] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1749'. [ 326.349362][ T9451] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1749'. [ 326.390626][ T9450] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.487418][ T9462] netlink: 146340 bytes leftover after parsing attributes in process `syz.0.1755'. [ 326.507227][ T9462] openvswitch: netlink: Key type 386 is out of range max 32 [ 327.038900][ T9493] netlink: 'syz.0.1762': attribute type 10 has an invalid length. [ 327.052826][ T9493] netlink: 55 bytes leftover after parsing attributes in process `syz.0.1762'. [ 327.336993][ T9499] netlink: 'syz.1.1766': attribute type 11 has an invalid length. [ 327.412169][ T9506] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1766'. [ 327.465247][ T9499] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1766'. [ 327.583124][ T9498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 328.958138][ T9541] netlink: 'syz.1.1781': attribute type 11 has an invalid length. [ 328.989268][ T9541] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1781'. [ 329.012358][ T9539] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1781'. [ 329.042296][ T9543] netlink: 'syz.2.1783': attribute type 3 has an invalid length. [ 329.077833][ T9543] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1783'. [ 329.093053][ T9537] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 330.232019][ T9582] netlink: 'syz.1.1798': attribute type 11 has an invalid length. [ 330.274420][ T9582] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1798'. [ 330.395258][ T9580] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 331.156529][ T9608] netlink: 'syz.2.1804': attribute type 21 has an invalid length. [ 331.255351][ T9608] netlink: 'syz.2.1804': attribute type 7 has an invalid length. [ 331.634588][ T9618] netlink: 'syz.0.1810': attribute type 11 has an invalid length. [ 331.647250][ T9618] __nla_validate_parse: 1 callbacks suppressed [ 331.647285][ T9618] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1810'. [ 331.700556][ T9618] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1810'. [ 331.717762][ T9617] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.066010][ T49] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 332.095113][ T9632] delete_channel: no stack [ 332.218261][ T9632] delete_channel: no stack [ 333.047178][ T9651] netlink: 'syz.2.1823': attribute type 11 has an invalid length. [ 333.096655][ T9651] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1823'. [ 333.254277][ T9655] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1823'. [ 333.326368][ T9650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 333.925498][ T9682] netlink: 'syz.2.1832': attribute type 10 has an invalid length. [ 334.812583][ T9702] netlink: 'syz.1.1839': attribute type 11 has an invalid length. [ 334.849261][ T9702] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1839'. [ 334.990040][ T9703] netlink: 'syz.3.1837': attribute type 10 has an invalid length. [ 335.043917][ T9703] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1837'. [ 335.084717][ T9703] batman_adv: batadv0: Adding interface: virt_wifi0 [ 335.119160][ T9703] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 335.219938][ T9703] batman_adv: batadv0: Interface activated: virt_wifi0 [ 335.254098][ T9704] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1839'. [ 335.294930][ T9698] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 335.600176][ T9718] netlink: 'syz.2.1844': attribute type 21 has an invalid length. [ 335.629986][ T9718] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1844'. [ 335.840699][ T9730] tipc: Started in network mode [ 335.878235][ T9730] tipc: Node identity 9215a268, cluster identity 4711 [ 335.915778][ T9730] tipc: Node number set to 2450891368 [ 336.956695][ T9758] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1857'. [ 336.977998][ T9754] netlink: 'syz.3.1856': attribute type 11 has an invalid length. [ 337.035786][ T9754] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1856'. [ 337.073774][ T9761] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1856'. [ 337.171484][ T9751] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 337.724664][ T9778] netlink: 'syz.0.1865': attribute type 10 has an invalid length. [ 338.183211][ T9791] FAULT_INJECTION: forcing a failure. [ 338.183211][ T9791] name failslab, interval 1, probability 0, space 0, times 0 [ 338.230283][ T9791] CPU: 0 PID: 9791 Comm: syz.1.1869 Not tainted syzkaller #0 [ 338.237718][ T9791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 338.247793][ T9791] Call Trace: [ 338.251082][ T9791] [ 338.254025][ T9791] dump_stack_lvl+0x188/0x24e [ 338.258735][ T9791] ? show_regs_print_info+0x12/0x12 [ 338.264006][ T9791] ? load_image+0x410/0x410 [ 338.268534][ T9791] ? __might_sleep+0xd0/0xd0 [ 338.273140][ T9791] ? __lock_acquire+0x7c40/0x7c40 [ 338.278188][ T9791] ? perf_trace_preemptirq_template+0xa8/0x320 [ 338.284356][ T9791] should_fail_ex+0x390/0x4c0 [ 338.289048][ T9791] should_failslab+0x5/0x20 [ 338.293557][ T9791] slab_pre_alloc_hook+0x59/0x300 [ 338.298582][ T9791] ? tomoyo_realpath_from_path+0xe2/0x5c0 [ 338.304303][ T9791] __kmem_cache_alloc_node+0x4f/0x270 [ 338.309676][ T9791] ? tomoyo_realpath_from_path+0xe2/0x5c0 [ 338.315391][ T9791] __kmalloc+0xa3/0x240 [ 338.319550][ T9791] tomoyo_realpath_from_path+0xe2/0x5c0 [ 338.325100][ T9791] ? tomoyo_path_number_perm+0x205/0x650 [ 338.330728][ T9791] tomoyo_path_number_perm+0x22f/0x650 [ 338.336186][ T9791] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 338.341644][ T9791] ? ksys_write+0x1ce/0x260 [ 338.346147][ T9791] ? common_file_perm+0x171/0x1c0 [ 338.351195][ T9791] ? __fget_files+0x28/0x460 [ 338.355793][ T9791] security_file_ioctl+0x6c/0xa0 [ 338.360732][ T9791] __se_sys_ioctl+0x48/0x170 [ 338.365324][ T9791] do_syscall_64+0x4c/0xa0 [ 338.369743][ T9791] ? clear_bhb_loop+0x60/0xb0 [ 338.374417][ T9791] ? clear_bhb_loop+0x60/0xb0 [ 338.379094][ T9791] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 338.384983][ T9791] RIP: 0033:0x7f9ecad9e159 [ 338.389397][ T9791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 338.408996][ T9791] RSP: 002b:00007f9ecbc87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 338.417407][ T9791] RAX: ffffffffffffffda RBX: 00007f9ecb025fa0 RCX: 00007f9ecad9e159 [ 338.425375][ T9791] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 338.433340][ T9791] RBP: 00007f9ecbc87090 R08: 0000000000000000 R09: 0000000000000000 [ 338.441304][ T9791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 338.449271][ T9791] R13: 00007f9ecb026038 R14: 00007f9ecb025fa0 R15: 00007ffed3388b48 [ 338.457267][ T9791] [ 338.501779][ T9791] ERROR: Out of memory at tomoyo_realpath_from_path. [ 339.485991][ T9804] netlink: 'syz.1.1874': attribute type 11 has an invalid length. [ 339.536493][ T9804] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1874'. [ 340.241687][ T9802] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 340.624407][ T9804] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1874'. [ 341.101278][ T9807] device syzkaller0 entered promiscuous mode [ 341.434999][ T9832] netlink: 'syz.3.1885': attribute type 10 has an invalid length. [ 341.456884][ T9836] netlink: 'syz.0.1886': attribute type 3 has an invalid length. [ 341.488848][ T9836] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1886'. [ 341.499270][ T9832] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 341.539273][ T9838] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1887'. [ 341.550778][ T9834] netlink: 'syz.1.1887': attribute type 11 has an invalid length. [ 341.560617][ T9834] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1887'. [ 341.581779][ T9833] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 343.298843][ T49] Bluetooth: hci3: unexpected event 0x12 length: 15 > 8 [ 343.376153][ T9874] netlink: 'syz.4.1899': attribute type 11 has an invalid length. [ 343.470287][ T9878] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1899'. [ 343.490572][ T9874] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1899'. [ 343.537663][ T9872] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 343.660571][ T9885] netlink: 'syz.1.1901': attribute type 10 has an invalid length. [ 343.747844][ T9885] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 347.092780][ T9912] netlink: 'syz.0.1914': attribute type 1 has an invalid length. [ 347.132034][ T9912] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1914'. [ 347.406788][ T9920] netlink: 'syz.1.1917': attribute type 11 has an invalid length. [ 347.495925][ T9920] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1917'. [ 347.512776][ T9923] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1917'. [ 347.525779][ T9928] netlink: 'syz.4.1920': attribute type 2 has an invalid length. [ 347.549112][ T9928] netlink: 'syz.4.1920': attribute type 1 has an invalid length. [ 347.551415][ T9919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 347.565457][ T9928] netlink: 181400 bytes leftover after parsing attributes in process `syz.4.1920'. [ 347.659711][ T9929] netlink: 'syz.4.1920': attribute type 39 has an invalid length. [ 348.552006][ T9953] netlink: 'syz.0.1928': attribute type 10 has an invalid length. [ 348.564035][ T9953] netlink: 55 bytes leftover after parsing attributes in process `syz.0.1928'. [ 348.660895][ T9955] netlink: 'syz.0.1929': attribute type 17 has an invalid length. [ 349.083799][ T9958] FAULT_INJECTION: forcing a failure. [ 349.083799][ T9958] name failslab, interval 1, probability 0, space 0, times 0 [ 349.109078][ T9958] CPU: 1 PID: 9958 Comm: syz.1.1930 Not tainted syzkaller #0 [ 349.116535][ T9958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 349.126611][ T9958] Call Trace: [ 349.129904][ T9958] [ 349.132850][ T9958] dump_stack_lvl+0x188/0x24e [ 349.137620][ T9958] ? show_regs_print_info+0x12/0x12 [ 349.142929][ T9958] ? load_image+0x410/0x410 [ 349.147452][ T9958] ? __might_sleep+0xd0/0xd0 [ 349.152182][ T9958] ? __lock_acquire+0x7c40/0x7c40 [ 349.157275][ T9958] should_fail_ex+0x390/0x4c0 [ 349.162059][ T9958] should_failslab+0x5/0x20 [ 349.166626][ T9958] slab_pre_alloc_hook+0x59/0x300 [ 349.171707][ T9958] ? tomoyo_encode+0x28a/0x550 [ 349.176520][ T9958] __kmem_cache_alloc_node+0x4f/0x270 [ 349.181896][ T9958] ? tomoyo_encode+0x28a/0x550 [ 349.186655][ T9958] __kmalloc+0xa3/0x240 [ 349.190845][ T9958] tomoyo_encode+0x28a/0x550 [ 349.195440][ T9958] tomoyo_realpath_from_path+0x578/0x5c0 [ 349.201074][ T9958] ? tomoyo_domain+0xd2/0x120 [ 349.205749][ T9958] ? tomoyo_path_number_perm+0x205/0x650 [ 349.211389][ T9958] tomoyo_path_number_perm+0x22f/0x650 [ 349.216866][ T9958] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 349.222334][ T9958] ? ksys_write+0x1ce/0x260 [ 349.226950][ T9958] ? __fget_files+0x28/0x460 [ 349.231560][ T9958] security_file_ioctl+0x6c/0xa0 [ 349.236547][ T9958] __se_sys_ioctl+0x48/0x170 [ 349.241171][ T9958] do_syscall_64+0x4c/0xa0 [ 349.245677][ T9958] ? clear_bhb_loop+0x60/0xb0 [ 349.250361][ T9958] ? clear_bhb_loop+0x60/0xb0 [ 349.255061][ T9958] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 349.260956][ T9958] RIP: 0033:0x7f9ecad9e159 [ 349.265373][ T9958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.284978][ T9958] RSP: 002b:00007f9ecbc87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 349.293666][ T9958] RAX: ffffffffffffffda RBX: 00007f9ecb025fa0 RCX: 00007f9ecad9e159 [ 349.301641][ T9958] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 349.309614][ T9958] RBP: 00007f9ecbc87090 R08: 0000000000000000 R09: 0000000000000000 [ 349.317580][ T9958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 349.325554][ T9958] R13: 00007f9ecb026038 R14: 00007f9ecb025fa0 R15: 00007ffed3388b48 [ 349.333531][ T9958] [ 349.349305][ T9958] ERROR: Out of memory at tomoyo_realpath_from_path. [ 349.806826][ T9970] netlink: 'syz.2.1934': attribute type 11 has an invalid length. [ 349.839273][ T9970] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1934'. [ 349.858056][ T9974] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1934'. [ 349.882273][ T9967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 350.647054][ T9999] netlink: 'syz.3.1946': attribute type 29 has an invalid length. [ 350.673174][ T9999] netlink: 'syz.3.1946': attribute type 29 has an invalid length. [ 352.274367][T10040] netlink: 'syz.3.1962': attribute type 17 has an invalid length. [ 353.598500][T10067] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.1971'. [ 355.644802][T10075] netlink: 35840 bytes leftover after parsing attributes in process `syz.1.1976'. [ 355.845910][T10083] netlink: 'syz.4.1978': attribute type 17 has an invalid length. [ 356.526492][T10102] netlink: 'syz.3.1985': attribute type 2 has an invalid length. [ 356.574683][T10102] netlink: 'syz.3.1985': attribute type 1 has an invalid length. [ 356.609079][T10102] netlink: 181400 bytes leftover after parsing attributes in process `syz.3.1985'. [ 356.708455][T10102] netlink: 'syz.3.1985': attribute type 39 has an invalid length. [ 356.965558][T10108] netlink: 'syz.4.1987': attribute type 11 has an invalid length. [ 356.990428][T10108] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1987'. [ 357.052252][T10108] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1987'. [ 357.105291][T10107] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 357.520847][T10123] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.1988'. [ 357.716544][T10128] tun0: tun_chr_ioctl cmd 1074812117 [ 358.713275][T10150] netlink: 'syz.2.2003': attribute type 10 has an invalid length. [ 358.895857][T10150] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2003'. [ 359.002441][T10150] bridge0: port 3(ipvlan1) entered blocking state [ 359.059350][T10150] bridge0: port 3(ipvlan1) entered disabled state [ 359.094760][T10150] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 359.951062][T10184] FAULT_INJECTION: forcing a failure. [ 359.951062][T10184] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 359.996775][T10185] tun0: tun_chr_ioctl cmd 1074812117 [ 360.009998][T10184] CPU: 0 PID: 10184 Comm: syz.1.2012 Not tainted syzkaller #0 [ 360.017513][T10184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 360.027592][T10184] Call Trace: [ 360.030887][T10184] [ 360.033832][T10184] dump_stack_lvl+0x188/0x24e [ 360.038539][T10184] ? show_regs_print_info+0x12/0x12 [ 360.043762][T10184] ? load_image+0x410/0x410 [ 360.048288][T10184] ? __lock_acquire+0x7c40/0x7c40 [ 360.053333][T10184] ? tomoyo_path_number_perm+0x205/0x650 [ 360.058981][T10184] ? tomoyo_path_number_perm+0x5a4/0x650 [ 360.064641][T10184] should_fail_ex+0x390/0x4c0 [ 360.069352][T10184] _copy_from_user+0x2c/0x170 [ 360.074138][T10184] wext_handle_ioctl+0xc4/0x1d0 [ 360.079028][T10184] ? call_commit_handler+0xf0/0xf0 [ 360.084155][T10184] sock_ioctl+0x143/0x700 [ 360.088502][T10184] ? sock_poll+0x420/0x420 [ 360.092936][T10184] ? bpf_lsm_file_ioctl+0x5/0x10 [ 360.097967][T10184] ? security_file_ioctl+0x7c/0xa0 [ 360.103090][T10184] ? sock_poll+0x420/0x420 [ 360.107520][T10184] __se_sys_ioctl+0xfa/0x170 [ 360.112122][T10184] do_syscall_64+0x4c/0xa0 [ 360.116544][T10184] ? clear_bhb_loop+0x60/0xb0 [ 360.121230][T10184] ? clear_bhb_loop+0x60/0xb0 [ 360.125912][T10184] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 360.131806][T10184] RIP: 0033:0x7f9ecad9e159 [ 360.136220][T10184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.155831][T10184] RSP: 002b:00007f9ecbc87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 360.164245][T10184] RAX: ffffffffffffffda RBX: 00007f9ecb025fa0 RCX: 00007f9ecad9e159 [ 360.172215][T10184] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 360.180187][T10184] RBP: 00007f9ecbc87090 R08: 0000000000000000 R09: 0000000000000000 [ 360.188155][T10184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 360.196123][T10184] R13: 00007f9ecb026038 R14: 00007f9ecb025fa0 R15: 00007ffed3388b48 [ 360.204102][T10184] [ 360.618375][T10190] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2013'. [ 361.080852][T10202] netlink: 'syz.1.2017': attribute type 11 has an invalid length. [ 361.120544][T10202] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.2017'. [ 361.160971][T10207] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2017'. [ 361.199996][T10201] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 362.073421][T10225] device geneve1 entered promiscuous mode [ 362.230127][T10225] netlink: 'syz.3.2026': attribute type 10 has an invalid length. [ 362.405355][T10236] netlink: 'syz.1.2032': attribute type 2 has an invalid length. [ 362.497709][T10236] device 0 entered promiscuous mode [ 362.639804][T10244] tun0: tun_chr_ioctl cmd 1074812117 [ 363.019714][T10249] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.2035'. [ 364.172668][T10296] netlink: 'syz.1.2048': attribute type 7 has an invalid length. [ 364.199158][T10296] netlink: 148 bytes leftover after parsing attributes in process `syz.1.2048'. [ 364.502961][ T49] Bluetooth: hci2: unexpected event 0x12 length: 15 > 8 [ 365.007855][T10314] tun0: tun_chr_ioctl cmd 1074812117 [ 365.176934][T10324] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2054'. [ 365.843320][T10334] netlink: 134056 bytes leftover after parsing attributes in process `syz.3.2059'. [ 366.520894][T10348] netlink: 'syz.1.2066': attribute type 3 has an invalid length. [ 366.528892][T10348] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2066'. [ 369.655686][T10391] netlink: 'syz.4.2077': attribute type 21 has an invalid length. [ 370.047510][T10402] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2081'. [ 370.228612][T10408] netlink: 'syz.1.2084': attribute type 15 has an invalid length. [ 370.258484][T10408] netlink: 'syz.1.2084': attribute type 7 has an invalid length. [ 371.571928][T10441] netlink: 'syz.4.2098': attribute type 10 has an invalid length. [ 371.605811][T10441] netlink: 55 bytes leftover after parsing attributes in process `syz.4.2098'. [ 371.606918][T10442] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2096'. [ 376.145347][T10523] FAULT_INJECTION: forcing a failure. [ 376.145347][T10523] name failslab, interval 1, probability 0, space 0, times 0 [ 376.222276][T10523] CPU: 0 PID: 10523 Comm: syz.2.2124 Not tainted syzkaller #0 [ 376.229809][T10523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 376.239887][T10523] Call Trace: [ 376.243186][T10523] [ 376.246131][T10523] dump_stack_lvl+0x188/0x24e [ 376.250840][T10523] ? show_regs_print_info+0x12/0x12 [ 376.256073][T10523] ? load_image+0x410/0x410 [ 376.260611][T10523] ? __might_sleep+0xd0/0xd0 [ 376.265222][T10523] ? __lock_acquire+0x7c40/0x7c40 [ 376.270274][T10523] should_fail_ex+0x390/0x4c0 [ 376.274978][T10523] should_failslab+0x5/0x20 [ 376.279500][T10523] slab_pre_alloc_hook+0x59/0x300 [ 376.284565][T10523] ? ioctl_standard_iw_point+0x529/0xd50 [ 376.290219][T10523] __kmem_cache_alloc_node+0x4f/0x270 [ 376.295588][T10523] ? ioctl_standard_iw_point+0x529/0xd50 [ 376.301231][T10523] __kmalloc+0xa3/0x240 [ 376.305380][T10523] ioctl_standard_iw_point+0x529/0xd50 [ 376.310856][T10523] ? __cfg80211_wext_giwauth+0x10/0x10 [ 376.316352][T10523] ? iw_handler_get_iwstats+0x240/0x240 [ 376.321924][T10523] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 376.328184][T10523] ? lockdep_hardirqs_on+0x94/0x140 [ 376.333380][T10523] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 376.339541][T10523] ioctl_standard_call+0xaa/0x250 [ 376.344564][T10523] ? __cfg80211_wext_giwauth+0x10/0x10 [ 376.350021][T10523] ? __cfg80211_wext_giwauth+0x10/0x10 [ 376.355485][T10523] wext_ioctl_dispatch+0x3da/0x470 [ 376.360592][T10523] ? wext_ioctl_dispatch+0x470/0x470 [ 376.365874][T10523] ? iw_handler_get_private+0x1e0/0x1e0 [ 376.371429][T10523] wext_handle_ioctl+0x114/0x1d0 [ 376.376366][T10523] ? call_commit_handler+0xf0/0xf0 [ 376.381485][T10523] sock_ioctl+0x143/0x700 [ 376.385812][T10523] ? sock_poll+0x420/0x420 [ 376.390227][T10523] ? bpf_lsm_file_ioctl+0x5/0x10 [ 376.395168][T10523] ? security_file_ioctl+0x7c/0xa0 [ 376.400278][T10523] ? sock_poll+0x420/0x420 [ 376.404686][T10523] __se_sys_ioctl+0xfa/0x170 [ 376.409276][T10523] do_syscall_64+0x4c/0xa0 [ 376.413693][T10523] ? clear_bhb_loop+0x60/0xb0 [ 376.418365][T10523] ? clear_bhb_loop+0x60/0xb0 [ 376.423041][T10523] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 376.428933][T10523] RIP: 0033:0x7fea0359e159 [ 376.433348][T10523] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.452946][T10523] RSP: 002b:00007fea017f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 376.461354][T10523] RAX: ffffffffffffffda RBX: 00007fea03825fa0 RCX: 00007fea0359e159 [ 376.469320][T10523] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 376.477285][T10523] RBP: 00007fea017f6090 R08: 0000000000000000 R09: 0000000000000000 [ 376.485249][T10523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 376.493209][T10523] R13: 00007fea03826038 R14: 00007fea03825fa0 R15: 00007ffe1cc17938 [ 376.501191][T10523] [ 376.814595][T10531] netlink: 'syz.4.2128': attribute type 3 has an invalid length. [ 376.845385][T10531] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2128'. [ 378.571634][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.577957][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.764863][T10543] netlink: 'syz.2.2131': attribute type 39 has an invalid length. [ 379.788663][T10543] device macvlan0 entered promiscuous mode [ 380.763294][T10579] netlink: 122896 bytes leftover after parsing attributes in process `syz.0.2142'. [ 380.846376][T10579] debugfs: Directory '!!!' with parent 'ieee80211' already present! [ 381.307156][ T49] Bluetooth: hci2: ISO packet for unknown connection handle 2366 [ 381.315147][ T49] Bluetooth: hci2: unexpected event 0x05 length: 151 > 4 [ 384.106819][T10654] netlink: 'syz.3.2169': attribute type 11 has an invalid length. [ 384.190623][T10654] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2169'. [ 384.443450][T10654] netlink: 10 bytes leftover after parsing attributes in process `syz.3.2169'. [ 384.483484][T10653] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 387.018014][T10691] netlink: 'syz.0.2184': attribute type 11 has an invalid length. [ 387.070164][T10691] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.2184'. [ 387.143802][T10691] netlink: 10 bytes leftover after parsing attributes in process `syz.0.2184'. [ 387.189308][T10689] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 387.776701][T10715] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2192'. [ 387.808897][T10716] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2192'. [ 388.376760][T10735] netlink: 'syz.2.2199': attribute type 11 has an invalid length. [ 388.417490][T10735] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.2199'. [ 388.479903][T10735] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2199'. [ 388.510376][T10734] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 388.717950][T10745] netlink: 'syz.2.2203': attribute type 10 has an invalid length. [ 388.750092][T10745] netlink: 55 bytes leftover after parsing attributes in process `syz.2.2203'. [ 389.573738][T10758] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.2209'. [ 389.981965][T10767] netlink: 'syz.0.2213': attribute type 11 has an invalid length. [ 389.995002][T10767] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.2213'. [ 390.046487][T10767] netlink: 10 bytes leftover after parsing attributes in process `syz.0.2213'. [ 390.066458][T10765] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 391.595975][T10796] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.2227'. [ 391.748378][T10802] ¥: port 1(team0) entered blocking state [ 391.826304][T10802] ¥: port 1(team0) entered disabled state [ 391.857461][T10802] device team0 entered promiscuous mode [ 391.864032][T10802] device team_slave_0 entered promiscuous mode [ 391.959366][T10802] device team_slave_1 entered promiscuous mode [ 391.997288][T10801] device team0 left promiscuous mode [ 392.016827][T10801] device team_slave_0 left promiscuous mode [ 392.043854][T10801] device team_slave_1 left promiscuous mode [ 392.066614][T10801] ¥: port 1(team0) entered disabled state [ 393.196392][T10834] FAULT_INJECTION: forcing a failure. [ 393.196392][T10834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 393.225627][T10834] CPU: 1 PID: 10834 Comm: syz.4.2242 Not tainted syzkaller #0 [ 393.233154][T10834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 393.243239][T10834] Call Trace: [ 393.246548][T10834] [ 393.249525][T10834] dump_stack_lvl+0x188/0x24e [ 393.254293][T10834] ? show_regs_print_info+0x12/0x12 [ 393.259514][T10834] ? load_image+0x410/0x410 [ 393.264040][T10834] ? __lock_acquire+0x7c40/0x7c40 [ 393.269090][T10834] should_fail_ex+0x390/0x4c0 [ 393.273831][T10834] _copy_from_user+0x2c/0x170 [ 393.278534][T10834] sctp_setsockopt+0x19a/0xf90 [ 393.283322][T10834] ? sock_common_recvmsg+0x190/0x190 [ 393.288640][T10834] __sys_setsockopt+0x2bf/0x3d0 [ 393.293520][T10834] __x64_sys_setsockopt+0xb1/0xc0 [ 393.298567][T10834] do_syscall_64+0x4c/0xa0 [ 393.302997][T10834] ? clear_bhb_loop+0x60/0xb0 [ 393.307686][T10834] ? clear_bhb_loop+0x60/0xb0 [ 393.312388][T10834] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 393.318342][T10834] RIP: 0033:0x7ff5f479e159 [ 393.322769][T10834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.342390][T10834] RSP: 002b:00007ff5f55eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 393.350828][T10834] RAX: ffffffffffffffda RBX: 00007ff5f4a25fa0 RCX: 00007ff5f479e159 [ 393.358806][T10834] RDX: 0000000000000072 RSI: 0000000000000084 RDI: 0000000000000007 [ 393.366785][T10834] RBP: 00007ff5f55eb090 R08: 000000000000000c R09: 0000000000000000 [ 393.374764][T10834] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.382747][T10834] R13: 00007ff5f4a26038 R14: 00007ff5f4a25fa0 R15: 00007ffd458749f8 [ 393.390751][T10834] [ 393.648108][T10845] netlink: 129384 bytes leftover after parsing attributes in process `syz.1.2243'. [ 393.730653][T10846] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.2245'. [ 394.585302][T10867] netlink: 'syz.4.2253': attribute type 11 has an invalid length. [ 394.620625][T10867] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.2253'. [ 394.665967][T10867] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2253'. [ 394.745618][T10866] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.847326][ T49] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 395.277760][T10892] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.2261'. [ 395.493795][T10895] netlink: 129384 bytes leftover after parsing attributes in process `syz.4.2262'. [ 396.221622][T10923] netlink: 'syz.2.2268': attribute type 12 has an invalid length. [ 396.269191][T10923] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2268'. [ 396.296754][T10924] netlink: 'syz.2.2268': attribute type 12 has an invalid length. [ 396.323311][T10924] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2268'. [ 397.003715][T10953] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.2277'. [ 401.426119][T11015] netlink: 'syz.3.2297': attribute type 10 has an invalid length. [ 401.434447][T11015] netlink: 55 bytes leftover after parsing attributes in process `syz.3.2297'. [ 402.582642][T11039] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 402.589942][T11039] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 402.903639][T11054] netlink: 64771 bytes leftover after parsing attributes in process `syz.0.2314'. [ 403.201112][T11061] FAULT_INJECTION: forcing a failure. [ 403.201112][T11061] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 403.255768][T11061] CPU: 0 PID: 11061 Comm: syz.0.2316 Not tainted syzkaller #0 [ 403.263305][T11061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 403.273389][T11061] Call Trace: [ 403.276687][T11061] [ 403.279635][T11061] dump_stack_lvl+0x188/0x24e [ 403.284346][T11061] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 403.290541][T11061] ? show_regs_print_info+0x12/0x12 [ 403.295772][T11061] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 403.301967][T11061] ? dump_stack+0x5/0x12 [ 403.306248][T11061] should_fail_ex+0x390/0x4c0 [ 403.310960][T11061] _copy_to_user+0x2c/0x130 [ 403.315474][T11061] simple_read_from_buffer+0xe3/0x150 [ 403.320939][T11061] proc_fail_nth_read+0x1a6/0x220 [ 403.325986][T11061] ? proc_fault_inject_write+0x310/0x310 [ 403.331624][T11061] ? fsnotify_perm+0x248/0x550 [ 403.336386][T11061] ? proc_fault_inject_write+0x310/0x310 [ 403.342016][T11061] vfs_read+0x2db/0x960 [ 403.346179][T11061] ? kernel_read+0x1e0/0x1e0 [ 403.350772][T11061] ? __fget_files+0x28/0x460 [ 403.355363][T11061] ? __fget_files+0x3fc/0x460 [ 403.360048][T11061] ? __fdget_pos+0x2ae/0x360 [ 403.364638][T11061] ? ksys_read+0x70/0x260 [ 403.368972][T11061] ksys_read+0x14d/0x260 [ 403.373221][T11061] ? vfs_write+0x9a0/0x9a0 [ 403.377644][T11061] ? lockdep_hardirqs_on+0x94/0x140 [ 403.382848][T11061] do_syscall_64+0x4c/0xa0 [ 403.387265][T11061] ? clear_bhb_loop+0x60/0xb0 [ 403.391943][T11061] ? clear_bhb_loop+0x60/0xb0 [ 403.396623][T11061] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 403.402521][T11061] RIP: 0033:0x7f86ea35e98e [ 403.406939][T11061] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 403.426542][T11061] RSP: 002b:00007f86eb2d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 403.434955][T11061] RAX: ffffffffffffffda RBX: 00007f86eb2d56c0 RCX: 00007f86ea35e98e [ 403.442924][T11061] RDX: 000000000000000f RSI: 00007f86eb2d50a0 RDI: 0000000000000007 [ 403.450891][T11061] RBP: 00007f86eb2d5090 R08: 0000000000000000 R09: 0000000000000000 [ 403.458857][T11061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 403.466823][T11061] R13: 00007f86ea626038 R14: 00007f86ea625fa0 R15: 00007ffc9becaf18 [ 403.474805][T11061] [ 404.153150][T11080] bond0: (slave bridge_slave_1): Error: Slave has XDP program loaded, please unload before enslaving [ 404.384894][T11081] netlink: 'syz.3.2320': attribute type 10 has an invalid length. [ 405.876590][T11113] FAULT_INJECTION: forcing a failure. [ 405.876590][T11113] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 405.909133][T11113] CPU: 1 PID: 11113 Comm: syz.0.2333 Not tainted syzkaller #0 [ 405.916664][T11113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 405.926746][T11113] Call Trace: [ 405.930039][T11113] [ 405.933071][T11113] dump_stack_lvl+0x188/0x24e [ 405.937784][T11113] ? show_regs_print_info+0x12/0x12 [ 405.943013][T11113] ? load_image+0x410/0x410 [ 405.947523][T11113] ? __lock_acquire+0x7c40/0x7c40 [ 405.952550][T11113] ? snprintf+0xe5/0x140 [ 405.956795][T11113] should_fail_ex+0x390/0x4c0 [ 405.961483][T11113] _copy_to_user+0x2c/0x130 [ 405.965988][T11113] simple_read_from_buffer+0xe3/0x150 [ 405.971362][T11113] proc_fail_nth_read+0x1a6/0x220 [ 405.976406][T11113] ? proc_fault_inject_write+0x310/0x310 [ 405.982051][T11113] ? fsnotify_perm+0x248/0x550 [ 405.986824][T11113] ? proc_fault_inject_write+0x310/0x310 [ 405.992461][T11113] vfs_read+0x2db/0x960 [ 405.996627][T11113] ? kernel_read+0x1e0/0x1e0 [ 406.001219][T11113] ? __fget_files+0x28/0x460 [ 406.005808][T11113] ? __fget_files+0x3fc/0x460 [ 406.010490][T11113] ? __fdget_pos+0x2ae/0x360 [ 406.015084][T11113] ? ksys_read+0x70/0x260 [ 406.019415][T11113] ksys_read+0x14d/0x260 [ 406.023659][T11113] ? vfs_write+0x9a0/0x9a0 [ 406.028075][T11113] ? lockdep_hardirqs_on+0x94/0x140 [ 406.033274][T11113] do_syscall_64+0x4c/0xa0 [ 406.037692][T11113] ? clear_bhb_loop+0x60/0xb0 [ 406.042386][T11113] ? clear_bhb_loop+0x60/0xb0 [ 406.047085][T11113] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 406.052979][T11113] RIP: 0033:0x7f86ea35e98e [ 406.057392][T11113] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 406.076995][T11113] RSP: 002b:00007f86eb2d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 406.085430][T11113] RAX: ffffffffffffffda RBX: 00007f86eb2d56c0 RCX: 00007f86ea35e98e [ 406.093428][T11113] RDX: 000000000000000f RSI: 00007f86eb2d50a0 RDI: 0000000000000008 [ 406.101406][T11113] RBP: 00007f86eb2d5090 R08: 0000000000000000 R09: 0000000000000000 [ 406.109387][T11113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 406.117364][T11113] R13: 00007f86ea626038 R14: 00007f86ea625fa0 R15: 00007ffc9becaf18 [ 406.125354][T11113] [ 406.389395][T11120] device pim6reg1 entered promiscuous mode [ 407.291681][ T49] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 408.425778][T11174] netlink: 138532 bytes leftover after parsing attributes in process `syz.1.2352'. [ 408.558417][T11174] netlink: zone id is out of range [ 408.629642][T11174] netlink: zone id is out of range [ 408.635436][T11174] netlink: zone id is out of range [ 408.738133][T11174] netlink: zone id is out of range [ 408.873271][T11174] netlink: zone id is out of range [ 408.906564][T11174] netlink: zone id is out of range [ 408.965014][T11174] netlink: zone id is out of range [ 409.058016][T11174] netlink: zone id is out of range [ 409.231899][T11174] netlink: zone id is out of range [ 409.237315][T11174] netlink: zone id is out of range [ 412.315741][T11245] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2380'. [ 414.997527][T11254] netlink: 'syz.0.2382': attribute type 21 has an invalid length. [ 415.007470][T11254] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2382'. [ 416.371322][T11285] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.2394'. [ 416.485457][T11283] netlink: 129384 bytes leftover after parsing attributes in process `syz.1.2393'. [ 416.944997][T11297] netlink: 129384 bytes leftover after parsing attributes in process `syz.4.2397'. [ 417.119243][T11303] netlink: 'syz.2.2399': attribute type 11 has an invalid length. [ 417.160019][T11303] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.2399'. [ 417.859380][T11302] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 418.255669][T11306] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2399'. [ 418.699337][T11332] delete_channel: no stack [ 418.703973][T11332] delete_channel: no stack [ 418.746041][T11332] delete_channel: no stack [ 418.765386][T11332] delete_channel: no stack [ 418.775698][T11332] delete_channel: no stack [ 418.806430][T11332] delete_channel: no stack [ 418.837011][T11332] delete_channel: no stack [ 418.871731][T11332] delete_channel: no stack [ 418.905268][T11332] delete_channel: no stack [ 418.933844][T11332] delete_channel: no stack [ 418.967756][T11332] delete_channel: no stack [ 418.994830][T11332] delete_channel: no stack [ 419.026544][T11332] delete_channel: no stack [ 419.051830][T11332] delete_channel: no stack [ 419.073943][T11338] netlink: 129384 bytes leftover after parsing attributes in process `syz.1.2409'. [ 419.075050][T11332] delete_channel: no stack [ 419.137091][T11332] delete_channel: no stack [ 419.170760][T11332] delete_channel: no stack [ 419.193314][T11332] delete_channel: no stack [ 419.217316][T11332] delete_channel: no stack [ 419.243563][T11332] delete_channel: no stack [ 419.425662][T11343] netlink: 'syz.2.2411': attribute type 27 has an invalid length. [ 419.727145][ T49] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 419.736395][T11349] netlink: 129384 bytes leftover after parsing attributes in process `syz.1.2414'. [ 419.868735][T11353] netlink: 'syz.4.2415': attribute type 11 has an invalid length. [ 419.921749][T11353] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.2415'. [ 419.971836][T11357] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2415'. [ 420.007579][T11352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.651813][T11373] netlink: 'syz.3.2423': attribute type 27 has an invalid length. [ 420.931409][T11376] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2424'. [ 421.246583][T11390] netlink: 'syz.4.2430': attribute type 11 has an invalid length. [ 421.267534][T11392] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2430'. [ 421.305124][T11390] netlink: 149476 bytes leftover after parsing attributes in process `syz.4.2430'. [ 421.337840][T11389] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 421.493615][T11399] pimreg: tun_chr_ioctl cmd 1074025677 [ 421.522267][T11399] pimreg: linktype set to 270 [ 421.580441][T11401] netlink: 'syz.3.2442': attribute type 11 has an invalid length. [ 421.600742][T11401] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2442'. [ 421.620458][T11401] netlink: 10 bytes leftover after parsing attributes in process `syz.3.2442'. [ 421.648583][T11400] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 422.048736][T11412] netlink: 'syz.4.2434': attribute type 27 has an invalid length. [ 423.045677][ C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 423.258263][T11435] netlink: 'syz.3.2443': attribute type 29 has an invalid length. [ 423.403188][T11435] netlink: 'syz.3.2443': attribute type 29 has an invalid length. [ 423.498404][T11437] netlink: 'syz.3.2443': attribute type 29 has an invalid length. [ 423.526432][T11437] netlink: 'syz.3.2443': attribute type 29 has an invalid length. [ 423.536493][T11447] netlink: 129384 bytes leftover after parsing attributes in process `syz.4.2446'. [ 423.647717][T11435] netlink: 'syz.3.2443': attribute type 29 has an invalid length. [ 424.276222][T11471] netlink: 'syz.1.2453': attribute type 2 has an invalid length. [ 424.296604][T11471] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2453'. [ 425.553792][T11493] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.2459'. [ 425.689992][T11482] netlink: 'syz.1.2453': attribute type 21 has an invalid length. [ 425.792039][T11482] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2453'. [ 425.820619][T11480] tap0: tun_chr_ioctl cmd 1074025677 [ 425.826114][T11480] tap0: linktype set to 805 [ 426.360466][T11541] netlink: 'syz.3.2465': attribute type 4 has an invalid length. [ 426.368260][T11541] netlink: 'syz.3.2465': attribute type 8 has an invalid length. [ 426.485635][T11541] netlink: 109560 bytes leftover after parsing attributes in process `syz.3.2465'. [ 428.227387][T11582] netlink: 129384 bytes leftover after parsing attributes in process `syz.1.2476'. [ 428.399474][T11587] net_ratelimit: 27 callbacks suppressed [ 428.399517][T11587] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 428.411909][T11587] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 429.379764][T11624] netlink: 'syz.2.2488': attribute type 3 has an invalid length. [ 429.387737][T11624] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.2488'. [ 429.504187][T11595] netlink: 'syz.0.2480': attribute type 7 has an invalid length. [ 429.612064][T11626] netlink: 176 bytes leftover after parsing attributes in process `syz.2.2488'. [ 429.881447][T11625] device pim6reg1 entered promiscuous mode [ 430.440250][T11643] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2494'. [ 430.625439][T11648] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 430.632214][T11648] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 431.712855][T11662] netlink: 'syz.2.2500': attribute type 11 has an invalid length. [ 431.733740][T11662] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.2500'. [ 431.776711][T11661] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2500'. [ 431.800073][T11660] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 432.054592][T11669] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2503'. [ 432.074400][T11669] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 432.455582][T11678] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.2508'. [ 432.475256][T11687] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2509'. [ 432.568812][T11687] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2509'. [ 432.634426][T11688] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2509'. [ 432.643988][T11689] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2509'. [ 432.967867][T11694] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 432.974667][T11694] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 433.066101][ T49] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 433.202198][T11703] netlink: 'syz.1.2514': attribute type 11 has an invalid length. [ 433.274149][T11703] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.2514'. [ 433.282382][T11706] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2514'. [ 433.351054][T11702] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 433.880074][T11731] netlink: 'syz.1.2528': attribute type 29 has an invalid length. [ 433.919362][T11731] netlink: 'syz.1.2528': attribute type 29 has an invalid length. [ 434.039356][T11731] netlink: 'syz.1.2528': attribute type 29 has an invalid length. [ 437.063358][T11733] ------------[ cut here ]------------ [ 437.068866][T11733] WARNING: CPU: 0 PID: 11733 at kernel/events/core.c:6602 perf_pending_task+0x353/0x480 [ 437.079058][T11733] Modules linked in: [ 437.082980][T11733] CPU: 0 PID: 11733 Comm: syz.0.2529 Not tainted syzkaller #0 [ 437.090514][T11733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 437.100739][T11733] RIP: 0010:perf_pending_task+0x353/0x480 [ 437.106494][T11733] Code: e8 c2 77 da ff 84 db 75 10 e8 59 75 da ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 49 75 da ff e8 2c b7 58 ff eb e9 e8 3d 75 da ff <0f> 0b 49 bd 00 00 00 00 00 fc ff df 43 80 3c 2f 00 0f 85 0a ff ff [ 437.126255][T11733] RSP: 0018:ffffc900032d78e8 EFLAGS: 00010293 [ 437.132407][T11733] RAX: ffffffff81a7cc53 RBX: ffff888077c9cc58 RCX: ffff888027485a00 [ 437.140431][T11733] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 437.148417][T11733] RBP: ffff888077c9ca20 R08: ffff8880b8e357cb R09: 1ffff110171c6af9 [ 437.156454][T11733] R10: dffffc0000000000 R11: ffffed10171c6afa R12: ffff888027485a00 [ 437.164481][T11733] R13: ffff888028240d60 R14: 0000000000000000 R15: 1ffff1100ef93944 [ 437.172519][T11733] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 437.181502][T11733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 437.188101][T11733] CR2: 000055557f7804e8 CR3: 0000000079271000 CR4: 00000000003506f0 [ 437.196138][T11733] DR0: 0000200000000300 DR1: 0000200000000300 DR2: 0000000000000000 [ 437.204173][T11733] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 437.212315][T11733] Call Trace: [ 437.215609][T11733] [ 437.218554][T11733] task_work_run+0x1d0/0x260 [ 437.223321][T11733] ? task_work_cancel+0x220/0x220 [ 437.228371][T11733] ? do_raw_spin_unlock+0x11d/0x230 [ 437.233660][T11733] do_exit+0x9d5/0x2570 [ 437.237953][T11733] ? put_task_struct+0x80/0x80 [ 437.242803][T11733] ? ct_nmi_exit+0x145/0x1c0 [ 437.247422][T11733] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 437.253490][T11733] ? _raw_spin_lock_irq+0x86/0xf0 [ 437.258536][T11733] ? lock_chain_count+0x20/0x20 [ 437.263478][T11733] ? _raw_spin_lock_irq+0xb7/0xf0 [ 437.268533][T11733] do_group_exit+0x229/0x2e0 [ 437.273210][T11733] ? lockdep_hardirqs_on+0x94/0x140 [ 437.278436][T11733] get_signal+0x1259/0x1340 [ 437.283140][T11733] arch_do_signal_or_restart+0xc4/0x1310 [ 437.288882][T11733] ? do_futex+0x310/0x320 [ 437.293381][T11733] ? get_sigframe_size+0x10/0x10 [ 437.298366][T11733] ? exit_to_user_mode_loop+0x3b/0x110 [ 437.304012][T11733] exit_to_user_mode_loop+0x70/0x110 [ 437.309374][T11733] exit_to_user_mode_prepare+0xee/0x180 [ 437.314945][T11733] syscall_exit_to_user_mode+0x16/0x40 [ 437.320477][T11733] do_syscall_64+0x58/0xa0 [ 437.324917][T11733] ? clear_bhb_loop+0x60/0xb0 [ 437.329676][T11733] ? clear_bhb_loop+0x60/0xb0 [ 437.334404][T11733] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 437.340395][T11733] RIP: 0033:0x7f86ea39e159 [ 437.344822][T11733] Code: Unable to access opcode bytes at 0x7f86ea39e12f. [ 437.351884][T11733] RSP: 002b:00007f86eb2d50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 437.360365][T11733] RAX: fffffffffffffe00 RBX: 00007f86ea625fa8 RCX: 00007f86ea39e159 [ 437.368344][T11733] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f86ea625fa8 [ 437.376367][T11733] RBP: 00007f86ea625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 437.384379][T11733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 437.392415][T11733] R13: 00007f86ea626038 R14: 00007ffc9becae30 R15: 00007ffc9becaf18 [ 437.400457][T11733] [ 437.403485][T11733] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 437.410753][T11733] CPU: 0 PID: 11733 Comm: syz.0.2529 Not tainted syzkaller #0 [ 437.418203][T11733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 437.428252][T11733] Call Trace: [ 437.431524][T11733] [ 437.434446][T11733] dump_stack_lvl+0x188/0x24e [ 437.439122][T11733] ? memcpy+0x3c/0x60 [ 437.443180][T11733] ? show_regs_print_info+0x12/0x12 [ 437.448374][T11733] ? load_image+0x410/0x410 [ 437.452896][T11733] panic+0x2d3/0x710 [ 437.456788][T11733] ? bpf_jit_dump+0xd0/0xd0 [ 437.461296][T11733] __warn+0x2f8/0x4f0 [ 437.465270][T11733] ? perf_pending_task+0x353/0x480 [ 437.470384][T11733] ? perf_pending_task+0x353/0x480 [ 437.475574][T11733] report_bug+0x2ba/0x4f0 [ 437.479899][T11733] ? perf_pending_task+0x353/0x480 [ 437.485005][T11733] handle_bug+0x3a/0x70 [ 437.489162][T11733] exc_invalid_op+0x16/0x40 [ 437.493662][T11733] asm_exc_invalid_op+0x16/0x20 [ 437.498513][T11733] RIP: 0010:perf_pending_task+0x353/0x480 [ 437.504231][T11733] Code: e8 c2 77 da ff 84 db 75 10 e8 59 75 da ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 49 75 da ff e8 2c b7 58 ff eb e9 e8 3d 75 da ff <0f> 0b 49 bd 00 00 00 00 00 fc ff df 43 80 3c 2f 00 0f 85 0a ff ff [ 437.523830][T11733] RSP: 0018:ffffc900032d78e8 EFLAGS: 00010293 [ 437.529890][T11733] RAX: ffffffff81a7cc53 RBX: ffff888077c9cc58 RCX: ffff888027485a00 [ 437.537855][T11733] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 437.545815][T11733] RBP: ffff888077c9ca20 R08: ffff8880b8e357cb R09: 1ffff110171c6af9 [ 437.553777][T11733] R10: dffffc0000000000 R11: ffffed10171c6afa R12: ffff888027485a00 [ 437.561739][T11733] R13: ffff888028240d60 R14: 0000000000000000 R15: 1ffff1100ef93944 [ 437.569714][T11733] ? perf_pending_task+0x353/0x480 [ 437.574826][T11733] ? perf_pending_task+0x353/0x480 [ 437.579930][T11733] task_work_run+0x1d0/0x260 [ 437.584520][T11733] ? task_work_cancel+0x220/0x220 [ 437.589543][T11733] ? do_raw_spin_unlock+0x11d/0x230 [ 437.594734][T11733] do_exit+0x9d5/0x2570 [ 437.598894][T11733] ? put_task_struct+0x80/0x80 [ 437.603649][T11733] ? ct_nmi_exit+0x145/0x1c0 [ 437.608234][T11733] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 437.614212][T11733] ? _raw_spin_lock_irq+0x86/0xf0 [ 437.619231][T11733] ? lock_chain_count+0x20/0x20 [ 437.624083][T11733] ? _raw_spin_lock_irq+0xb7/0xf0 [ 437.629105][T11733] do_group_exit+0x229/0x2e0 [ 437.633692][T11733] ? lockdep_hardirqs_on+0x94/0x140 [ 437.638884][T11733] get_signal+0x1259/0x1340 [ 437.643396][T11733] arch_do_signal_or_restart+0xc4/0x1310 [ 437.649029][T11733] ? do_futex+0x310/0x320 [ 437.653378][T11733] ? get_sigframe_size+0x10/0x10 [ 437.658321][T11733] ? exit_to_user_mode_loop+0x3b/0x110 [ 437.663778][T11733] exit_to_user_mode_loop+0x70/0x110 [ 437.669058][T11733] exit_to_user_mode_prepare+0xee/0x180 [ 437.674602][T11733] syscall_exit_to_user_mode+0x16/0x40 [ 437.680053][T11733] do_syscall_64+0x58/0xa0 [ 437.684466][T11733] ? clear_bhb_loop+0x60/0xb0 [ 437.689142][T11733] ? clear_bhb_loop+0x60/0xb0 [ 437.693815][T11733] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 437.699703][T11733] RIP: 0033:0x7f86ea39e159 [ 437.704113][T11733] Code: Unable to access opcode bytes at 0x7f86ea39e12f. [ 437.711118][T11733] RSP: 002b:00007f86eb2d50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 437.719546][T11733] RAX: fffffffffffffe00 RBX: 00007f86ea625fa8 RCX: 00007f86ea39e159 [ 437.727508][T11733] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f86ea625fa8 [ 437.735472][T11733] RBP: 00007f86ea625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 437.743435][T11733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 437.751397][T11733] R13: 00007f86ea626038 R14: 00007ffc9becae30 R15: 00007ffc9becaf18 [ 437.759402][T11733] [ 437.762557][T11733] Kernel Offset: disabled [ 437.766872][T11733] Rebooting in 86400 seconds..