last executing test programs: 18.724697699s ago: executing program 2 (id=9151): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x14, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000300000000000000c553dd3818110000", @ANYRES32, @ANYBLOB="00593d0000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018490000fdffffff0000000000060000851000000100000085100000f8ffffff8510"], &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400000}, 0x94) 18.551784083s ago: executing program 2 (id=9155): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000000001000b00000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x10) 18.424926177s ago: executing program 2 (id=9159): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9febf3ff1800000000000000180000001800000002000000000000000000000d0300000000000000000000020300"], 0x0, 0x32}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)}, 0x4004010) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'sit0\x00'}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f2, &(0x7f0000000080)) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 18.280740361s ago: executing program 2 (id=9163): bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000800)={0x2, 0x80, 0xcb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0xfffffffd, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x10, 0x2}, 0x48) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0x17, &(0x7f0000000c80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055090100000000009500000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000898500000071000000bf91000000000000b7020000000000008500000005000000b70000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="5aed41deb03e9eee28e622e573a3", 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x422, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0xfff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)}, 0x8000) recvmsg(r5, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000040)={'veth1_macvtap\x00', @random="4f33e363a4b1"}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) 17.402795645s ago: executing program 2 (id=9165): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$ppp(0xffffffffffffff9c, 0x0, 0x5ae43, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0xfffffffd, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x17, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1}]}, &(0x7f0000000100)='GPL\x00'}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x20001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, @perf_bp={0x0}, 0x0, 0xc8, 0x0, 0x0, 0x5}, 0x0, 0x3, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x12}, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce8100036c00fb80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r5, 0x0, 0xe, 0x0, &(0x7f00000002c0)="e02742e86c0d85ff9782762f0800", 0x0, 0x46b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000800000000000000000000000850000009b000000850000007d000000950000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000000, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x40082406, &(0x7f00000001c0)='cpu&-0\t||') syz_clone(0x8000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xfca804a0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0xa00, 0x0, 0xffffff63, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000340)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}}, @call={0x85, 0x0, 0x0, 0x2a}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0x0, 0xe, 0x0, &(0x7f0000000800)="0000000000000000606b53cc7273", 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800"], 0x48) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r11, &(0x7f0000000000), 0x2a979d) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r10}, &(0x7f0000000080), 0x0}, 0x20) 16.983211996s ago: executing program 3 (id=9167): socketpair(0x1, 0x1, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x3e) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, 0x0, 0xffdd) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{}, 0x0, 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={&(0x7f0000000100)="bc94867962694df0437ed189a132", 0x0, 0x0, &(0x7f0000000340), 0x1}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94) 15.910098875s ago: executing program 3 (id=9168): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000080)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000000380)=r7) write$cgroup_devices(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 15.163221426s ago: executing program 2 (id=9169): r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x822a0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4000008, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x1) syz_clone(0x419a0100, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x24, 0x12506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x5, 0x0, @perf_config_ext={0x9, 0x2}, 0x7602, 0x0, 0x0, 0x0, 0x10003, 0x1000000, 0xbb, 0x0, 0x0, 0x0, 0x2000000003}, 0x0, 0xffffffffffffffff, r0, 0xa) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000), 0x2a979d) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x27, 0x0, 0x0, &(0x7f0000000640), 0x0, 0x3ad9, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffff}, 0x50) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r1, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000400), 0x12) syz_clone(0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) 14.700097419s ago: executing program 1 (id=9170): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0x1}], 0x1}, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000c00)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="15000000220d0000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES64=0x0], 0x20) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000300)=""/163, 0xa3}], 0x1}, 0x8040) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x480283, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x3, 0x0, @perf_bp={0x0, 0x8}, 0x7606, 0x3ff, 0x80000000, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r2, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000900000000000000213f0000c50000000e800000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r3}, 0xc) bpf$ITER_CREATE(0xb, 0x0, 0x0) r4 = perf_event_open$cgroup(&(0x7f0000000180)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x20000000000001, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8922, &(0x7f0000001f40)='lo:\x96o8\x14d\xa1\xe3\xd7\\b}\x1f\xa1C\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\xf5\a\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xbaUn\x04\'5\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\x06\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\r\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc5\xdcZ\xb9\xd7Z\x88\x9b\xdff[\x90\xfa\x9a{b\xf4Dq') ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r4, 0x4008240b, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'sit0\x00', @local}) 14.088795216s ago: executing program 0 (id=9171): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0xd, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYBLOB="0000000000000000b7080000000000007b5af8ff000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) openat$tun(0xffffffffffffff9c, 0x0, 0x400, 0x0) r1 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe69, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000200)='\x00') ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r3, 0x0, 0x0}, 0x10) 13.763310014s ago: executing program 0 (id=9172): bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0a003d7b5146116726", @ANYRES32, @ANYRES32, @ANYBLOB], 0x48) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)) write$cgroup_devices(r0, &(0x7f00000005c0)=ANY=[], 0xfffffeff) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) socketpair(0x28, 0x2, 0x93, 0x0) write$cgroup_int(r0, &(0x7f0000000300)=0x6, 0x12) 10.382404357s ago: executing program 0 (id=9173): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x30}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) 10.25417249s ago: executing program 0 (id=9174): bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, 0x0, 0x0) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000080)=r3, 0x12) 9.88983197s ago: executing program 0 (id=9175): r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fd, 0x22a0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffb}, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x1) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) syz_clone(0x41980100, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x24, 0x12506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602}, 0x0, 0xffffffffffffffff, r0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) 6.126285803s ago: executing program 1 (id=9176): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x1, 0x5}, 0x50) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000ac0)={r0, 0xe0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0], 0x0, 0xd3, &(0x7f0000000440)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000480), &(0x7f00000004c0), 0x8, 0xcf, 0x8, 0x8, &(0x7f0000000500)}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b00)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x874, '\x00', r2, 0xffffffffffffffff, 0x3, 0x5}, 0x50) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x4}, 0x18) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0xb4, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002880)={0x18, 0x8, 0x0, 0x0, 0xff, 0x0, 0x0, 0x40f00, 0x4a, '\x00', r3, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000027c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000002800)=[{0x2, 0x2, 0x4, 0x6}, {0x4, 0x5, 0x2, 0x6}, {0x2, 0x3, 0xf, 0x8}, {0x3, 0x5, 0xc, 0x7}], 0x10, 0xb}, 0x94) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x828, 0x0, 0x0, 0x0, 0x10000, 0x800000, 0x9, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000000)={'vlan0\x00', @random="010000201000"}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000000)={'veth0_vlan\x00', @random="010000201000"}) 6.125348993s ago: executing program 3 (id=9177): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000800)={0x2, 0x80, 0xcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfff, 0xecc}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x10020, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8e20, 0xa2a}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0xf, 0x9, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0xbb}, @generic={0xa7}, @initr0, @exit]}, &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000004000000020000000000000e02000000000000000000"], 0x0, 0x38}, 0x28) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x85, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, @perf_bp={0x0, 0xc}, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000010000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x5, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x25, 0x0, 0x3, 0xfffffffe}, {0x20}, {0xb1, 0x0, 0x28, 0x7}, {0x16, 0xfc, 0x5, 0xffffffff}]}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)="31de76fb398bc62d058b8a96924594f5476a0824be53f7a5949f80614c42391e4b80412938c955d34d37eb96ba7849c3eb823bb36724bd6f6d0219cfe5c884afcd2bdea5acf9c877c03dcdbbb3e47417b6707c27d4c5c1", 0x57}], 0x1, 0x0, 0xa0}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{}, &(0x7f0000000240), 0x0}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x4, 0x80, 0x4, 0x8, 0x2c, 0x5, 0x0, 0x1, 0x200, 0x3, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_bp={0x0, 0xb}, 0xc0, 0x9, 0x9, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x7ff, 0x0, 0x9}, 0x0, 0x40003, 0xffffffffffffffff, 0x1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000000140), 0x1}, 0x38) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f0, &(0x7f0000000080)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_clone(0x22023500, 0x0, 0x0, 0x0, 0x0, 0x0) 5.357055994s ago: executing program 1 (id=9178): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$ppp(0xffffffffffffff9c, 0x0, 0x5ae43, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0xfffffffd, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 5.272070766s ago: executing program 3 (id=9179): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000aecd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c1faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6fab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b79db2e3d5986c82b5aa94e539b204d58f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000020000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72b0000000000001cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2cc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78ac02ca3cdf6a662db1c9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea5080000000cdcd2063d11dd665647223c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca2533659edc8be05cc85451c6a14507434eb54b6f43caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffca9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a294351c5356c1d06c92cf8ce3c7c56cd31121624d74517fd3666277f670e812b28e2f30d035cee5d0e77a3c7220000000000000005a474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f034b8d3ebce68663ef5af469abe75b314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041e12282ce24463aaf28345bd168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262d0af3246eb4fc4bda3453602004535a976eacd3adaa4d2ee6fe0d072ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d401adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb40f7f02f750d6c977a191852c9ae031db044b2353199546609f9f69a6cfefdf879d447df53f3b9b70d10355b00300000000000000553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5631820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe527340935aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2a81425ff000000d2a0a765d20b30f87af976a46f9a9a1ac7dea1ea684533dc6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f88735fce5115dc83ed73d8ee4a91322608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf5000000000000fa08ad0731c4b839688b22c4da2a6bc4cf45dbeea042f9b33393f85a0417854d221a2d5f96bc64647f15daa2ba79cd0f4254ed55217912ef84bd2927df82fc061aef2920c49b2a90886da75561173fa186cb7ee86dd4285c4721eb428c953296ac2f5d825da54dbef07c1b349b4901e093d13e6b9a0000009b5b22e887bc061d40bcaf0aa18623fd9b7179ccc692ba74b531b65c4decf9d080a8ac7e82d4cde1267aa64b2a94fd87a009e6742c2ddc3a9d7eccbb1831b1fa218277c2814a91cab7cb59c697166d6f1bb1a360470000000000000000000000000000000000000000000000000000f9f9b4ce7e871f507084c8c88e0652decbe579b03ed84ea94597dd1059620a050f69ea03b99b4e19d35f4a3b54e96ae2172effecec80f6baa4bf69a6ebf5392882df78b0983e662dc0cb"], &(0x7f0000000000)='GPL\x00', 0x5}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000f2dcc6d0e5bfb6ecc27477a80d1fcf4b137d054bd61743b079bac97f2141d9f3fc65776a653c4ec621d3c20287f5605901decf24849b329a36c04e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x204, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}, 0x0, 0xf, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c40)={0x1b, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, 0x42, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000b40), 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000b80)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xb00, '\x00', 0x0, r3, 0x4, 0x2, 0x3}, 0x50) syz_open_procfs$namespace(0x0, 0x0) perf_event_open(&(0x7f00000007c0)={0x5, 0x80, 0x69, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x5, 0x800}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1}, 0x0, 0xffffffbfffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open$cgroup(&(0x7f0000000180)={0x0, 0x80, 0x9, 0x2, 0x7, 0xc7, 0x0, 0x0, 0x10100, 0x8, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5, 0x1, @perf_config_ext={0x5, 0x80}, 0x800, 0xfffffffffffff000, 0x80000001, 0x4, 0x6c2, 0x10000, 0x80, 0x0, 0x3}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0xbe1d3127a16933c4) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x40082406, &(0x7f0000001880)='cpu&\t\t\x8ap\'\xe2+\xdb]\x84\xc1\x95C\xac\x16\xbd\x83\xf8L\xee\xb3G\x14?\xab\x193i\xf4^\x01\x00\x00\x00\xdaq\x14\xdf\xe1X)+\xdaa\xf2\xc1\x1f]\xc6=e\xba\xa8\xed\xad\xdb}\xd749^a=s\xa9\bi\x88\x05\x00\x00\x00\x00\x00\x00\x00,8\x16\x16e\xf3k\x8c>\x13\xa98,\x00\x10\x00\x00\xff\xe7\x04_\x00\x00\x00\x00\x00\x00\x00=Y\xd3\xbe\xf2\x84\xbe\xb9z2\x03\xbd\x8bP\x12\x19\xbf\t\xbd]kC\xeb\xc2\x9b\xae\xeb\x81\v\x04\x06!9\x118\xe6\x8f\x12\x9dA9\xddv\v\xffl\x8b2\xff\x00\x00\x00\x00\x00\x00\x00\xa8\xa5=f\x11\x00\xd6\x83\xd2|\xa5\xa5\x91\\r\x9c\xe2\x10\fh\x9eM\xf5\x135\x9dM\x9a\xca\xac\xf4\x04~\xffR\x1db\xa7T\x0e\x012\xe1\xab*\x99s]I\x19\x1e0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="0c0000000988"}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x89a3, &(0x7f0000000080)) 3.186859733s ago: executing program 1 (id=9183): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000080)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x24, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f0000000300)=r5) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 2.353379946s ago: executing program 3 (id=9184): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xec8}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101082, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETFILTEREBPF(r3, 0x800454e1, &(0x7f0000000380)=r5) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 60.666479ms ago: executing program 1 (id=9185): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000000800000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6020, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 0s ago: executing program 32 (id=9169): r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x822a0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4000008, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x1) syz_clone(0x419a0100, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x24, 0x12506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x5, 0x0, @perf_config_ext={0x9, 0x2}, 0x7602, 0x0, 0x0, 0x0, 0x10003, 0x1000000, 0xbb, 0x0, 0x0, 0x0, 0x2000000003}, 0x0, 0xffffffffffffffff, r0, 0xa) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000), 0x2a979d) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x27, 0x0, 0x0, &(0x7f0000000640), 0x0, 0x3ad9, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffff}, 0x50) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r1, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000400), 0x12) syz_clone(0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) kernel console output (not intermixed with test programs): 2][T24995] free:1341076 free_pcp:10687 free_cma:0 [ 915.223926][T24994] netlink: 'syz.1.6964': attribute type 4 has an invalid length. [ 915.233222][T24995] Node 0 active_anon:28712kB inactive_anon:0kB active_file:76156kB inactive_file:160916kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100196kB dirty:1556kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10160kB pagetables:2260kB sec_pagetables:0kB all_unreclaimable? no [ 915.236965][T24994] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.6964'. [ 915.266445][T24995] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 915.333128][T24995] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 915.387192][T24995] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 915.393016][T24995] Node 0 DMA32 free:1452708kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:28540kB inactive_anon:0kB active_file:76156kB inactive_file:160088kB unevictable:1536kB writepending:1560kB present:3129332kB managed:2586952kB mlocked:0kB bounce:0kB free_pcp:26736kB local_pcp:11256kB free_cma:0kB [ 915.430795][T24995] lowmem_reserve[]: 0 0 0 0 0 [ 915.435575][T24995] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:828kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 915.466430][T24995] lowmem_reserve[]: 0 0 0 0 0 [ 915.473895][T24995] Node 1 Normal free:3896232kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:17156kB local_pcp:5828kB free_cma:0kB [ 915.507253][T24995] lowmem_reserve[]: 0 0 0 0 0 [ 915.513865][T24995] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 915.528160][T24995] Node 0 DMA32: 1951*4kB (UM) 1053*8kB (UME) 1076*16kB (UME) 1036*32kB (UME) 640*64kB (UME) 131*128kB (UME) 25*256kB (UM) 48*512kB (UM) 33*1024kB (UM) 9*2048kB (UME) 304*4096kB (M) = 1452708kB [ 915.548725][T24995] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 915.560657][T24995] Node 1 Normal: 224*4kB (UME) 57*8kB (UME) 36*16kB (UME) 59*32kB (UME) 13*64kB (UE) 9*128kB (UME) 1*256kB (U) 2*512kB (ME) 2*1024kB (UE) 2*2048kB (UE) 948*4096kB (M) = 3896232kB [ 915.582326][T24995] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 915.592024][T24995] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 915.601571][T24995] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 915.611678][T24995] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 915.627356][T24995] 60679 total pagecache pages [ 915.632059][T24995] 0 pages in swap cache [ 915.636340][T24995] Free swap = 124996kB [ 915.640701][T24995] Total swap = 124996kB [ 915.644878][T24995] 2097051 pages RAM [ 915.648782][T24995] 0 pages HighMem/MovableOnly [ 915.658844][T24995] 416927 pages reserved [ 915.666918][T24995] 0 pages cma reserved [ 916.245415][T25007] delete_channel: no stack [ 916.345878][T25014] netlink: 'syz.1.6971': attribute type 1 has an invalid length. [ 916.354622][T25014] netlink: 'syz.1.6971': attribute type 4 has an invalid length. [ 916.362798][T25014] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.6971'. [ 917.007684][T25022] netlink: 'syz.1.6975': attribute type 9 has an invalid length. [ 917.030610][T25022] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.6975'. [ 917.724588][T25034] FAULT_INJECTION: forcing a failure. [ 917.724588][T25034] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 917.756958][T25034] CPU: 1 PID: 25034 Comm: syz.3.6978 Not tainted syzkaller #0 [ 917.764477][T25034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 917.774815][T25034] Call Trace: [ 917.778094][T25034] [ 917.781019][T25034] dump_stack_lvl+0x18c/0x250 [ 917.785698][T25034] ? show_regs_print_info+0x20/0x20 [ 917.790896][T25034] ? load_image+0x420/0x420 [ 917.795396][T25034] ? __might_fault+0xaa/0x120 [ 917.800063][T25034] ? __lock_acquire+0x7d40/0x7d40 [ 917.805084][T25034] should_fail_ex+0x39d/0x4d0 [ 917.809765][T25034] _copy_from_user+0x2f/0xe0 [ 917.814348][T25034] ___sys_sendmsg+0x1c7/0x360 [ 917.819019][T25034] ? __sys_sendmsg+0x2a0/0x2a0 [ 917.823787][T25034] ? seqcount_lockdep_reader_access+0x17b/0x1d0 [ 917.830037][T25034] __se_sys_sendmsg+0x1c2/0x2b0 [ 917.834881][T25034] ? hrtimer_interrupt+0x7bb/0x9c0 [ 917.839991][T25034] ? __x64_sys_sendmsg+0x80/0x80 [ 917.844931][T25034] ? lockdep_hardirqs_on+0x98/0x150 [ 917.850128][T25034] do_syscall_64+0x55/0xa0 [ 917.854533][T25034] ? clear_bhb_loop+0x40/0x90 [ 917.859201][T25034] ? clear_bhb_loop+0x40/0x90 [ 917.863876][T25034] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 917.869765][T25034] RIP: 0033:0x7f8b95f9cdd9 [ 917.874176][T25034] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 917.893776][T25034] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 917.902187][T25034] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 917.910154][T25034] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 917.918121][T25034] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 917.926086][T25034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 917.934049][T25034] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 917.942028][T25034] [ 918.576009][T25035] delete_channel: no stack [ 918.739494][T25050] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6984'. [ 918.762968][T25050] netlink: 'syz.2.6984': attribute type 21 has an invalid length. [ 919.077392][T25055] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6983'. [ 919.446657][T25064] FAULT_INJECTION: forcing a failure. [ 919.446657][T25064] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 919.466155][T25064] CPU: 1 PID: 25064 Comm: syz.3.6988 Not tainted syzkaller #0 [ 919.473682][T25064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 919.483771][T25064] Call Trace: [ 919.487078][T25064] [ 919.490034][T25064] dump_stack_lvl+0x18c/0x250 [ 919.494755][T25064] ? show_regs_print_info+0x20/0x20 [ 919.499999][T25064] ? load_image+0x420/0x420 [ 919.504548][T25064] ? __lock_acquire+0x7d40/0x7d40 [ 919.509613][T25064] ? snprintf+0xe9/0x140 [ 919.513900][T25064] should_fail_ex+0x39d/0x4d0 [ 919.518625][T25064] _copy_to_user+0x2f/0xa0 [ 919.523082][T25064] simple_read_from_buffer+0xe7/0x150 [ 919.528504][T25064] proc_fail_nth_read+0x1e8/0x260 [ 919.533568][T25064] ? proc_fault_inject_write+0x360/0x360 [ 919.539242][T25064] ? fsnotify_perm+0x271/0x5e0 [ 919.544042][T25064] ? proc_fault_inject_write+0x360/0x360 [ 919.549708][T25064] vfs_read+0x28b/0x970 [ 919.553904][T25064] ? kernel_read+0x1e0/0x1e0 [ 919.558537][T25064] ? __fget_files+0x28/0x4b0 [ 919.563154][T25064] ? __fget_files+0x28/0x4b0 [ 919.567778][T25064] ? __fget_files+0x43d/0x4b0 [ 919.572507][T25064] ? __fdget_pos+0x2a3/0x330 [ 919.577130][T25064] ? ksys_read+0x75/0x260 [ 919.581499][T25064] ksys_read+0x150/0x260 [ 919.585784][T25064] ? vfs_write+0x990/0x990 [ 919.590329][T25064] ? lockdep_hardirqs_on+0x98/0x150 [ 919.595581][T25064] do_syscall_64+0x55/0xa0 [ 919.600029][T25064] ? clear_bhb_loop+0x40/0x90 [ 919.604735][T25064] ? clear_bhb_loop+0x40/0x90 [ 919.609444][T25064] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 919.615371][T25064] RIP: 0033:0x7f8b95f5d60e [ 919.619824][T25064] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 919.639456][T25064] RSP: 002b:00007f8b96efafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 919.647879][T25064] RAX: ffffffffffffffda RBX: 00007f8b96efb6c0 RCX: 00007f8b95f5d60e [ 919.655849][T25064] RDX: 000000000000000f RSI: 00007f8b96efb0a0 RDI: 0000000000000005 [ 919.663822][T25064] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 919.671794][T25064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 919.679764][T25064] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 919.687757][T25064] [ 919.999686][T25057] delete_channel: no stack [ 920.892537][T25075] delete_channel: no stack [ 920.897144][T25088] netlink: 'syz.2.6994': attribute type 21 has an invalid length. [ 920.898146][T25086] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6994'. [ 921.294743][T25105] FAULT_INJECTION: forcing a failure. [ 921.294743][T25105] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 921.312336][T25105] CPU: 1 PID: 25105 Comm: syz.3.7001 Not tainted syzkaller #0 [ 921.319930][T25105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 921.330090][T25105] Call Trace: [ 921.333467][T25105] [ 921.336502][T25105] dump_stack_lvl+0x18c/0x250 [ 921.341334][T25105] ? show_regs_print_info+0x20/0x20 [ 921.346697][T25105] ? load_image+0x420/0x420 [ 921.351391][T25105] ? __might_fault+0xaa/0x120 [ 921.356223][T25105] ? __lock_acquire+0x7d40/0x7d40 [ 921.361459][T25105] should_fail_ex+0x39d/0x4d0 [ 921.366337][T25105] _copy_from_user+0x2f/0xe0 [ 921.371095][T25105] ___sys_sendmsg+0x1c7/0x360 [ 921.375981][T25105] ? __sys_sendmsg+0x2a0/0x2a0 [ 921.381157][T25105] ? __lock_acquire+0x7d40/0x7d40 [ 921.386625][T25105] __se_sys_sendmsg+0x1c2/0x2b0 [ 921.391654][T25105] ? __x64_sys_sendmsg+0x80/0x80 [ 921.396902][T25105] ? lockdep_hardirqs_on+0x98/0x150 [ 921.402295][T25105] do_syscall_64+0x55/0xa0 [ 921.406832][T25105] ? clear_bhb_loop+0x40/0x90 [ 921.411635][T25105] ? clear_bhb_loop+0x40/0x90 [ 921.416484][T25105] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 921.422510][T25105] RIP: 0033:0x7f8b95f9cdd9 [ 921.427075][T25105] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 921.446816][T25105] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 921.455409][T25105] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 921.463524][T25105] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 000000000000000b [ 921.471634][T25105] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 921.479739][T25105] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 921.487848][T25105] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 921.496139][T25105] [ 922.095068][T25120] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7006'. [ 922.132141][T25120] netlink: 'syz.3.7006': attribute type 21 has an invalid length. [ 922.342612][T25122] netlink: 'syz.0.7005': attribute type 2 has an invalid length. [ 922.362296][T25122] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7005'. [ 922.414901][T25112] delete_channel: no stack [ 922.957221][T25134] FAULT_INJECTION: forcing a failure. [ 922.957221][T25134] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 922.972265][T25134] CPU: 0 PID: 25134 Comm: syz.0.7011 Not tainted syzkaller #0 [ 922.979754][T25134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 922.989814][T25134] Call Trace: [ 922.993088][T25134] [ 922.996024][T25134] dump_stack_lvl+0x18c/0x250 [ 923.000735][T25134] ? show_regs_print_info+0x20/0x20 [ 923.005956][T25134] ? load_image+0x420/0x420 [ 923.010481][T25134] ? __lock_acquire+0x7d40/0x7d40 [ 923.015507][T25134] ? snprintf+0xe9/0x140 [ 923.019766][T25134] should_fail_ex+0x39d/0x4d0 [ 923.024456][T25134] _copy_to_user+0x2f/0xa0 [ 923.028879][T25134] simple_read_from_buffer+0xe7/0x150 [ 923.034264][T25134] proc_fail_nth_read+0x1e8/0x260 [ 923.039290][T25134] ? proc_fault_inject_write+0x360/0x360 [ 923.044925][T25134] ? fsnotify_perm+0x271/0x5e0 [ 923.049700][T25134] ? proc_fault_inject_write+0x360/0x360 [ 923.055333][T25134] vfs_read+0x28b/0x970 [ 923.059499][T25134] ? kernel_read+0x1e0/0x1e0 [ 923.064087][T25134] ? __fget_files+0x28/0x4b0 [ 923.068672][T25134] ? __fget_files+0x28/0x4b0 [ 923.073254][T25134] ? __fget_files+0x43d/0x4b0 [ 923.077935][T25134] ? __fdget_pos+0x2a3/0x330 [ 923.082526][T25134] ? ksys_read+0x75/0x260 [ 923.086853][T25134] ksys_read+0x150/0x260 [ 923.091093][T25134] ? vfs_write+0x990/0x990 [ 923.095511][T25134] ? lockdep_hardirqs_on+0x98/0x150 [ 923.100703][T25134] do_syscall_64+0x55/0xa0 [ 923.105107][T25134] ? clear_bhb_loop+0x40/0x90 [ 923.109780][T25134] ? clear_bhb_loop+0x40/0x90 [ 923.114452][T25134] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 923.120342][T25134] RIP: 0033:0x7f5fa315d60e [ 923.124756][T25134] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 923.144353][T25134] RSP: 002b:00007f5fa4113fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 923.152762][T25134] RAX: ffffffffffffffda RBX: 00007f5fa41146c0 RCX: 00007f5fa315d60e [ 923.160725][T25134] RDX: 000000000000000f RSI: 00007f5fa41140a0 RDI: 0000000000000007 [ 923.168684][T25134] RBP: 00007f5fa4114090 R08: 0000000000000000 R09: 0000000000000000 [ 923.176643][T25134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 923.184608][T25134] R13: 00007f5fa3416038 R14: 00007f5fa3415fa0 R15: 00007fff1fc75cd8 [ 923.192586][T25134] [ 923.343936][T25143] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7015'. [ 923.417670][T25143] netlink: 'syz.2.7015': attribute type 21 has an invalid length. [ 923.469195][T25145] netlink: 184 bytes leftover after parsing attributes in process `syz.0.7013'. [ 924.113619][T25149] delete_channel: no stack [ 924.673369][T25176] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7026'. [ 924.800744][T25176] netlink: 'syz.2.7026': attribute type 21 has an invalid length. [ 924.957629][T25184] delete_channel: no stack [ 926.077320][T25205] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7038'. [ 926.125681][T25205] netlink: 'syz.3.7038': attribute type 21 has an invalid length. [ 926.228126][T25209] delete_channel: no stack [ 926.509075][T25216] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 926.519448][T25216] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 926.529711][T25216] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 926.542186][T25216] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 926.553856][T25216] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 926.562911][T25216] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 926.751868][ T2923] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 926.932157][ T2923] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 927.080781][ T2923] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 927.211148][ T2923] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 927.614125][T25215] chnl_net:caif_netlink_parms(): no params data found [ 927.913751][T25248] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7048'. [ 927.951165][T25244] netlink: 'syz.0.7048': attribute type 21 has an invalid length. [ 927.965578][T25250] delete_channel: no stack [ 928.086193][T25215] bridge0: port 1(bridge_slave_0) entered blocking state [ 928.117234][T25215] bridge0: port 1(bridge_slave_0) entered disabled state [ 928.124485][T25215] bridge_slave_0: entered allmulticast mode [ 928.154657][T25215] bridge_slave_0: entered promiscuous mode [ 928.173185][T25260] FAULT_INJECTION: forcing a failure. [ 928.173185][T25260] name failslab, interval 1, probability 0, space 0, times 0 [ 928.187117][T25215] bridge0: port 2(bridge_slave_1) entered blocking state [ 928.199135][T25215] bridge0: port 2(bridge_slave_1) entered disabled state [ 928.206337][T25260] CPU: 1 PID: 25260 Comm: syz.0.7052 Not tainted syzkaller #0 [ 928.213826][T25260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 928.223983][T25260] Call Trace: [ 928.227280][T25260] [ 928.230229][T25260] dump_stack_lvl+0x18c/0x250 [ 928.234939][T25260] ? show_regs_print_info+0x20/0x20 [ 928.240163][T25260] ? load_image+0x420/0x420 [ 928.244686][T25260] ? __might_sleep+0xe0/0xe0 [ 928.249295][T25260] ? __lock_acquire+0x7d40/0x7d40 [ 928.254338][T25260] ? __lock_acquire+0x7d40/0x7d40 [ 928.259386][T25260] should_fail_ex+0x39d/0x4d0 [ 928.264091][T25260] should_failslab+0x9/0x20 [ 928.268615][T25260] slab_pre_alloc_hook+0x59/0x310 [ 928.273663][T25260] kmem_cache_alloc_node+0x60/0x320 [ 928.278875][T25260] ? __alloc_skb+0x103/0x2c0 [ 928.283464][T25260] __alloc_skb+0x103/0x2c0 [ 928.287876][T25260] alloc_skb_with_frags+0xca/0x7b0 [ 928.292988][T25260] sock_alloc_send_pskb+0x883/0x9a0 [ 928.298193][T25260] ? sock_kzfree_s+0x50/0x50 [ 928.302788][T25260] tun_get_user+0x82c/0x3ca0 [ 928.307396][T25260] ? aa_file_perm+0x11b/0xee0 [ 928.312084][T25260] ? rcu_read_unlock+0xa0/0xa0 [ 928.316858][T25260] ? tun_get+0x1c/0x2e0 [ 928.321014][T25260] ? __lock_acquire+0x7d40/0x7d40 [ 928.326035][T25260] ? tun_get+0x1c/0x2e0 [ 928.330186][T25260] tun_chr_write_iter+0x119/0x200 [ 928.335201][T25260] vfs_write+0x46c/0x990 [ 928.339440][T25260] ? file_end_write+0x250/0x250 [ 928.344287][T25260] ? __fget_files+0x43d/0x4b0 [ 928.348961][T25260] ? __fdget_pos+0x1d8/0x330 [ 928.353539][T25260] ? ksys_write+0x75/0x260 [ 928.357952][T25260] ksys_write+0x150/0x260 [ 928.362275][T25260] ? __ia32_sys_read+0x90/0x90 [ 928.367037][T25260] ? lockdep_hardirqs_on+0x98/0x150 [ 928.372231][T25260] do_syscall_64+0x55/0xa0 [ 928.376634][T25260] ? clear_bhb_loop+0x40/0x90 [ 928.381307][T25260] ? clear_bhb_loop+0x40/0x90 [ 928.385979][T25260] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 928.391864][T25260] RIP: 0033:0x7f5fa319cdd9 [ 928.396269][T25260] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 928.415876][T25260] RSP: 002b:00007f5fa4114028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 928.424290][T25260] RAX: ffffffffffffffda RBX: 00007f5fa3415fa0 RCX: 00007f5fa319cdd9 [ 928.432258][T25260] RDX: 000000000000fdef RSI: 0000200000000200 RDI: 00000000000000c8 [ 928.440227][T25260] RBP: 00007f5fa4114090 R08: 0000000000000000 R09: 0000000000000000 [ 928.448195][T25260] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 928.456159][T25260] R13: 00007f5fa3416038 R14: 00007f5fa3415fa0 R15: 00007fff1fc75cd8 [ 928.464135][T25260] [ 928.468418][T25215] bridge_slave_1: entered allmulticast mode [ 928.475694][T25215] bridge_slave_1: entered promiscuous mode [ 928.507455][T25215] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 928.519708][T25215] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 928.553828][T25215] team0: Port device team_slave_0 added [ 928.565548][T25215] team0: Port device team_slave_1 added [ 928.627234][T25216] Bluetooth: hci1: command tx timeout [ 928.689558][T25215] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 928.701106][T25215] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 928.727505][T25215] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 928.786245][T25268] syzkaller0: entered promiscuous mode [ 928.793742][T25268] syzkaller0: entered allmulticast mode [ 928.851211][T25215] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 928.859586][T25215] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 928.917100][T25215] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 930.264375][T25293] delete_channel: no stack [ 930.711346][T25216] Bluetooth: hci1: command tx timeout [ 931.677200][T25215] hsr_slave_0: entered promiscuous mode [ 931.683451][T25215] hsr_slave_1: entered promiscuous mode [ 931.691321][T25215] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 931.699018][T25215] Cannot create hsr debugfs directory [ 931.796651][T25294] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7059'. [ 931.806638][T25295] netlink: 'syz.3.7059': attribute type 21 has an invalid length. [ 931.831990][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.838408][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.993735][T25306] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7061'. [ 932.042670][T25302] netlink: 'syz.0.7061': attribute type 21 has an invalid length. [ 932.620422][ T2923] hsr_slave_0: left promiscuous mode [ 932.638759][ T2923] hsr_slave_1: left promiscuous mode [ 932.662617][ T2923] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 932.680426][ T2923] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 932.787602][T25216] Bluetooth: hci1: command tx timeout [ 933.170010][ T2923] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 933.207117][ T2923] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 933.316025][ T2923] veth1_vlan: left promiscuous mode [ 933.327526][ T2923] veth0_vlan: left promiscuous mode [ 934.619505][T25349] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7070'. [ 934.630216][T25351] netlink: 'syz.2.7070': attribute type 21 has an invalid length. [ 934.873627][T25215] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 934.883042][T25216] Bluetooth: hci1: command tx timeout [ 935.115740][T25215] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 935.193902][T25363] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7072'. [ 935.254222][T25215] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 935.297702][T25215] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 935.858463][T25215] 8021q: adding VLAN 0 to HW filter on device bond0 [ 935.926795][T25215] 8021q: adding VLAN 0 to HW filter on device team0 [ 935.934095][T25381] delete_channel: no stack [ 935.969601][ T2923] bridge0: port 1(bridge_slave_0) entered blocking state [ 935.976834][ T2923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 936.031595][ T2923] bridge0: port 2(bridge_slave_1) entered blocking state [ 936.038803][ T2923] bridge0: port 2(bridge_slave_1) entered forwarding state [ 936.644905][T25392] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7078'. [ 936.863702][T25400] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7079'. [ 937.464729][T25215] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 938.102240][T25215] veth0_vlan: entered promiscuous mode [ 938.413400][T25215] veth1_vlan: entered promiscuous mode [ 938.524371][T25215] veth0_macvtap: entered promiscuous mode [ 938.556796][T25215] veth1_macvtap: entered promiscuous mode [ 938.586268][T25435] FAULT_INJECTION: forcing a failure. [ 938.586268][T25435] name failslab, interval 1, probability 0, space 0, times 0 [ 938.641263][T25435] CPU: 0 PID: 25435 Comm: syz.2.7084 Not tainted syzkaller #0 [ 938.648799][T25435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 938.658884][T25435] Call Trace: [ 938.662193][T25435] [ 938.665147][T25435] dump_stack_lvl+0x18c/0x250 [ 938.669867][T25435] ? show_regs_print_info+0x20/0x20 [ 938.675101][T25435] ? load_image+0x420/0x420 [ 938.679646][T25435] ? __might_sleep+0xe0/0xe0 [ 938.684273][T25435] ? __lock_acquire+0x7d40/0x7d40 [ 938.689340][T25435] should_fail_ex+0x39d/0x4d0 [ 938.694065][T25435] should_failslab+0x9/0x20 [ 938.698605][T25435] slab_pre_alloc_hook+0x59/0x310 [ 938.703678][T25435] ? trace_event_raw_event_lock+0x250/0x250 [ 938.709615][T25435] ? sock_kmalloc+0x96/0xf0 [ 938.714168][T25435] ? sock_kmalloc+0x96/0xf0 [ 938.718719][T25435] __kmem_cache_alloc_node+0x53/0x250 [ 938.724156][T25435] ? sock_kmalloc+0x96/0xf0 [ 938.728698][T25435] __kmalloc+0xa4/0x230 [ 938.732900][T25435] sock_kmalloc+0x96/0xf0 [ 938.737284][T25435] ____sys_sendmsg+0x1be/0x960 [ 938.742080][T25435] ? __lock_acquire+0x7d40/0x7d40 [ 938.747146][T25435] ? __asan_memset+0x22/0x40 [ 938.751769][T25435] ? __sys_sendmsg_sock+0x30/0x30 [ 938.756844][T25435] ? __import_iovec+0x3fa/0x850 [ 938.761769][T25435] ? import_iovec+0x73/0xa0 [ 938.766326][T25435] ___sys_sendmsg+0x2a6/0x360 [ 938.771096][T25435] ? __sys_sendmsg+0x2a0/0x2a0 [ 938.775939][T25435] ? __lock_acquire+0x7d40/0x7d40 [ 938.781042][T25435] __se_sys_sendmsg+0x1c2/0x2b0 [ 938.785933][T25435] ? __x64_sys_sendmsg+0x80/0x80 [ 938.790936][T25435] ? lockdep_hardirqs_on+0x98/0x150 [ 938.796193][T25435] do_syscall_64+0x55/0xa0 [ 938.800638][T25435] ? clear_bhb_loop+0x40/0x90 [ 938.805356][T25435] ? clear_bhb_loop+0x40/0x90 [ 938.810080][T25435] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 938.816006][T25435] RIP: 0033:0x7fcdf279cdd9 [ 938.820450][T25435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 938.840097][T25435] RSP: 002b:00007fcdf09f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 938.848563][T25435] RAX: ffffffffffffffda RBX: 00007fcdf2a15fa0 RCX: 00007fcdf279cdd9 [ 938.856575][T25435] RDX: 000000000000ff00 RSI: 0000200000001180 RDI: 0000000000000003 [ 938.864586][T25435] RBP: 00007fcdf09f6090 R08: 0000000000000000 R09: 0000000000000000 [ 938.872599][T25435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 938.880606][T25435] R13: 00007fcdf2a16038 R14: 00007fcdf2a15fa0 R15: 00007ffecb7355e8 [ 938.888647][T25435] [ 938.937526][T25215] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 938.961109][T25215] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 938.979403][T25215] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 938.991621][T25215] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 939.005088][T25215] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 939.020320][T25215] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 939.033357][T25215] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 939.227613][T25215] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 939.256834][T25215] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 939.272061][T25215] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 939.284137][T25215] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 939.295386][T25215] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 939.306627][T25215] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 939.320508][T25215] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 939.353766][T25449] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7085'. [ 939.525819][T25215] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 939.569458][T25215] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 939.610888][T25215] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 939.650879][T25215] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.262148][T23396] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 940.292684][T23396] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 940.351813][ T2883] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 940.365176][ T2883] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 941.153901][T25496] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7093'. [ 941.522223][T25498] syzkaller0: entered promiscuous mode [ 941.539571][T25498] syzkaller0: entered allmulticast mode [ 941.935090][T25506] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7096'. [ 944.763462][T25545] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7107'. [ 945.395497][T25551] syzkaller0: entered promiscuous mode [ 945.408492][T25551] syzkaller0: entered allmulticast mode [ 947.710635][T25559] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7113'. [ 948.085153][T25576] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7118'. [ 948.119877][T25576] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7118'. [ 948.434447][T25589] FAULT_INJECTION: forcing a failure. [ 948.434447][T25589] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 948.448359][T25589] CPU: 0 PID: 25589 Comm: syz.3.7123 Not tainted syzkaller #0 [ 948.455849][T25589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 948.465926][T25589] Call Trace: [ 948.469220][T25589] [ 948.472160][T25589] dump_stack_lvl+0x18c/0x250 [ 948.476863][T25589] ? show_regs_print_info+0x20/0x20 [ 948.482095][T25589] ? load_image+0x420/0x420 [ 948.486622][T25589] ? __might_fault+0xaa/0x120 [ 948.491309][T25589] ? __lock_acquire+0x7d40/0x7d40 [ 948.496353][T25589] should_fail_ex+0x39d/0x4d0 [ 948.501057][T25589] _copy_from_user+0x2f/0xe0 [ 948.505658][T25589] __sys_bpf+0x23e/0x890 [ 948.509898][T25589] ? bpf_link_show_fdinfo+0x390/0x390 [ 948.515274][T25589] ? lock_chain_count+0x20/0x20 [ 948.520122][T25589] __x64_sys_bpf+0x7c/0x90 [ 948.524531][T25589] do_syscall_64+0x55/0xa0 [ 948.528943][T25589] ? clear_bhb_loop+0x40/0x90 [ 948.533610][T25589] ? clear_bhb_loop+0x40/0x90 [ 948.538279][T25589] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 948.544165][T25589] RIP: 0033:0x7f8b95f9cdd9 [ 948.548575][T25589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 948.568171][T25589] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 948.576573][T25589] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 948.584533][T25589] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 948.592493][T25589] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 948.600456][T25589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 948.608417][T25589] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 948.616409][T25589] [ 949.211669][T25602] syzkaller0: entered promiscuous mode [ 949.219426][T25602] syzkaller0: entered allmulticast mode [ 949.269038][T19426] Bluetooth: hci2: command 0x0406 tx timeout [ 949.646666][T25605] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7125'. [ 951.846304][T25618] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7130'. [ 951.857025][T25621] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7130'. [ 952.154523][T25630] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7136'. [ 952.400368][T25635] netlink: 12415 bytes leftover after parsing attributes in process `syz.3.7137'. [ 952.840552][T25648] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7143'. [ 952.883139][T25648] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7143'. [ 953.066640][T25649] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7142'. [ 953.948958][T25660] syzkaller0: entered promiscuous mode [ 953.967166][T25660] syzkaller0: entered allmulticast mode [ 954.028013][T25669] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7148'. [ 956.449441][T25686] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7153'. [ 956.497187][T25686] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7153'. [ 957.204642][T25711] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7163'. [ 957.577915][T25720] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7166'. [ 957.620003][T25720] netlink: 160 bytes leftover after parsing attributes in process `syz.3.7166'. [ 957.796685][T25722] C: renamed from team_slave_0 (while UP) [ 957.821268][T25722] netlink: 'syz.1.7168': attribute type 4 has an invalid length. [ 957.830151][T25722] netlink: 116 bytes leftover after parsing attributes in process `syz.1.7168'. [ 957.844281][T25722] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 958.335018][T25742] FAULT_INJECTION: forcing a failure. [ 958.335018][T25742] name failslab, interval 1, probability 0, space 0, times 0 [ 958.347880][T25742] CPU: 0 PID: 25742 Comm: syz.2.7175 Not tainted syzkaller #0 [ 958.355358][T25742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 958.365424][T25742] Call Trace: [ 958.368710][T25742] [ 958.371636][T25742] dump_stack_lvl+0x18c/0x250 [ 958.376403][T25742] ? show_regs_print_info+0x20/0x20 [ 958.381598][T25742] ? load_image+0x420/0x420 [ 958.386098][T25742] ? verify_lock_unused+0x140/0x140 [ 958.391320][T25742] should_fail_ex+0x39d/0x4d0 [ 958.396008][T25742] should_failslab+0x9/0x20 [ 958.400510][T25742] slab_pre_alloc_hook+0x59/0x310 [ 958.405536][T25742] kmem_cache_alloc+0x5a/0x2d0 [ 958.410300][T25742] ? skb_clone+0x1eb/0x370 [ 958.414719][T25742] skb_clone+0x1eb/0x370 [ 958.418963][T25742] __netlink_deliver_tap+0x41c/0x830 [ 958.424259][T25742] ? netlink_deliver_tap+0x2e/0x1b0 [ 958.429457][T25742] netlink_deliver_tap+0x19c/0x1b0 [ 958.434566][T25742] netlink_unicast+0x72c/0x8d0 [ 958.439336][T25742] netlink_sendmsg+0x8d0/0xbf0 [ 958.444109][T25742] ? netlink_getsockopt+0x590/0x590 [ 958.449307][T25742] ? aa_sock_msg_perm+0x94/0x150 [ 958.454239][T25742] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 958.459519][T25742] ? security_socket_sendmsg+0x80/0xa0 [ 958.464976][T25742] ? netlink_getsockopt+0x590/0x590 [ 958.470174][T25742] ____sys_sendmsg+0x5ba/0x960 [ 958.474939][T25742] ? __asan_memset+0x22/0x40 [ 958.479532][T25742] ? __sys_sendmsg_sock+0x30/0x30 [ 958.484546][T25742] ? __import_iovec+0x5f2/0x850 [ 958.489396][T25742] ? import_iovec+0x73/0xa0 [ 958.493891][T25742] ___sys_sendmsg+0x2a6/0x360 [ 958.498562][T25742] ? get_pid_task+0x20/0x1e0 [ 958.503149][T25742] ? __sys_sendmsg+0x2a0/0x2a0 [ 958.507920][T25742] ? __lock_acquire+0x7d40/0x7d40 [ 958.512971][T25742] __se_sys_sendmsg+0x1c2/0x2b0 [ 958.517820][T25742] ? __x64_sys_sendmsg+0x80/0x80 [ 958.522761][T25742] ? lockdep_hardirqs_on+0x98/0x150 [ 958.527959][T25742] do_syscall_64+0x55/0xa0 [ 958.532370][T25742] ? clear_bhb_loop+0x40/0x90 [ 958.537041][T25742] ? clear_bhb_loop+0x40/0x90 [ 958.541799][T25742] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 958.547687][T25742] RIP: 0033:0x7fcdf279cdd9 [ 958.552098][T25742] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 958.571699][T25742] RSP: 002b:00007fcdf09f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 958.580110][T25742] RAX: ffffffffffffffda RBX: 00007fcdf2a15fa0 RCX: 00007fcdf279cdd9 [ 958.588072][T25742] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 958.596034][T25742] RBP: 00007fcdf09f6090 R08: 0000000000000000 R09: 0000000000000000 [ 958.603996][T25742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 958.611967][T25742] R13: 00007fcdf2a16038 R14: 00007fcdf2a15fa0 R15: 00007ffecb7355e8 [ 958.619944][T25742] [ 958.801077][T25748] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7177'. [ 958.869172][T25748] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7177'. [ 959.521760][T25753] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7176'. [ 960.159727][T25779] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7188'. [ 960.228956][T25779] netlink: 160 bytes leftover after parsing attributes in process `syz.0.7188'. [ 960.473606][T25782] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7190'. [ 960.933562][T25791] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7192'. [ 961.378750][T25795] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 961.389823][T25795] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 961.401840][T25795] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 961.422438][T25795] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 961.633133][T25812] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7199'. [ 961.740377][T25812] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7199'. [ 961.906233][T25815] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7209'. [ 964.191222][T25854] __nla_validate_parse: 3 callbacks suppressed [ 964.191253][T25854] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7211'. [ 964.397604][T25857] netlink: 160 bytes leftover after parsing attributes in process `syz.1.7211'. [ 964.418233][T25860] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7212'. [ 964.468966][T25860] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7212'. [ 964.648993][T25865] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7215'. [ 964.856701][T25871] FAULT_INJECTION: forcing a failure. [ 964.856701][T25871] name failslab, interval 1, probability 0, space 0, times 0 [ 964.884194][T25871] CPU: 0 PID: 25871 Comm: syz.3.7217 Not tainted syzkaller #0 [ 964.891748][T25871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 964.901852][T25871] Call Trace: [ 964.905165][T25871] [ 964.908137][T25871] dump_stack_lvl+0x18c/0x250 [ 964.912881][T25871] ? show_regs_print_info+0x20/0x20 [ 964.918138][T25871] ? load_image+0x420/0x420 [ 964.922706][T25871] ? __might_sleep+0xe0/0xe0 [ 964.927346][T25871] ? __lock_acquire+0x7d40/0x7d40 [ 964.932494][T25871] should_fail_ex+0x39d/0x4d0 [ 964.937243][T25871] should_failslab+0x9/0x20 [ 964.941836][T25871] slab_pre_alloc_hook+0x59/0x310 [ 964.946919][T25871] ? bpf_prog_test_run_skb+0x238/0x12b0 [ 964.952518][T25871] ? bpf_prog_test_run_skb+0x238/0x12b0 [ 964.958118][T25871] __kmem_cache_alloc_node+0x53/0x250 [ 964.963571][T25871] ? bpf_prog_test_run_skb+0x238/0x12b0 [ 964.969171][T25871] __kmalloc+0xa4/0x230 [ 964.973402][T25871] bpf_prog_test_run_skb+0x238/0x12b0 [ 964.978829][T25871] ? __fget_files+0x28/0x4b0 [ 964.983477][T25871] ? __fget_files+0x28/0x4b0 [ 964.988115][T25871] ? __fget_files+0x43d/0x4b0 [ 964.992870][T25871] ? cpu_online+0x60/0x60 [ 964.997246][T25871] bpf_prog_test_run+0x321/0x390 [ 965.002233][T25871] __sys_bpf+0x49d/0x890 [ 965.006521][T25871] ? bpf_link_show_fdinfo+0x390/0x390 [ 965.011981][T25871] ? lock_chain_count+0x20/0x20 [ 965.016880][T25871] __x64_sys_bpf+0x7c/0x90 [ 965.021326][T25871] do_syscall_64+0x55/0xa0 [ 965.025781][T25871] ? clear_bhb_loop+0x40/0x90 [ 965.030505][T25871] ? clear_bhb_loop+0x40/0x90 [ 965.035226][T25871] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 965.041300][T25871] RIP: 0033:0x7f8b95f9cdd9 [ 965.045759][T25871] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 965.065414][T25871] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 965.073883][T25871] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 965.081893][T25871] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 965.089911][T25871] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 965.097929][T25871] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 965.105940][T25871] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 965.113993][T25871] [ 965.352695][T25868] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 965.366982][T25868] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 965.390623][T25868] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 965.431209][T25868] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 965.815220][T25892] netlink: zone id is out of range [ 965.825983][T25892] netlink: set zone limit has 8 unknown bytes [ 966.091472][T25898] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7226'. [ 966.136193][T25898] netlink: 160 bytes leftover after parsing attributes in process `syz.1.7226'. [ 966.193965][T25900] syzkaller0: entered promiscuous mode [ 966.199742][T25900] syzkaller0: entered allmulticast mode [ 966.224551][T25902] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7228'. [ 966.323025][T25902] netlink: 160 bytes leftover after parsing attributes in process `syz.0.7228'. [ 966.488071][T25911] delete_channel: no stack [ 968.286904][T25907] netlink: 'syz.2.7229': attribute type 10 has an invalid length. [ 968.294937][T25907] netlink: 55 bytes leftover after parsing attributes in process `syz.2.7229'. [ 968.541870][T25916] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 968.562662][T25916] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 968.573967][T25916] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 968.581921][T25916] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 969.011134][T25934] openvswitch: netlink: Tunnel attr 2548 out of range max 16 [ 969.263544][T25930] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 969.646649][T25944] __nla_validate_parse: 5 callbacks suppressed [ 969.646670][T25944] netlink: 135856 bytes leftover after parsing attributes in process `syz.3.7237'. [ 969.819425][T25947] delete_channel: no stack [ 969.824209][T25939] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7239'. [ 969.834095][T25944] netlink: 8442 bytes leftover after parsing attributes in process `syz.3.7237'. [ 971.822844][T25954] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7242'. [ 972.019793][T25960] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7245'. [ 972.043179][T25960] netlink: 160 bytes leftover after parsing attributes in process `syz.3.7245'. [ 972.641465][T25978] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7253'. [ 972.728972][T25971] delete_channel: no stack [ 972.824261][T25981] delete_channel: no stack [ 972.854150][T25984] netlink: 'syz.2.7256': attribute type 3 has an invalid length. [ 972.885511][T25984] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7256'. [ 973.390628][T26001] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7260'. [ 973.403666][T26004] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7263'. [ 973.711739][T26012] delete_channel: no stack [ 975.051956][T26046] delete_channel: no stack [ 975.592153][T26065] __nla_validate_parse: 4 callbacks suppressed [ 975.592194][T26065] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7281'. [ 976.424857][T19426] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 976.435837][T19426] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 976.455042][T19426] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 976.474246][T19426] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 976.484582][T19426] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 976.492261][T19426] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 977.010583][T26076] chnl_net:caif_netlink_parms(): no params data found [ 977.292629][T26076] bridge0: port 1(bridge_slave_0) entered blocking state [ 977.308450][T26078] delete_channel: no stack [ 977.319448][T26076] bridge0: port 1(bridge_slave_0) entered disabled state [ 977.333334][T26076] bridge_slave_0: entered allmulticast mode [ 977.345086][T26076] bridge_slave_0: entered promiscuous mode [ 977.365359][T26076] bridge0: port 2(bridge_slave_1) entered blocking state [ 977.377971][T26076] bridge0: port 2(bridge_slave_1) entered disabled state [ 977.385616][T26076] bridge_slave_1: entered allmulticast mode [ 977.399026][T26076] bridge_slave_1: entered promiscuous mode [ 977.483238][T26076] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 977.508765][T26076] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 977.605672][T26076] team0: Port device team_slave_0 added [ 977.661241][T26076] team0: Port device team_slave_1 added [ 977.773370][T26076] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 977.780647][T26076] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 977.810375][T26076] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 977.823238][T26076] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 977.830383][T26076] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 977.861167][T26076] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 977.980599][T26099] netlink: 'syz.3.7291': attribute type 29 has an invalid length. [ 978.001954][T26097] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7290'. [ 978.043472][T26099] netlink: 'syz.3.7291': attribute type 29 has an invalid length. [ 978.092848][T26076] hsr_slave_0: entered promiscuous mode [ 978.100119][T26076] hsr_slave_1: entered promiscuous mode [ 978.107182][T26076] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 978.115221][T26076] Cannot create hsr debugfs directory [ 978.123650][T26100] netlink: 'syz.3.7291': attribute type 29 has an invalid length. [ 978.139690][T26099] netlink: 'syz.3.7291': attribute type 29 has an invalid length. [ 978.242448][T26101] netlink: 'syz.3.7291': attribute type 29 has an invalid length. [ 978.547050][T25216] Bluetooth: hci3: command tx timeout [ 978.620218][T26076] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.666158][T26115] delete_channel: no stack [ 978.760829][T26076] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.827355][T26113] delete_channel: no stack [ 978.870283][T26076] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 978.994742][T26122] netlink: 'syz.0.7300': attribute type 29 has an invalid length. [ 979.008720][T26076] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 979.024075][T26122] netlink: 'syz.0.7300': attribute type 29 has an invalid length. [ 979.060774][T26122] netlink: 'syz.0.7300': attribute type 29 has an invalid length. [ 979.089265][T26123] netlink: 'syz.0.7300': attribute type 29 has an invalid length. [ 979.112272][T26122] netlink: 'syz.0.7300': attribute type 29 has an invalid length. [ 979.262055][T26126] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7301'. [ 979.535806][T26130] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7303'. [ 979.827486][T26076] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 979.908135][T26076] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 979.933883][T26076] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 979.947596][T26076] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 980.062453][T26140] delete_channel: no stack [ 980.225998][T26076] 8021q: adding VLAN 0 to HW filter on device bond0 [ 980.373006][T26141] delete_channel: no stack [ 980.402027][T26076] 8021q: adding VLAN 0 to HW filter on device team0 [ 980.476410][T26150] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7309'. [ 980.526636][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 980.533891][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 980.554788][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 980.562018][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 980.637723][T19426] Bluetooth: hci3: command tx timeout [ 980.963803][T26161] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7313'. [ 981.002667][ T59] hsr_slave_1: left promiscuous mode [ 981.021586][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 981.040026][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 981.068104][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 981.077463][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 981.103758][ T59] bridge_slave_1: left allmulticast mode [ 981.110628][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 981.133671][ T59] bridge_slave_0: left allmulticast mode [ 981.142033][ T59] bridge_slave_0: left promiscuous mode [ 981.154679][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 982.245405][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 982.288943][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 982.564954][ T59] bond0 (unregistering): Released all slaves [ 982.653326][T26165] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7314'. [ 982.706921][T19426] Bluetooth: hci3: command tx timeout [ 982.708783][T26172] syzkaller0: entered promiscuous mode [ 982.717928][T26172] syzkaller0: entered allmulticast mode [ 983.642917][T26177] delete_channel: no stack [ 984.531826][T26076] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 984.684764][T26076] veth0_vlan: entered promiscuous mode [ 984.764886][T26076] veth1_vlan: entered promiscuous mode [ 984.789904][T19426] Bluetooth: hci3: command tx timeout [ 984.823778][T26076] veth0_macvtap: entered promiscuous mode [ 984.839961][T26076] veth1_macvtap: entered promiscuous mode [ 984.923780][T26076] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 984.969339][T26076] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 984.981743][T26076] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 984.990800][T26076] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.000112][T26076] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.009207][T26076] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.146166][ T2923] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 985.165664][ T2923] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 985.278093][ T635] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 985.286315][ T635] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 985.580262][T26196] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7323'. [ 986.100644][T26199] delete_channel: no stack [ 986.315817][T26208] syzkaller0: entered promiscuous mode [ 986.321897][T26208] syzkaller0: entered allmulticast mode [ 986.525076][T26216] validate_nla: 3 callbacks suppressed [ 986.525095][T26216] netlink: 'syz.1.7329': attribute type 3 has an invalid length. [ 986.540132][T26216] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7329'. [ 988.243555][T26229] delete_channel: no stack [ 988.895030][T26240] netlink: 'syz.2.7337': attribute type 3 has an invalid length. [ 988.936984][T26240] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7337'. [ 989.466981][T26249] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7341'. [ 989.621785][T25216] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 989.638928][T25216] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 989.649164][T25216] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 989.664022][T25216] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 989.672457][T25216] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 989.681555][T25216] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 990.310264][T26251] chnl_net:caif_netlink_parms(): no params data found [ 990.595339][T26251] bridge0: port 1(bridge_slave_0) entered blocking state [ 990.611659][T26251] bridge0: port 1(bridge_slave_0) entered disabled state [ 990.629973][T26251] bridge_slave_0: entered allmulticast mode [ 990.645203][T26251] bridge_slave_0: entered promiscuous mode [ 990.674262][T26251] bridge0: port 2(bridge_slave_1) entered blocking state [ 990.681608][T26251] bridge0: port 2(bridge_slave_1) entered disabled state [ 990.691170][T26251] bridge_slave_1: entered allmulticast mode [ 990.698887][T26251] bridge_slave_1: entered promiscuous mode [ 990.707673][T26261] delete_channel: no stack [ 990.763355][T26251] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 990.774108][T26277] netlink: 'syz.1.7347': attribute type 3 has an invalid length. [ 990.776644][T26251] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 990.797717][T26277] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7347'. [ 990.847395][T26279] delete_channel: no stack [ 991.084968][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.165940][T26251] team0: Port device team_slave_0 added [ 991.182402][T26251] team0: Port device team_slave_1 added [ 991.216386][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.298480][T26251] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 991.305738][T26251] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 991.349280][T26251] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 991.450559][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.474640][T26251] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 991.490075][T26251] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 991.534768][T26251] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 991.572189][T26293] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7353'. [ 991.747292][T25216] Bluetooth: hci0: command tx timeout [ 991.880054][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.994412][T26294] delete_channel: no stack [ 992.071533][T26251] hsr_slave_0: entered promiscuous mode [ 992.083601][T26251] hsr_slave_1: entered promiscuous mode [ 992.525116][ T12] tipc: Left network mode [ 993.282380][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.289207][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.301270][ T1283] eth1 selects TX queue 0, but real number of TX queues is 0 [ 993.504232][T26322] delete_channel: no stack [ 993.691009][T26326] netlink: 'syz.3.7360': attribute type 3 has an invalid length. [ 993.707826][T26326] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7360'. [ 993.837000][T25216] Bluetooth: hci0: command tx timeout [ 993.903490][T26251] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 993.985477][T26251] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 994.051354][T26251] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 994.064092][T26338] delete_channel: no stack [ 994.073378][T26251] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 994.554916][T26355] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7365'. [ 994.807207][ T12] hsr_slave_0: left promiscuous mode [ 994.814442][ T12] hsr_slave_1: left promiscuous mode [ 994.822124][ T12] bridge_slave_1: left allmulticast mode [ 994.828105][ T12] bridge_slave_1: left promiscuous mode [ 994.834002][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 994.844831][ T12] bridge_slave_0: left allmulticast mode [ 994.850709][ T12] bridge_slave_0: left promiscuous mode [ 994.861228][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 994.920334][ T12] veth1_macvtap: left allmulticast mode [ 994.926177][ T12] veth0_macvtap: left promiscuous mode [ 994.938215][ T12] veth1_vlan: left promiscuous mode [ 994.943600][ T12] veth0_vlan: left promiscuous mode [ 995.858051][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 995.903709][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 995.912346][T25216] Bluetooth: hci0: command tx timeout [ 996.172557][ T12] bond0 (unregistering): Released all slaves [ 996.308565][T26251] 8021q: adding VLAN 0 to HW filter on device bond0 [ 996.332868][T26251] 8021q: adding VLAN 0 to HW filter on device team0 [ 996.347431][T23396] bridge0: port 1(bridge_slave_0) entered blocking state [ 996.354551][T23396] bridge0: port 1(bridge_slave_0) entered forwarding state [ 996.400741][ T2883] bridge0: port 2(bridge_slave_1) entered blocking state [ 996.407895][ T2883] bridge0: port 2(bridge_slave_1) entered forwarding state [ 996.900624][T26379] netlink: 'syz.1.7371': attribute type 3 has an invalid length. [ 996.913219][T26379] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7371'. [ 997.015725][T26251] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 997.236563][T26251] veth0_vlan: entered promiscuous mode [ 997.311988][T26251] veth1_vlan: entered promiscuous mode [ 997.378924][T26385] syzkaller0: entered promiscuous mode [ 997.401930][T26385] syzkaller0: entered allmulticast mode [ 997.527553][T26390] delete_channel: no stack [ 997.542655][T26251] veth0_macvtap: entered promiscuous mode [ 997.591340][T26251] veth1_macvtap: entered promiscuous mode [ 997.986889][T25216] Bluetooth: hci0: command tx timeout [ 998.029806][T26381] mac80211_hwsim hwsim182 wlan1: entered allmulticast mode [ 998.120482][T26251] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 998.131265][T26251] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 998.144054][T26251] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 998.165064][T26251] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 998.176197][T26251] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 998.189063][T26251] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 998.232184][T26251] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.243919][T26251] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.253368][T26251] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.263801][T26251] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.466599][T16903] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 998.486373][T16903] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 998.566901][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 998.574767][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 998.691746][T26404] netlink: 'syz.2.7379': attribute type 3 has an invalid length. [ 998.719981][T26404] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7379'. [ 998.997403][T26409] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7380'. [ 999.051515][T26411] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7336'. [ 999.696256][T26420] delete_channel: no stack [ 999.800083][T26424] FAULT_INJECTION: forcing a failure. [ 999.800083][T26424] name failslab, interval 1, probability 0, space 0, times 0 [ 999.831887][T26424] CPU: 0 PID: 26424 Comm: syz.3.7384 Not tainted syzkaller #0 [ 999.839421][T26424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 999.849519][T26424] Call Trace: [ 999.852841][T26424] [ 999.855810][T26424] dump_stack_lvl+0x18c/0x250 [ 999.860538][T26424] ? show_regs_print_info+0x20/0x20 [ 999.865777][T26424] ? load_image+0x420/0x420 [ 999.870324][T26424] ? verify_lock_unused+0x140/0x140 [ 999.875555][T26424] ? perf_trace_lock_acquire+0x34f/0x410 [ 999.881239][T26424] should_fail_ex+0x39d/0x4d0 [ 999.885985][T26424] should_failslab+0x9/0x20 [ 999.890518][T26424] slab_pre_alloc_hook+0x59/0x310 [ 999.895591][T26424] kmem_cache_alloc+0x5a/0x2d0 [ 999.900390][T26424] ? skb_clone+0x1eb/0x370 [ 999.904846][T26424] skb_clone+0x1eb/0x370 [ 999.909122][T26424] __netlink_deliver_tap+0x41c/0x830 [ 999.914467][T26424] ? netlink_deliver_tap+0x2e/0x1b0 [ 999.919707][T26424] netlink_deliver_tap+0x19c/0x1b0 [ 999.924865][T26424] netlink_unicast+0x72c/0x8d0 [ 999.929688][T26424] netlink_sendmsg+0x8d0/0xbf0 [ 999.934507][T26424] ? netlink_getsockopt+0x590/0x590 [ 999.939746][T26424] ? aa_sock_msg_perm+0x94/0x150 [ 999.944728][T26424] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 999.950054][T26424] ? security_socket_sendmsg+0x80/0xa0 [ 999.955547][T26424] ? netlink_getsockopt+0x590/0x590 [ 999.960793][T26424] ____sys_sendmsg+0x5ba/0x960 [ 999.965608][T26424] ? __asan_memset+0x22/0x40 [ 999.970231][T26424] ? __sys_sendmsg_sock+0x30/0x30 [ 999.975296][T26424] ? __import_iovec+0x5f2/0x850 [ 999.980196][T26424] ? import_iovec+0x73/0xa0 [ 999.984741][T26424] ___sys_sendmsg+0x2a6/0x360 [ 999.989445][T26424] ? get_pid_task+0x20/0x1e0 [ 999.994162][T26424] ? __sys_sendmsg+0x2a0/0x2a0 [ 999.998996][T26424] ? __lock_acquire+0x7d40/0x7d40 [ 1000.004104][T26424] __se_sys_sendmsg+0x1c2/0x2b0 [ 1000.009003][T26424] ? __x64_sys_sendmsg+0x80/0x80 [ 1000.014005][T26424] ? lockdep_hardirqs_on+0x98/0x150 [ 1000.019254][T26424] do_syscall_64+0x55/0xa0 [ 1000.023696][T26424] ? clear_bhb_loop+0x40/0x90 [ 1000.028408][T26424] ? clear_bhb_loop+0x40/0x90 [ 1000.033131][T26424] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1000.039062][T26424] RIP: 0033:0x7f8b95f9cdd9 [ 1000.043509][T26424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1000.063156][T26424] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1000.071617][T26424] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 1000.079635][T26424] RDX: 0000000024044054 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1000.087635][T26424] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1000.095637][T26424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1000.103639][T26424] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1000.111679][T26424] [ 1000.772986][T26424] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7384'. [ 1000.960440][T26439] FAULT_INJECTION: forcing a failure. [ 1000.960440][T26439] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1000.986878][T26442] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7389'. [ 1000.996198][T26439] CPU: 1 PID: 26439 Comm: syz.2.7388 Not tainted syzkaller #0 [ 1001.003693][T26439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1001.013772][T26439] Call Trace: [ 1001.017050][T26439] [ 1001.019975][T26439] dump_stack_lvl+0x18c/0x250 [ 1001.024658][T26439] ? show_regs_print_info+0x20/0x20 [ 1001.029858][T26439] ? load_image+0x420/0x420 [ 1001.034534][T26439] ? __lock_acquire+0x7d40/0x7d40 [ 1001.039561][T26439] ? snprintf+0xe9/0x140 [ 1001.043804][T26439] should_fail_ex+0x39d/0x4d0 [ 1001.048482][T26439] _copy_to_user+0x2f/0xa0 [ 1001.052898][T26439] simple_read_from_buffer+0xe7/0x150 [ 1001.058279][T26439] proc_fail_nth_read+0x1e8/0x260 [ 1001.063301][T26439] ? proc_fault_inject_write+0x360/0x360 [ 1001.068933][T26439] ? fsnotify_perm+0x271/0x5e0 [ 1001.073696][T26439] ? proc_fault_inject_write+0x360/0x360 [ 1001.079322][T26439] vfs_read+0x28b/0x970 [ 1001.083478][T26439] ? kernel_read+0x1e0/0x1e0 [ 1001.088066][T26439] ? __fget_files+0x28/0x4b0 [ 1001.092652][T26439] ? __fget_files+0x28/0x4b0 [ 1001.097324][T26439] ? __fget_files+0x43d/0x4b0 [ 1001.102007][T26439] ? __fdget_pos+0x2a3/0x330 [ 1001.106590][T26439] ? ksys_read+0x75/0x260 [ 1001.110924][T26439] ksys_read+0x150/0x260 [ 1001.115167][T26439] ? vfs_write+0x990/0x990 [ 1001.119589][T26439] ? lockdep_hardirqs_on+0x98/0x150 [ 1001.124790][T26439] do_syscall_64+0x55/0xa0 [ 1001.129200][T26439] ? clear_bhb_loop+0x40/0x90 [ 1001.133875][T26439] ? clear_bhb_loop+0x40/0x90 [ 1001.138558][T26439] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1001.144450][T26439] RIP: 0033:0x7efe7fd5d60e [ 1001.148859][T26439] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1001.168464][T26439] RSP: 002b:00007efe80d14fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1001.176874][T26439] RAX: ffffffffffffffda RBX: 00007efe80d156c0 RCX: 00007efe7fd5d60e [ 1001.184847][T26439] RDX: 000000000000000f RSI: 00007efe80d150a0 RDI: 0000000000000005 [ 1001.192815][T26439] RBP: 00007efe80d15090 R08: 0000000000000000 R09: 0000000000000000 [ 1001.200786][T26439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1001.208755][T26439] R13: 00007efe80016038 R14: 00007efe80015fa0 R15: 00007ffe2524ff18 [ 1001.216739][T26439] [ 1001.361882][T26449] netlink: 'syz.1.7390': attribute type 3 has an invalid length. [ 1001.382752][T26449] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7390'. [ 1001.440007][T25216] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 1001.629225][T26451] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7391'. [ 1001.712900][T26458] delete_channel: no stack [ 1001.847645][T26465] netlink: 'syz.0.7396': attribute type 10 has an invalid length. [ 1002.120379][T26465] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1002.685444][T26479] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.7401'. [ 1002.703132][T26479] bridge_slave_1: default FDB implementation only supports local addresses [ 1002.899944][T26485] netlink: 'syz.0.7402': attribute type 21 has an invalid length. [ 1002.923896][T26485] netlink: 14548 bytes leftover after parsing attributes in process `syz.0.7402'. [ 1002.990386][T26489] netlink: 'syz.3.7405': attribute type 3 has an invalid length. [ 1003.000580][T26489] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7405'. [ 1003.084718][T25216] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1003.193584][T26493] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1003.207260][T26493] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1003.254727][T26493] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1003.332789][T26493] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1004.010028][T26494] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7406'. [ 1004.035496][T26498] mac80211_hwsim hwsim178 wlan1: entered allmulticast mode [ 1004.227524][T26506] FAULT_INJECTION: forcing a failure. [ 1004.227524][T26506] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1004.267975][T26506] CPU: 0 PID: 26506 Comm: syz.0.7410 Not tainted syzkaller #0 [ 1004.275493][T26506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1004.285564][T26506] Call Trace: [ 1004.288855][T26506] [ 1004.291799][T26506] dump_stack_lvl+0x18c/0x250 [ 1004.296512][T26506] ? show_regs_print_info+0x20/0x20 [ 1004.301733][T26506] ? load_image+0x420/0x420 [ 1004.306245][T26506] ? __lock_acquire+0x7d40/0x7d40 [ 1004.311274][T26506] ? snprintf+0xe9/0x140 [ 1004.315520][T26506] should_fail_ex+0x39d/0x4d0 [ 1004.320203][T26506] _copy_to_user+0x2f/0xa0 [ 1004.324615][T26506] simple_read_from_buffer+0xe7/0x150 [ 1004.329994][T26506] proc_fail_nth_read+0x1e8/0x260 [ 1004.335017][T26506] ? proc_fault_inject_write+0x360/0x360 [ 1004.340658][T26506] ? fsnotify_perm+0x271/0x5e0 [ 1004.345419][T26506] ? proc_fault_inject_write+0x360/0x360 [ 1004.351044][T26506] vfs_read+0x28b/0x970 [ 1004.355201][T26506] ? kernel_read+0x1e0/0x1e0 [ 1004.359788][T26506] ? __fget_files+0x28/0x4b0 [ 1004.364374][T26506] ? __fget_files+0x28/0x4b0 [ 1004.368955][T26506] ? __fget_files+0x43d/0x4b0 [ 1004.373671][T26506] ? __fdget_pos+0x2a3/0x330 [ 1004.378257][T26506] ? ksys_read+0x75/0x260 [ 1004.382588][T26506] ksys_read+0x150/0x260 [ 1004.386828][T26506] ? vfs_write+0x990/0x990 [ 1004.391243][T26506] do_syscall_64+0x55/0xa0 [ 1004.395650][T26506] ? clear_bhb_loop+0x40/0x90 [ 1004.400323][T26506] ? clear_bhb_loop+0x40/0x90 [ 1004.404994][T26506] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1004.410880][T26506] RIP: 0033:0x7f49f155d60e [ 1004.415287][T26506] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1004.434882][T26506] RSP: 002b:00007f49f23c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1004.443287][T26506] RAX: ffffffffffffffda RBX: 00007f49f23c86c0 RCX: 00007f49f155d60e [ 1004.451248][T26506] RDX: 000000000000000f RSI: 00007f49f23c80a0 RDI: 0000000000000007 [ 1004.459206][T26506] RBP: 00007f49f23c8090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.467163][T26506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1004.475121][T26506] R13: 00007f49f1816038 R14: 00007f49f1815fa0 R15: 00007ffd44ca26b8 [ 1004.483093][T26506] [ 1004.545314][T26511] netlink: 'syz.1.7413': attribute type 4 has an invalid length. [ 1004.566517][T26511] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7413'. [ 1004.579744][T26515] FAULT_INJECTION: forcing a failure. [ 1004.579744][T26515] name failslab, interval 1, probability 0, space 0, times 0 [ 1004.600287][T26515] CPU: 0 PID: 26515 Comm: syz.3.7414 Not tainted syzkaller #0 [ 1004.607782][T26515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1004.617849][T26515] Call Trace: [ 1004.621149][T26515] [ 1004.623609][T26511] .`: renamed from bond0 (while UP) [ 1004.624078][T26515] dump_stack_lvl+0x18c/0x250 [ 1004.633971][T26515] ? show_regs_print_info+0x20/0x20 [ 1004.639205][T26515] ? load_image+0x420/0x420 [ 1004.643737][T26515] ? __might_sleep+0xe0/0xe0 [ 1004.648355][T26515] ? __lock_acquire+0x7d40/0x7d40 [ 1004.653403][T26515] should_fail_ex+0x39d/0x4d0 [ 1004.658120][T26515] should_failslab+0x9/0x20 [ 1004.662655][T26515] slab_pre_alloc_hook+0x59/0x310 [ 1004.667700][T26515] ? apparmor_sk_alloc_security+0x77/0x100 [ 1004.673519][T26515] __kmem_cache_alloc_node+0x53/0x250 [ 1004.678914][T26515] ? apparmor_sk_alloc_security+0x77/0x100 [ 1004.684737][T26515] kmalloc_trace+0x2a/0xe0 [ 1004.689170][T26515] apparmor_sk_alloc_security+0x77/0x100 [ 1004.694818][T26515] security_sk_alloc+0x6e/0xa0 [ 1004.699602][T26515] sk_prot_alloc+0x101/0x210 [ 1004.704224][T26515] ? sk_alloc+0x24/0x360 [ 1004.708485][T26515] sk_alloc+0x3a/0x360 [ 1004.712570][T26515] ? bpf_ctx_init+0x163/0x1a0 [ 1004.717256][T26515] ? bpf_prog_test_run_skb+0x273/0x12b0 [ 1004.722814][T26515] bpf_prog_test_run_skb+0x3a5/0x12b0 [ 1004.728190][T26515] ? __fget_files+0x28/0x4b0 [ 1004.732788][T26515] ? __fget_files+0x28/0x4b0 [ 1004.737389][T26515] ? __fget_files+0x43d/0x4b0 [ 1004.742086][T26515] ? cpu_online+0x60/0x60 [ 1004.746424][T26515] bpf_prog_test_run+0x321/0x390 [ 1004.751371][T26515] __sys_bpf+0x49d/0x890 [ 1004.755629][T26515] ? bpf_link_show_fdinfo+0x390/0x390 [ 1004.761027][T26515] ? lock_chain_count+0x20/0x20 [ 1004.765889][T26515] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1004.771883][T26515] __x64_sys_bpf+0x7c/0x90 [ 1004.776312][T26515] do_syscall_64+0x55/0xa0 [ 1004.780736][T26515] ? clear_bhb_loop+0x40/0x90 [ 1004.785425][T26515] ? clear_bhb_loop+0x40/0x90 [ 1004.790110][T26515] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1004.796012][T26515] RIP: 0033:0x7f8b95f9cdd9 [ 1004.800436][T26515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1004.820050][T26515] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1004.828488][T26515] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 1004.836464][T26515] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1004.844442][T26515] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.852424][T26515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1004.860404][T26515] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1004.868405][T26515] [ 1004.988336][T26522] netlink: 'syz.2.7416': attribute type 3 has an invalid length. [ 1004.996287][T26522] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7416'. [ 1005.020323][T25216] Bluetooth: hci3: unexpected subevent 0x0e length: 150 > 15 [ 1005.235718][T26528] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1005.248672][T26528] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1005.265620][T26528] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1005.275902][T26528] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1005.626397][T26535] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7421'. [ 1005.916634][T26541] AþÿÙñÃÞ`N¾oqÊ: renamed from bond_slave_1 (while UP) [ 1006.047185][T26549] FAULT_INJECTION: forcing a failure. [ 1006.047185][T26549] name failslab, interval 1, probability 0, space 0, times 0 [ 1006.094845][T26549] CPU: 0 PID: 26549 Comm: syz.1.7425 Not tainted syzkaller #0 [ 1006.102362][T26549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1006.112443][T26549] Call Trace: [ 1006.115742][T26549] [ 1006.118691][T26549] dump_stack_lvl+0x18c/0x250 [ 1006.121805][T26552] netlink: 'syz.3.7427': attribute type 3 has an invalid length. [ 1006.123379][T26549] ? show_regs_print_info+0x20/0x20 [ 1006.131645][T26552] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7427'. [ 1006.136282][T26549] ? load_image+0x420/0x420 [ 1006.136311][T26549] ? __might_sleep+0xe0/0xe0 [ 1006.136333][T26549] ? __lock_acquire+0x7d40/0x7d40 [ 1006.136350][T26549] ? register_lock_class+0xc4/0x8a0 [ 1006.136374][T26549] should_fail_ex+0x39d/0x4d0 [ 1006.136402][T26549] should_failslab+0x9/0x20 [ 1006.136424][T26549] slab_pre_alloc_hook+0x59/0x310 [ 1006.136454][T26549] ? __lock_acquire+0x1347/0x7d40 [ 1006.136473][T26549] ? tcp_sendmsg_fastopen+0x1de/0x5d0 [ 1006.136498][T26549] __kmem_cache_alloc_node+0x53/0x250 [ 1006.136524][T26549] ? tcp_sendmsg_fastopen+0x1de/0x5d0 [ 1006.136547][T26549] kmalloc_trace+0x2a/0xe0 [ 1006.136570][T26549] tcp_sendmsg_fastopen+0x1de/0x5d0 [ 1006.136597][T26549] tcp_sendmsg_locked+0x4621/0x4bd0 [ 1006.136619][T26549] ? verify_lock_unused+0x140/0x140 [ 1006.136639][T26549] ? verify_lock_unused+0x140/0x140 [ 1006.136672][T26549] ? __might_sleep+0xe0/0xe0 [ 1006.230166][T26549] ? mark_lock+0x94/0x320 [ 1006.234501][T26549] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1006.240592][T26549] ? lock_chain_count+0x20/0x20 [ 1006.245489][T26549] ? tcp_set_state+0x680/0x680 [ 1006.250276][T26549] tcp_sendmsg+0x2f/0x50 [ 1006.254523][T26549] ? inet_send_prepare+0x260/0x260 [ 1006.259633][T26549] ____sys_sendmsg+0x5ba/0x960 [ 1006.264397][T26549] ? __lock_acquire+0x7d40/0x7d40 [ 1006.269424][T26549] ? __asan_memset+0x22/0x40 [ 1006.274068][T26549] ? __sys_sendmsg_sock+0x30/0x30 [ 1006.279083][T26549] ? __import_iovec+0x3fa/0x850 [ 1006.283932][T26549] ? import_iovec+0x73/0xa0 [ 1006.288435][T26549] ___sys_sendmsg+0x2a6/0x360 [ 1006.293103][T26549] ? get_pid_task+0x20/0x1e0 [ 1006.297692][T26549] ? __sys_sendmsg+0x2a0/0x2a0 [ 1006.302467][T26549] ? __lock_acquire+0x7d40/0x7d40 [ 1006.307504][T26549] __se_sys_sendmsg+0x1c2/0x2b0 [ 1006.312351][T26549] ? __x64_sys_sendmsg+0x80/0x80 [ 1006.317289][T26549] ? lockdep_hardirqs_on+0x98/0x150 [ 1006.322482][T26549] do_syscall_64+0x55/0xa0 [ 1006.326893][T26549] ? clear_bhb_loop+0x40/0x90 [ 1006.331566][T26549] ? clear_bhb_loop+0x40/0x90 [ 1006.336258][T26549] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1006.342148][T26549] RIP: 0033:0x7f9348f9cdd9 [ 1006.346557][T26549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1006.366254][T26549] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1006.374688][T26549] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1006.382654][T26549] RDX: 000000003000c085 RSI: 0000200000000080 RDI: 0000000000000005 [ 1006.390616][T26549] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1006.398584][T26549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1006.406549][T26549] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1006.414804][T26549] [ 1006.467438][T26557] mac80211_hwsim hwsim186 wlan1: entered allmulticast mode [ 1006.852965][T26553] syzkaller0: entered promiscuous mode [ 1006.860219][T26553] syzkaller0: entered allmulticast mode [ 1009.128742][T26571] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7431'. [ 1009.313142][T26590] netlink: 'syz.3.7437': attribute type 3 has an invalid length. [ 1009.321835][T26590] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7437'. [ 1009.334819][T26588] netlink: 'syz.2.7436': attribute type 10 has an invalid length. [ 1009.359714][T25216] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1009.372906][T26588] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1009.425505][T26592] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.7438'. [ 1009.447034][T26592] bridge_slave_1: default FDB implementation only supports local addresses [ 1009.994411][T26609] syzkaller0: entered promiscuous mode [ 1009.999979][T26609] syzkaller0: entered allmulticast mode [ 1010.143851][T26617] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7447'. [ 1010.330736][T26619] netlink: 'syz.1.7448': attribute type 3 has an invalid length. [ 1010.347781][T26619] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7448'. [ 1010.415908][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1013.715062][T26649] netlink: 'syz.3.7457': attribute type 3 has an invalid length. [ 1013.722962][T26649] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7457'. [ 1013.781499][T26648] netlink: 'syz.1.7458': attribute type 10 has an invalid length. [ 1013.790649][T26648] mac80211_hwsim hwsim182 wlan1: left allmulticast mode [ 1013.798379][T26648] wlan1: mtu less than device minimum [ 1013.803786][T26648] .`: (slave wlan1): Error -22 calling dev_set_mtu [ 1013.814655][T25216] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1014.070704][T26652] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7459'. [ 1014.262130][T26658] netlink: 'syz.1.7462': attribute type 10 has an invalid length. [ 1014.272725][T26658] wlan1: mtu less than device minimum [ 1014.278294][T26658] .`: (slave wlan1): Error -22 calling dev_set_mtu [ 1016.595322][T26672] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7467'. [ 1016.606106][T26680] netlink: 'syz.2.7470': attribute type 10 has an invalid length. [ 1016.726974][T26687] netlink: 'syz.2.7480': attribute type 10 has an invalid length. [ 1016.814368][T26690] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7472'. [ 1016.863021][T26692] netlink: 'syz.2.7473': attribute type 10 has an invalid length. [ 1017.250012][T26706] netlink: 'syz.2.7478': attribute type 10 has an invalid length. [ 1017.338492][T26710] netlink: 'syz.3.7481': attribute type 3 has an invalid length. [ 1017.346353][T26710] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7481'. [ 1017.425236][T25216] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1017.619437][T26711] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7479'. [ 1017.733148][T26715] netlink: 'syz.1.7482': attribute type 10 has an invalid length. [ 1017.752957][T26715] wlan1: mtu less than device minimum [ 1017.771284][T26715] .`: (slave wlan1): Error -22 calling dev_set_mtu [ 1017.889698][T26719] syzkaller0: entered promiscuous mode [ 1017.895214][T26719] syzkaller0: entered allmulticast mode [ 1017.907657][T26722] FAULT_INJECTION: forcing a failure. [ 1017.907657][T26722] name failslab, interval 1, probability 0, space 0, times 0 [ 1017.921891][T26722] CPU: 0 PID: 26722 Comm: syz.1.7486 Not tainted syzkaller #0 [ 1017.929388][T26722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1017.939446][T26722] Call Trace: [ 1017.942750][T26722] [ 1017.945719][T26722] dump_stack_lvl+0x18c/0x250 [ 1017.950432][T26722] ? show_regs_print_info+0x20/0x20 [ 1017.955651][T26722] ? load_image+0x420/0x420 [ 1017.960159][T26722] ? __might_sleep+0xe0/0xe0 [ 1017.964741][T26722] ? __lock_acquire+0x7d40/0x7d40 [ 1017.969766][T26722] should_fail_ex+0x39d/0x4d0 [ 1017.974454][T26722] should_failslab+0x9/0x20 [ 1017.978973][T26722] slab_pre_alloc_hook+0x59/0x310 [ 1017.983999][T26722] ? kvmalloc_node+0x70/0x180 [ 1017.988671][T26722] ? kvmalloc_node+0x70/0x180 [ 1017.993342][T26722] __kmem_cache_alloc_node+0x53/0x250 [ 1017.998717][T26722] ? kvmalloc_node+0x70/0x180 [ 1018.003395][T26722] __kmalloc_node+0xa4/0x230 [ 1018.007985][T26722] kvmalloc_node+0x70/0x180 [ 1018.012485][T26722] alloc_netdev_mqs+0x8cd/0x1040 [ 1018.017432][T26722] ip6_tnl_locate+0x684/0x830 [ 1018.022121][T26722] ? ip6_tnl_parm_from_user+0x340/0x340 [ 1018.027656][T26722] ? __might_fault+0xaa/0x120 [ 1018.032322][T26722] ? __might_fault+0xc6/0x120 [ 1018.036991][T26722] ? __might_fault+0xaa/0x120 [ 1018.041659][T26722] ? ip6_tnl_siocdevprivate+0x5eb/0xab0 [ 1018.047204][T26722] ip6_tnl_siocdevprivate+0x619/0xab0 [ 1018.052577][T26722] ? ip6_tnl_start_xmit+0x11c0/0x11c0 [ 1018.057948][T26722] ? dev_ioctl+0x83c/0x1140 [ 1018.062457][T26722] ? dev_ifsioc+0x958/0xc40 [ 1018.066953][T26722] dev_ioctl+0x84c/0x1140 [ 1018.071282][T26722] sock_ioctl+0x74c/0x7e0 [ 1018.075607][T26722] ? sock_poll+0x3e0/0x3e0 [ 1018.080029][T26722] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1018.084957][T26722] ? security_file_ioctl+0x80/0xa0 [ 1018.090067][T26722] ? sock_poll+0x3e0/0x3e0 [ 1018.094483][T26722] __se_sys_ioctl+0xfd/0x170 [ 1018.099074][T26722] do_syscall_64+0x55/0xa0 [ 1018.103480][T26722] ? clear_bhb_loop+0x40/0x90 [ 1018.108154][T26722] ? clear_bhb_loop+0x40/0x90 [ 1018.112824][T26722] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1018.118710][T26722] RIP: 0033:0x7f9348f9cdd9 [ 1018.123116][T26722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1018.142718][T26722] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1018.151126][T26722] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1018.159089][T26722] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 0000000000000008 [ 1018.167055][T26722] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1018.175019][T26722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1018.182984][T26722] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1018.190965][T26722] [ 1018.199801][T26724] netlink: 'syz.0.7485': attribute type 10 has an invalid length. [ 1018.210228][T26724] mac80211_hwsim hwsim186 wlan1: left allmulticast mode [ 1020.010101][T26736] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7491'. [ 1020.073931][T26743] netlink: 'syz.0.7492': attribute type 3 has an invalid length. [ 1020.104445][T26743] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7492'. [ 1020.159480][T26745] netlink: 'syz.3.7493': attribute type 10 has an invalid length. [ 1020.170643][T25216] Bluetooth: hci0: unexpected subevent 0x0e length: 150 > 15 [ 1020.178438][T26745] mac80211_hwsim hwsim178 wlan1: left allmulticast mode [ 1020.191679][T26745] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1020.244246][T26748] netlink: 'syz.1.7494': attribute type 3 has an invalid length. [ 1020.273226][T26748] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7494'. [ 1020.411992][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1020.905360][T26768] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7501'. [ 1020.933256][T25216] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1021.340375][T26780] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7503'. [ 1021.477564][T26786] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7505'. [ 1021.532677][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1021.727739][T26793] validate_nla: 2 callbacks suppressed [ 1021.727755][T26793] netlink: 'syz.3.7508': attribute type 3 has an invalid length. [ 1021.755240][T26793] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7508'. [ 1021.829590][T25216] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1021.889647][T26801] netlink: 'syz.0.7512': attribute type 3 has an invalid length. [ 1021.900054][T26801] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7512'. [ 1022.051768][T26806] FAULT_INJECTION: forcing a failure. [ 1022.051768][T26806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1022.068939][T26806] CPU: 1 PID: 26806 Comm: syz.3.7515 Not tainted syzkaller #0 [ 1022.076441][T26806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1022.086512][T26806] Call Trace: [ 1022.089810][T26806] [ 1022.092771][T26806] dump_stack_lvl+0x18c/0x250 [ 1022.097485][T26806] ? show_regs_print_info+0x20/0x20 [ 1022.102710][T26806] ? load_image+0x420/0x420 [ 1022.107239][T26806] ? __lock_acquire+0x7d40/0x7d40 [ 1022.112291][T26806] ? snprintf+0xe9/0x140 [ 1022.116566][T26806] should_fail_ex+0x39d/0x4d0 [ 1022.121279][T26806] _copy_to_user+0x2f/0xa0 [ 1022.125728][T26806] simple_read_from_buffer+0xe7/0x150 [ 1022.131138][T26806] proc_fail_nth_read+0x1e8/0x260 [ 1022.136195][T26806] ? proc_fault_inject_write+0x360/0x360 [ 1022.141857][T26806] ? fsnotify_perm+0x271/0x5e0 [ 1022.146646][T26806] ? proc_fault_inject_write+0x360/0x360 [ 1022.152290][T26806] vfs_read+0x28b/0x970 [ 1022.156457][T26806] ? kernel_read+0x1e0/0x1e0 [ 1022.161089][T26806] ? __fget_files+0x28/0x4b0 [ 1022.165681][T26806] ? __fget_files+0x28/0x4b0 [ 1022.170269][T26806] ? __fget_files+0x43d/0x4b0 [ 1022.174951][T26806] ? __fdget_pos+0x2a3/0x330 [ 1022.179537][T26806] ? ksys_read+0x75/0x260 [ 1022.183867][T26806] ksys_read+0x150/0x260 [ 1022.188107][T26806] ? vfs_write+0x990/0x990 [ 1022.192523][T26806] ? lockdep_hardirqs_on+0x98/0x150 [ 1022.197720][T26806] do_syscall_64+0x55/0xa0 [ 1022.202125][T26806] ? clear_bhb_loop+0x40/0x90 [ 1022.206799][T26806] ? clear_bhb_loop+0x40/0x90 [ 1022.211469][T26806] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1022.217384][T26806] RIP: 0033:0x7f8b95f5d60e [ 1022.221793][T26806] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1022.241393][T26806] RSP: 002b:00007f8b96efafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1022.249803][T26806] RAX: ffffffffffffffda RBX: 00007f8b96efb6c0 RCX: 00007f8b95f5d60e [ 1022.257779][T26806] RDX: 000000000000000f RSI: 00007f8b96efb0a0 RDI: 0000000000000005 [ 1022.265743][T26806] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1022.273708][T26806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1022.281676][T26806] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1022.289657][T26806] [ 1022.455390][T26809] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7516'. [ 1022.699603][T26818] netlink: 'syz.0.7519': attribute type 10 has an invalid length. [ 1022.759640][T26821] netlink: 'syz.2.7520': attribute type 10 has an invalid length. [ 1022.835627][T26820] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7518'. [ 1023.039389][T26831] netlink: 'syz.2.7523': attribute type 3 has an invalid length. [ 1023.075819][T26831] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7523'. [ 1023.148268][T25216] Bluetooth: hci3: unexpected subevent 0x0e length: 150 > 15 [ 1023.168503][T26835] netlink: 'syz.0.7525': attribute type 3 has an invalid length. [ 1023.176456][T26835] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7525'. [ 1023.541260][T26849] netlink: 'syz.0.7530': attribute type 10 has an invalid length. [ 1023.588006][T26847] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7529'. [ 1024.065410][T26870] netlink: 'syz.2.7538': attribute type 3 has an invalid length. [ 1024.083562][T26870] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7538'. [ 1024.233234][T26874] netlink: 'syz.3.7540': attribute type 10 has an invalid length. [ 1024.358320][T26876] netlink: 'syz.2.7541': attribute type 10 has an invalid length. [ 1024.375126][T26880] FAULT_INJECTION: forcing a failure. [ 1024.375126][T26880] name failslab, interval 1, probability 0, space 0, times 0 [ 1024.404836][T26880] CPU: 1 PID: 26880 Comm: syz.0.7543 Not tainted syzkaller #0 [ 1024.412367][T26880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1024.422449][T26880] Call Trace: [ 1024.425749][T26880] [ 1024.428700][T26880] dump_stack_lvl+0x18c/0x250 [ 1024.433413][T26880] ? show_regs_print_info+0x20/0x20 [ 1024.438639][T26880] ? load_image+0x420/0x420 [ 1024.443170][T26880] ? __might_sleep+0xe0/0xe0 [ 1024.447792][T26880] ? __lock_acquire+0x7d40/0x7d40 [ 1024.452844][T26880] should_fail_ex+0x39d/0x4d0 [ 1024.457556][T26880] should_failslab+0x9/0x20 [ 1024.462085][T26880] slab_pre_alloc_hook+0x59/0x310 [ 1024.467151][T26880] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1024.472895][T26880] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1024.478631][T26880] __kmem_cache_alloc_node+0x53/0x250 [ 1024.484031][T26880] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1024.489793][T26880] __kmalloc+0xa4/0x230 [ 1024.493974][T26880] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1024.499552][T26880] tomoyo_path_number_perm+0x248/0x620 [ 1024.505050][T26880] ? tomoyo_path_number_perm+0x217/0x620 [ 1024.510715][T26880] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1024.516205][T26880] ? ksys_write+0x1c4/0x260 [ 1024.520859][T26880] ? __fget_files+0x28/0x4b0 [ 1024.525474][T26880] ? __fget_files+0x28/0x4b0 [ 1024.530087][T26880] security_file_ioctl+0x70/0xa0 [ 1024.535041][T26880] __se_sys_ioctl+0x48/0x170 [ 1024.539634][T26880] do_syscall_64+0x55/0xa0 [ 1024.544045][T26880] ? clear_bhb_loop+0x40/0x90 [ 1024.548720][T26880] ? clear_bhb_loop+0x40/0x90 [ 1024.553393][T26880] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1024.559288][T26880] RIP: 0033:0x7f49f159cdd9 [ 1024.563875][T26880] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1024.583483][T26880] RSP: 002b:00007f49f23c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1024.591894][T26880] RAX: ffffffffffffffda RBX: 00007f49f1815fa0 RCX: 00007f49f159cdd9 [ 1024.599857][T26880] RDX: 0000200000000080 RSI: 0000000000008983 RDI: 000000000000000a [ 1024.607819][T26880] RBP: 00007f49f23c8090 R08: 0000000000000000 R09: 0000000000000000 [ 1024.615802][T26880] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1024.623779][T26880] R13: 00007f49f1816038 R14: 00007f49f1815fa0 R15: 00007ffd44ca26b8 [ 1024.631775][T26880] [ 1024.651292][T26880] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1024.738365][T26889] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7542'. [ 1024.928373][T26898] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7549'. [ 1024.982248][T25216] Bluetooth: hci3: unexpected subevent 0x0e length: 150 > 15 [ 1025.474163][T26918] tc_dump_action: action bad kind [ 1025.649960][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1026.075649][T25216] Bluetooth: hci1: Malformed Event: 0x2f [ 1026.498778][T26961] wlan1: mtu less than device minimum [ 1026.504274][T26961] .`: (slave wlan1): Error -22 calling dev_set_mtu [ 1026.800710][T26970] __nla_validate_parse: 9 callbacks suppressed [ 1026.800755][T26970] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7577'. [ 1027.103080][T26980] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1027.121932][T26980] .` (unregistering): (slave 5AþÿÙñÃÞ`N¾oqÊ): Releasing backup interface [ 1027.135241][T26980] .` (unregistering): Released all slaves [ 1027.468824][T26990] validate_nla: 6 callbacks suppressed [ 1027.468841][T26990] netlink: 'syz.3.7584': attribute type 10 has an invalid length. [ 1027.572252][T26997] FAULT_INJECTION: forcing a failure. [ 1027.572252][T26997] name failslab, interval 1, probability 0, space 0, times 0 [ 1027.603706][T26997] CPU: 1 PID: 26997 Comm: syz.3.7587 Not tainted syzkaller #0 [ 1027.611224][T26997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1027.621315][T26997] Call Trace: [ 1027.624613][T26997] [ 1027.627562][T26997] dump_stack_lvl+0x18c/0x250 [ 1027.632264][T26997] ? show_regs_print_info+0x20/0x20 [ 1027.637482][T26997] ? load_image+0x420/0x420 [ 1027.642021][T26997] ? __might_sleep+0xe0/0xe0 [ 1027.646633][T26997] ? __lock_acquire+0x7d40/0x7d40 [ 1027.651680][T26997] should_fail_ex+0x39d/0x4d0 [ 1027.656380][T26997] should_failslab+0x9/0x20 [ 1027.660910][T26997] slab_pre_alloc_hook+0x59/0x310 [ 1027.665963][T26997] ? kvmalloc_node+0x70/0x180 [ 1027.670659][T26997] ? kvmalloc_node+0x70/0x180 [ 1027.675359][T26997] __kmem_cache_alloc_node+0x53/0x250 [ 1027.680760][T26997] ? kvmalloc_node+0x70/0x180 [ 1027.685461][T26997] __kmalloc_node+0xa4/0x230 [ 1027.690088][T26997] kvmalloc_node+0x70/0x180 [ 1027.694615][T26997] alloc_netdev_mqs+0x8cd/0x1040 [ 1027.699587][T26997] ip6gre_tunnel_locate+0x227/0x5d0 [ 1027.704814][T26997] ? apparmor_capable+0x137/0x1a0 [ 1027.709856][T26997] ? ip6gre_tnl_change+0x920/0x920 [ 1027.714974][T26997] ? __asan_memcpy+0x40/0x70 [ 1027.719569][T26997] ? ip6gre_tunnel_siocdevprivate+0x521/0x740 [ 1027.725647][T26997] ip6gre_tunnel_siocdevprivate+0x54e/0x740 [ 1027.731551][T26997] ? ip6gre_tunnel_init+0x150/0x150 [ 1027.736754][T26997] ? __mutex_lock+0x315/0xcc0 [ 1027.741436][T26997] ? dev_ioctl+0x83c/0x1140 [ 1027.745952][T26997] ? dev_ifsioc+0x958/0xc40 [ 1027.750465][T26997] dev_ioctl+0x84c/0x1140 [ 1027.754813][T26997] sock_ioctl+0x74c/0x7e0 [ 1027.759184][T26997] ? sock_poll+0x3e0/0x3e0 [ 1027.763607][T26997] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1027.768548][T26997] ? security_file_ioctl+0x80/0xa0 [ 1027.773667][T26997] ? sock_poll+0x3e0/0x3e0 [ 1027.778351][T26997] __se_sys_ioctl+0xfd/0x170 [ 1027.782949][T26997] do_syscall_64+0x55/0xa0 [ 1027.787365][T26997] ? clear_bhb_loop+0x40/0x90 [ 1027.792042][T26997] ? clear_bhb_loop+0x40/0x90 [ 1027.796721][T26997] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1027.802619][T26997] RIP: 0033:0x7f8b95f9cdd9 [ 1027.807030][T26997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1027.826635][T26997] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1027.835047][T26997] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 1027.843017][T26997] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 0000000000000004 [ 1027.850983][T26997] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1027.858954][T26997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1027.866922][T26997] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1027.874901][T26997] [ 1028.109833][T27004] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7589'. [ 1028.146404][T27009] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7590'. [ 1029.294087][T27047] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7604'. [ 1029.308900][T27049] netlink: 'syz.1.7606': attribute type 3 has an invalid length. [ 1029.316671][T27049] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7606'. [ 1029.385187][T27055] netlink: 'syz.3.7608': attribute type 21 has an invalid length. [ 1029.404469][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1029.412580][T27055] netlink: 'syz.3.7608': attribute type 6 has an invalid length. [ 1029.432576][T27055] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7608'. [ 1029.701880][T27060] IPv6: pim6reg1: Disabled Multicast RS [ 1030.462801][T27071] delete_channel: no stack [ 1030.660763][T27091] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.7618'. [ 1030.701728][T27092] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7617'. [ 1030.819453][T27095] netlink: 'syz.1.7619': attribute type 3 has an invalid length. [ 1030.831704][T27095] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7619'. [ 1030.870727][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1031.109362][T25216] Bluetooth: hci1: unexpected subevent 0x01 length: 150 > 18 [ 1031.368852][T27106] delete_channel: no stack [ 1031.537603][T27114] FAULT_INJECTION: forcing a failure. [ 1031.537603][T27114] name failslab, interval 1, probability 0, space 0, times 0 [ 1031.554326][T27114] CPU: 0 PID: 27114 Comm: syz.2.7627 Not tainted syzkaller #0 [ 1031.561859][T27114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1031.571957][T27114] Call Trace: [ 1031.575275][T27114] [ 1031.578248][T27114] dump_stack_lvl+0x18c/0x250 [ 1031.582992][T27114] ? show_regs_print_info+0x20/0x20 [ 1031.588250][T27114] ? load_image+0x420/0x420 [ 1031.592819][T27114] ? __might_sleep+0xe0/0xe0 [ 1031.597508][T27114] ? __lock_acquire+0x7d40/0x7d40 [ 1031.602602][T27114] should_fail_ex+0x39d/0x4d0 [ 1031.607349][T27114] should_failslab+0x9/0x20 [ 1031.611897][T27114] slab_pre_alloc_hook+0x59/0x310 [ 1031.616961][T27114] ? mutex_lock_nested+0x20/0x20 [ 1031.621945][T27114] ? bpf_xdp_link_attach+0x1ae/0x730 [ 1031.627237][T27114] __kmem_cache_alloc_node+0x53/0x250 [ 1031.632641][T27114] ? bpf_xdp_link_attach+0x1ae/0x730 [ 1031.637969][T27114] kmalloc_trace+0x2a/0xe0 [ 1031.642444][T27114] bpf_xdp_link_attach+0x1ae/0x730 [ 1031.647602][T27114] ? dev_xdp_prog+0x100/0x100 [ 1031.652303][T27114] ? __lock_acquire+0x7d40/0x7d40 [ 1031.657378][T27114] ? __fget_files+0x43d/0x4b0 [ 1031.662099][T27114] ? attach_type_to_prog_type+0x330/0x3a0 [ 1031.667838][T27114] ? bpf_prog_attach_check_attach_type+0x2d8/0x440 [ 1031.674361][T27114] link_create+0x3ff/0x720 [ 1031.678807][T27114] __sys_bpf+0x4d7/0x890 [ 1031.683069][T27114] ? bpf_link_show_fdinfo+0x390/0x390 [ 1031.688492][T27114] ? lock_chain_count+0x20/0x20 [ 1031.693379][T27114] __x64_sys_bpf+0x7c/0x90 [ 1031.697808][T27114] do_syscall_64+0x55/0xa0 [ 1031.702235][T27114] ? clear_bhb_loop+0x40/0x90 [ 1031.706929][T27114] ? clear_bhb_loop+0x40/0x90 [ 1031.711626][T27114] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1031.717530][T27114] RIP: 0033:0x7efe7fd9cdd9 [ 1031.721957][T27114] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1031.741570][T27114] RSP: 002b:00007efe80d15028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1031.749998][T27114] RAX: ffffffffffffffda RBX: 00007efe80015fa0 RCX: 00007efe7fd9cdd9 [ 1031.758077][T27114] RDX: 0000000000000040 RSI: 0000200000000240 RDI: 000000000000001c [ 1031.766066][T27114] RBP: 00007efe80d15090 R08: 0000000000000000 R09: 0000000000000000 [ 1031.774056][T27114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1031.782041][T27114] R13: 00007efe80016038 R14: 00007efe80015fa0 R15: 00007ffe2524ff18 [ 1031.790064][T27114] [ 1031.819367][T27118] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7629'. [ 1031.881726][T27114] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1031.899431][T27114] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1031.914719][T27114] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1031.926833][T27114] bond0 (unregistering): Released all slaves [ 1032.065685][T27127] netlink: 'syz.0.7630': attribute type 13 has an invalid length. [ 1032.075180][T27127] netlink: 152 bytes leftover after parsing attributes in process `syz.0.7630'. [ 1032.086372][T27127] syz_tun: refused to change device tx_queue_len [ 1032.093233][T27127] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1032.095412][T27129] netlink: 'syz.1.7631': attribute type 3 has an invalid length. [ 1032.129368][T27129] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7631'. [ 1032.202649][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1032.820784][T27137] delete_channel: no stack [ 1033.188269][T25216] Bluetooth: hci1: command tx timeout [ 1033.770909][T27152] netlink: 'syz.0.7638': attribute type 5 has an invalid length. [ 1033.782194][T27152] netlink: 176 bytes leftover after parsing attributes in process `syz.0.7638'. [ 1033.792183][T27152] FAULT_INJECTION: forcing a failure. [ 1033.792183][T27152] name failslab, interval 1, probability 0, space 0, times 0 [ 1033.810953][T27152] CPU: 0 PID: 27152 Comm: syz.0.7638 Not tainted syzkaller #0 [ 1033.818478][T27152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1033.828581][T27152] Call Trace: [ 1033.831904][T27152] [ 1033.834879][T27152] dump_stack_lvl+0x18c/0x250 [ 1033.839639][T27152] ? show_regs_print_info+0x20/0x20 [ 1033.844896][T27152] ? load_image+0x420/0x420 [ 1033.849440][T27152] ? __lock_acquire+0x7d40/0x7d40 [ 1033.854486][T27152] should_fail_ex+0x39d/0x4d0 [ 1033.859218][T27152] should_failslab+0x9/0x20 [ 1033.863772][T27152] slab_pre_alloc_hook+0x59/0x310 [ 1033.868848][T27152] ? __lock_acquire+0x7d40/0x7d40 [ 1033.873913][T27152] ? mark_lock+0x94/0x320 [ 1033.878294][T27152] ? fib_create_info+0xa61/0x2460 [ 1033.883367][T27152] ? fib_create_info+0xa61/0x2460 [ 1033.888439][T27152] __kmem_cache_alloc_node+0x53/0x250 [ 1033.893877][T27152] ? fib_create_info+0xa61/0x2460 [ 1033.898941][T27152] __kmalloc+0xa4/0x230 [ 1033.903162][T27152] fib_create_info+0xa61/0x2460 [ 1033.908067][T27152] ? _raw_spin_unlock+0x40/0x40 [ 1033.912967][T27152] ? pcpu_alloc+0x11db/0x1860 [ 1033.917678][T27152] fib_table_insert+0xc6/0x1b20 [ 1033.922590][T27152] ? fib_trie_table+0x138/0x1c0 [ 1033.927469][T27152] ? fib_new_table+0x27f/0x2d0 [ 1033.932266][T27152] inet_rtm_newroute+0x14b/0x240 [ 1033.937221][T27152] ? __mutex_lock+0x4f9/0xcc0 [ 1033.941921][T27152] ? rcu_read_unlock+0xa0/0xa0 [ 1033.946759][T27152] ? rtnetlink_rcv_msg+0x221/0xfa0 [ 1033.951891][T27152] ? rtnetlink_rcv_msg+0x221/0xfa0 [ 1033.957017][T27152] ? rcu_read_unlock+0xa0/0xa0 [ 1033.961795][T27152] rtnetlink_rcv_msg+0x869/0xfa0 [ 1033.966779][T27152] ? lockdep_hardirqs_on+0x98/0x150 [ 1033.972015][T27152] ? rtnetlink_bind+0x80/0x80 [ 1033.976718][T27152] ? perf_trace_preemptirq_template+0xac/0x330 [ 1033.982914][T27152] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1033.988929][T27152] ? lock_chain_count+0x20/0x20 [ 1033.993809][T27152] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1033.999198][T27152] ? lockdep_hardirqs_on+0x98/0x150 [ 1034.004418][T27152] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1034.009804][T27152] ? _local_bh_enable+0xa0/0xa0 [ 1034.014688][T27152] ? __dev_queue_xmit+0x265/0x3660 [ 1034.019815][T27152] ? __dev_queue_xmit+0x265/0x3660 [ 1034.024951][T27152] ? __dev_queue_xmit+0x1b2c/0x3660 [ 1034.030206][T27152] ? __dev_queue_xmit+0x265/0x3660 [ 1034.035367][T27152] ? ref_tracker_free+0x690/0x840 [ 1034.040437][T27152] netlink_rcv_skb+0x241/0x4d0 [ 1034.045224][T27152] ? rtnetlink_bind+0x80/0x80 [ 1034.050010][T27152] ? netlink_ack+0x1180/0x1180 [ 1034.054829][T27152] ? __lock_acquire+0x7d40/0x7d40 [ 1034.059896][T27152] ? netlink_deliver_tap+0x2e/0x1b0 [ 1034.065135][T27152] netlink_unicast+0x751/0x8d0 [ 1034.069963][T27152] netlink_sendmsg+0x8d0/0xbf0 [ 1034.074775][T27152] ? netlink_getsockopt+0x590/0x590 [ 1034.080003][T27152] ? aa_sock_msg_perm+0x94/0x150 [ 1034.084965][T27152] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1034.090264][T27152] ? security_socket_sendmsg+0x80/0xa0 [ 1034.095735][T27152] ? netlink_getsockopt+0x590/0x590 [ 1034.100962][T27152] ____sys_sendmsg+0x5ba/0x960 [ 1034.105764][T27152] ? __asan_memset+0x22/0x40 [ 1034.110377][T27152] ? __sys_sendmsg_sock+0x30/0x30 [ 1034.115409][T27152] ? __import_iovec+0x5f2/0x850 [ 1034.120305][T27152] ? import_iovec+0x73/0xa0 [ 1034.124848][T27152] ___sys_sendmsg+0x2a6/0x360 [ 1034.129543][T27152] ? get_pid_task+0x20/0x1e0 [ 1034.134171][T27152] ? __sys_sendmsg+0x2a0/0x2a0 [ 1034.139012][T27152] ? __lock_acquire+0x7d40/0x7d40 [ 1034.144126][T27152] __se_sys_sendmsg+0x1c2/0x2b0 [ 1034.149007][T27152] ? __x64_sys_sendmsg+0x80/0x80 [ 1034.154010][T27152] ? lockdep_hardirqs_on+0x98/0x150 [ 1034.159238][T27152] do_syscall_64+0x55/0xa0 [ 1034.163663][T27152] ? clear_bhb_loop+0x40/0x90 [ 1034.168357][T27152] ? clear_bhb_loop+0x40/0x90 [ 1034.173055][T27152] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1034.178964][T27152] RIP: 0033:0x7f49f159cdd9 [ 1034.183407][T27152] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1034.203037][T27152] RSP: 002b:00007f49f23c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1034.211471][T27152] RAX: ffffffffffffffda RBX: 00007f49f1815fa0 RCX: 00007f49f159cdd9 [ 1034.219458][T27152] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1034.227444][T27152] RBP: 00007f49f23c8090 R08: 0000000000000000 R09: 0000000000000000 [ 1034.235425][T27152] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.243405][T27152] R13: 00007f49f1816038 R14: 00007f49f1815fa0 R15: 00007ffd44ca26b8 [ 1034.251456][T27152] [ 1034.275212][T27159] netlink: 'syz.1.7642': attribute type 39 has an invalid length. [ 1034.292396][T27159] veth0_macvtap: left promiscuous mode [ 1034.300165][T27159] FAULT_INJECTION: forcing a failure. [ 1034.300165][T27159] name failslab, interval 1, probability 0, space 0, times 0 [ 1034.313523][T27159] CPU: 1 PID: 27159 Comm: syz.1.7642 Not tainted syzkaller #0 [ 1034.321013][T27159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1034.331080][T27159] Call Trace: [ 1034.334376][T27159] [ 1034.337324][T27159] dump_stack_lvl+0x18c/0x250 [ 1034.342033][T27159] ? show_regs_print_info+0x20/0x20 [ 1034.347352][T27159] ? load_image+0x420/0x420 [ 1034.351899][T27159] should_fail_ex+0x39d/0x4d0 [ 1034.356613][T27159] should_failslab+0x9/0x20 [ 1034.361135][T27159] slab_pre_alloc_hook+0x59/0x310 [ 1034.366186][T27159] kmem_cache_alloc_node+0x60/0x320 [ 1034.371399][T27159] ? __alloc_skb+0x103/0x2c0 [ 1034.375991][T27159] __alloc_skb+0x103/0x2c0 [ 1034.380401][T27159] rtmsg_ifinfo_build_skb+0x8c/0x260 [ 1034.385687][T27159] rtmsg_ifinfo+0x8c/0x1a0 [ 1034.390102][T27159] __dev_notify_flags+0xf3/0x310 [ 1034.395041][T27159] ? __dev_change_flags+0x6a0/0x6a0 [ 1034.400235][T27159] ? __dev_change_flags+0x4d4/0x6a0 [ 1034.405428][T27159] ? preempt_count_add+0x91/0x1a0 [ 1034.410452][T27159] ? vprintk_emit+0x53d/0x610 [ 1034.415122][T27159] ? dev_get_flags+0x1c0/0x1c0 [ 1034.419881][T27159] ? printk_sprint+0x460/0x460 [ 1034.424640][T27159] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1034.430528][T27159] ? _raw_spin_unlock+0x40/0x40 [ 1034.435379][T27159] dev_change_flags+0xe8/0x1a0 [ 1034.440147][T27159] do_setlink+0xc58/0x4130 [ 1034.444577][T27159] ? arch_stack_walk+0x160/0x190 [ 1034.449529][T27159] ? load_image+0x420/0x420 [ 1034.454054][T27159] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 1034.460265][T27159] ? stack_trace_save+0xaa/0x100 [ 1034.465226][T27159] ? __nla_validate_parse+0x2522/0x2ea0 [ 1034.470801][T27159] ? __nla_validate+0x50/0x50 [ 1034.475499][T27159] ? validate_linkmsg+0x719/0x910 [ 1034.480530][T27159] rtnl_newlink+0x17da/0x20a0 [ 1034.485216][T27159] ? rtnl_newlink+0x4b1/0x20a0 [ 1034.489997][T27159] ? rtnl_setlink+0x4e0/0x4e0 [ 1034.494668][T27159] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1034.500824][T27159] ? rcu_is_watching+0x15/0xb0 [ 1034.505613][T27159] ? trace_contention_end+0x39/0xe0 [ 1034.510823][T27159] ? __mutex_lock+0x315/0xcc0 [ 1034.515528][T27159] ? rtnetlink_rcv_msg+0x221/0xfa0 [ 1034.520641][T27159] ? rtnetlink_rcv_msg+0x221/0xfa0 [ 1034.525751][T27159] ? rtnl_setlink+0x4e0/0x4e0 [ 1034.530418][T27159] rtnetlink_rcv_msg+0x869/0xfa0 [ 1034.535401][T27159] ? lockdep_hardirqs_on+0x98/0x150 [ 1034.540600][T27159] ? rtnetlink_bind+0x80/0x80 [ 1034.545276][T27159] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1034.551251][T27159] ? lock_chain_count+0x20/0x20 [ 1034.556096][T27159] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1034.561469][T27159] ? lockdep_hardirqs_on+0x98/0x150 [ 1034.566663][T27159] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1034.572047][T27159] ? _local_bh_enable+0xa0/0xa0 [ 1034.576915][T27159] ? __dev_queue_xmit+0x265/0x3660 [ 1034.582026][T27159] ? __dev_queue_xmit+0x265/0x3660 [ 1034.587137][T27159] ? __dev_queue_xmit+0x1b2c/0x3660 [ 1034.592348][T27159] ? __dev_queue_xmit+0x265/0x3660 [ 1034.597470][T27159] ? ref_tracker_free+0x690/0x840 [ 1034.602505][T27159] netlink_rcv_skb+0x241/0x4d0 [ 1034.607282][T27159] ? rtnetlink_bind+0x80/0x80 [ 1034.611958][T27159] ? netlink_ack+0x1180/0x1180 [ 1034.616737][T27159] ? __lock_acquire+0x7d40/0x7d40 [ 1034.621769][T27159] ? netlink_deliver_tap+0x2e/0x1b0 [ 1034.626977][T27159] netlink_unicast+0x751/0x8d0 [ 1034.631755][T27159] netlink_sendmsg+0x8d0/0xbf0 [ 1034.636524][T27159] ? netlink_getsockopt+0x590/0x590 [ 1034.641724][T27159] ? aa_sock_msg_perm+0x94/0x150 [ 1034.646667][T27159] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1034.651953][T27159] ? security_socket_sendmsg+0x80/0xa0 [ 1034.657402][T27159] ? netlink_getsockopt+0x590/0x590 [ 1034.662598][T27159] ____sys_sendmsg+0x5ba/0x960 [ 1034.667374][T27159] ? __asan_memset+0x22/0x40 [ 1034.671979][T27159] ? __sys_sendmsg_sock+0x30/0x30 [ 1034.677014][T27159] ? __import_iovec+0x5f2/0x850 [ 1034.681874][T27159] ? import_iovec+0x73/0xa0 [ 1034.686381][T27159] ___sys_sendmsg+0x2a6/0x360 [ 1034.691065][T27159] ? get_pid_task+0x20/0x1e0 [ 1034.695677][T27159] ? __sys_sendmsg+0x2a0/0x2a0 [ 1034.700455][T27159] ? __lock_acquire+0x7d40/0x7d40 [ 1034.705495][T27159] __se_sys_sendmsg+0x1c2/0x2b0 [ 1034.710345][T27159] ? __x64_sys_sendmsg+0x80/0x80 [ 1034.715285][T27159] ? lockdep_hardirqs_on+0x98/0x150 [ 1034.720478][T27159] do_syscall_64+0x55/0xa0 [ 1034.724884][T27159] ? clear_bhb_loop+0x40/0x90 [ 1034.729557][T27159] ? clear_bhb_loop+0x40/0x90 [ 1034.734231][T27159] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1034.740120][T27159] RIP: 0033:0x7f9348f9cdd9 [ 1034.744525][T27159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1034.764129][T27159] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1034.772538][T27159] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1034.780505][T27159] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000003 [ 1034.788473][T27159] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1034.796437][T27159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.804400][T27159] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1034.812375][T27159] [ 1034.835789][T27155] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7639'. [ 1034.897557][T27163] netlink: 'syz.0.7644': attribute type 3 has an invalid length. [ 1034.926912][T27163] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7644'. [ 1034.977132][T27165] netlink: 'syz.1.7645': attribute type 5 has an invalid length. [ 1034.985200][T27165] netlink: 176 bytes leftover after parsing attributes in process `syz.1.7645'. [ 1035.303837][T27169] delete_channel: no stack [ 1036.541686][T27184] delete_channel: no stack [ 1036.639881][T27192] netlink: 'syz.1.7656': attribute type 3 has an invalid length. [ 1036.649800][T27192] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7656'. [ 1036.817177][T27198] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7658'. [ 1036.971375][T27193] delete_channel: no stack [ 1037.533429][T27210] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7662'. [ 1038.684995][T27227] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7666'. [ 1038.748715][T27217] delete_channel: no stack [ 1038.865940][T27232] netlink: 'syz.3.7668': attribute type 3 has an invalid length. [ 1038.880588][T27232] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7668'. [ 1039.028499][T27233] delete_channel: no stack [ 1039.424192][T27250] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7673'. [ 1039.442760][T27249] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7672'. [ 1039.791028][T27261] netlink: 'syz.3.7676': attribute type 10 has an invalid length. [ 1040.000781][T27267] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7677'. [ 1040.215983][T27270] netlink: 'syz.3.7680': attribute type 3 has an invalid length. [ 1040.238310][T27270] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7680'. [ 1040.314369][T27268] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7679'. [ 1040.818827][T27271] delete_channel: no stack [ 1040.953887][T27277] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7682'. [ 1041.762610][T27292] netlink: 'syz.0.7688': attribute type 10 has an invalid length. [ 1042.016611][T27300] netlink: 'syz.2.7690': attribute type 3 has an invalid length. [ 1042.024481][T27300] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7690'. [ 1042.073141][T27297] delete_channel: no stack [ 1042.382871][T27305] delete_channel: no stack [ 1042.591375][T27319] __nla_validate_parse: 1 callbacks suppressed [ 1042.591412][T27319] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7694'. [ 1042.619871][T27320] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7697'. [ 1042.870228][T27330] netlink: 'syz.2.7700': attribute type 10 has an invalid length. [ 1042.893439][T27327] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7698'. [ 1043.257423][T27333] team_slave_0: left promiscuous mode [ 1043.265627][T27333] team_slave_0: left allmulticast mode [ 1043.323418][T27333] team0: Port device team_slave_0 removed [ 1043.323956][T27336] netlink: 'syz.0.7703': attribute type 3 has an invalid length. [ 1043.337206][T27333] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1043.373535][T27336] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7703'. [ 1043.514501][T25216] Bluetooth: hci0: unexpected subevent 0x0e length: 150 > 15 [ 1044.005300][T27347] delete_channel: no stack [ 1044.027737][T27360] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7710'. [ 1044.075909][T27362] netlink: 'syz.0.7712': attribute type 10 has an invalid length. [ 1044.185588][T27366] netlink: 'syz.0.7714': attribute type 39 has an invalid length. [ 1044.201075][T27366] veth0_macvtap: left promiscuous mode [ 1044.316282][T27371] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7713'. [ 1044.337764][T27367] delete_channel: no stack [ 1044.581482][T27378] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7715'. [ 1045.222766][T27393] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7722'. [ 1045.241360][T27395] netlink: 'syz.0.7723': attribute type 3 has an invalid length. [ 1045.255577][T27395] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7723'. [ 1045.301529][T27397] netlink: 'syz.2.7724': attribute type 10 has an invalid length. [ 1045.308969][T25216] Bluetooth: hci0: unexpected subevent 0x0e length: 150 > 15 [ 1045.419382][T27403] tap0: tun_chr_ioctl cmd 35108 [ 1045.992347][T27400] delete_channel: no stack [ 1046.167992][T27417] netlink: 'syz.1.7730': attribute type 13 has an invalid length. [ 1046.175866][T27417] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7730'. [ 1046.192134][T27417] syz_tun: refused to change device tx_queue_len [ 1046.206151][T27417] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1046.791171][T27436] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1046.797672][T27436] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1047.161204][T27434] syzkaller0: entered promiscuous mode [ 1047.167214][T27434] syzkaller0: entered allmulticast mode [ 1048.926892][T27455] netlink: 'syz.0.7743': attribute type 39 has an invalid length. [ 1048.959529][T27453] netlink: 'syz.2.7742': attribute type 10 has an invalid length. [ 1049.225121][T27464] __nla_validate_parse: 3 callbacks suppressed [ 1049.225274][T27464] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7746'. [ 1049.324895][T27465] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.7747'. [ 1049.351712][T27465] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1049.408822][T27468] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7748'. [ 1049.836313][T27475] syzkaller0: entered promiscuous mode [ 1049.842451][T27475] syzkaller0: entered allmulticast mode [ 1050.114399][T19426] Bluetooth: hci2: Malformed LE Event: 0x0b [ 1051.608597][T27495] netlink: 'syz.1.7755': attribute type 10 has an invalid length. [ 1051.666907][T19426] Bluetooth: hci1: command 0x0406 tx timeout [ 1051.822622][T27507] netlink: 'syz.0.7766': attribute type 10 has an invalid length. [ 1051.868134][T27513] FAULT_INJECTION: forcing a failure. [ 1051.868134][T27513] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1051.898307][T27513] CPU: 1 PID: 27513 Comm: syz.2.7759 Not tainted syzkaller #0 [ 1051.905822][T27513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1051.915893][T27513] Call Trace: [ 1051.919176][T27513] [ 1051.922103][T27513] dump_stack_lvl+0x18c/0x250 [ 1051.926786][T27513] ? show_regs_print_info+0x20/0x20 [ 1051.932002][T27513] ? load_image+0x420/0x420 [ 1051.936504][T27513] ? __lock_acquire+0x7d40/0x7d40 [ 1051.941529][T27513] ? snprintf+0xe9/0x140 [ 1051.945766][T27513] should_fail_ex+0x39d/0x4d0 [ 1051.950447][T27513] _copy_to_user+0x2f/0xa0 [ 1051.954865][T27513] simple_read_from_buffer+0xe7/0x150 [ 1051.960237][T27513] proc_fail_nth_read+0x1e8/0x260 [ 1051.965259][T27513] ? proc_fault_inject_write+0x360/0x360 [ 1051.970894][T27513] ? fsnotify_perm+0x271/0x5e0 [ 1051.975655][T27513] ? proc_fault_inject_write+0x360/0x360 [ 1051.981287][T27513] vfs_read+0x28b/0x970 [ 1051.985453][T27513] ? kernel_read+0x1e0/0x1e0 [ 1051.990038][T27513] ? __fget_files+0x28/0x4b0 [ 1051.994624][T27513] ? __fget_files+0x28/0x4b0 [ 1051.999210][T27513] ? __fget_files+0x43d/0x4b0 [ 1052.003888][T27513] ? __fdget_pos+0x2a3/0x330 [ 1052.008478][T27513] ? ksys_read+0x75/0x260 [ 1052.012804][T27513] ksys_read+0x150/0x260 [ 1052.017047][T27513] ? vfs_write+0x990/0x990 [ 1052.021459][T27513] ? lockdep_hardirqs_on+0x98/0x150 [ 1052.026653][T27513] do_syscall_64+0x55/0xa0 [ 1052.031060][T27513] ? clear_bhb_loop+0x40/0x90 [ 1052.035735][T27513] ? clear_bhb_loop+0x40/0x90 [ 1052.040410][T27513] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1052.046298][T27513] RIP: 0033:0x7efe7fd5d60e [ 1052.050716][T27513] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1052.070315][T27513] RSP: 002b:00007efe80cf3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1052.078728][T27513] RAX: ffffffffffffffda RBX: 00007efe80cf46c0 RCX: 00007efe7fd5d60e [ 1052.086699][T27513] RDX: 000000000000000f RSI: 00007efe80cf40a0 RDI: 0000000000000006 [ 1052.094672][T27513] RBP: 00007efe80cf4090 R08: 0000000000000000 R09: 0000000000000000 [ 1052.102641][T27513] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1052.110605][T27513] R13: 00007efe80016128 R14: 00007efe80016090 R15: 00007ffe2524ff18 [ 1052.118591][T27513] [ 1052.295217][T27519] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7761'. [ 1052.317580][T27512] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7758'. [ 1052.392075][T27520] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7762'. [ 1052.746842][T27533] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.7767'. [ 1052.756117][T27533] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1052.805762][T27535] syzkaller0: entered promiscuous mode [ 1052.811409][T27535] syzkaller0: entered allmulticast mode [ 1052.822611][T27537] netlink: 'syz.3.7770': attribute type 10 has an invalid length. [ 1054.711649][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.719720][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.954589][T27551] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7774'. [ 1055.096761][T27563] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7777'. [ 1055.252692][T27565] netlink: 'syz.0.7780': attribute type 10 has an invalid length. [ 1055.364653][T27566] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7778'. [ 1055.797723][T27576] netlink: 'syz.0.7791': attribute type 10 has an invalid length. [ 1055.886803][T27581] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7783'. [ 1056.059987][T27586] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7785'. [ 1056.166341][T27588] syzkaller0: entered promiscuous mode [ 1056.172267][T27588] syzkaller0: entered allmulticast mode [ 1057.998349][T27599] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7790'. [ 1058.143458][T27609] netlink: 'syz.3.7795': attribute type 10 has an invalid length. [ 1058.618373][T27618] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7799'. [ 1059.055490][T27631] syzkaller0: entered promiscuous mode [ 1059.068002][T27631] syzkaller0: entered allmulticast mode [ 1059.132637][T27638] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7806'. [ 1059.396629][T27623] delete_channel: no stack [ 1061.831007][T27665] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7814'. [ 1062.039323][T27673] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7816'. [ 1062.133615][T27678] netlink: 'syz.2.7817': attribute type 3 has an invalid length. [ 1062.141866][T27678] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7817'. [ 1062.312534][T27684] netlink: 'syz.1.7819': attribute type 10 has an invalid length. [ 1062.629880][T27690] syzkaller0: entered promiscuous mode [ 1062.640358][T27690] syzkaller0: entered allmulticast mode [ 1064.621343][T27706] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7826'. [ 1064.631052][T27712] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7828'. [ 1065.271826][T27735] netlink: 'syz.2.7835': attribute type 10 has an invalid length. [ 1065.916761][T27744] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.7837'. [ 1065.925944][T27744] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1066.206394][T27750] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7840'. [ 1066.743423][T27774] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7850'. [ 1066.781472][T27773] netlink: 'syz.0.7851': attribute type 10 has an invalid length. [ 1067.199616][T27790] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.7854'. [ 1067.268920][T27790] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1067.428976][T27796] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7856'. [ 1067.857708][T27800] FAULT_INJECTION: forcing a failure. [ 1067.857708][T27800] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1067.876447][T27800] CPU: 1 PID: 27800 Comm: syz.2.7857 Not tainted syzkaller #0 [ 1067.883976][T27800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1067.894067][T27800] Call Trace: [ 1067.897383][T27800] [ 1067.900355][T27800] dump_stack_lvl+0x18c/0x250 [ 1067.905105][T27800] ? show_regs_print_info+0x20/0x20 [ 1067.910365][T27800] ? load_image+0x420/0x420 [ 1067.914951][T27800] ? __might_fault+0xaa/0x120 [ 1067.919766][T27800] ? __lock_acquire+0x7d40/0x7d40 [ 1067.924864][T27800] should_fail_ex+0x39d/0x4d0 [ 1067.929581][T27800] _copy_from_iter+0x1d9/0x12e0 [ 1067.934451][T27800] ? slab_post_alloc_hook+0x8a/0x4b0 [ 1067.939752][T27800] ? __virt_addr_valid+0x18c/0x540 [ 1067.944886][T27800] ? __lock_acquire+0x7d40/0x7d40 [ 1067.949929][T27800] ? rcu_is_watching+0x15/0xb0 [ 1067.954719][T27800] ? copyout_mc+0x70/0x70 [ 1067.959073][T27800] ? __virt_addr_valid+0x18c/0x540 [ 1067.964206][T27800] ? __virt_addr_valid+0x18c/0x540 [ 1067.969339][T27800] ? __virt_addr_valid+0x469/0x540 [ 1067.974475][T27800] ? __check_object_size+0x506/0xa20 [ 1067.979778][T27800] netlink_sendmsg+0x76b/0xbf0 [ 1067.984567][T27800] ? perf_trace_lock+0x304/0x3b0 [ 1067.989525][T27800] ? netlink_getsockopt+0x590/0x590 [ 1067.994745][T27800] ? aa_sock_msg_perm+0x94/0x150 [ 1067.999714][T27800] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1068.005024][T27800] ? security_socket_sendmsg+0x80/0xa0 [ 1068.010494][T27800] ? netlink_getsockopt+0x590/0x590 [ 1068.015693][T27800] ____sys_sendmsg+0x5ba/0x960 [ 1068.020457][T27800] ? __asan_memset+0x22/0x40 [ 1068.025046][T27800] ? __sys_sendmsg_sock+0x30/0x30 [ 1068.030070][T27800] ? __import_iovec+0x5f2/0x850 [ 1068.035431][T27800] ? import_iovec+0x73/0xa0 [ 1068.039936][T27800] ___sys_sendmsg+0x2a6/0x360 [ 1068.044613][T27800] ? __sys_sendmsg+0x2a0/0x2a0 [ 1068.049387][T27800] ? trace_call_bpf+0xc3/0x6c0 [ 1068.054193][T27800] __se_sys_sendmsg+0x1c2/0x2b0 [ 1068.059058][T27800] ? __x64_sys_sendmsg+0x80/0x80 [ 1068.064013][T27800] ? lockdep_hardirqs_on+0x98/0x150 [ 1068.069210][T27800] do_syscall_64+0x55/0xa0 [ 1068.073624][T27800] ? clear_bhb_loop+0x40/0x90 [ 1068.078302][T27800] ? clear_bhb_loop+0x40/0x90 [ 1068.082977][T27800] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1068.088863][T27800] RIP: 0033:0x7efe7fd9cdd9 [ 1068.093277][T27800] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1068.112878][T27800] RSP: 002b:00007efe80d15028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1068.121288][T27800] RAX: ffffffffffffffda RBX: 00007efe80015fa0 RCX: 00007efe7fd9cdd9 [ 1068.129251][T27800] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1068.137220][T27800] RBP: 00007efe80d15090 R08: 0000000000000000 R09: 0000000000000000 [ 1068.145186][T27800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1068.153158][T27800] R13: 00007efe80016038 R14: 00007efe80015fa0 R15: 00007ffe2524ff18 [ 1068.161172][T27800] [ 1068.883007][T27813] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7861'. [ 1069.056297][T27822] netlink: 'syz.1.7866': attribute type 10 has an invalid length. [ 1069.281879][T27836] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.7869'. [ 1069.299120][T27836] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1069.314694][T27833] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7867'. [ 1069.668949][T27847] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.7870'. [ 1069.697194][T27847] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1070.261709][T27856] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7875'. [ 1070.694363][T27874] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 1070.701335][T27872] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7880'. [ 1071.056555][T27880] syzkaller0: entered promiscuous mode [ 1071.087578][T27880] syzkaller0: entered allmulticast mode [ 1073.500126][T27898] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7888'. [ 1073.897779][T27909] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7892'. [ 1074.341567][T27922] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1074.713874][T27933] syzkaller0: entered promiscuous mode [ 1074.719699][T27933] syzkaller0: entered allmulticast mode [ 1076.589966][T27952] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7906'. [ 1076.784782][T27961] netlink: 'syz.0.7909': attribute type 10 has an invalid length. [ 1076.965255][T27959] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7907'. [ 1076.987396][T27965] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7910'. [ 1077.761051][T27994] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7918'. [ 1077.951457][T27996] syzkaller0: entered promiscuous mode [ 1077.957779][T27996] syzkaller0: entered allmulticast mode [ 1079.971820][T28005] netlink: 'syz.0.7922': attribute type 10 has an invalid length. [ 1079.989081][T28013] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7925'. [ 1080.153746][T28019] team0: Port device team_slave_0 removed [ 1080.163205][T28019] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1080.545747][T28033] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7930'. [ 1080.949070][T28045] netlink: 'syz.2.7935': attribute type 10 has an invalid length. [ 1081.073470][T28049] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1081.227845][T28051] syzkaller0: entered promiscuous mode [ 1081.236800][T28051] syzkaller0: entered allmulticast mode [ 1083.084628][T28057] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1083.120944][T28065] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7941'. [ 1083.335515][T28074] netlink: 'syz.3.7945': attribute type 10 has an invalid length. [ 1083.359553][T28075] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7944'. [ 1083.582967][T28084] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1083.750513][T28090] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1083.839532][T25216] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1084.713624][T28094] delete_channel: no stack [ 1084.903497][T28107] netlink: 'syz.2.7955': attribute type 10 has an invalid length. [ 1085.075546][T28116] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7957'. [ 1085.221603][T28119] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1085.306845][T28124] netlink: 'syz.2.7961': attribute type 21 has an invalid length. [ 1085.349063][T28124] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.7961'. [ 1085.359400][T28124] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 1085.587046][T25216] Bluetooth: hci0: unexpected event 0x0f length: 151 > 4 [ 1085.654741][T28133] team0: Port device C removed [ 1085.668009][T28133] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1086.291676][T28134] delete_channel: no stack [ 1086.367006][T28141] syzkaller0: entered promiscuous mode [ 1086.388108][T28141] syzkaller0: entered allmulticast mode [ 1088.089617][T28151] netlink: 'syz.2.7968': attribute type 10 has an invalid length. [ 1088.097771][T28154] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7969'. [ 1088.149810][T28158] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7970'. [ 1088.300786][T25216] Bluetooth: hci0: unexpected subevent 0x0e length: 150 > 15 [ 1088.393297][T28168] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1088.773217][T25216] Bluetooth: hci3: unexpected subevent 0x0e length: 150 > 15 [ 1089.138351][T28175] delete_channel: no stack [ 1089.215624][T28189] syzkaller0: entered promiscuous mode [ 1089.221255][T28189] syzkaller0: entered allmulticast mode [ 1089.676488][T25216] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 1089.686257][T25216] Bluetooth: hci0: Injecting HCI hardware error event [ 1089.708573][T25216] Bluetooth: hci0: hardware error 0x00 [ 1091.043084][T28191] netlink: 'syz.1.7981': attribute type 10 has an invalid length. [ 1091.055185][T28195] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7982'. [ 1091.074261][T28198] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7983'. [ 1091.327704][T28203] team0: Port device team_slave_0 removed [ 1091.334216][T28203] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1091.628404][T19426] Bluetooth: hci2: unexpected subevent 0x0e length: 150 > 15 [ 1091.827369][T25216] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1092.104835][T28221] delete_channel: no stack [ 1092.176064][T28233] netlink: 'syz.3.7992': attribute type 10 has an invalid length. [ 1092.246571][T28235] syzkaller0: entered promiscuous mode [ 1092.252275][T28235] syzkaller0: entered allmulticast mode [ 1094.078127][T28241] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7995'. [ 1094.087436][T28244] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7996'. [ 1094.101082][T28246] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1094.352103][T28255] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8001'. [ 1094.534543][T25216] Bluetooth: hci1: unexpected subevent 0x0e length: 150 > 15 [ 1094.982331][T28261] delete_channel: no stack [ 1095.031062][T28267] netlink: 'syz.1.8005': attribute type 10 has an invalid length. [ 1095.121780][T28271] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1095.209421][T28273] syzkaller0: entered promiscuous mode [ 1095.216759][T28273] syzkaller0: entered allmulticast mode [ 1097.292720][T28298] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8017'. [ 1097.422668][T28308] FAULT_INJECTION: forcing a failure. [ 1097.422668][T28308] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1097.436295][T28308] CPU: 0 PID: 28308 Comm: syz.1.8021 Not tainted syzkaller #0 [ 1097.443785][T28308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1097.453849][T28308] Call Trace: [ 1097.457126][T28308] [ 1097.460050][T28308] dump_stack_lvl+0x18c/0x250 [ 1097.464732][T28308] ? show_regs_print_info+0x20/0x20 [ 1097.469927][T28308] ? load_image+0x420/0x420 [ 1097.474431][T28308] ? __might_fault+0xaa/0x120 [ 1097.479100][T28308] ? __lock_acquire+0x7d40/0x7d40 [ 1097.484153][T28308] should_fail_ex+0x39d/0x4d0 [ 1097.488835][T28308] _copy_to_user+0x2f/0xa0 [ 1097.493246][T28308] bpf_test_finish+0x19f/0x650 [ 1097.498008][T28308] ? convert___skb_to_skb+0x590/0x590 [ 1097.503372][T28308] ? convert_skb_to___skb+0x420/0x420 [ 1097.508744][T28308] bpf_prog_test_run_skb+0xcc3/0x12b0 [ 1097.514150][T28308] ? cpu_online+0x60/0x60 [ 1097.518492][T28308] bpf_prog_test_run+0x321/0x390 [ 1097.523439][T28308] __sys_bpf+0x49d/0x890 [ 1097.527682][T28308] ? bpf_link_show_fdinfo+0x390/0x390 [ 1097.533060][T28308] ? lock_chain_count+0x20/0x20 [ 1097.537920][T28308] __x64_sys_bpf+0x7c/0x90 [ 1097.542345][T28308] do_syscall_64+0x55/0xa0 [ 1097.546763][T28308] ? clear_bhb_loop+0x40/0x90 [ 1097.551495][T28308] ? clear_bhb_loop+0x40/0x90 [ 1097.556187][T28308] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1097.562078][T28308] RIP: 0033:0x7f9348f9cdd9 [ 1097.566488][T28308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1097.586109][T28308] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1097.594527][T28308] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1097.602492][T28308] RDX: 0000000000000028 RSI: 0000200000000080 RDI: 000000000000000a [ 1097.610572][T28308] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1097.618541][T28308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1097.626506][T28308] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1097.634486][T28308] [ 1097.655760][T28303] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1098.084207][T28326] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8028'. [ 1098.310688][T28341] FAULT_INJECTION: forcing a failure. [ 1098.310688][T28341] name failslab, interval 1, probability 0, space 0, times 0 [ 1098.333950][T28341] CPU: 0 PID: 28341 Comm: syz.0.8033 Not tainted syzkaller #0 [ 1098.341460][T28341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1098.351538][T28341] Call Trace: [ 1098.354836][T28341] [ 1098.357782][T28341] dump_stack_lvl+0x18c/0x250 [ 1098.362494][T28341] ? show_regs_print_info+0x20/0x20 [ 1098.367721][T28341] ? load_image+0x420/0x420 [ 1098.372245][T28341] ? __might_sleep+0xe0/0xe0 [ 1098.376839][T28341] ? __lock_acquire+0x7d40/0x7d40 [ 1098.381875][T28341] should_fail_ex+0x39d/0x4d0 [ 1098.386548][T28341] should_failslab+0x9/0x20 [ 1098.391048][T28341] slab_pre_alloc_hook+0x59/0x310 [ 1098.396084][T28341] ? __inet_diag_dump_start+0x8b/0x9f0 [ 1098.401582][T28341] __kmem_cache_alloc_node+0x53/0x250 [ 1098.406965][T28341] ? __inet_diag_dump_start+0x8b/0x9f0 [ 1098.412440][T28341] kmalloc_trace+0x2a/0xe0 [ 1098.416857][T28341] __inet_diag_dump_start+0x8b/0x9f0 [ 1098.422138][T28341] ? netlink_lookup+0x30/0x200 [ 1098.426908][T28341] ? netlink_lookup+0x30/0x200 [ 1098.431698][T28341] __netlink_dump_start+0x4a9/0x810 [ 1098.436928][T28341] inet_diag_rcv_msg_compat+0x215/0x440 [ 1098.442502][T28341] ? __inet_diag_dump+0x380/0x380 [ 1098.447553][T28341] ? sock_diag_rcv_msg+0xd1/0x600 [ 1098.452571][T28341] ? inet_diag_rcv_msg_compat+0x440/0x440 [ 1098.458292][T28341] ? inet_diag_dump_start_compat+0x20/0x20 [ 1098.464106][T28341] ? inet_diag_dump+0x50/0x50 [ 1098.468783][T28341] ? __inet_diag_dump+0x380/0x380 [ 1098.473798][T28341] sock_diag_rcv_msg+0x3d8/0x600 [ 1098.478750][T28341] netlink_rcv_skb+0x241/0x4d0 [ 1098.483522][T28341] ? sock_diag_bind+0xb0/0xb0 [ 1098.488206][T28341] ? netlink_ack+0x1180/0x1180 [ 1098.492964][T28341] ? __lock_acquire+0x7d40/0x7d40 [ 1098.497984][T28341] ? netlink_deliver_tap+0x2e/0x1b0 [ 1098.503209][T28341] sock_diag_rcv+0x2a/0x40 [ 1098.507625][T28341] netlink_unicast+0x751/0x8d0 [ 1098.512391][T28341] netlink_sendmsg+0x8d0/0xbf0 [ 1098.517159][T28341] ? netlink_getsockopt+0x590/0x590 [ 1098.522355][T28341] ? aa_sock_msg_perm+0x94/0x150 [ 1098.527296][T28341] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1098.532592][T28341] ? security_socket_sendmsg+0x80/0xa0 [ 1098.538042][T28341] ? netlink_getsockopt+0x590/0x590 [ 1098.543236][T28341] ____sys_sendmsg+0x5ba/0x960 [ 1098.548010][T28341] ? __asan_memset+0x22/0x40 [ 1098.552594][T28341] ? __sys_sendmsg_sock+0x30/0x30 [ 1098.557615][T28341] ? __import_iovec+0x5f2/0x850 [ 1098.562491][T28341] ? import_iovec+0x73/0xa0 [ 1098.567011][T28341] ___sys_sendmsg+0x2a6/0x360 [ 1098.571688][T28341] ? get_pid_task+0x20/0x1e0 [ 1098.576273][T28341] ? __sys_sendmsg+0x2a0/0x2a0 [ 1098.581045][T28341] ? __lock_acquire+0x7d40/0x7d40 [ 1098.586073][T28341] __se_sys_sendmsg+0x1c2/0x2b0 [ 1098.590921][T28341] ? __x64_sys_sendmsg+0x80/0x80 [ 1098.595869][T28341] ? lockdep_hardirqs_on+0x98/0x150 [ 1098.601079][T28341] do_syscall_64+0x55/0xa0 [ 1098.605491][T28341] ? clear_bhb_loop+0x40/0x90 [ 1098.610170][T28341] ? clear_bhb_loop+0x40/0x90 [ 1098.614845][T28341] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1098.620742][T28341] RIP: 0033:0x7f49f159cdd9 [ 1098.625176][T28341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1098.644802][T28341] RSP: 002b:00007f49f23c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1098.653243][T28341] RAX: ffffffffffffffda RBX: 00007f49f1815fa0 RCX: 00007f49f159cdd9 [ 1098.661232][T28341] RDX: 0000000000000004 RSI: 0000200000000380 RDI: 0000000000000003 [ 1098.669387][T28341] RBP: 00007f49f23c8090 R08: 0000000000000000 R09: 0000000000000000 [ 1098.677374][T28341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1098.685355][T28341] R13: 00007f49f1816038 R14: 00007f49f1815fa0 R15: 00007ffd44ca26b8 [ 1098.693325][T28341] [ 1098.740923][T28339] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8032'. [ 1098.975667][T28355] netlink: 'syz.1.8038': attribute type 25 has an invalid length. [ 1098.984975][T28355] netlink: 'syz.1.8038': attribute type 1 has an invalid length. [ 1098.993018][T28355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1099.157199][T28364] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8040'. [ 1099.206539][T28368] FAULT_INJECTION: forcing a failure. [ 1099.206539][T28368] name failslab, interval 1, probability 0, space 0, times 0 [ 1099.236902][T28368] CPU: 0 PID: 28368 Comm: syz.3.8043 Not tainted syzkaller #0 [ 1099.244416][T28368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1099.254491][T28368] Call Trace: [ 1099.257788][T28368] [ 1099.260731][T28368] dump_stack_lvl+0x18c/0x250 [ 1099.265415][T28368] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1099.271568][T28368] ? show_regs_print_info+0x20/0x20 [ 1099.276763][T28368] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1099.282921][T28368] should_fail_ex+0x39d/0x4d0 [ 1099.287601][T28368] should_failslab+0x9/0x20 [ 1099.292099][T28368] slab_pre_alloc_hook+0x59/0x310 [ 1099.297147][T28368] ? bpf_prog_test_run_skb+0x238/0x12b0 [ 1099.302687][T28368] ? bpf_prog_test_run_skb+0x238/0x12b0 [ 1099.308225][T28368] __kmem_cache_alloc_node+0x53/0x250 [ 1099.313597][T28368] ? bpf_prog_test_run_skb+0x238/0x12b0 [ 1099.319134][T28368] __kmalloc+0xa4/0x230 [ 1099.323288][T28368] bpf_prog_test_run_skb+0x238/0x12b0 [ 1099.328653][T28368] ? __fget_files+0x28/0x4b0 [ 1099.333236][T28368] ? __fget_files+0x28/0x4b0 [ 1099.337822][T28368] ? __fget_files+0x43d/0x4b0 [ 1099.342497][T28368] ? cpu_online+0x60/0x60 [ 1099.346829][T28368] bpf_prog_test_run+0x321/0x390 [ 1099.351774][T28368] __sys_bpf+0x49d/0x890 [ 1099.356017][T28368] ? bpf_link_show_fdinfo+0x390/0x390 [ 1099.361390][T28368] ? lock_chain_count+0x20/0x20 [ 1099.366276][T28368] __x64_sys_bpf+0x7c/0x90 [ 1099.370690][T28368] do_syscall_64+0x55/0xa0 [ 1099.375098][T28368] ? clear_bhb_loop+0x40/0x90 [ 1099.379775][T28368] ? clear_bhb_loop+0x40/0x90 [ 1099.384456][T28368] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1099.390343][T28368] RIP: 0033:0x7f8b95f9cdd9 [ 1099.394753][T28368] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1099.414353][T28368] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1099.422763][T28368] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 1099.430728][T28368] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1099.438690][T28368] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1099.446649][T28368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1099.454619][T28368] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1099.462614][T28368] [ 1099.851511][T28380] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8046'. [ 1100.378805][T28402] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8053'. [ 1100.508906][T28406] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.8054'. [ 1100.518855][T28406] netlink: 6332 bytes leftover after parsing attributes in process `syz.0.8054'. [ 1101.038435][T28395] delete_channel: no stack [ 1101.410145][T28417] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8058'. [ 1102.138343][T28430] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8062'. [ 1102.878181][T25216] Bluetooth: hci3: command 0x0406 tx timeout [ 1104.273411][T28451] FAULT_INJECTION: forcing a failure. [ 1104.273411][T28451] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1104.295885][T28451] CPU: 1 PID: 28451 Comm: syz.3.8066 Not tainted syzkaller #0 [ 1104.303394][T28451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1104.313468][T28451] Call Trace: [ 1104.316761][T28451] [ 1104.319701][T28451] dump_stack_lvl+0x18c/0x250 [ 1104.324403][T28451] ? show_regs_print_info+0x20/0x20 [ 1104.329639][T28451] ? load_image+0x420/0x420 [ 1104.334172][T28451] ? __might_fault+0xaa/0x120 [ 1104.338869][T28451] ? __lock_acquire+0x7d40/0x7d40 [ 1104.343911][T28451] ? unix_ioctl+0x261/0x670 [ 1104.348430][T28451] should_fail_ex+0x39d/0x4d0 [ 1104.353131][T28451] _copy_from_user+0x2f/0xe0 [ 1104.357753][T28451] sock_do_ioctl+0x190/0x310 [ 1104.362365][T28451] ? sock_show_fdinfo+0xb0/0xb0 [ 1104.367246][T28451] sock_ioctl+0x5ba/0x7e0 [ 1104.371597][T28451] ? sock_poll+0x3e0/0x3e0 [ 1104.376035][T28451] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1104.380985][T28451] ? security_file_ioctl+0x80/0xa0 [ 1104.386115][T28451] ? sock_poll+0x3e0/0x3e0 [ 1104.390547][T28451] __se_sys_ioctl+0xfd/0x170 [ 1104.395142][T28451] do_syscall_64+0x55/0xa0 [ 1104.399557][T28451] ? clear_bhb_loop+0x40/0x90 [ 1104.404227][T28451] ? clear_bhb_loop+0x40/0x90 [ 1104.408901][T28451] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1104.414789][T28451] RIP: 0033:0x7f8b95f9cdd9 [ 1104.419231][T28451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1104.438828][T28451] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1104.447232][T28451] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 1104.455204][T28451] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000030 [ 1104.463173][T28451] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1104.471167][T28451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1104.479146][T28451] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1104.487125][T28451] [ 1104.714175][T28468] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8072'. [ 1105.197807][T28462] delete_channel: no stack [ 1105.455484][T28483] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8075'. [ 1106.132179][T28482] delete_channel: no stack [ 1106.531865][T28510] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8082'. [ 1107.241571][T28512] delete_channel: no stack [ 1107.708101][T28526] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8088'. [ 1108.027564][T28528] delete_channel: no stack [ 1108.120045][T28544] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.8093'. [ 1108.197482][T28544] netlink: 'syz.0.8093': attribute type 10 has an invalid length. [ 1108.205348][T28544] netlink: 55 bytes leftover after parsing attributes in process `syz.0.8093'. [ 1108.374941][T19426] Bluetooth: hci2: unexpected event 0x0f length: 151 > 4 [ 1108.536398][T28547] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8095'. [ 1109.138135][T28568] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8102'. [ 1109.545251][T28569] delete_channel: no stack [ 1109.764877][T28586] netlink: 'syz.1.8107': attribute type 25 has an invalid length. [ 1109.773046][T28586] netlink: 'syz.1.8107': attribute type 1 has an invalid length. [ 1109.782610][T28586] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1109.963414][T28593] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8108'. [ 1110.037719][T28597] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8111'. [ 1110.059777][T28597] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8111'. [ 1110.090969][T28597] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8111'. [ 1110.200604][T28603] FAULT_INJECTION: forcing a failure. [ 1110.200604][T28603] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1110.213828][T28603] CPU: 0 PID: 28603 Comm: syz.2.8114 Not tainted syzkaller #0 [ 1110.221313][T28603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1110.231414][T28603] Call Trace: [ 1110.234702][T28603] [ 1110.237645][T28603] dump_stack_lvl+0x18c/0x250 [ 1110.242354][T28603] ? show_regs_print_info+0x20/0x20 [ 1110.247564][T28603] ? load_image+0x420/0x420 [ 1110.252082][T28603] ? __lock_acquire+0x7d40/0x7d40 [ 1110.257101][T28603] ? snprintf+0xe9/0x140 [ 1110.261337][T28603] should_fail_ex+0x39d/0x4d0 [ 1110.266010][T28603] _copy_to_user+0x2f/0xa0 [ 1110.270425][T28603] simple_read_from_buffer+0xe7/0x150 [ 1110.275814][T28603] proc_fail_nth_read+0x1e8/0x260 [ 1110.280849][T28603] ? proc_fault_inject_write+0x360/0x360 [ 1110.286489][T28603] ? fsnotify_perm+0x271/0x5e0 [ 1110.291257][T28603] ? proc_fault_inject_write+0x360/0x360 [ 1110.296888][T28603] vfs_read+0x28b/0x970 [ 1110.301046][T28603] ? kernel_read+0x1e0/0x1e0 [ 1110.305637][T28603] ? __fget_files+0x28/0x4b0 [ 1110.310218][T28603] ? __fget_files+0x28/0x4b0 [ 1110.314803][T28603] ? __fget_files+0x43d/0x4b0 [ 1110.319480][T28603] ? __fdget_pos+0x2a3/0x330 [ 1110.324067][T28603] ? ksys_read+0x75/0x260 [ 1110.328402][T28603] ksys_read+0x150/0x260 [ 1110.332644][T28603] ? vfs_write+0x990/0x990 [ 1110.337059][T28603] ? lockdep_hardirqs_on+0x98/0x150 [ 1110.342258][T28603] do_syscall_64+0x55/0xa0 [ 1110.346662][T28603] ? clear_bhb_loop+0x40/0x90 [ 1110.351340][T28603] ? clear_bhb_loop+0x40/0x90 [ 1110.356008][T28603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1110.361893][T28603] RIP: 0033:0x7efe7fd5d60e [ 1110.366308][T28603] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1110.385909][T28603] RSP: 002b:00007efe80d14fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1110.394318][T28603] RAX: ffffffffffffffda RBX: 00007efe80d156c0 RCX: 00007efe7fd5d60e [ 1110.402288][T28603] RDX: 000000000000000f RSI: 00007efe80d150a0 RDI: 0000000000000005 [ 1110.410264][T28603] RBP: 00007efe80d15090 R08: 0000000000000000 R09: 0000000000000000 [ 1110.418244][T28603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1110.426212][T28603] R13: 00007efe80016038 R14: 00007efe80015fa0 R15: 00007ffe2524ff18 [ 1110.434191][T28603] [ 1110.732960][T28610] netlink: 'syz.3.8117': attribute type 10 has an invalid length. [ 1110.774708][T28606] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8115'. [ 1111.233786][T28630] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8124'. [ 1111.460163][T19426] Bluetooth: hci3: unexpected event 0x0f length: 151 > 4 [ 1111.929435][T28653] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8131'. [ 1112.221877][T28666] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8136'. [ 1112.263709][T19426] Bluetooth: hci1: unexpected event 0x0f length: 151 > 4 [ 1112.386868][T19426] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 1112.404580][T19426] Bluetooth: hci2: Injecting HCI hardware error event [ 1112.412712][T25216] Bluetooth: hci2: hardware error 0x00 [ 1112.805927][T19426] Bluetooth: hci2: unexpected event 0x0f length: 151 > 4 [ 1112.972264][T28695] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8145'. [ 1113.080423][T28698] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8147'. [ 1113.434564][T28716] netlink: 'syz.0.8153': attribute type 10 has an invalid length. [ 1113.597585][T19426] Bluetooth: hci1: unexpected event 0x0f length: 151 > 4 [ 1114.466948][T25216] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 1114.875564][T28755] netlink: 'syz.2.8167': attribute type 10 has an invalid length. [ 1115.130748][T28766] FAULT_INJECTION: forcing a failure. [ 1115.130748][T28766] name failslab, interval 1, probability 0, space 0, times 0 [ 1115.145043][T28766] CPU: 0 PID: 28766 Comm: syz.2.8171 Not tainted syzkaller #0 [ 1115.152542][T28766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1115.162616][T28766] Call Trace: [ 1115.165929][T28766] [ 1115.168874][T28766] dump_stack_lvl+0x18c/0x250 [ 1115.173584][T28766] ? show_regs_print_info+0x20/0x20 [ 1115.178817][T28766] ? load_image+0x420/0x420 [ 1115.183345][T28766] ? __might_sleep+0xe0/0xe0 [ 1115.187957][T28766] ? __lock_acquire+0x7d40/0x7d40 [ 1115.192997][T28766] ? stack_trace_save+0xaa/0x100 [ 1115.197948][T28766] ? stack_trace_snprint+0xf0/0xf0 [ 1115.203059][T28766] should_fail_ex+0x39d/0x4d0 [ 1115.207737][T28766] should_failslab+0x9/0x20 [ 1115.212237][T28766] slab_pre_alloc_hook+0x59/0x310 [ 1115.217256][T28766] ? kasan_set_track+0x5f/0x70 [ 1115.222009][T28766] ? kasan_set_track+0x4e/0x70 [ 1115.226762][T28766] ? __kasan_kmalloc+0x8f/0xa0 [ 1115.231521][T28766] kmem_cache_alloc_node+0x60/0x320 [ 1115.236715][T28766] ? netlink_sendmsg+0x8d0/0xbf0 [ 1115.241648][T28766] ? __alloc_skb+0x103/0x2c0 [ 1115.246230][T28766] __alloc_skb+0x103/0x2c0 [ 1115.250640][T28766] netlink_dump+0x1ec/0xe50 [ 1115.255144][T28766] ? netlink_lookup+0x200/0x200 [ 1115.259998][T28766] ? __kasan_kmalloc+0x8f/0xa0 [ 1115.264755][T28766] ? __inet_diag_dump_start+0x886/0x9f0 [ 1115.270294][T28766] ? netlink_lookup+0x30/0x200 [ 1115.275061][T28766] __netlink_dump_start+0x5f1/0x810 [ 1115.280262][T28766] inet_diag_handler_cmd+0x1e1/0x2c0 [ 1115.285544][T28766] ? inet_diag_unregister+0xb0/0xb0 [ 1115.290740][T28766] ? inet_diag_handler_get_info+0x7a0/0x7a0 [ 1115.296630][T28766] ? inet_diag_dump_start+0x20/0x20 [ 1115.301828][T28766] ? inet_diag_dump+0x50/0x50 [ 1115.306504][T28766] ? sock_diag_lock_handler+0x19/0x280 [ 1115.311956][T28766] ? sock_diag_lock_handler+0x19/0x280 [ 1115.317406][T28766] ? inet_diag_unregister+0xb0/0xb0 [ 1115.322610][T28766] sock_diag_rcv_msg+0x3d8/0x600 [ 1115.327544][T28766] netlink_rcv_skb+0x241/0x4d0 [ 1115.332307][T28766] ? sock_diag_bind+0xb0/0xb0 [ 1115.336979][T28766] ? netlink_ack+0x1180/0x1180 [ 1115.341745][T28766] ? __lock_acquire+0x7d40/0x7d40 [ 1115.346767][T28766] ? netlink_deliver_tap+0x2e/0x1b0 [ 1115.351968][T28766] sock_diag_rcv+0x2a/0x40 [ 1115.356375][T28766] netlink_unicast+0x751/0x8d0 [ 1115.361141][T28766] netlink_sendmsg+0x8d0/0xbf0 [ 1115.365902][T28766] ? netlink_getsockopt+0x590/0x590 [ 1115.371094][T28766] ? aa_sock_msg_perm+0x94/0x150 [ 1115.376030][T28766] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1115.381309][T28766] ? security_socket_sendmsg+0x80/0xa0 [ 1115.386765][T28766] ? netlink_getsockopt+0x590/0x590 [ 1115.391962][T28766] ____sys_sendmsg+0x5ba/0x960 [ 1115.396723][T28766] ? __asan_memset+0x22/0x40 [ 1115.401311][T28766] ? __sys_sendmsg_sock+0x30/0x30 [ 1115.406324][T28766] ? __import_iovec+0x5f2/0x850 [ 1115.411168][T28766] ? import_iovec+0x73/0xa0 [ 1115.415662][T28766] ___sys_sendmsg+0x2a6/0x360 [ 1115.420337][T28766] ? get_pid_task+0x20/0x1e0 [ 1115.424924][T28766] ? __sys_sendmsg+0x2a0/0x2a0 [ 1115.429696][T28766] ? __lock_acquire+0x7d40/0x7d40 [ 1115.434730][T28766] __se_sys_sendmsg+0x1c2/0x2b0 [ 1115.439573][T28766] ? __x64_sys_sendmsg+0x80/0x80 [ 1115.444511][T28766] ? lockdep_hardirqs_on+0x98/0x150 [ 1115.449707][T28766] do_syscall_64+0x55/0xa0 [ 1115.454110][T28766] ? clear_bhb_loop+0x40/0x90 [ 1115.458793][T28766] ? clear_bhb_loop+0x40/0x90 [ 1115.463483][T28766] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1115.469383][T28766] RIP: 0033:0x7efe7fd9cdd9 [ 1115.473807][T28766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1115.493421][T28766] RSP: 002b:00007efe80cf4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1115.501837][T28766] RAX: ffffffffffffffda RBX: 00007efe80016090 RCX: 00007efe7fd9cdd9 [ 1115.509817][T28766] RDX: 0000000000044000 RSI: 0000200000000200 RDI: 0000000000000004 [ 1115.517805][T28766] RBP: 00007efe80cf4090 R08: 0000000000000000 R09: 0000000000000000 [ 1115.525792][T28766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1115.533767][T28766] R13: 00007efe80016128 R14: 00007efe80016090 R15: 00007ffe2524ff18 [ 1115.541763][T28766] [ 1115.555305][T25216] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 1115.565714][T25216] Bluetooth: hci3: Injecting HCI hardware error event [ 1115.574234][T25216] Bluetooth: hci3: hardware error 0x00 [ 1115.974188][T28773] __nla_validate_parse: 4 callbacks suppressed [ 1115.975839][T28773] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8174'. [ 1116.189820][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.207097][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.307050][T19426] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 1116.319337][T19426] Bluetooth: hci1: Injecting HCI hardware error event [ 1116.329849][T19426] Bluetooth: hci1: hardware error 0x00 [ 1116.574945][T28793] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8177'. [ 1117.364596][T28813] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8186'. [ 1117.530066][T28780] Bluetooth: hci3: unexpected subevent 0x0e length: 150 > 15 [ 1117.662363][T28827] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8190'. [ 1117.671846][T25216] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 1118.387186][T19426] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 1119.038797][T28840] delete_channel: no stack [ 1119.117698][T28853] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8199'. [ 1119.357014][T28860] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8201'. [ 1120.292339][T28881] delete_channel: no stack [ 1120.522248][T28897] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8213'. [ 1120.556187][T28896] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8212'. [ 1122.043848][T28918] delete_channel: no stack [ 1122.498345][T28938] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8228'. [ 1123.455152][T28960] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8234'. [ 1124.020768][T28950] delete_channel: no stack [ 1124.373168][T28978] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8239'. [ 1124.512833][T28982] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8241'. [ 1125.512449][T28994] delete_channel: no stack [ 1125.756976][T29012] netlink: 'syz.0.8253': attribute type 10 has an invalid length. [ 1125.855522][T29016] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8254'. [ 1126.944251][T29027] delete_channel: no stack [ 1128.215073][T29052] netlink: 'syz.1.8265': attribute type 10 has an invalid length. [ 1128.287228][T29051] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8263'. [ 1128.496432][T29059] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8267'. [ 1128.636197][T29061] netlink: 'syz.1.8276': attribute type 10 has an invalid length. [ 1128.685622][T29067] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8268'. [ 1128.719816][T29070] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8269'. [ 1129.685675][T29071] delete_channel: no stack [ 1130.165678][T29102] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8279'. [ 1130.267741][T29109] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8280'. [ 1130.332362][T29111] netlink: 'syz.1.8283': attribute type 10 has an invalid length. [ 1130.456637][T29116] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8284'. [ 1131.300449][T29117] delete_channel: no stack [ 1131.695194][T29136] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1132.926995][T29148] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8293'. [ 1132.988148][T29150] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8295'. [ 1133.623239][T29155] delete_channel: no stack [ 1133.644115][T29162] netlink: 'syz.0.8297': attribute type 10 has an invalid length. [ 1133.822799][T29174] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1134.127886][T29186] netlink: 'syz.2.8306': attribute type 2 has an invalid length. [ 1134.150267][T29186] netlink: 'syz.2.8306': attribute type 8 has an invalid length. [ 1134.170101][T29186] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8306'. [ 1134.233985][T29191] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8307'. [ 1134.431092][T29195] syzkaller0: entered promiscuous mode [ 1134.436801][T29195] syzkaller0: entered allmulticast mode [ 1135.148386][T29192] delete_channel: no stack [ 1137.995338][T29204] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1138.023353][T29208] netlink: 'syz.0.8312': attribute type 10 has an invalid length. [ 1138.376016][T29226] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8318'. [ 1139.405809][T29233] delete_channel: no stack [ 1140.460269][T29246] netlink: 'syz.3.8324': attribute type 10 has an invalid length. [ 1140.602870][T29249] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1140.801029][T29256] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8328'. [ 1141.533829][T29270] delete_channel: no stack [ 1141.583223][T29259] delete_channel: no stack [ 1141.650361][T29275] netlink: 'syz.2.8334': attribute type 10 has an invalid length. [ 1141.896284][T29283] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1142.017499][T29287] syzkaller0: entered promiscuous mode [ 1142.023019][T29287] syzkaller0: entered allmulticast mode [ 1142.562238][T29292] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8341'. [ 1142.576481][T29291] delete_channel: no stack [ 1142.694621][T29301] FAULT_INJECTION: forcing a failure. [ 1142.694621][T29301] name failslab, interval 1, probability 0, space 0, times 0 [ 1142.708617][T29301] CPU: 1 PID: 29301 Comm: syz.1.8344 Not tainted syzkaller #0 [ 1142.716107][T29301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1142.726179][T29301] Call Trace: [ 1142.729482][T29301] [ 1142.732427][T29301] dump_stack_lvl+0x18c/0x250 [ 1142.737151][T29301] ? show_regs_print_info+0x20/0x20 [ 1142.742379][T29301] ? load_image+0x420/0x420 [ 1142.746881][T29301] ? __might_sleep+0xe0/0xe0 [ 1142.751476][T29301] ? __lock_acquire+0x7d40/0x7d40 [ 1142.756526][T29301] should_fail_ex+0x39d/0x4d0 [ 1142.761201][T29301] should_failslab+0x9/0x20 [ 1142.765696][T29301] slab_pre_alloc_hook+0x59/0x310 [ 1142.770734][T29301] ? sk_prot_alloc+0xe7/0x210 [ 1142.775411][T29301] ? sk_prot_alloc+0xe7/0x210 [ 1142.780084][T29301] __kmem_cache_alloc_node+0x53/0x250 [ 1142.785463][T29301] ? sk_prot_alloc+0xe7/0x210 [ 1142.790141][T29301] __kmalloc+0xa4/0x230 [ 1142.794293][T29301] sk_prot_alloc+0xe7/0x210 [ 1142.798786][T29301] ? sk_alloc+0x24/0x360 [ 1142.803024][T29301] sk_alloc+0x3a/0x360 [ 1142.807087][T29301] ? bpf_ctx_init+0x163/0x1a0 [ 1142.811754][T29301] ? bpf_prog_test_run_skb+0x273/0x12b0 [ 1142.817291][T29301] bpf_prog_test_run_skb+0x3a5/0x12b0 [ 1142.822652][T29301] ? __fget_files+0x28/0x4b0 [ 1142.827233][T29301] ? __fget_files+0x28/0x4b0 [ 1142.831815][T29301] ? __fget_files+0x43d/0x4b0 [ 1142.836487][T29301] ? cpu_online+0x60/0x60 [ 1142.840807][T29301] bpf_prog_test_run+0x321/0x390 [ 1142.845739][T29301] __sys_bpf+0x49d/0x890 [ 1142.849972][T29301] ? bpf_link_show_fdinfo+0x390/0x390 [ 1142.855341][T29301] ? lock_chain_count+0x20/0x20 [ 1142.860187][T29301] __x64_sys_bpf+0x7c/0x90 [ 1142.864592][T29301] do_syscall_64+0x55/0xa0 [ 1142.869000][T29301] ? clear_bhb_loop+0x40/0x90 [ 1142.873665][T29301] ? clear_bhb_loop+0x40/0x90 [ 1142.878336][T29301] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1142.884219][T29301] RIP: 0033:0x7f9348f9cdd9 [ 1142.888653][T29301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1142.908251][T29301] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1142.916662][T29301] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1142.924634][T29301] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1142.932684][T29301] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1142.940645][T29301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1142.948605][T29301] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1142.956576][T29301] [ 1144.549865][T29308] netlink: 'syz.1.8347': attribute type 10 has an invalid length. [ 1145.301106][T29320] delete_channel: no stack [ 1145.402162][T29329] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1145.520503][T29334] netlink: 'syz.2.8356': attribute type 10 has an invalid length. [ 1145.654029][T29339] syzkaller0: entered promiscuous mode [ 1145.659773][T29339] syzkaller0: entered allmulticast mode [ 1145.684722][T29342] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8359'. [ 1147.830859][T29360] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8363'. [ 1148.180866][T29370] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8367'. [ 1148.311520][T29357] delete_channel: no stack [ 1148.580893][T29375] netlink: 'syz.2.8368': attribute type 10 has an invalid length. [ 1151.173910][T29378] delete_channel: no stack [ 1151.483157][T29405] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8376'. [ 1151.865798][T29401] delete_channel: no stack [ 1152.339100][T29415] raw_sendmsg: syz.3.8380 forgot to set AF_INET. Fix it! [ 1153.685338][T29420] netlink: 'syz.1.8382': attribute type 10 has an invalid length. [ 1154.245611][T29422] delete_channel: no stack [ 1154.785072][T29432] delete_channel: no stack [ 1155.157983][T29446] FAULT_INJECTION: forcing a failure. [ 1155.157983][T29446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1155.197121][T29446] CPU: 1 PID: 29446 Comm: syz.0.8392 Not tainted syzkaller #0 [ 1155.204636][T29446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1155.214711][T29446] Call Trace: [ 1155.218009][T29446] [ 1155.220961][T29446] dump_stack_lvl+0x18c/0x250 [ 1155.225670][T29446] ? show_regs_print_info+0x20/0x20 [ 1155.230891][T29446] ? load_image+0x420/0x420 [ 1155.235423][T29446] ? __might_fault+0xaa/0x120 [ 1155.240119][T29446] ? __lock_acquire+0x7d40/0x7d40 [ 1155.245162][T29446] ? do_vfs_ioctl+0x1573/0x1cc0 [ 1155.250031][T29446] should_fail_ex+0x39d/0x4d0 [ 1155.254709][T29446] _copy_from_user+0x2f/0xe0 [ 1155.259293][T29446] tipc_ioctl+0x166/0x340 [ 1155.263636][T29446] ? tipc_poll+0x5f0/0x5f0 [ 1155.268071][T29446] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1155.273542][T29446] sock_do_ioctl+0xfc/0x310 [ 1155.278045][T29446] ? sock_show_fdinfo+0xb0/0xb0 [ 1155.282899][T29446] sock_ioctl+0x5ba/0x7e0 [ 1155.287229][T29446] ? sock_poll+0x3e0/0x3e0 [ 1155.291646][T29446] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1155.296580][T29446] ? security_file_ioctl+0x80/0xa0 [ 1155.301696][T29446] ? sock_poll+0x3e0/0x3e0 [ 1155.306110][T29446] __se_sys_ioctl+0xfd/0x170 [ 1155.310743][T29446] do_syscall_64+0x55/0xa0 [ 1155.315164][T29446] ? clear_bhb_loop+0x40/0x90 [ 1155.319836][T29446] ? clear_bhb_loop+0x40/0x90 [ 1155.324505][T29446] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1155.330389][T29446] RIP: 0033:0x7f49f159cdd9 [ 1155.334796][T29446] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1155.354605][T29446] RSP: 002b:00007f49f23a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1155.363012][T29446] RAX: ffffffffffffffda RBX: 00007f49f1816090 RCX: 00007f49f159cdd9 [ 1155.370991][T29446] RDX: 0000200000000300 RSI: 00000000000089e1 RDI: 0000000000000003 [ 1155.378954][T29446] RBP: 00007f49f23a7090 R08: 0000000000000000 R09: 0000000000000000 [ 1155.386913][T29446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1155.394874][T29446] R13: 00007f49f1816128 R14: 00007f49f1816090 R15: 00007ffd44ca26b8 [ 1155.402847][T29446] [ 1155.810384][T29437] delete_channel: no stack [ 1158.178506][T29448] netlink: 'syz.1.8393': attribute type 10 has an invalid length. [ 1158.671382][T29474] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8400'. [ 1158.960658][T29484] netlink: 'syz.1.8405': attribute type 10 has an invalid length. [ 1159.732301][T29480] delete_channel: no stack [ 1161.847665][T29507] FAULT_INJECTION: forcing a failure. [ 1161.847665][T29507] name failslab, interval 1, probability 0, space 0, times 0 [ 1161.866789][T29511] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8413'. [ 1161.872269][T29507] CPU: 1 PID: 29507 Comm: syz.3.8414 Not tainted syzkaller #0 [ 1161.883325][T29507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1161.893402][T29507] Call Trace: [ 1161.896700][T29507] [ 1161.899643][T29507] dump_stack_lvl+0x18c/0x250 [ 1161.904361][T29507] ? show_regs_print_info+0x20/0x20 [ 1161.909590][T29507] ? load_image+0x420/0x420 [ 1161.914120][T29507] ? __might_sleep+0xe0/0xe0 [ 1161.918739][T29507] ? __lock_acquire+0x7d40/0x7d40 [ 1161.923789][T29507] should_fail_ex+0x39d/0x4d0 [ 1161.928496][T29507] should_failslab+0x9/0x20 [ 1161.933021][T29507] slab_pre_alloc_hook+0x59/0x310 [ 1161.938072][T29507] ? __lock_acquire+0x7d40/0x7d40 [ 1161.943114][T29507] ? kvmalloc_node+0x70/0x180 [ 1161.947812][T29507] ? kvmalloc_node+0x70/0x180 [ 1161.952503][T29507] __kmem_cache_alloc_node+0x53/0x250 [ 1161.957892][T29507] ? __schedule_delayed_monitor_work+0x200/0x200 [ 1161.964245][T29507] ? kvmalloc_node+0x70/0x180 [ 1161.968938][T29507] __kmalloc_node+0xa4/0x230 [ 1161.973550][T29507] kvmalloc_node+0x70/0x180 [ 1161.978060][T29507] bpf_test_run_xdp_live+0x1c2/0x1b20 [ 1161.983464][T29507] ? 0xffffffffa0004740 [ 1161.987635][T29507] ? 0xffffffffa0004740 [ 1161.991796][T29507] ? bpf_dispatcher_change_prog+0xcbf/0xf10 [ 1161.997704][T29507] ? 0xffffffffa0004740 [ 1162.001872][T29507] ? xdp_convert_md_to_buff+0x330/0x330 [ 1162.007461][T29507] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 1162.013725][T29507] ? _copy_from_user+0xa5/0xe0 [ 1162.018512][T29507] ? bpf_test_init+0x119/0x140 [ 1162.023289][T29507] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1162.028766][T29507] bpf_prog_test_run_xdp+0x7ca/0x10e0 [ 1162.034173][T29507] ? dev_put+0x80/0x80 [ 1162.038273][T29507] ? dev_put+0x80/0x80 [ 1162.042367][T29507] bpf_prog_test_run+0x321/0x390 [ 1162.047323][T29507] __sys_bpf+0x49d/0x890 [ 1162.051589][T29507] ? bpf_link_show_fdinfo+0x390/0x390 [ 1162.056992][T29507] ? lock_chain_count+0x20/0x20 [ 1162.061861][T29507] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1162.067869][T29507] __x64_sys_bpf+0x7c/0x90 [ 1162.072288][T29507] do_syscall_64+0x55/0xa0 [ 1162.076702][T29507] ? clear_bhb_loop+0x40/0x90 [ 1162.081386][T29507] ? clear_bhb_loop+0x40/0x90 [ 1162.086060][T29507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1162.091944][T29507] RIP: 0033:0x7f8b95f9cdd9 [ 1162.096355][T29507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1162.115955][T29507] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1162.124392][T29507] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 1162.132358][T29507] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1162.140321][T29507] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1162.148289][T29507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1162.156252][T29507] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1162.164226][T29507] [ 1162.539360][T29522] netlink: 'syz.0.8416': attribute type 10 has an invalid length. [ 1163.059025][T29548] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8427'. [ 1163.117714][T29549] netlink: 'syz.1.8428': attribute type 10 has an invalid length. [ 1165.790827][T29576] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1165.941312][T29580] netlink: 'syz.0.8438': attribute type 10 has an invalid length. [ 1166.228184][T29593] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8441'. [ 1166.564416][T29603] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1167.146355][T29623] bond0: entered promiscuous mode [ 1167.151849][T29623] bond_slave_0: entered promiscuous mode [ 1167.167116][T29623] bond_slave_1: entered promiscuous mode [ 1167.179125][T29623] mac80211_hwsim hwsim186 wlan1: entered promiscuous mode [ 1167.194086][T29623] bond0: entered allmulticast mode [ 1167.206293][T29623] bond_slave_0: entered allmulticast mode [ 1167.219324][T29623] bond_slave_1: entered allmulticast mode [ 1167.232698][T29623] mac80211_hwsim hwsim186 wlan1: entered allmulticast mode [ 1167.247152][T29630] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8456'. [ 1167.528888][T29639] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1167.809466][T29652] FAULT_INJECTION: forcing a failure. [ 1167.809466][T29652] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1167.823883][T29652] CPU: 1 PID: 29652 Comm: syz.3.8467 Not tainted syzkaller #0 [ 1167.831406][T29652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1167.841509][T29652] Call Trace: [ 1167.844822][T29652] [ 1167.847787][T29652] dump_stack_lvl+0x18c/0x250 [ 1167.852520][T29652] ? show_regs_print_info+0x20/0x20 [ 1167.857792][T29652] ? load_image+0x420/0x420 [ 1167.862341][T29652] ? __lock_acquire+0x7d40/0x7d40 [ 1167.867420][T29652] should_fail_ex+0x39d/0x4d0 [ 1167.872154][T29652] _copy_from_user+0x2f/0xe0 [ 1167.876784][T29652] __copy_msghdr+0x3bb/0x580 [ 1167.881413][T29652] ___sys_sendmsg+0x214/0x360 [ 1167.886117][T29652] ? get_pid_task+0x20/0x1e0 [ 1167.890756][T29652] ? __sys_sendmsg+0x2a0/0x2a0 [ 1167.895623][T29652] ? __lock_acquire+0x7d40/0x7d40 [ 1167.900776][T29652] __se_sys_sendmsg+0x1c2/0x2b0 [ 1167.905678][T29652] ? __x64_sys_sendmsg+0x80/0x80 [ 1167.910700][T29652] ? lockdep_hardirqs_on+0x98/0x150 [ 1167.915952][T29652] do_syscall_64+0x55/0xa0 [ 1167.920394][T29652] ? clear_bhb_loop+0x40/0x90 [ 1167.925107][T29652] ? clear_bhb_loop+0x40/0x90 [ 1167.929825][T29652] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1167.935750][T29652] RIP: 0033:0x7f8b95f9cdd9 [ 1167.940203][T29652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1167.959846][T29652] RSP: 002b:00007f8b96efb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1167.968310][T29652] RAX: ffffffffffffffda RBX: 00007f8b96215fa0 RCX: 00007f8b95f9cdd9 [ 1167.976317][T29652] RDX: 000000000000ff00 RSI: 0000200000001180 RDI: 0000000000000003 [ 1167.984324][T29652] RBP: 00007f8b96efb090 R08: 0000000000000000 R09: 0000000000000000 [ 1167.992326][T29652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1168.000331][T29652] R13: 00007f8b96216038 R14: 00007f8b96215fa0 R15: 00007ffecdda63c8 [ 1168.008381][T29652] [ 1168.181860][T29655] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8468'. [ 1168.721953][T29676] syzkaller0: entered promiscuous mode [ 1168.727842][T29676] syzkaller0: entered allmulticast mode [ 1168.740917][T29674] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1170.650659][T29687] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8480'. [ 1171.094964][T29706] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1171.444196][T29714] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8492'. [ 1171.913808][T29728] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1172.059533][T29737] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8501'. [ 1173.043523][T29773] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8513'. [ 1173.107265][T29775] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1173.905080][T29799] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1173.960991][T29803] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8526'. [ 1174.700949][T29826] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1174.854209][T29830] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8539'. [ 1177.549086][T29854] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8549'. [ 1177.558621][T29857] netlink: 14 bytes leftover after parsing attributes in process `syz.2.8550'. [ 1177.569751][T29857] hsr_slave_0: left promiscuous mode [ 1177.575964][T29857] hsr_slave_1: left promiscuous mode [ 1177.600335][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.607050][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.976553][T29869] netlink: 'syz.2.8555': attribute type 10 has an invalid length. [ 1178.384348][T29884] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8562'. [ 1178.651641][T29892] netlink: 'syz.3.8565': attribute type 10 has an invalid length. [ 1178.738790][T29888] netlink: 14 bytes leftover after parsing attributes in process `syz.0.8564'. [ 1178.772795][T29888] hsr_slave_0: left promiscuous mode [ 1178.786573][T29888] hsr_slave_1: left promiscuous mode [ 1179.428300][T29920] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8575'. [ 1179.480904][T29922] netlink: 'syz.2.8577': attribute type 10 has an invalid length. [ 1179.721468][T29928] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8578'. [ 1180.459208][T29949] netlink: 14 bytes leftover after parsing attributes in process `syz.1.8583'. [ 1180.484825][T29949] hsr_slave_0: left promiscuous mode [ 1180.529513][T29949] hsr_slave_1: left promiscuous mode [ 1180.668308][T29957] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8588'. [ 1180.686384][T29956] netlink: 'syz.0.8587': attribute type 10 has an invalid length. [ 1181.820856][T29992] netlink: 'syz.0.8599': attribute type 10 has an invalid length. [ 1182.130911][T30003] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8601'. [ 1182.398295][T30006] syzkaller0: entered promiscuous mode [ 1182.404052][T30006] syzkaller0: entered allmulticast mode [ 1184.503795][T30020] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8616'. [ 1184.713325][T30031] netlink: 'syz.1.8611': attribute type 10 has an invalid length. [ 1185.581249][T30053] netlink: 'syz.0.8621': attribute type 10 has an invalid length. [ 1186.080319][T30065] syzkaller0: entered promiscuous mode [ 1186.086134][T30065] syzkaller0: entered allmulticast mode [ 1186.119757][T30074] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8629'. [ 1188.103692][T30081] netlink: 'syz.0.8631': attribute type 10 has an invalid length. [ 1188.167049][T30088] FAULT_INJECTION: forcing a failure. [ 1188.167049][T30088] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1188.182773][T30088] CPU: 1 PID: 30088 Comm: syz.0.8634 Not tainted syzkaller #0 [ 1188.190275][T30088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1188.200331][T30088] Call Trace: [ 1188.203605][T30088] [ 1188.206529][T30088] dump_stack_lvl+0x18c/0x250 [ 1188.211222][T30088] ? show_regs_print_info+0x20/0x20 [ 1188.216450][T30088] ? load_image+0x420/0x420 [ 1188.220954][T30088] ? __lock_acquire+0x7d40/0x7d40 [ 1188.225983][T30088] ? snprintf+0xe9/0x140 [ 1188.230221][T30088] should_fail_ex+0x39d/0x4d0 [ 1188.234894][T30088] _copy_to_user+0x2f/0xa0 [ 1188.239321][T30088] simple_read_from_buffer+0xe7/0x150 [ 1188.244723][T30088] proc_fail_nth_read+0x1e8/0x260 [ 1188.249754][T30088] ? proc_fault_inject_write+0x360/0x360 [ 1188.255473][T30088] ? fsnotify_perm+0x271/0x5e0 [ 1188.260238][T30088] ? proc_fault_inject_write+0x360/0x360 [ 1188.265954][T30088] vfs_read+0x28b/0x970 [ 1188.270126][T30088] ? kernel_read+0x1e0/0x1e0 [ 1188.274733][T30088] ? __fget_files+0x28/0x4b0 [ 1188.279315][T30088] ? __fget_files+0x28/0x4b0 [ 1188.283906][T30088] ? __fget_files+0x43d/0x4b0 [ 1188.288595][T30088] ? __fdget_pos+0x2a3/0x330 [ 1188.293209][T30088] ? ksys_read+0x75/0x260 [ 1188.297553][T30088] ksys_read+0x150/0x260 [ 1188.301803][T30088] ? vfs_write+0x990/0x990 [ 1188.306227][T30088] ? lockdep_hardirqs_on+0x98/0x150 [ 1188.311431][T30088] do_syscall_64+0x55/0xa0 [ 1188.315849][T30088] ? clear_bhb_loop+0x40/0x90 [ 1188.320529][T30088] ? clear_bhb_loop+0x40/0x90 [ 1188.325211][T30088] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1188.331101][T30088] RIP: 0033:0x7f49f155d60e [ 1188.335530][T30088] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1188.355149][T30088] RSP: 002b:00007f49f23c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1188.363580][T30088] RAX: ffffffffffffffda RBX: 00007f49f23c86c0 RCX: 00007f49f155d60e [ 1188.371545][T30088] RDX: 000000000000000f RSI: 00007f49f23c80a0 RDI: 0000000000000004 [ 1188.379511][T30088] RBP: 00007f49f23c8090 R08: 0000000000000000 R09: 0000000000000000 [ 1188.387477][T30088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1188.395455][T30088] R13: 00007f49f1816038 R14: 00007f49f1815fa0 R15: 00007ffd44ca26b8 [ 1188.403452][T30088] [ 1188.816072][T30098] syzkaller0: entered promiscuous mode [ 1188.821705][T30098] syzkaller0: entered allmulticast mode [ 1190.869231][T30107] netlink: 'syz.3.8642': attribute type 10 has an invalid length. [ 1191.058986][T30124] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8646'. [ 1191.125149][T30122] syzkaller0: entered promiscuous mode [ 1191.132813][T30122] syzkaller0: entered allmulticast mode [ 1193.101792][T30145] netlink: 'syz.1.8653': attribute type 10 has an invalid length. [ 1193.269723][T30155] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1193.296523][T30155] syzkaller1: linktype set to 786 [ 1193.415567][T30149] syzkaller0: entered promiscuous mode [ 1193.421618][T30149] syzkaller0: entered allmulticast mode [ 1193.512615][T30158] syzkaller0: entered promiscuous mode [ 1193.518461][T30158] syzkaller0: entered allmulticast mode [ 1195.130804][T30162] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8658'. [ 1196.912785][T30176] netlink: 'syz.1.8663': attribute type 10 has an invalid length. [ 1197.064489][T30183] syzkaller0: entered promiscuous mode [ 1197.070193][T30183] syzkaller0: entered allmulticast mode [ 1199.138235][T30195] syzkaller0: entered promiscuous mode [ 1199.143794][T30195] syzkaller0: entered allmulticast mode [ 1201.261867][T30215] netlink: 'syz.3.8674': attribute type 10 has an invalid length. [ 1201.371223][T30219] netlink: 'syz.1.8676': attribute type 19 has an invalid length. [ 1201.382547][T30219] netlink: 156 bytes leftover after parsing attributes in process `syz.1.8676'. [ 1201.400022][T30222] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8675'. [ 1201.675768][T30228] syzkaller0: entered promiscuous mode [ 1201.684752][T30228] syzkaller0: entered allmulticast mode [ 1202.206670][T30247] netlink: 6 bytes leftover after parsing attributes in process `syz.0.8684'. [ 1202.216623][T30247] openvswitch: netlink: Flow actions attr not present in new flow. [ 1202.263465][T30246] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.8683'. [ 1202.274109][T30246] openvswitch: netlink: Tunnel attr 2548 out of range max 16 [ 1203.893170][T30243] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1204.076531][T30258] netlink: 6 bytes leftover after parsing attributes in process `syz.3.8688'. [ 1204.086511][T30258] openvswitch: netlink: Flow actions attr not present in new flow. [ 1204.099610][T30257] netlink: 'syz.0.8686': attribute type 10 has an invalid length. [ 1204.300508][T30263] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8689'. [ 1204.817552][T30276] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8693'. [ 1205.360991][T30287] syzkaller0: entered promiscuous mode [ 1205.367910][T30287] syzkaller0: entered allmulticast mode [ 1207.704712][T30295] netlink: 'syz.2.8699': attribute type 10 has an invalid length. [ 1207.717032][T30299] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8700'. [ 1208.846597][T30322] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8705'. [ 1209.701134][T30346] netlink: 'syz.0.8711': attribute type 10 has an invalid length. [ 1211.069484][T30421] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8718'. [ 1211.289934][T30423] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8719'. [ 1211.419092][T30426] @: port 1(veth1_to_team) entered blocking state [ 1211.426556][T30426] @: port 1(veth1_to_team) entered disabled state [ 1211.433803][T30426] veth1_to_team: entered allmulticast mode [ 1211.444225][T30426] veth1_to_team: entered promiscuous mode [ 1212.176852][T30438] netlink: 'syz.1.8722': attribute type 10 has an invalid length. [ 1212.870442][T30456] netlink: 'syz.3.8729': attribute type 6 has an invalid length. [ 1212.896845][T30456] netlink: 'syz.3.8729': attribute type 1 has an invalid length. [ 1212.915714][T30456] netlink: 199820 bytes leftover after parsing attributes in process `syz.3.8729'. [ 1213.152254][T30463] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8731'. [ 1213.404035][T30469] netlink: 'syz.1.8734': attribute type 10 has an invalid length. [ 1213.576285][T30476] FAULT_INJECTION: forcing a failure. [ 1213.576285][T30476] name failslab, interval 1, probability 0, space 0, times 0 [ 1213.589013][T30476] CPU: 1 PID: 30476 Comm: syz.0.8736 Not tainted syzkaller #0 [ 1213.596491][T30476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1213.606567][T30476] Call Trace: [ 1213.609862][T30476] [ 1213.612802][T30476] dump_stack_lvl+0x18c/0x250 [ 1213.617510][T30476] ? show_regs_print_info+0x20/0x20 [ 1213.622755][T30476] ? load_image+0x420/0x420 [ 1213.627298][T30476] should_fail_ex+0x39d/0x4d0 [ 1213.632005][T30476] should_failslab+0x9/0x20 [ 1213.636533][T30476] slab_pre_alloc_hook+0x59/0x310 [ 1213.641578][T30476] ? verify_lock_unused+0x140/0x140 [ 1213.646800][T30476] kmem_cache_alloc+0x5a/0x2d0 [ 1213.651581][T30476] ? skb_clone+0x1eb/0x370 [ 1213.655998][T30476] skb_clone+0x1eb/0x370 [ 1213.660234][T30476] bpf_clone_redirect+0x167/0x4a0 [ 1213.665267][T30476] bpf_prog_208b094576c80b22+0x5e/0x63 [ 1213.670730][T30476] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1213.676738][T30476] ? lock_chain_count+0x20/0x20 [ 1213.681583][T30476] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 1213.687817][T30476] ? lockdep_softirqs_on+0x580/0x580 [ 1213.693093][T30476] ? ktime_get+0x7f/0x280 [ 1213.697414][T30476] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 1213.703648][T30476] ? ktime_get_real_ts64+0x440/0x440 [ 1213.708920][T30476] ? __x64_sys_bpf+0x7c/0x90 [ 1213.713501][T30476] ? __local_bh_disable_ip+0x108/0x1a0 [ 1213.718952][T30476] ? __cant_sleep+0x220/0x220 [ 1213.723623][T30476] ? read_tsc+0x9/0x20 [ 1213.727687][T30476] ? ktime_get+0x24b/0x280 [ 1213.732102][T30476] ? bpf_test_run+0x174/0x870 [ 1213.736777][T30476] bpf_test_run+0x2df/0x870 [ 1213.741280][T30476] ? bpf_test_run+0x174/0x870 [ 1213.745948][T30476] ? convert___skb_to_skb+0x590/0x590 [ 1213.751313][T30476] ? eth_get_headlen+0x210/0x210 [ 1213.756275][T30476] ? slab_build_skb+0x25f/0x3f0 [ 1213.761115][T30476] ? convert___skb_to_skb+0x3d/0x590 [ 1213.766393][T30476] bpf_prog_test_run_skb+0xad2/0x12b0 [ 1213.771766][T30476] ? cpu_online+0x60/0x60 [ 1213.776089][T30476] bpf_prog_test_run+0x321/0x390 [ 1213.781025][T30476] __sys_bpf+0x49d/0x890 [ 1213.785267][T30476] ? bpf_link_show_fdinfo+0x390/0x390 [ 1213.790639][T30476] ? lock_chain_count+0x20/0x20 [ 1213.795484][T30476] __x64_sys_bpf+0x7c/0x90 [ 1213.799894][T30476] do_syscall_64+0x55/0xa0 [ 1213.804298][T30476] ? clear_bhb_loop+0x40/0x90 [ 1213.808968][T30476] ? clear_bhb_loop+0x40/0x90 [ 1213.813641][T30476] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1213.819526][T30476] RIP: 0033:0x7f49f159cdd9 [ 1213.823932][T30476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1213.843531][T30476] RSP: 002b:00007f49f23c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1213.851936][T30476] RAX: ffffffffffffffda RBX: 00007f49f1815fa0 RCX: 00007f49f159cdd9 [ 1213.859897][T30476] RDX: 0000000000000048 RSI: 0000200000000080 RDI: 000000000000000a [ 1213.867859][T30476] RBP: 00007f49f23c8090 R08: 0000000000000000 R09: 0000000000000000 [ 1213.875824][T30476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1213.883786][T30476] R13: 00007f49f1816038 R14: 00007f49f1815fa0 R15: 00007ffd44ca26b8 [ 1213.891764][T30476] [ 1214.444076][T30495] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8741'. [ 1214.659965][T30502] netlink: 'syz.1.8743': attribute type 10 has an invalid length. [ 1215.015480][T30513] IPv6: Can't replace route, no match found [ 1215.759023][T30544] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8753'. [ 1215.834262][T30546] netlink: 'syz.0.8754': attribute type 10 has an invalid length. [ 1215.910980][T30543] netlink: 'syz.1.8752': attribute type 20 has an invalid length. [ 1215.955870][T30550] netlink: 'syz.0.8756': attribute type 13 has an invalid length. [ 1215.972521][T30550] netlink: 152 bytes leftover after parsing attributes in process `syz.0.8756'. [ 1215.986164][T30550] syz_tun: refused to change device tx_queue_len [ 1215.993475][T30550] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1216.057968][T30550] netlink: 'syz.0.8756': attribute type 10 has an invalid length. [ 1216.806115][T30583] FAULT_INJECTION: forcing a failure. [ 1216.806115][T30583] name failslab, interval 1, probability 0, space 0, times 0 [ 1216.826604][T30583] CPU: 0 PID: 30583 Comm: syz.1.8764 Not tainted syzkaller #0 [ 1216.834128][T30583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1216.844187][T30583] Call Trace: [ 1216.847470][T30583] [ 1216.850416][T30583] dump_stack_lvl+0x18c/0x250 [ 1216.855125][T30583] ? show_regs_print_info+0x20/0x20 [ 1216.860339][T30583] ? load_image+0x420/0x420 [ 1216.864866][T30583] ? __might_sleep+0xe0/0xe0 [ 1216.869541][T30583] ? __lock_acquire+0x7d40/0x7d40 [ 1216.874581][T30583] should_fail_ex+0x39d/0x4d0 [ 1216.879276][T30583] should_failslab+0x9/0x20 [ 1216.883784][T30583] slab_pre_alloc_hook+0x59/0x310 [ 1216.888813][T30583] ? kvmalloc_node+0x70/0x180 [ 1216.893579][T30583] ? kvmalloc_node+0x70/0x180 [ 1216.898257][T30583] __kmem_cache_alloc_node+0x53/0x250 [ 1216.903637][T30583] ? kvmalloc_node+0x70/0x180 [ 1216.908315][T30583] __kmalloc_node+0xa4/0x230 [ 1216.912934][T30583] kvmalloc_node+0x70/0x180 [ 1216.917468][T30583] page_pool_create+0x1eb/0x5c0 [ 1216.922333][T30583] bpf_test_run_xdp_live+0x203/0x1b20 [ 1216.927713][T30583] ? 0xffffffffa0004740 [ 1216.931872][T30583] ? 0xffffffffa0004740 [ 1216.936027][T30583] ? bpf_dispatcher_change_prog+0xcbf/0xf10 [ 1216.941922][T30583] ? 0xffffffffa0004740 [ 1216.946079][T30583] ? xdp_convert_md_to_buff+0x330/0x330 [ 1216.951825][T30583] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 1216.958065][T30583] ? _copy_from_user+0xa5/0xe0 [ 1216.962829][T30583] ? bpf_test_init+0x119/0x140 [ 1216.967585][T30583] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1216.973041][T30583] bpf_prog_test_run_xdp+0x7ca/0x10e0 [ 1216.978425][T30583] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1216.984576][T30583] ? lockdep_hardirqs_on+0x98/0x150 [ 1216.989781][T30583] ? dev_put+0x80/0x80 [ 1216.993854][T30583] ? dev_put+0x80/0x80 [ 1216.997918][T30583] bpf_prog_test_run+0x321/0x390 [ 1217.002856][T30583] __sys_bpf+0x49d/0x890 [ 1217.007096][T30583] ? bpf_link_show_fdinfo+0x390/0x390 [ 1217.012479][T30583] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1217.018649][T30583] __x64_sys_bpf+0x7c/0x90 [ 1217.023071][T30583] do_syscall_64+0x55/0xa0 [ 1217.027479][T30583] ? clear_bhb_loop+0x40/0x90 [ 1217.032153][T30583] ? clear_bhb_loop+0x40/0x90 [ 1217.036829][T30583] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1217.042739][T30583] RIP: 0033:0x7f9348f9cdd9 [ 1217.047148][T30583] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1217.066748][T30583] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1217.075157][T30583] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1217.083216][T30583] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1217.091196][T30583] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1217.099161][T30583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1217.107127][T30583] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1217.115106][T30583] [ 1217.129590][T30583] page_pool_create() gave up with errno -12 [ 1217.307037][T30588] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8766'. [ 1217.471095][T30592] netlink: 'syz.1.8768': attribute type 1 has an invalid length. [ 1217.492918][T30592] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.8768'. [ 1217.547171][T30599] mac80211_hwsim hwsim186 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1217.577094][T30594] netlink: 'syz.2.8767': attribute type 10 has an invalid length. [ 1218.274983][T30617] syzkaller0: entered promiscuous mode [ 1218.280697][T30617] syzkaller0: entered allmulticast mode [ 1218.383002][T30622] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1218.499093][T30627] netlink: 'syz.2.8780': attribute type 6 has an invalid length. [ 1218.516927][T30627] netlink: 185612 bytes leftover after parsing attributes in process `syz.2.8780'. [ 1220.142434][T30630] netlink: 'syz.0.8781': attribute type 10 has an invalid length. [ 1220.448041][T30643] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8784'. [ 1220.929396][T30661] netlink: 'syz.3.8791': attribute type 10 has an invalid length. [ 1220.950615][T30664] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1221.058484][T30667] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8794'. [ 1221.621516][T30691] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8801'. [ 1221.691330][T30685] netlink: 'syz.1.8800': attribute type 17 has an invalid length. [ 1221.711429][T30685] netlink: 152 bytes leftover after parsing attributes in process `syz.1.8800'. [ 1221.812918][T30685] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1222.281875][T30702] netlink: 'syz.1.8804': attribute type 10 has an invalid length. [ 1222.359191][T30701] netlink: 'syz.0.8812': attribute type 1 has an invalid length. [ 1222.384290][T30701] netlink: 'syz.0.8812': attribute type 4 has an invalid length. [ 1222.407100][T30701] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.8812'. [ 1222.462195][T30709] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8806'. [ 1222.847854][T30727] netlink: 'syz.0.8814': attribute type 21 has an invalid length. [ 1222.856009][T30727] netlink: 128 bytes leftover after parsing attributes in process `syz.0.8814'. [ 1222.952303][T30733] netlink: 'syz.2.8816': attribute type 10 has an invalid length. [ 1223.140519][T30740] FAULT_INJECTION: forcing a failure. [ 1223.140519][T30740] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1223.156867][T30740] CPU: 0 PID: 30740 Comm: syz.2.8818 Not tainted syzkaller #0 [ 1223.164454][T30740] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1223.174519][T30740] Call Trace: [ 1223.177810][T30740] [ 1223.180775][T30740] dump_stack_lvl+0x18c/0x250 [ 1223.185481][T30740] ? show_regs_print_info+0x20/0x20 [ 1223.190688][T30740] ? load_image+0x420/0x420 [ 1223.195195][T30740] ? __might_fault+0xaa/0x120 [ 1223.199878][T30740] ? __lock_acquire+0x7d40/0x7d40 [ 1223.204904][T30740] ? __lock_acquire+0x1347/0x7d40 [ 1223.209942][T30740] should_fail_ex+0x39d/0x4d0 [ 1223.214733][T30740] _copy_from_user+0x2f/0xe0 [ 1223.219326][T30740] ethtool_set_per_queue+0xf0/0x1f0 [ 1223.224527][T30740] ? ethtool_get_phy_stats+0x600/0x600 [ 1223.230040][T30740] ? __might_fault+0xaa/0x120 [ 1223.234725][T30740] ? __lock_acquire+0x7d40/0x7d40 [ 1223.239759][T30740] ? __might_fault+0xaa/0x120 [ 1223.244456][T30740] ? __might_fault+0xc6/0x120 [ 1223.249141][T30740] ? __might_fault+0xaa/0x120 [ 1223.253828][T30740] dev_ethtool+0x1733/0x18d0 [ 1223.258434][T30740] ? ethtool_get_module_eeprom_call+0x170/0x170 [ 1223.264678][T30740] ? __lock_acquire+0x7d40/0x7d40 [ 1223.269699][T30740] ? __might_fault+0xaa/0x120 [ 1223.274369][T30740] ? full_name_hash+0x92/0xe0 [ 1223.279047][T30740] ? dev_load+0x21/0x1f0 [ 1223.283289][T30740] dev_ioctl+0x392/0x1140 [ 1223.287619][T30740] sock_do_ioctl+0x239/0x310 [ 1223.292207][T30740] ? sock_show_fdinfo+0xb0/0xb0 [ 1223.297062][T30740] sock_ioctl+0x5ba/0x7e0 [ 1223.301411][T30740] ? sock_poll+0x3e0/0x3e0 [ 1223.305861][T30740] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1223.310818][T30740] ? security_file_ioctl+0x80/0xa0 [ 1223.315948][T30740] ? sock_poll+0x3e0/0x3e0 [ 1223.320374][T30740] __se_sys_ioctl+0xfd/0x170 [ 1223.324973][T30740] do_syscall_64+0x55/0xa0 [ 1223.329382][T30740] ? clear_bhb_loop+0x40/0x90 [ 1223.334057][T30740] ? clear_bhb_loop+0x40/0x90 [ 1223.338727][T30740] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1223.344616][T30740] RIP: 0033:0x7efe7fd9cdd9 [ 1223.349040][T30740] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1223.368649][T30740] RSP: 002b:00007efe80d15028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1223.377065][T30740] RAX: ffffffffffffffda RBX: 00007efe80015fa0 RCX: 00007efe7fd9cdd9 [ 1223.385027][T30740] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 000000000000002b [ 1223.392998][T30740] RBP: 00007efe80d15090 R08: 0000000000000000 R09: 0000000000000000 [ 1223.400995][T30740] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1223.408959][T30740] R13: 00007efe80016038 R14: 00007efe80015fa0 R15: 00007ffe2524ff18 [ 1223.416954][T30740] [ 1223.590283][T30752] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8821'. [ 1223.840546][T30761] netlink: 'syz.3.8826': attribute type 2 has an invalid length. [ 1223.853022][T30761] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8826'. [ 1223.871788][T30765] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.8828'. [ 1223.897254][T30763] netlink: 'syz.1.8827': attribute type 10 has an invalid length. [ 1224.570336][T30783] C: renamed from team_slave_0 [ 1225.551865][T30783] netlink: 'syz.2.8831': attribute type 1 has an invalid length. [ 1225.561820][T30783] netlink: 152 bytes leftover after parsing attributes in process `syz.2.8831'. [ 1225.573796][T30783] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1226.291722][T30806] syzkaller0: entered promiscuous mode [ 1226.326714][T30806] syzkaller0: entered allmulticast mode [ 1226.352547][T30807] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8836'. [ 1226.395727][T30810] netlink: 'syz.3.8839': attribute type 10 has an invalid length. [ 1228.903990][T30829] netlink: 'syz.3.8844': attribute type 10 has an invalid length. [ 1228.912915][T30829] bridge0: port 3(team0) entered disabled state [ 1228.919577][T30829] bridge0: port 2(bridge_slave_1) entered disabled state [ 1228.926951][T30829] bridge0: port 1(bridge_slave_0) entered disabled state [ 1228.955668][T30829] bridge0: port 3(team0) entered blocking state [ 1228.962093][T30829] bridge0: port 3(team0) entered forwarding state [ 1228.968826][T30829] bridge0: port 2(bridge_slave_1) entered blocking state [ 1228.975966][T30829] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1228.983358][T30829] bridge0: port 1(bridge_slave_0) entered blocking state [ 1228.990535][T30829] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1229.006430][T30829] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1229.023565][T30830] C: renamed from team_slave_0 [ 1229.033708][T30830] netlink: 'syz.3.8844': attribute type 1 has an invalid length. [ 1229.043460][T30830] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8844'. [ 1229.053312][T30830] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1229.451386][T30845] netlink: 'syz.1.8849': attribute type 10 has an invalid length. [ 1229.675849][T30852] syzkaller0: entered promiscuous mode [ 1229.697332][T30852] syzkaller0: entered allmulticast mode [ 1229.721151][T30855] FAULT_INJECTION: forcing a failure. [ 1229.721151][T30855] name failslab, interval 1, probability 0, space 0, times 0 [ 1229.740968][T30855] CPU: 0 PID: 30855 Comm: syz.1.8852 Not tainted syzkaller #0 [ 1229.748486][T30855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1229.758841][T30855] Call Trace: [ 1229.762147][T30855] [ 1229.765105][T30855] dump_stack_lvl+0x18c/0x250 [ 1229.769862][T30855] ? show_regs_print_info+0x20/0x20 [ 1229.775114][T30855] ? load_image+0x420/0x420 [ 1229.779671][T30855] ? __might_sleep+0xe0/0xe0 [ 1229.784306][T30855] ? __lock_acquire+0x7d40/0x7d40 [ 1229.789366][T30855] ? perf_trace_lock+0xfc/0x3b0 [ 1229.794263][T30855] should_fail_ex+0x39d/0x4d0 [ 1229.798991][T30855] should_failslab+0x9/0x20 [ 1229.803534][T30855] slab_pre_alloc_hook+0x59/0x310 [ 1229.808609][T30855] ? __get_vm_area_node+0x125/0x370 [ 1229.813855][T30855] __kmem_cache_alloc_node+0x53/0x250 [ 1229.819279][T30855] ? __get_vm_area_node+0x125/0x370 [ 1229.824524][T30855] kmalloc_node_trace+0x26/0xe0 [ 1229.829426][T30855] __get_vm_area_node+0x125/0x370 [ 1229.834507][T30855] __vmalloc_node_range+0x36e/0x1330 [ 1229.839844][T30855] ? netlink_sendmsg+0x602/0xbf0 [ 1229.844825][T30855] ? netlink_insert+0x109f/0x13a0 [ 1229.849934][T30855] ? netlink_data_ready+0x10/0x10 [ 1229.854999][T30855] ? free_vm_area+0x50/0x50 [ 1229.859542][T30855] ? netlink_sendmsg+0x602/0xbf0 [ 1229.864499][T30855] vmalloc+0x79/0x90 [ 1229.868421][T30855] ? netlink_sendmsg+0x602/0xbf0 [ 1229.873372][T30855] netlink_sendmsg+0x602/0xbf0 [ 1229.878158][T30855] ? netlink_getsockopt+0x590/0x590 [ 1229.883368][T30855] ? aa_sock_msg_perm+0x94/0x150 [ 1229.888317][T30855] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1229.893609][T30855] ? security_socket_sendmsg+0x80/0xa0 [ 1229.899067][T30855] ? netlink_getsockopt+0x590/0x590 [ 1229.904275][T30855] ____sys_sendmsg+0x5ba/0x960 [ 1229.909053][T30855] ? __asan_memset+0x22/0x40 [ 1229.913649][T30855] ? __sys_sendmsg_sock+0x30/0x30 [ 1229.918670][T30855] ? __import_iovec+0x5f2/0x850 [ 1229.923537][T30855] ? import_iovec+0x73/0xa0 [ 1229.928045][T30855] ___sys_sendmsg+0x2a6/0x360 [ 1229.932739][T30855] ? __sys_sendmsg+0x2a0/0x2a0 [ 1229.937548][T30855] ? __lock_acquire+0x7d40/0x7d40 [ 1229.942625][T30855] __se_sys_sendmsg+0x1c2/0x2b0 [ 1229.947485][T30855] ? __x64_sys_sendmsg+0x80/0x80 [ 1229.952456][T30855] ? lockdep_hardirqs_on+0x98/0x150 [ 1229.957663][T30855] do_syscall_64+0x55/0xa0 [ 1229.962080][T30855] ? clear_bhb_loop+0x40/0x90 [ 1229.966780][T30855] ? clear_bhb_loop+0x40/0x90 [ 1229.971502][T30855] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1229.977407][T30855] RIP: 0033:0x7f9348f9cdd9 [ 1229.981822][T30855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1230.001433][T30855] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1230.009856][T30855] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1230.017852][T30855] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 1230.025823][T30855] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1230.033803][T30855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1230.041774][T30855] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1230.049772][T30855] [ 1230.067191][T30855] syz.1.8852: vmalloc error: size 65600, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 1230.089747][T30855] CPU: 1 PID: 30855 Comm: syz.1.8852 Not tainted syzkaller #0 [ 1230.097325][T30855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1230.107458][T30855] Call Trace: [ 1230.110808][T30855] [ 1230.113799][T30855] dump_stack_lvl+0x18c/0x250 [ 1230.118528][T30855] ? show_regs_print_info+0x20/0x20 [ 1230.123786][T30855] ? load_image+0x420/0x420 [ 1230.128357][T30855] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1230.134830][T30855] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1230.141361][T30855] warn_alloc+0x246/0x340 [ 1230.145719][T30855] ? __get_vm_area_node+0x125/0x370 [ 1230.150992][T30855] ? zone_watermark_ok_safe+0x230/0x230 [ 1230.156601][T30855] ? rcu_is_watching+0x15/0xb0 [ 1230.161436][T30855] ? __get_vm_area_node+0x356/0x370 [ 1230.166730][T30855] __vmalloc_node_range+0x393/0x1330 [ 1230.172048][T30855] ? netlink_insert+0x109f/0x13a0 [ 1230.177152][T30855] ? netlink_data_ready+0x10/0x10 [ 1230.182223][T30855] ? free_vm_area+0x50/0x50 [ 1230.186798][T30855] ? netlink_sendmsg+0x602/0xbf0 [ 1230.191834][T30855] vmalloc+0x79/0x90 [ 1230.195778][T30855] ? netlink_sendmsg+0x602/0xbf0 [ 1230.200767][T30855] netlink_sendmsg+0x602/0xbf0 [ 1230.205633][T30855] ? netlink_getsockopt+0x590/0x590 [ 1230.210885][T30855] ? aa_sock_msg_perm+0x94/0x150 [ 1230.215864][T30855] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1230.221180][T30855] ? security_socket_sendmsg+0x80/0xa0 [ 1230.226688][T30855] ? netlink_getsockopt+0x590/0x590 [ 1230.231937][T30855] ____sys_sendmsg+0x5ba/0x960 [ 1230.236757][T30855] ? __asan_memset+0x22/0x40 [ 1230.241382][T30855] ? __sys_sendmsg_sock+0x30/0x30 [ 1230.246437][T30855] ? __import_iovec+0x5f2/0x850 [ 1230.251355][T30855] ? import_iovec+0x73/0xa0 [ 1230.256207][T30855] ___sys_sendmsg+0x2a6/0x360 [ 1230.260963][T30855] ? __sys_sendmsg+0x2a0/0x2a0 [ 1230.265860][T30855] ? __lock_acquire+0x7d40/0x7d40 [ 1230.271028][T30855] __se_sys_sendmsg+0x1c2/0x2b0 [ 1230.275939][T30855] ? __x64_sys_sendmsg+0x80/0x80 [ 1230.280984][T30855] ? lockdep_hardirqs_on+0x98/0x150 [ 1230.286264][T30855] do_syscall_64+0x55/0xa0 [ 1230.290717][T30855] ? clear_bhb_loop+0x40/0x90 [ 1230.295427][T30855] ? clear_bhb_loop+0x40/0x90 [ 1230.300161][T30855] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1230.306093][T30855] RIP: 0033:0x7f9348f9cdd9 [ 1230.310543][T30855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1230.330190][T30855] RSP: 002b:00007f9349ed7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1230.338643][T30855] RAX: ffffffffffffffda RBX: 00007f9349215fa0 RCX: 00007f9348f9cdd9 [ 1230.346654][T30855] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 1230.354665][T30855] RBP: 00007f9349ed7090 R08: 0000000000000000 R09: 0000000000000000 [ 1230.362664][T30855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1230.370664][T30855] R13: 00007f9349216038 R14: 00007f9349215fa0 R15: 00007ffe868efd88 [ 1230.378723][T30855] [ 1230.407257][T30855] Mem-Info: [ 1230.410468][T30855] active_anon:7217 inactive_anon:0 isolated_anon:0 [ 1230.410468][T30855] active_file:19814 inactive_file:40406 isolated_file:0 [ 1230.410468][T30855] unevictable:768 dirty:119 writeback:0 [ 1230.410468][T30855] slab_reclaimable:10957 slab_unreclaimable:93851 [ 1230.410468][T30855] mapped:25426 shmem:1361 pagetables:570 [ 1230.410468][T30855] sec_pagetables:0 bounce:0 [ 1230.410468][T30855] kernel_misc_reclaimable:0 [ 1230.410468][T30855] free:1343217 free_pcp:5508 free_cma:0 [ 1230.511688][T30855] Node 0 active_anon:28868kB inactive_anon:0kB active_file:79256kB inactive_file:161424kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:101704kB dirty:476kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10668kB pagetables:2280kB sec_pagetables:0kB all_unreclaimable? no [ 1230.568001][T30855] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1230.610314][T30855] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1230.640724][T30855] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1230.648721][T30855] Node 0 DMA32 free:1461020kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:28828kB inactive_anon:0kB active_file:79256kB inactive_file:160596kB unevictable:1536kB writepending:476kB present:3129332kB managed:2586952kB mlocked:0kB bounce:0kB free_pcp:4012kB local_pcp:2436kB free_cma:0kB [ 1230.681432][T30855] lowmem_reserve[]: 0 0 0 0 0 [ 1230.686540][T30855] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:828kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1230.715866][T30855] lowmem_reserve[]: 0 0 0 0 0 [ 1230.721530][T30855] Node 1 Normal free:3896232kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:17160kB local_pcp:11332kB free_cma:0kB [ 1230.778180][T30855] lowmem_reserve[]: 0 0 0 0 0 [ 1230.783205][T30855] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1230.808100][T30855] Node 0 DMA32: 951*4kB (UME) 672*8kB (UME) 818*16kB (ME) 2167*32kB (UME) 1507*64kB (UME) 327*128kB (UME) 97*256kB (UME) 44*512kB (UM) 30*1024kB (UM) 13*2048kB (UME) 275*4096kB (UM) = 1461020kB [ 1230.846933][T30855] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1230.866849][T30855] Node 1 Normal: 224*4kB (UME) 57*8kB (UME) 36*16kB (UME) 59*32kB (UME) 13*64kB (UE) 9*128kB (UME) 1*256kB (U) 2*512kB (ME) 2*1024kB (UE) 2*2048kB (UE) 948*4096kB (M) = 3896232kB [ 1230.902843][T30855] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1230.923386][T30855] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1230.936843][T30855] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1230.951592][T30855] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1230.962252][T30855] 61581 total pagecache pages [ 1230.969212][T30855] 0 pages in swap cache [ 1230.974886][T30855] Free swap = 124996kB [ 1230.979802][T30855] Total swap = 124996kB [ 1230.983994][T30855] 2097051 pages RAM [ 1230.988780][T30855] 0 pages HighMem/MovableOnly [ 1230.993493][T30855] 416927 pages reserved [ 1231.005138][T30855] 0 pages cma reserved [ 1233.415093][T30871] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8856'. [ 1233.622734][T30877] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8857'. [ 1233.741044][T30881] netlink: 'syz.2.8860': attribute type 10 has an invalid length. [ 1233.858672][T30883] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8859'. [ 1234.404670][T30899] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.8864'. [ 1234.417701][T30899] bridge_slave_1: default FDB implementation only supports local addresses [ 1234.504444][T30901] syzkaller0: entered promiscuous mode [ 1234.516688][T30901] syzkaller0: entered allmulticast mode [ 1236.457625][T30911] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8867'. [ 1236.472431][T30915] netlink: 'syz.2.8869': attribute type 10 has an invalid length. [ 1236.687269][T30923] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8870'. [ 1236.820000][T30922] syzkaller0: entered promiscuous mode [ 1236.825515][T30922] syzkaller0: entered allmulticast mode [ 1236.859045][T30930] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1238.585338][T30931] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8873'. [ 1239.041179][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 1239.047645][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.295614][T30956] netlink: 'syz.3.8878': attribute type 10 has an invalid length. [ 1239.424045][T30950] syzkaller0: entered promiscuous mode [ 1239.434498][T30950] syzkaller0: entered allmulticast mode [ 1242.555562][T30973] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1244.922243][T30981] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8887'. [ 1244.936754][T30988] netlink: 'syz.1.8890': attribute type 10 has an invalid length. [ 1245.214784][T30993] syzkaller0: entered promiscuous mode [ 1245.220396][T30993] syzkaller0: entered allmulticast mode [ 1247.427897][T30997] syzkaller0: entered promiscuous mode [ 1247.433722][T30997] syzkaller0: entered allmulticast mode [ 1247.475808][T31002] syzkaller0: entered promiscuous mode [ 1247.481677][T31002] syzkaller0: entered allmulticast mode [ 1250.737443][T31014] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8897'. [ 1250.747953][T31016] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1252.767253][T31030] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8903'. [ 1253.072762][T31037] syzkaller0: entered promiscuous mode [ 1253.086949][T31037] syzkaller0: entered allmulticast mode [ 1254.871036][T31042] syzkaller0: entered promiscuous mode [ 1254.876742][T31042] syzkaller0: entered allmulticast mode [ 1254.888737][T31045] C: renamed from team_slave_0 [ 1254.895025][T31045] netlink: 152 bytes leftover after parsing attributes in process `syz.0.8908'. [ 1256.668470][T31055] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8909'. [ 1256.678486][T31057] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1257.077029][T31071] netlink: 'syz.2.8917': attribute type 9 has an invalid length. [ 1257.085090][T31071] netlink: 84908 bytes leftover after parsing attributes in process `syz.2.8917'. [ 1258.905200][T31083] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8919'. [ 1259.084339][T31087] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1259.255913][T31091] syzkaller0: entered promiscuous mode [ 1259.276676][T31091] syzkaller0: entered allmulticast mode [ 1261.339563][T31107] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8929'. [ 1261.375115][T31110] syzkaller0: entered promiscuous mode [ 1261.386713][T31110] syzkaller0: entered allmulticast mode [ 1263.117346][T31119] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1263.549327][T31139] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8936'. [ 1263.962129][T31147] syzkaller0: entered promiscuous mode [ 1263.981176][T31147] syzkaller0: entered allmulticast mode [ 1265.801408][T31159] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1266.198112][T31177] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8949'. [ 1267.378886][T31204] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1267.733688][T31206] syzkaller0: entered promiscuous mode [ 1267.746736][T31206] syzkaller0: entered allmulticast mode [ 1267.888768][T31212] syzkaller0: entered promiscuous mode [ 1267.904735][T31212] syzkaller0: entered allmulticast mode [ 1268.389871][T31190] delete_channel: no stack [ 1270.523646][T25216] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1270.543211][T25216] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1270.551305][T25216] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1270.570254][T25216] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1270.599064][T25216] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1270.614959][T25216] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1271.831539][T31225] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8962'. [ 1272.065046][T31238] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1272.191818][ T2883] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1272.306403][T31245] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8970'. [ 1272.353481][ T2883] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1272.374705][T31232] chnl_net:caif_netlink_parms(): no params data found [ 1272.482432][ T2883] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1272.520857][T31250] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8972'. [ 1272.707961][T25216] Bluetooth: hci4: command tx timeout [ 1273.449530][ T2883] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1273.585926][T31262] syzkaller0: entered promiscuous mode [ 1273.604290][T31262] syzkaller0: entered allmulticast mode [ 1274.553283][T31260] delete_channel: no stack [ 1274.792747][T25216] Bluetooth: hci4: command tx timeout [ 1275.770609][T31232] bridge0: port 1(bridge_slave_0) entered blocking state [ 1275.785045][T31232] bridge0: port 1(bridge_slave_0) entered disabled state [ 1275.792330][T31232] bridge_slave_0: entered allmulticast mode [ 1275.799225][T31232] bridge_slave_0: entered promiscuous mode [ 1275.806273][T31273] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8977'. [ 1275.861862][T31232] bridge0: port 2(bridge_slave_1) entered blocking state [ 1275.870628][T31232] bridge0: port 2(bridge_slave_1) entered disabled state [ 1275.884282][T31232] bridge_slave_1: entered allmulticast mode [ 1275.896948][T31232] bridge_slave_1: entered promiscuous mode [ 1275.974376][T31277] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1276.062135][T31232] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1276.077660][T31232] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1276.306436][T31286] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8981'. [ 1276.327742][T31232] team0: Port device team_slave_0 added [ 1276.358185][T31232] team0: Port device team_slave_1 added [ 1276.578256][T31232] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1276.585242][T31232] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1276.626190][T31232] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1276.703057][T31232] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1276.710421][T31232] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1276.737430][T31232] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1276.759017][T31303] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8984'. [ 1276.768531][T31300] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8983'. [ 1276.869737][T25216] Bluetooth: hci4: command tx timeout [ 1276.981809][T31232] hsr_slave_0: entered promiscuous mode [ 1276.997675][T31232] hsr_slave_1: entered promiscuous mode [ 1277.263292][T31312] syzkaller0: entered promiscuous mode [ 1277.268871][T31312] syzkaller0: entered allmulticast mode [ 1277.334342][ T2883] bond0: (slave wlan1): Releasing backup interface [ 1278.956794][T25216] Bluetooth: hci4: command tx timeout [ 1279.562378][T31327] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1279.914621][ T2883] hsr_slave_0: left promiscuous mode [ 1279.922188][ T2883] hsr_slave_1: left promiscuous mode [ 1279.931720][ T2883] team0: left allmulticast mode [ 1279.938757][ T2883] team_slave_1: left allmulticast mode [ 1279.944521][ T2883] team0: left promiscuous mode [ 1279.953215][ T2883] team_slave_1: left promiscuous mode [ 1279.959603][ T2883] bridge0: port 3(team0) entered disabled state [ 1279.975947][ T2883] bridge_slave_1: left allmulticast mode [ 1279.991598][ T2883] bridge_slave_1: left promiscuous mode [ 1280.004396][ T2883] bridge0: port 2(bridge_slave_1) entered disabled state [ 1280.023477][ T2883] bridge_slave_0: left allmulticast mode [ 1280.029659][ T2883] bridge_slave_0: left promiscuous mode [ 1280.035919][ T2883] bridge0: port 1(bridge_slave_0) entered disabled state [ 1280.095323][ T2883] veth1_vlan: left promiscuous mode [ 1280.111602][ T2883] veth0_vlan: left promiscuous mode [ 1280.973938][ T2883] team0 (unregistering): Port device team_slave_1 removed [ 1281.045487][ T2883] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1281.088056][ T2883] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1281.379573][ T2883] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1281.389879][ T2883] bond0 (unregistering): Released all slaves [ 1282.014764][T31371] syzkaller0: entered promiscuous mode [ 1282.020889][T31371] syzkaller0: entered allmulticast mode [ 1284.028108][T31390] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8997'. [ 1284.088646][T31232] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1284.121156][T31232] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1284.155433][T31232] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1284.174060][T31232] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1284.214790][T31404] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1284.242985][T31408] netlink: 68 bytes leftover after parsing attributes in process `syz.0.9000'. [ 1284.431497][T31408] netlink: 209840 bytes leftover after parsing attributes in process `syz.0.9000'. [ 1284.915917][T31232] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1285.184438][T31232] 8021q: adding VLAN 0 to HW filter on device team0 [ 1285.224778][T30404] bridge0: port 1(bridge_slave_0) entered blocking state [ 1285.232037][T30404] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1285.346097][T30404] bridge0: port 2(bridge_slave_1) entered blocking state [ 1285.353343][T30404] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1285.570039][T31232] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1285.925776][T31447] netlink: 'syz.1.9008': attribute type 10 has an invalid length. [ 1286.161648][T31232] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1286.440615][T31232] veth0_vlan: entered promiscuous mode [ 1286.457144][T31232] veth1_vlan: entered promiscuous mode [ 1286.688444][T31232] veth0_macvtap: entered promiscuous mode [ 1286.717920][T31232] veth1_macvtap: entered promiscuous mode [ 1286.754723][T31232] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1286.773832][T31232] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1286.793570][T31232] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1286.803027][T31232] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1286.813258][T31232] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1286.822451][T31232] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1286.997510][T31486] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1287.042203][ T2883] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1287.081052][ T2883] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1287.144445][T30402] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1287.166683][T30402] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1287.222238][T31497] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9022'. [ 1287.359352][T31501] netlink: 68 bytes leftover after parsing attributes in process `syz.1.9018'. [ 1287.481961][T31501] netlink: 209840 bytes leftover after parsing attributes in process `syz.1.9018'. [ 1287.930526][T31512] netlink: 'syz.0.9020': attribute type 10 has an invalid length. [ 1288.705671][T31531] syzkaller0: entered promiscuous mode [ 1288.746895][T31531] syzkaller0: entered allmulticast mode [ 1288.850948][T31535] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9029'. [ 1290.650267][T31548] netlink: 68 bytes leftover after parsing attributes in process `syz.2.9034'. [ 1290.695686][T31547] syzkaller0: entered promiscuous mode [ 1290.701814][T31547] syzkaller0: entered allmulticast mode [ 1290.715965][T31548] netlink: 209840 bytes leftover after parsing attributes in process `syz.2.9034'. [ 1292.776851][T31561] syzkaller0: entered promiscuous mode [ 1292.782377][T31561] syzkaller0: entered allmulticast mode [ 1292.795275][T31563] netlink: 'syz.2.9038': attribute type 10 has an invalid length. [ 1294.966280][T31578] syzkaller0: entered promiscuous mode [ 1294.971951][T31578] syzkaller0: entered allmulticast mode [ 1296.966422][T31592] netlink: 68 bytes leftover after parsing attributes in process `syz.3.9051'. [ 1297.063195][T31592] netlink: 209840 bytes leftover after parsing attributes in process `syz.3.9051'. [ 1297.405378][T31598] syzkaller0: entered promiscuous mode [ 1297.411394][T31598] syzkaller0: entered allmulticast mode [ 1299.794664][T31610] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9057'. [ 1299.805916][T31612] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9056'. [ 1299.825939][T31617] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1299.838814][T31617] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1299.847562][T31617] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1299.855829][T31617] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1300.156881][T31630] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1300.293201][T31637] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9070'. [ 1300.380495][T31639] syzkaller0: entered promiscuous mode [ 1300.397198][T31639] syzkaller0: entered allmulticast mode [ 1300.471337][ T1283] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.477756][ T1283] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.314297][T31656] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.9077'. [ 1302.148102][T25216] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 1302.158084][T25216] Bluetooth: hci4: Injecting HCI hardware error event [ 1302.176054][T25216] Bluetooth: hci4: hardware error 0x00 [ 1302.249432][T31651] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9075'. [ 1302.459780][T31663] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1302.593234][T31669] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9082'. [ 1302.855667][T31681] syzkaller0: entered promiscuous mode [ 1302.861394][T31681] syzkaller0: entered allmulticast mode [ 1304.231508][T25216] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 1304.677116][T31691] veth0_to_bond: entered promiscuous mode [ 1304.693072][T31691] veth0_to_bond: entered allmulticast mode [ 1304.760173][T31697] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1304.798320][T31699] netlink: 'syz.0.9093': attribute type 10 has an invalid length. [ 1305.064731][T31714] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9100'. [ 1305.080541][T31714] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9100'. [ 1305.091880][T31714] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9100'. [ 1306.034037][T31763] sctp: [Deprecated]: syz.2.9125 (pid 31763) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1306.034037][T31763] Use struct sctp_sack_info instead [ 1306.546452][T31789] sctp: [Deprecated]: syz.1.9135 (pid 31789) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1306.546452][T31789] Use struct sctp_sack_info instead [ 1306.808424][T31808] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9147'. [ 1306.817673][T31808] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9147'. [ 1306.828195][T31808] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9147'. [ 1307.519806][T31844] veth1_macvtap: entered allmulticast mode [ 1310.498597][T31861] syzkaller0: entered promiscuous mode [ 1310.504258][T31861] syzkaller0: entered allmulticast mode serialport: Connection terminated to allow system upgrade. Please reconnect at your convenience.