last executing test programs: 5.209502332s ago: executing program 4 (id=3897): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="110000005a"], 0xfe33) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) socket$kcm(0x2, 0x200000000000001, 0x106) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r2, 0x0, 0x15, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x5, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1a, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff000010000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x94) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f0000000100)=r4, 0x4) syz_clone(0x630c0700, 0x0, 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0xd}, 0x0, 0xc8, 0x0, 0x4, 0x5}, 0x0, 0x3, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x11, 0x0, &(0x7f0000000000)="b9ff03076044238c9e9e15f088a84cb688", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0xfdef) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x10000000}, 0x0) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x5d2f, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x6}, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r8 = socket$kcm(0xa, 0x6, 0x0) recvmsg$kcm(r8, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x43) socket$kcm(0x10, 0x2, 0x10) 4.404847466s ago: executing program 2 (id=3903): bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000000000}, 0x0, 0x0, 0x0, 0x0, 0xf60}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, &(0x7f0000000c40)=""/4096, 0x0, 0x1000, 0x1}, 0x28) r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0xdd86, 0x2c}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000080)='b', 0x28}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'sit0\x00', @local}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'sit0\x00', @random="4f33e363a4b1"}) close(0xffffffffffffffff) recvmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2f00020b, 0x0, 0x0, 0x0, 0x0, 0xefdf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000840)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00"], 0xfdef) close(r1) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x7, 0x4, 0x300, 0xfffffffe, 0x0, 0x1}, 0x48) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r5, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)={@ifindex, r6, 0x11, 0x0, 0x0, @void, @value=0x0}, 0x20) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNGETVNETLE(r1, 0x40107447, &(0x7f0000000180)) 3.748328956s ago: executing program 2 (id=3907): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18020000feffffff00000000000000008500000053000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70600000000000085000000170000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x81) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) r2 = socket$kcm(0x2, 0x200000000000001, 0x106) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000240)={0xffffffffffffffff}, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1e0000000b66000001000000030000", @ANYRES32=0x1, @ANYBLOB="0600000000000000000000000000000000000000d001973e138fd2de2a3106eafdaf2d82085eb8ae25ce47aecc71c8e8333c0120d6bd46eee207845b9da1f17cf84a6902fb2f27e77dbc8aef3857f78458a53c5005886c90ed8764364a1ed0d168eb64c0010000001d3f51f22df1194d56e954452ce935fe2a06fce3d18a13151f138ed1c570cf35920d3cd2eb2f08954cbd8d93650003ba9f0738e0dd01da7ee6fdc1419d572d18c6a6647d741e196c23c0eb003516ba40b0f167988a02c97ffa9e", @ANYRES8=r2, @ANYRES64=r3, @ANYRES32=r3], 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000300)={r3, r4}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000840)={0x1, 0x58, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000009c0)={&(0x7f0000000880)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0xc, [@fwd={0x2}, @int={0xe, 0x0, 0x0, 0x1, 0x0, 0x34, 0x0, 0x3d, 0x3}, @enum64={0xa, 0x5, 0x0, 0x13, 0x0, 0xc, [{0xf, 0x69d, 0x8}, {0x7, 0x4, 0x4}, {0xf, 0x2, 0x89c6f6ee}, {0x5, 0x1, 0x100}, {0x10, 0x4, 0x10001}]}, @func={0xf, 0x0, 0x0, 0xc, 0x2}, @struct={0x3, 0x6, 0x0, 0x4, 0x1, 0xa, [{0x8, 0x0, 0x7}, {0xf, 0x3, 0x5}, {0x7, 0x2, 0xffffffff}, {0x3, 0x0, 0x5}, {0x6, 0x4, 0x7fff}, {0xc, 0x2, 0x8000000}]}]}, {0x0, [0x5f, 0x0, 0x5f, 0x61, 0x5f, 0x5f, 0x5f, 0x61, 0x61, 0x2e]}}, &(0x7f0000000980), 0xe8}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x6, 0x22, &(0x7f0000000640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xc5f0}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@jmp={0x5, 0x1, 0x4, 0x0, 0x6, 0x80, 0xffffffffffffffff}, @map_idx={0x18, 0xa, 0x5, 0x0, 0xd}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @ldst={0x2, 0x2, 0x6, 0x9653c38d0b7b7115, 0x2, 0x30, 0x1}, @jmp={0x5, 0x0, 0xb, 0x9, 0x4, 0x776f06730c920c76, 0xfffffffffffffff0}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000780)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x4, '\x00', r5, 0x25, r6, 0x8, &(0x7f0000000a00)={0x6, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r7 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000080), 0x4) r8 = bpf$ITER_CREATE(0x21, &(0x7f0000000200)={r7}, 0x8) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000580)={r8, 0x58, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0xffffff00, 0x0, r8, 0x10, '\x00', r9, 0xffffffffffffffff, 0x5, 0x1, 0x8}, 0x50) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x11}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r10, 0xc, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xd, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @cb_func={0x18, 0x8, 0x4, 0x0, 0x6}, @alu={0x4, 0x0, 0xc, 0x3, 0x7c56fa0aa96bebf4, 0xffffffffffffffc8, 0xfffffffffffffffc}, @func={0x85, 0x0, 0x1, 0x0, 0x5}, @generic={0xc8, 0x9, 0x0, 0x48, 0x4}]}, &(0x7f00000001c0)='GPL\x00', 0x7fffffff, 0xbd, &(0x7f0000000200)=""/189, 0x41100, 0x0, '\x00', r9, @fallback=0x6, r10, 0x8, &(0x7f00000002c0)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000000300)={0x3, 0x6, 0x4, 0x8}, 0x10, 0xffffffffffffffff, r0, 0x1, &(0x7f0000000340)=[0x1], &(0x7f0000000380)=[{0x0, 0x2, 0x0, 0x5}], 0x10, 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r0, 0xfeff, 0xe, 0x0, &(0x7f00000000c0)="c1b9545dd30a1d31677b2d0bfa91", 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.652628289s ago: executing program 1 (id=3908): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, &(0x7f00000004c0)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x6f, 0x8, 0x0, 0x0}}, 0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xf, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_config_ext={0x2, 0x1946}, 0x0, 0x0, 0x1000000, 0x8, 0x7ffd, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x86dd, 0x0, 0x0, 0x0, 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.448948975s ago: executing program 3 (id=3909): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x1000000000000008, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{}, &(0x7f0000000840), &(0x7f0000000340)}, 0x20) r0 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0xfdef) sendmsg$inet(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000005c0)="09feaa7f7c97849ac946f58fbfb2603627", 0x11}, {&(0x7f0000000900)}], 0x2, &(0x7f00000009c0)=ANY=[@ANYBLOB="180000000000000000000000070000008608000000020002110000000000000000000000010000000700000000000000540000000000000000000000070000008607516fb1f9ac94040000008907db5ac46d4a832767ac1e00016401010100000000ffffffff0a010101ac141425e00000020a0101006401010089074aac14140c000000000000001100000000000000000000000100000005000000000000001400000000000000000000000100000002000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="576aa63be6e00000010a0101"], 0xd8}, 0x40040040) socket$kcm(0x2, 0x3, 0x2) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020022003505d25a806f8c6394f91224fc60040011000a7403004700000037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x4, 0x80, 0xfc, 0x3, 0x41, 0x0, 0x0, 0xe5b1, 0x1a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x8000000000000000, 0x1}, 0x0, 0x2000007fff, 0x0, 0x6, 0x6, 0x6aee, 0x0, 0x0, 0x2, 0x0, 0x9}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="8500000002"], 0x0}, 0x94) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x3b) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair(0x10, 0x3, 0x3, &(0x7f00000002c0)) 2.828412704s ago: executing program 1 (id=3911): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c40)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c40)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000142020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000e02800850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x100820, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff0000000000000000851000000200000085000000070000009500000000000000"], 0x0, 0xfffffdff, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff0000000000000000851000000200000085000000070000009500000000000000"], 0x0, 0xfffffdff, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='blkio.bfq.group_wait_time\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/net\x00') syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x12, &(0x7f0000000340)=r5, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0], 0x0, 0xda, &(0x7f00000003c0)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0xa9, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0], 0x0, 0xda, &(0x7f00000003c0)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0xa9, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000600), 0x4) (async) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000600), 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000640)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x3}, 0x50) (async) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000640)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x3}, 0x50) r9 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000700)=@generic={&(0x7f00000006c0)='./file0\x00', 0x0, 0x8}, 0x18) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x84da, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) r11 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000007c0)={0x0, 0x1ff}, 0xc) r12 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a80)=@bpf_ext={0x1c, 0x0, &(0x7f0000000200), 0x0, 0x80000001, 0x1000, &(0x7f0000001480)=""/4096, 0x41000, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x9, r4, 0x9, &(0x7f0000002480)=[0x1, 0xffffffffffffffff, 0x1], &(0x7f00000024c0)=[{0x1, 0x2, 0xa, 0x4}, {0x5, 0x4, 0x0, 0xc}, {0x3, 0x2, 0xf, 0x7}, {0x4, 0x2, 0xf, 0x6}, {0x2, 0x4, 0xc, 0x2}, {0x1, 0x1, 0x9, 0x7}, {0x4, 0x1, 0x5, 0x1}, {0x3, 0x3, 0x7, 0x7}, {0x0, 0x5, 0x200, 0xa}], 0x10, 0x8}, 0x94) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) (async) r13 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) bpf$PROG_BIND_MAP(0x23, &(0x7f0000002640)={r12, r13}, 0xc) (async) bpf$PROG_BIND_MAP(0x23, &(0x7f0000002640)={r12, r13}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x7, 0xe, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, [@btf_id={0x18, 0xe, 0x3, 0x0, 0x2}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffe}, @map_idx={0x18, 0x8, 0x5, 0x0, 0x9}, @alu={0x4, 0x1, 0x8, 0x9, 0x3, 0xfffffffffffffffe}, @alu={0x7, 0x1, 0x1, 0x6, 0x8, 0x4, 0xfffffffffffffffc}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x3}]}, &(0x7f0000000140)='syzkaller\x00', 0x1, 0xd8, &(0x7f0000000180)=""/216, 0x41000, 0x2, '\x00', 0x0, @fallback=0x29, r5, 0x8, &(0x7f0000000280)={0x9, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x1, 0x9, 0x0, 0x2}, 0x10, r6, r7, 0xa, &(0x7f0000000800)=[r8, r9, r10, r11, r13], &(0x7f0000000840)=[{0x1, 0x4, 0x3, 0x4}, {0x3, 0x1, 0x4, 0xe}, {0x1, 0x3, 0x8, 0x3}, {0x1, 0x1, 0xe, 0xa}, {0x2, 0x4, 0x2, 0xa}, {0x0, 0x1, 0x8, 0x2}, {0x0, 0x5, 0xf, 0x3}, {0x0, 0x5, 0xf, 0x6}, {0x4, 0x3, 0xc, 0x8}, {0x2, 0x5, 0xc, 0xc}], 0x10, 0x3}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f0000000a00)={0x1, 0x80, 0x81, 0x2, 0x5, 0x3, 0x0, 0x6, 0x2000, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, @perf_config_ext={0x1, 0x7fff}, 0xcc, 0x100000001, 0x3, 0x2, 0x2, 0x7fff, 0xdd, 0x0, 0xa, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) (async) perf_event_open$cgroup(&(0x7f0000000a00)={0x1, 0x80, 0x81, 0x2, 0x5, 0x3, 0x0, 0x6, 0x2000, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, @perf_config_ext={0x1, 0x7fff}, 0xcc, 0x100000001, 0x3, 0x2, 0x2, 0x7fff, 0xdd, 0x0, 0xa, 0x0, 0x4}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000074000000000000000000b7080000410000007b8af8ff00000000b7080000000000007b8af0ff00000000bf81"], 0x0, 0x5, 0x0, 0x0, 0x41100}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb790700368df3757f0086dd6317ce8000377ac9b0e0865a6596aff57b00"/43], 0xffffffffffffffc7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="0000186df4b1768c36153d42", @ANYRES32, @ANYBLOB="0a00000000a3f500950004000000010045"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd04}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'sit0\x00'}) 2.793143306s ago: executing program 3 (id=3912): socket$kcm(0xf, 0x3, 0x2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000100730109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xb}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="11000000040000000c0000620000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="11000000040000000c0000620000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, &(0x7f0000000480)="023a"}, 0x20) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001040)='cgroup.controllers\x00', 0x100002, 0x0) openat$cgroup(r1, &(0x7f0000001000)='syz0\x00', 0x200002, 0x0) (async) openat$cgroup(r1, &(0x7f0000001000)='syz0\x00', 0x200002, 0x0) write$cgroup_type(r2, &(0x7f0000000180), 0x40010) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7, 0x0, 0x4, 0x400001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, 0xffffffffffffffff) (async) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, 0xffffffffffffffff) socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000010c0)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r4, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x1dc, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_config_ext={0x9, 0xf8e}, 0x4481, 0x0, 0x0, 0x0, 0x2, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x2, 0x3, 0x2) (async) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x4}, 0x108282, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x4}, 0x108282, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) socket$kcm(0x10, 0x2, 0x0) (async) r5 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000560013f16ff28e036afc004a07"], 0xfe33) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)) (async) r6 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)) close(r6) 2.696518118s ago: executing program 2 (id=3914): r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x8, 0x0, 0x4000004, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001240)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000aecd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad94ed406f21caf5adcf920569c00cc1199684fa75814709fea019af247c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c1faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6fab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b79db2e3d5986c82b5aa94e539b204d58f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c7160ec83070000020000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72b0000000000001cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2cc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78ac02ca3cdf6a662db1c9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad943e392955f4f979ea13201bafedcd2063d11dd665647223c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd89346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca2533659edc8be05cc85451c6a14507434eb54b6f43caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffca9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a294351c5356c1d06c92cf8ce3c7c56cd31121624d74517fd3666277f670e812b28e2f30d035cee5d0e77a3c7220000000000000005a474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f034b8d3ebce68663ef5af469abe75b314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041e12282ce24463aaf28345bd168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f09000000000000004fc4bda3453602004535a976eacd3adaa4d2ee6fe0d072ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d401adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb40f7f02f750d6c977a191852c9ae031db044b2353199546609f9f69a6cfefdf879d447df53f3b9b70d10355b00300000000000000553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f58fab987baab97a9bfbd8f185b5631820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe527340935aa3c0b4f3f45b418a18217747ae442e31560e5b741445ea2a1acee2a81425ff000000d2a0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51423b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f88735fce5115dc83ed73d8ee4a91322608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf5000000000000fa08ad0631c4b839688b22c4da2a6bc4cf45854d221a2d5f96bc64647f15daa2ba79cd0f4254ed55217912ef84bd2927df82fc061aef2920c49b2a90886da75561173fa186cb7ee86dd4285c4721eb428c953296bb2f5d825da54dbef07c1b349b4901e093d13e6b9a0000009b5b22e887bc061d40bcaf0aa18623fd9b7179ccc692ba74b531b65c4decf9d080a8ac7e82d4cde1267aa64b2a94fd87a009e6742c2ddc3a9d7eccbb1831b1fa218277c2814a91cab7cb59c697166d6f1bb1a360470000000000000000000000000000000000000000000000000000f9f9b4ce7e871f507084c8c88e0652decbe579b03ed84ea94597dd1059620a050f69ea03b99b4e19d35f4a3b54e96ae2172effecec80f6baa4bf69a6ebf5392882df78b0983e662dc0cb64b77f3f006b6b25443197ae93f0be6de5a703d003f00720943c0e4b33af00000000000000000021a688b2d7007fcc4b59f719afb0b3b7e0aee306ca70fe42bf4984a68f40e1fc043a03a17e4744359b87dc27c82d51cbeb64e52a28daeb6a78d6fe06181ecc840000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) syz_clone(0x40400, &(0x7f0000000280)="414ce612294582d046f411d5c0b0ab8d53f623e8a8d1ae1f7c5659ba0dc7a77197adb9dbfa84050643a70e3f7c79867e5538a4ec6c4c8c9d0790fdcba6f67220340fd7c1580e61204970447b3969cc572dd837279c417e57e632fed44795f511d6ec9626c6ab518d50471f414961bf5a74d07c8b1c4db081d9e05b6f51073406c15469bdef632491f370acbaa706f1d0601722f41080a06c09ea9d8d18fdcd89c3d6729d046e49269167d23e60457b24a0417fa5ba72e3bb", 0xb8, &(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000540)="ac0f92bb4d5165a56a5f8fb82f0e184d85ac0d2715694dd2fff2a1451f579e7a961335e88fda7b4f150fa3f5bd0b44d534834f440a7752fd9338782248912b2ea1d488427b6c182ffe7574ecb7b93f17d26d396786caed6190545240692a853f7f1186affbac1c2dde9f67dd5a2618a50d1652bfb51b92e36f1fb72b0ee05a5369fe93c8782254136beb47e93d14a915a6934574bc72d33a61e8ab4c8cdb86a68609bbdb1181a57f73d3ee7ce76ff57f7a0ac6641defcf3af188817082a73186431b1780a5d3a06da7396731149312dab489d7126ebb5c") perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x4b, 0x0, 0x0, 0xff, 0x5cc0d1b89fca497e, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, @perf_config_ext={0x3, 0x5d}, 0x0, 0xca, 0x0, 0x2, 0x3, 0x3ff, 0x40, 0x0, 0x0, 0x0, 0x6c6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) (async) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x19c5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="020000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) perf_event_open(&(0x7f0000000540)={0x2, 0x80, 0x83, 0x1, 0x0, 0x0, 0x0, 0xc, 0x12b020, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000240)}, 0x250, 0x0, 0x800000, 0x2, 0x0, 0xd, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@bloom_filter={0x1e, 0x8000, 0x1, 0x7f, 0x20401, r2, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5, 0x6}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000200), &(0x7f0000000880)=r2}, 0xff65) (async) r4 = perf_event_open$cgroup(&(0x7f0000000640)={0x2, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4099, 0x0, 0x0, 0x5, 0xfffffffffffffffd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9}, 0xffffffffffffffff, 0xa, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x40082406, &(0x7f0000000040)='|\"@]K@{.\"\x02') (async) r5 = socket$kcm(0x21, 0x2, 0x2) (async) socket$kcm(0x2, 0x1000000000000002, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r6 = socket$kcm(0x2, 0x5, 0x84) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) (async) recvmsg$unix(r7, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r6, 0x84, 0x64, &(0x7f0000000000)=r9, 0x10) (async) sendmsg$inet(r6, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0x1a000}], 0x1}, 0x80d1) (async) close(r6) (async) syz_clone(0x22023500, 0x0, 0x20010, 0x0, 0x0, 0x0) sendmsg$inet(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x110, 0xd, {0x0, @loopback=0x7f000300, @loopback}}}], 0x20}, 0x0) perf_event_open(&(0x7f0000000480)={0x2, 0x80, 0xbf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10000000000000}, 0x0, 0x0, 0xfffffff7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_clone(0x1100, 0x0, 0x0, 0x0, 0x0, 0x0) 2.480676845s ago: executing program 2 (id=3915): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x1000000000000008, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0200000004000000040000000100000080000000", @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{}, &(0x7f0000000840), &(0x7f0000000340)}, 0x20) r0 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0xfdef) sendmsg$inet(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000005c0)="09feaa7f7c97849ac946f58fbfb2603627", 0x11}, {&(0x7f0000000900)}], 0x2, &(0x7f00000009c0)=ANY=[@ANYBLOB="180000000000000000000000070000008608000000020002110000000000000000000000010000000700000000000000540000000000000000000000070000008607516fb1f9ac94040000008907db5ac46d4a832767ac1e00016401010100000000ffffffff0a010101ac141425e00000020a0101006401010089074aac14140c000000000000001100000000000000000000000100000005000000000000001400000000000000000000000100000002000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="576aa63be6e00000010a0101"], 0xd8}, 0x40040040) socket$kcm(0x2, 0x3, 0x2) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020022003505d25a806f8c6394f91224fc60040011000a7403004700000037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x4, 0x80, 0xfc, 0x3, 0x41, 0x0, 0x0, 0xe5b1, 0x1a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x8000000000000000, 0x1}, 0x0, 0x2000007fff, 0x0, 0x6, 0x6, 0x6aee, 0x0, 0x0, 0x2, 0x0, 0x9}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="8500000002"], 0x0}, 0x94) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x3b) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair(0x10, 0x3, 0x3, &(0x7f00000002c0)) 2.480231675s ago: executing program 3 (id=3916): r0 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10000000000002d5, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0x9}, {0x10000004, 0xfffffffd, 0x1, 0xc}], 0x10, 0x8}, 0x94) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) (async) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x64, &(0x7f0000000000)=r3, 0x10) sendmsg$inet(r0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0x1e000}], 0x1}, 0x80d1) socket$kcm(0xa, 0x5, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r4 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x302, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0xc2ba, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x800000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x5452, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb4Y\xa9\xc87,%\x81\xfe\x00\xd2\xd1|\x00\x00\x00\x00\x00\x00\xe3\xd8Yk\xdf\x85\xaac{\x8c\x8ffp`-\xcd\xd9\xd5\xf4\xe68\xe6O\xc2\xf1V0\x8b\t\xed\x13q2\xdd\xcc\xeeR\xf2/\xba\fE>k\a\xe7>t7\x8e(\xf0\x87d\xaf\x93\xfa`\xa6,o\x81.\x1cR\xa5\t\x00\x00\x00\x00\x00\x00\x00|pT\x15\xbc\f*d\xcb\xc2\xcd\x8f\x98\xdf\x00\x00\x1cM\x9c\xa5\xe0\xa8\x00\x00\x00\x80V\xf6\x80\x06\xd9$H!w\xa6m\xd8\x7f\xc6\x837\x83/\x9a\xdf\x01\xf2\x9e\xbb\xca\x04\x00\x05\xeb\xb8{7[\xf9\xe9\x15\xdc0]\x89\x9b~\x04\xb4\xa5\xad\v.\xd0*%`\xb0\x03\x00\x00\x00\x00\x00\x00\x00\xab\xf4\xa7\x83r\xa4\x80|\x03C\x9c\x00\xac\xba\xcb\xa4h\x86w_Eu\xbfy%,\xe5\n\xc1\xb3\xa4g\xa3P\x0f\x11\x93\xc7\xf3\xcf\x17\xf5\x86\xae\xa5\xea?\xc5E\x00\xb2e\xa8\xf1<\xb2\xc82\xbf=o\x00\x00\x00\x00E\x00\xc6X\x92\x0e[\x19\xaa?\x06\xe5\x9d\xd1\x87\x922A\x95\x8e\xbc\xc80xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8b26, &(0x7f0000000140)={'wlan1\x00', @random="0010000900"}) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8933, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r6 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r6, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x20000001) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000000180)={0x3, &(0x7f0000000040)=[{0x3, 0x4, 0x9}, {0x7, 0x2, 0x0, 0x9}, {0x6, 0x4, 0x0, 0x2}]}) recvmsg$kcm(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)}, 0x10000) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r5, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], &(0x7f0000000840)=""/262, 0x37, 0x106, 0x1}, 0x20) close(0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r8, 0x4004743d, 0x110e22ffe2) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 2.228926043s ago: executing program 4 (id=3918): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b05d25a806f8c6394f91a24fc6007020f", 0x17}], 0x1, 0x0, 0x0, 0x400300}, 0x0) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x8, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6}, [@tail_call={{}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x42, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000100)=@ieee802154={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0302}}}, 0x80, &(0x7f0000001440)=[{&(0x7f0000000840)="1a01000000180090000084", 0xb}], 0x1}, 0x4000080) (async) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) (async) r2 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) 2.048785578s ago: executing program 0 (id=3919): socket$kcm(0x2, 0x200000000000001, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000004000000020000000000001103000000ffffffff000000000000000200000000020000000000000802000000a1000000"], 0x0, 0x44}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000073013a00000000009502000000000000"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x2, 0x1, 0x84) socket$kcm(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x12}, 0x48) socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x248, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40000000, 0x10001}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x23ffffff, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x6, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x4, @perf_bp={0x0}, 0x21, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x1ffffdc1, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000ff0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r1 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x5}, {0x2, 0x0, 0x0, 0x8}]}, 0x94) sendmsg$inet(r1, &(0x7f00000029c0)={&(0x7f0000000100)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000002780)=[{&(0x7f00000006c0)='{', 0x1}], 0x1}, 0x4000040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x1c, 0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000, 0x0, 0x0, 0x1, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xf, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xd, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x1}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x10000000}, 0x94) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r1, 0x84, 0x7b, &(0x7f0000000000)=r4, 0x8) close(0x3) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, 0x0}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bridge0\x00', 0x400}) 1.98884927s ago: executing program 3 (id=3920): r0 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) (async) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) r2 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0x12, &(0x7f00000000c0)=r2, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000100850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9bf0bdf81524f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6cd87cef9000000a39c15a7ef365cc27dfeac7b9b0e9048517354b0ca4f9cf8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19e9b5381791cbf0ceb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc089a9813c1efa26001b3f486ebfaae85c4d0b96778478ae5355e6f923b11056969f486f80a35f7f2339704fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d0000000000000000000000004e1fa60acabcf0553910ca2e5ea499fd5889dde9261f0848a5b8af657bfc96049308e8953431b269053627a1523551c160c813969925a892d266792352ec0204596a37ce8d6d260b32239bddbce2e79f93cb5a0ad897adb53b397d07c50f84b74f2605a565ee149016aa75ea31c008fc6da4fb2e98e5083aa3c0ad0d"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r3, 0x18000000000002a0, 0x26, 0x0, &(0x7f0000000040)="b90103600033f0000000000081001fffffe100004000632f77fbac141411e0000601be3e7d2a", 0x0, 0x104, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000380)={0x0, r0}, 0x8) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x148, 0x148, 0x4, [@enum64={0xb, 0x7, 0x0, 0x13, 0x1, 0x0, [{0x1, 0x5, 0x80000000}, {0x9, 0xffff, 0x7f4}, {0x7, 0x2}, {0x5, 0x8, 0x8}, {0x7, 0x3, 0x76}, {0x8, 0x4, 0xffffff68}, {0xb, 0xe9b3, 0x9c}]}, @ptr={0x1}, @int={0x8, 0x0, 0x0, 0x1, 0x0, 0x33, 0x0, 0x5c, 0x4}, @func={0x6, 0x0, 0x0, 0xc, 0x5}, @var={0x402, 0x0, 0x0, 0xe, 0x4}, @datasec={0xe, 0xa, 0x0, 0xf, 0x2, [{0x2, 0x0, 0xe}, {0x2, 0x2, 0x61f}, {0x4, 0x80000000, 0x2}, {0x5, 0x81, 0x3}, {0x1, 0x524, 0x2}, {0x2, 0x3, 0xfffff801}, {0x1, 0x7f1bc8be, 0x3}, {0x4, 0x3, 0x6ffb}, {0x5, 0x3, 0x4}, {0x3, 0x46, 0x8001}], "96d2"}, @var={0x4, 0x0, 0x0, 0xe, 0x4, 0x1}, @datasec={0x2, 0x1, 0x0, 0xf, 0x2, [{0x1, 0x401ff}], "e145"}]}, {0x0, [0x30, 0x5f]}}, &(0x7f0000000640)=""/256, 0x164, 0x100, 0x0, 0xfff}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b40000000002000000000000000000000400080000000000950000000000000046a1106954caf9317ef0ec6cf5f9296f92e6d9fbaf8d628d5afd48ee755f33e7495dde895d9a2b8c8ac3ff9cafec3c01608c93122ee076b3b798618d6d6b6f391799a552c3a162939866b4087b8f1138b0ea32408bd16eb68664ce33ee26d6d2ad9ca26e9d26806cc4757f9660753259904f10096a640500000000000000c8211e6dc15c1e117ff7396fbe8cc4ecca198ef986ba4d4c54bab969528b49b60350e14a47633502b5df75a6e8e080eb75034c7c8e6cb8dc6b8688d98dd6606b61f7a3f727d95dc566b2e1228fc67bd301da93e6890fc83da599da13d49fd66e5ada0367e89bc4e45e121584f3ffc69af6878c358991249cce"], &(0x7f0000000080)='GPL\x00', 0x6, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, r0}, 0x94) 1.936926172s ago: executing program 4 (id=3921): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, &(0x7f00000004c0)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x6f, 0x8, 0x0, 0x0}}, 0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xf, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_config_ext={0x2, 0x1946}, 0x0, 0x0, 0x1000000, 0x8, 0x7ffd, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x86dd, 0x0, 0x0, 0x0, 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.856516574s ago: executing program 1 (id=3922): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x1000000000000008, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{}, &(0x7f0000000840), &(0x7f0000000340)}, 0x20) r0 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, 0x0, 0x0) r1 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0xfdef) sendmsg$inet(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000005c0)="09feaa7f7c97849ac946f58fbfb2603627", 0x11}, {&(0x7f0000000900)}], 0x2, &(0x7f00000009c0)=ANY=[@ANYBLOB="180000000000000000000000070000008608000000020002110000000000000000000000010000000700000000000000540000000000000000000000070000008607516fb1f9ac94040000008907db5ac46d4a832767ac1e00016401010100000000ffffffff0a010101ac141425e00000020a0101006401010089074aac14140c000000000000001100000000000000000000000100000005000000000000001400000000000000000000000100000002000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="576aa63be6e00000010a0101"], 0xd8}, 0x40040040) socket$kcm(0x2, 0x3, 0x2) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020022003505d25a806f8c6394f91224fc60040011000a7403004700000037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x4, 0x80, 0xfc, 0x3, 0x41, 0x0, 0x0, 0xe5b1, 0x1a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x8000000000000000, 0x1}, 0x0, 0x2000007fff, 0x0, 0x6, 0x6, 0x6aee, 0x0, 0x0, 0x2, 0x0, 0x9}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="8500000002"], 0x0}, 0x94) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x3b) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair(0x10, 0x3, 0x3, &(0x7f00000002c0)) 1.541056573s ago: executing program 0 (id=3923): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x25, 0x2, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x28, 0x2, 0x10, 0x8, 0x0, 0x0, 0x900a0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_bp={0x0, 0xd}, 0x106842, 0xc8, 0x0, 0x7, 0x0, 0xdd, 0x1, 0x0, 0x20, 0x0, 0xffffffffffffffff}, 0x0, 0x4, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r2, &(0x7f00000006c0)=ANY=[@ANYBLOB="8f03000000000060007538e486dd630ace2212052f00fe80000000000000875a65059ff57b00000003000000000000000000ac1414aa000088be"], 0xcfa4) 1.476916775s ago: executing program 3 (id=3924): r0 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000040)='./file0\x00', 0x0, 0x4018}, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x12, &(0x7f0000000280)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000002c0), &(0x7f0000000300), 0x8, 0xcb, 0x8, 0x8, &(0x7f0000000340)}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xf, 0x800, 0x9, 0x7f, 0x10, r0, 0x5, '\x00', r1, 0xffffffffffffffff, 0x0, 0x5}, 0x50) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002100), 0x48) socket$kcm(0x29, 0x7, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x8, &(0x7f0000000000)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000640)='syzkaller\x00', 0x7, 0xf9, &(0x7f0000000080)=""/249}, 0x94) 1.476329835s ago: executing program 4 (id=3925): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0xfffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000200)="d80000001d0081044e81f782db4400000000000002000000000000a1180015000600142603600e1208000f0000000401a80016002000014003000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3", 0x82}], 0x1}, 0x0) r1 = gettid() perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffffc}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0xffffffff}, 0x10}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x5e, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0x10}}, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffdb}, 0x94) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f93d24fc60", 0x14}], 0x1}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="110000000400000004000000"], 0x48) socket$kcm(0x2c, 0x3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r4}, &(0x7f0000000080), &(0x7f00000001c0)=r2}, 0x32) close(0x4) recvmsg(r3, &(0x7f0000002440)={0x0, 0x0, 0x0}, 0x0) r5 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="934300005a"], 0xfe33) bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETLINK(r6, 0x400454cd, 0x336) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) close(r6) 1.446218987s ago: executing program 2 (id=3926): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair(0x27, 0xa, 0x0, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80046a, 0x1, @perf_bp={0x0}, 0x8000, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x2846c0, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x200400c0) close(0xffffffffffffffff) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f0000000040)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth0_to_batadv\x00', 0x800}) socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000080)) socket$kcm(0x10, 0x2, 0x0) 1.32954447s ago: executing program 3 (id=3927): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a80)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'bond0\x00', 0x2000}) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) recvmsg$unix(r2, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[@ANYRES8=r3, @ANYBLOB="3eca", @ANYRES8=r4], 0x9a) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22667f32"], 0x66) 1.32466657s ago: executing program 1 (id=3928): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a4f1ff0000000071302000000000001d400500000000004704000001ed00000f030000000000001d44000000000000620a00ff040400007203000000000000b500f7ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3380d28e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51bf900000000000000d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93020000000000000080e69db384ac7eeedcf2ba3a9508f9d6aba582a896a9f1e096df6ecea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6032399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x28, 0x10, &(0x7f0000000000), 0xfffffffffffffd00, 0x0, 0xffffffffffffffff, 0xffffffffffffff20, 0x0, 0x0, 0x10, 0xfffffffd}, 0x48) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8937, &(0x7f0000000cc0)='lo:\x96o8\x14d\xa1\xba\xda\xd1\xa0J\x12tQ\xb16\xe3\xd7\\b\x8b\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00l \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x02\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xeb\xe1\xde\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xfc\xfa 6(%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc50xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x42, &(0x7f0000000040), 0x3b) sendmsg$kcm(r0, &(0x7f0000000440)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000180)="8900", 0x2}, {&(0x7f0000000640)="25b2b3cbea4056eb9d315d760d7e9dfcd937", 0x12}], 0x2, 0x0, 0x0, 0x900}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.net/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000100)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) write$cgroup_int(r3, &(0x7f00000000c0)=0x2, 0xe) r4 = socket$kcm(0x2, 0x0, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x2d, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000340)=[{0x0, 0x0, 0x80000000, 0xc}, {0x1000000a, 0x84}, {0x0, 0x4, 0x4, 0x7}], 0x10, 0x4}, 0x94) close(0x3) r7 = socket$kcm(0xa, 0x5, 0x0) recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x10042) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x20, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) setsockopt$sock_attach_bpf(r4, 0x84, 0x64, &(0x7f0000000000)=r8, 0x1c) r9 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380), 0xc) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYRES32=r7, @ANYRES8], 0xfe33) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d08000b000000e8fe55a1180015000600142603600e1209000d0000000401a80016000a00014006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[], 0xfe33) r11 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) sendmsg$kcm(r11, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) 1.071949248s ago: executing program 1 (id=3930): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r0) socket$kcm(0x21, 0x2, 0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r0}, &(0x7f0000000080), &(0x7f00000000c0)=r0}, 0x20) bpf$MAP_CREATE(0x0, 0x0, 0x48) socketpair(0x1d, 0x2, 0x2, &(0x7f0000000280)) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x113001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="1400000031000b05d2fc6000001d000006000000", 0x14}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="180000000000000000"], 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x2, @empty}, 0x80, 0x0}, 0x20000001) close(0x3) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) 997.30258ms ago: executing program 4 (id=3931): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1d, 0x10520, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0xb}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x300440c4) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001780)={0x0, 0x0, 0x0}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000000000000000000000ffffffe9"], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r6 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r5) syz_clone(0x111, 0x0, 0x9, 0x0, 0x0, 0x0) (async) r7 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r7, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000100100000100000000000000000000001000000000000000100100000b"], 0x28}, 0xfc40) (async) r8 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r8, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x28}, 0xfc40) (async) recvmsg$unix(r3, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x41, &(0x7f0000000040)=r9, 0x4) (async) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$TUNSETPERSIST(r9, 0x400454cb, 0x0) r10 = socket$kcm(0x15, 0x5, 0x0) recvmsg(r10, &(0x7f0000000140)={0x0, 0xffffffffffffff7b, 0x0}, 0x0) ioctl$TUNSETSTEERINGEBPF(r9, 0x800454e0, &(0x7f0000000000)=r0) 920.161152ms ago: executing program 1 (id=3932): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0xffffffff, 0xfffffffd, 0xe}, {0x10000002, 0x0, 0x4, 0x2}]}, 0x94) r1 = socket$kcm(0x2, 0x1, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r5 = socket$kcm(0x2, 0x1, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r5, 0x84, 0x64, &(0x7f0000000000)=r8, 0x10) r9 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{}, {0x10400002}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000300), 0x2}, 0x0, 0x0, 0xc2ba}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r12 = socket$kcm(0x2c, 0x3, 0x0) setsockopt$sock_attach_bpf(r12, 0x11b, 0x6, &(0x7f0000000000), 0x4) close(r11) recvmsg$unix(r10, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x22) setsockopt$sock_attach_bpf(r9, 0x84, 0x64, &(0x7f0000000000)=r13, 0x10) setsockopt$sock_attach_bpf(r1, 0x84, 0x64, &(0x7f0000000000)=r4, 0x10) socket$kcm(0x2, 0x200000000000001, 0x106) openat$cgroup_devices(r4, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000}, 0x10c002, 0xac5d, 0x288a00, 0x0, 0x0, 0xc, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r14, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r14, 0x89e0, &(0x7f0000000000)={r0, r14}) syz_clone(0x630c0700, 0x0, 0x0, 0x0, 0x0, 0x0) 872.908244ms ago: executing program 2 (id=3933): sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, 0x0, 0x10}, 0x20040090) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r0) socket$kcm(0x11, 0xa, 0x300) ioctl$TUNGETVNETLE(r0, 0x8955, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001940)={0x0, 0x0, 0xb0, 0x0, 0x0, 0x3f}, 0x28) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x400000007, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00070000420091"], 0xfe33) recvmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000000840)=""/4085, 0xff5}, {&(0x7f0000003700)=""/4074, 0xfea}], 0x2, 0x0, 0x0, 0x8000000}, 0x20) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, 0x0, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(0x0, 0x0, 0x9, 0xffffffffffffffff, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a00000080000000064242"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000002000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x66) 526.221005ms ago: executing program 4 (id=3934): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'\x00', 0x6132}) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYRES16], 0xffd3) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x0, 0x6, 0xfe, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x72bd1de2ad10d6f3, 0xfffffffffffffffc, 0xcfb5, 0x1, 0x0, 0x4, 0x0, 0x0, 0x84000, 0x0, 0x1}, 0x0, 0xb, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000200), 0x2, 0x0) write$cgroup_netprio_ifpriomap(r3, &(0x7f0000000240)={'batadv0', 0x32, 0x39}, 0xa) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40086602, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0x6}, 0x2805, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x58c8, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r4 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r4, 0x84, 0x4, &(0x7f00000003c0), 0x4) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305828, &(0x7f0000000040)=0x20000) perf_event_open$cgroup(&(0x7f0000000340)={0x2, 0x80, 0x4, 0x87, 0x9, 0xc3, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x2f0, 0xf72a}, 0x0, 0x3, 0xfffffff9, 0x3, 0x0, 0x9, 0xc, 0x0, 0x1, 0x0, 0x6}, r1, 0x10, 0xffffffffffffffff, 0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000840)={&(0x7f0000001200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0xa, [@enum={0x2, 0x1, 0x0, 0x6, 0x4, [{0x6}]}]}, {0x0, [0x0, 0x61, 0x61, 0x2e, 0x2e, 0x5f, 0x30, 0x61]}}, &(0x7f0000001300)=""/160, 0x36, 0xa0, 0x1}, 0x20) write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="2d6e65745f7072696f20f53cc4127b47bf335ae5e85ff2608ea11ce6b86846db67b36ed32a03fb646517235f164784be7161400f2d9ce74afb07f2bb853950ff442559b39f23a886d7aec551c699c6557bf545ca0e72128301e65d9522d7676e9c5dd49b033dcd53f0dd759900fd62fa346ce4fd8d5b657151306c5c4d58c7dff52fe5c3b1d5a4bf65805b52ecd306559b9f18b7b81701de0e1b20ab81974dc6894b50ebc332760194a08297078b87"], 0xa) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7, 0x0, 0x4, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv6\x00\x00s/\x8br\bc_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd11=\x11\xc8\xdd\x90ih\xecd\'%\x11c\x91l,'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x6, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000017000000bca30000000000002403000040feffff6b0af0ff0000000071a4f0ff000000001f030000000000002e0a0200000000002604fdffffff000061171400000000001d430000000000007a0a00fe0000001f6114100000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff6194732827a58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f37382000000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf799b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac987fd637c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fd52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812fc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a2271d96c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795d35f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7eddd12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b0200780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca78fa04d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b78825d5ed789711b77d40dc31e0b8fc651b45559da463f00000000000000005bae7859839f856e7a397913eec7977f6231c5f11849b3deabc60c5ccf240d16924eb760a969813be02a229c674045b88915518a17b683268f10358e1c0b20cfc2bd105e5e1db7fed951b8faf126267bb38b8d356f63d3433d3dee643503a8ba4968adf6673f720c474ecf324d989235f1b52aacfe52e4519af87b7e1594728d6d6fff1248e72d5b1b1b692b2b732f0f2ac0714079fd7bf97bf2b5687d1db91daa5210d09ebe66d00ff4f35143be01585e629d408f2d00a0a290db76adc5f57e160b2c188bb1ecc4e7d2948788e4f9c1bcaf91dac53a2f525f7385d5d82728b5217908748f4c22b6d797b5bbeb61411f88ee1554a78306fe"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x21, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x5, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) perf_event_open(&(0x7f00000002c0)={0x5, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x16016, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x1}, 0x0, 0x3, 0x0, 0x7, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) 294.581611ms ago: executing program 0 (id=3935): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={&(0x7f0000000000)="87591508901e20814a9b38b6291e04c65e4cf27afad4507b1a711e9d9417452cc63951460c2e1729c3d04b6a9156c79a45f8785fd2836aa2b4fd39ccc4327b575fba60c3950def933841039317251de17e6ae24385747aecf69c2ddd9753d1c083bd6b884fb6ccd23d4044c5d1f29931af936d56022913e18833db2193ed6247e818b3c474b34e4c324c5d262239aca9e4d922e079105d07f3af0545cbb006971d92a326243a5625552f866767e1820323ceb51e1f77a4ee87bb16d84a0d54be3f65719f63de0a032761e565a893d337e7ce5c240e1481ff63fd6b8b62bdc6e063becce5bc941c4d9db3d29e830d1214765f16fec77cb0", &(0x7f0000000100)=""/243, &(0x7f0000000280)="44661f536f408166e3c7b3354f7d59498251251de7450482cab52a9cba73ff3fc13b014104b31c8d56fd13fbb973a0903f261676fc11fb5a9af8a4faff0608ba17f53814b2c724bd8b22a014c49fc0dde0f535add56fb1147ff4b47a4d9c46bec9e971a3f0a593b2630558323a120a5d4e90dd044e5c35802121d78299a1a71e057505047806fda6338374b89cb9189aeeb1cdc9fbe503d382265b2910baf4c0b09dd8498e5abb0f36642ea976669d34c6299a9a9d7ebbccf14776c7acb631db00573ed9aa8db181e75e93b792e61fbdf0", &(0x7f0000000380)="d4cb6535c043f7e2c76e5cf3bbfb9040706d5b02ef6fac0b0fa6ade0d845fed022a3eabc4a485db44937df5f63625b836b25864fbcaefc5ae82d0106a0b5fb2bcf6320095866", 0x3, 0x1}, 0x38) r0 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) syz_clone(0x9900000, 0x0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 0 (id=3936): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, &(0x7f00000004c0)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x6f, 0x8, 0x0, 0x0}}, 0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xf, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_config_ext={0x2, 0x1946}, 0x0, 0x0, 0x1000000, 0x8, 0x7ffd, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x86dd, 0x0, 0x0, 0x0, 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): 375.169370][ T9080] should_fail_ex+0x390/0x4c0 [ 375.174601][ T9080] _copy_from_user+0x2c/0x170 [ 375.179648][ T9080] csum_and_copy_from_iter+0x492/0x1380 [ 375.185368][ T9080] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 375.191918][ T9080] ? __alloc_pages+0x290/0x4f0 [ 375.197375][ T9080] ? zone_statistics+0x170/0x170 [ 375.203073][ T9080] ip_generic_getfrag+0x150/0x2e0 [ 375.208770][ T9080] ? csum_partial+0x23d/0x2c0 [ 375.213548][ T9080] ? ip_skb_dst_mtu+0x9b0/0x9b0 [ 375.218633][ T9080] ? raw6_getfrag+0x1e8/0x300 [ 375.224184][ T9080] __ip6_append_data+0x1d75/0x3ed0 [ 375.230014][ T9080] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 375.236329][ T9080] ? ip6_setup_cork+0xff0/0xff0 [ 375.241314][ T9080] ? ip6_setup_cork+0xa4a/0xff0 [ 375.247219][ T9080] ip6_append_data+0x1c8/0x3d0 [ 375.253814][ T9080] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 375.259451][ T9080] rawv6_sendmsg+0x1221/0x1710 [ 375.265014][ T9080] ? compat_rawv6_ioctl+0x60/0x60 [ 375.272674][ T9080] ? aa_sk_perm+0x81f/0x950 [ 375.277295][ T9080] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 375.283786][ T9080] ? inet_sendmsg+0x7a/0x2a0 [ 375.288623][ T9080] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 375.294061][ T9080] ? inet_send_prepare+0x250/0x250 [ 375.299763][ T9080] ____sys_sendmsg+0x5ed/0x9a0 [ 375.304662][ T9080] ? __sys_sendmsg_sock+0x30/0x30 [ 375.309811][ T9080] ? __import_iovec+0x306/0x510 [ 375.316520][ T9080] ? import_iovec+0x6f/0xa0 [ 375.322047][ T9080] ___sys_sendmsg+0x2a2/0x360 [ 375.327207][ T9080] ? __sys_sendmsg+0x2a0/0x2a0 [ 375.332132][ T9080] ? __lock_acquire+0x7bd0/0x7bd0 [ 375.337240][ T9080] __se_sys_sendmsg+0x1c3/0x2b0 [ 375.342320][ T9080] ? ct_nmi_exit+0x145/0x1c0 [ 375.347058][ T9080] ? __x64_sys_sendmsg+0x80/0x80 [ 375.352252][ T9080] ? lockdep_hardirqs_on+0x94/0x140 [ 375.357684][ T9080] do_syscall_64+0x4c/0xa0 [ 375.362137][ T9080] ? clear_bhb_loop+0x60/0xb0 [ 375.367106][ T9080] ? clear_bhb_loop+0x60/0xb0 [ 375.373737][ T9080] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 375.379837][ T9080] RIP: 0033:0x7f592859ce59 [ 375.384468][ T9080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 375.405152][ T9080] RSP: 002b:00007f5929517028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 375.413956][ T9080] RAX: ffffffffffffffda RBX: 00007f5928815fa0 RCX: 00007f592859ce59 [ 375.422146][ T9080] RDX: 0000000000000060 RSI: 0000200000000080 RDI: 0000000000000003 [ 375.430693][ T9080] RBP: 00007f5929517090 R08: 0000000000000000 R09: 0000000000000000 [ 375.439354][ T9080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 375.448843][ T9080] R13: 00007f5928816038 R14: 00007f5928815fa0 R15: 00007fff5532d198 [ 375.456961][ T9080] [ 376.085544][ T9093] netlink: 'syz.1.1435': attribute type 21 has an invalid length. [ 376.125676][ T9093] netlink: 'syz.1.1435': attribute type 1 has an invalid length. [ 376.193180][ T9093] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1435'. [ 376.257745][ T2960] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 377.678550][ T9143] netlink: 'syz.4.1453': attribute type 1 has an invalid length. [ 377.738410][ T9143] netlink: 'syz.4.1453': attribute type 3 has an invalid length. [ 377.773941][ T9143] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1453'. [ 378.412629][ T9142] delete_channel: no stack [ 378.538164][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.545308][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.540242][ T9148] netlink: 'syz.3.1454': attribute type 9 has an invalid length. [ 379.548418][ T9148] netlink: 61951 bytes leftover after parsing attributes in process `syz.3.1454'. [ 379.750846][ T9168] FAULT_INJECTION: forcing a failure. [ 379.750846][ T9168] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 379.794545][ T9168] CPU: 0 PID: 9168 Comm: syz.0.1459 Not tainted syzkaller #0 [ 379.801990][ T9168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 379.812170][ T9168] Call Trace: [ 379.815479][ T9168] [ 379.818518][ T9168] dump_stack_lvl+0x188/0x24e [ 379.823329][ T9168] ? show_regs_print_info+0x12/0x12 [ 379.829009][ T9168] ? load_image+0x410/0x410 [ 379.833657][ T9168] ? __lock_acquire+0x7bd0/0x7bd0 [ 379.838824][ T9168] should_fail_ex+0x390/0x4c0 [ 379.843803][ T9168] _copy_from_user+0x2c/0x170 [ 379.848606][ T9168] csum_and_copy_from_iter+0x492/0x1380 [ 379.855066][ T9168] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 379.861171][ T9168] ? __alloc_pages+0x290/0x4f0 [ 379.865975][ T9168] ? zone_statistics+0x170/0x170 [ 379.870972][ T9168] ip_generic_getfrag+0x150/0x2e0 [ 379.876088][ T9168] ? ip_skb_dst_mtu+0x9b0/0x9b0 [ 379.880953][ T9168] ? raw6_getfrag+0xe6/0x300 [ 379.885676][ T9168] __ip6_append_data+0x1d75/0x3ed0 [ 379.890853][ T9168] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 379.896182][ T9168] ? ip6_setup_cork+0xff0/0xff0 [ 379.901594][ T9168] ? ip6_setup_cork+0xa4a/0xff0 [ 379.906484][ T9168] ip6_append_data+0x1c8/0x3d0 [ 379.911281][ T9168] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 379.916777][ T9168] rawv6_sendmsg+0x1221/0x1710 [ 379.921592][ T9168] ? compat_rawv6_ioctl+0x60/0x60 [ 379.926666][ T9168] ? aa_sk_perm+0x81f/0x950 [ 379.932679][ T9168] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 379.939268][ T9168] ? inet_sendmsg+0x7a/0x2a0 [ 379.943992][ T9168] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 379.949313][ T9168] ? inet_send_prepare+0x250/0x250 [ 379.954467][ T9168] ____sys_sendmsg+0x5ed/0x9a0 [ 379.959298][ T9168] ? __sys_sendmsg_sock+0x30/0x30 [ 379.964461][ T9168] ? __import_iovec+0x306/0x510 [ 379.969448][ T9168] ? import_iovec+0x6f/0xa0 [ 379.974010][ T9168] ___sys_sendmsg+0x2a2/0x360 [ 379.978793][ T9168] ? __sys_sendmsg+0x2a0/0x2a0 [ 379.983727][ T9168] ? __lock_acquire+0x7bd0/0x7bd0 [ 379.988911][ T9168] __se_sys_sendmsg+0x1c3/0x2b0 [ 379.993903][ T9168] ? __x64_sys_sendmsg+0x80/0x80 [ 379.998983][ T9168] ? lockdep_hardirqs_on+0x94/0x140 [ 380.004751][ T9168] do_syscall_64+0x4c/0xa0 [ 380.009231][ T9168] ? clear_bhb_loop+0x60/0xb0 [ 380.013940][ T9168] ? clear_bhb_loop+0x60/0xb0 [ 380.018931][ T9168] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 380.025127][ T9168] RIP: 0033:0x7f6d3c19ce59 [ 380.029899][ T9168] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 380.050584][ T9168] RSP: 002b:00007f6d3d006028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 380.059210][ T9168] RAX: ffffffffffffffda RBX: 00007f6d3c415fa0 RCX: 00007f6d3c19ce59 [ 380.067228][ T9168] RDX: 0000000000000060 RSI: 0000200000000080 RDI: 0000000000000003 [ 380.075317][ T9168] RBP: 00007f6d3d006090 R08: 0000000000000000 R09: 0000000000000000 [ 380.084180][ T9168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 380.085641][ T9181] netlink: 'syz.2.1467': attribute type 16 has an invalid length. [ 380.092351][ T9168] R13: 00007f6d3c416038 R14: 00007f6d3c415fa0 R15: 00007ffef9779698 [ 380.092389][ T9168] [ 380.112428][ T9181] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1467'. [ 380.640684][ T9199] netlink: 'syz.3.1470': attribute type 21 has an invalid length. [ 380.653990][ T9199] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1470'. [ 380.909398][ T9203] device syzkaller0 entered promiscuous mode [ 381.461950][ T9225] FAULT_INJECTION: forcing a failure. [ 381.461950][ T9225] name failslab, interval 1, probability 0, space 0, times 0 [ 381.476348][ T9225] CPU: 1 PID: 9225 Comm: syz.2.1479 Not tainted syzkaller #0 [ 381.483866][ T9225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 381.493946][ T9225] Call Trace: [ 381.497239][ T9225] [ 381.500194][ T9225] dump_stack_lvl+0x188/0x24e [ 381.504900][ T9225] ? show_regs_print_info+0x12/0x12 [ 381.510137][ T9225] ? load_image+0x410/0x410 [ 381.514938][ T9225] ? __might_sleep+0xd0/0xd0 [ 381.519570][ T9225] ? __lock_acquire+0x7bd0/0x7bd0 [ 381.524695][ T9225] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 381.530368][ T9225] should_fail_ex+0x390/0x4c0 [ 381.535080][ T9225] should_failslab+0x5/0x20 [ 381.539619][ T9225] slab_pre_alloc_hook+0x59/0x300 [ 381.544752][ T9225] kmem_cache_alloc_node+0x5a/0x310 [ 381.549960][ T9225] ? __alloc_skb+0xf9/0x7d0 [ 381.554567][ T9225] __alloc_skb+0xf9/0x7d0 [ 381.559010][ T9225] __ip6_append_data+0x2b71/0x3ed0 [ 381.564255][ T9225] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 381.569676][ T9225] ? ip6_setup_cork+0xff0/0xff0 [ 381.574548][ T9225] ? ip6_setup_cork+0xa4a/0xff0 [ 381.579433][ T9225] ip6_append_data+0x1c8/0x3d0 [ 381.584357][ T9225] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 381.589659][ T9225] rawv6_sendmsg+0x1221/0x1710 [ 381.594702][ T9225] ? compat_rawv6_ioctl+0x60/0x60 [ 381.599756][ T9225] ? aa_sk_perm+0x81f/0x950 [ 381.604362][ T9225] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 381.610993][ T9225] ? inet_sendmsg+0x7a/0x2a0 [ 381.615694][ T9225] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 381.621101][ T9225] ? inet_send_prepare+0x250/0x250 [ 381.626256][ T9225] ____sys_sendmsg+0x5ed/0x9a0 [ 381.631053][ T9225] ? __sys_sendmsg_sock+0x30/0x30 [ 381.636449][ T9225] ? __import_iovec+0x306/0x510 [ 381.641323][ T9225] ? import_iovec+0x6f/0xa0 [ 381.645833][ T9225] ___sys_sendmsg+0x2a2/0x360 [ 381.650625][ T9225] ? __sys_sendmsg+0x2a0/0x2a0 [ 381.655409][ T9225] ? __lock_acquire+0x7bd0/0x7bd0 [ 381.661116][ T9225] __se_sys_sendmsg+0x1c3/0x2b0 [ 381.665984][ T9225] ? __x64_sys_sendmsg+0x80/0x80 [ 381.670941][ T9225] ? lockdep_hardirqs_on+0x94/0x140 [ 381.676334][ T9225] do_syscall_64+0x4c/0xa0 [ 381.680762][ T9225] ? clear_bhb_loop+0x60/0xb0 [ 381.685442][ T9225] ? clear_bhb_loop+0x60/0xb0 [ 381.690231][ T9225] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 381.696152][ T9225] RIP: 0033:0x7ffba1b9ce59 [ 381.700660][ T9225] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 381.720735][ T9225] RSP: 002b:00007ffba29d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 381.729273][ T9225] RAX: ffffffffffffffda RBX: 00007ffba1e15fa0 RCX: 00007ffba1b9ce59 [ 381.737443][ T9225] RDX: 0000000000000060 RSI: 0000200000000080 RDI: 0000000000000003 [ 381.745454][ T9225] RBP: 00007ffba29d4090 R08: 0000000000000000 R09: 0000000000000000 [ 381.754231][ T9225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 381.762421][ T9225] R13: 00007ffba1e16038 R14: 00007ffba1e15fa0 R15: 00007ffde63f8cb8 [ 381.771639][ T9225] [ 381.928218][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 381.970415][ T9231] ref_ctr_offset mismatch. inode: 0x604 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x7602 [ 384.009704][ T9253] netlink: 'syz.0.1487': attribute type 29 has an invalid length. [ 384.810773][ T9253] netlink: 'syz.0.1487': attribute type 29 has an invalid length. [ 385.729956][ T9291] netlink: 'syz.0.1500': attribute type 21 has an invalid length. [ 385.730564][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 385.760904][ T9291] netlink: 'syz.0.1500': attribute type 1 has an invalid length. [ 385.831622][ T9291] netlink: 16098 bytes leftover after parsing attributes in process `syz.0.1500'. [ 386.296358][ T9294] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 386.343809][ T9294] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 386.375086][ T9294] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 386.382603][ T9294] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 386.572427][ T9295] netlink: 'syz.1.1501': attribute type 21 has an invalid length. [ 386.601236][ T9295] netlink: 'syz.1.1501': attribute type 6 has an invalid length. [ 386.704209][ T9295] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1501'. [ 386.732111][ T9304] FAULT_INJECTION: forcing a failure. [ 386.732111][ T9304] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 386.758340][ T9307] netlink: 'syz.2.1505': attribute type 29 has an invalid length. [ 386.770590][ T9304] CPU: 1 PID: 9304 Comm: syz.0.1506 Not tainted syzkaller #0 [ 386.778117][ T9304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 386.788639][ T9304] Call Trace: [ 386.792054][ T9304] [ 386.795012][ T9304] dump_stack_lvl+0x188/0x24e [ 386.799911][ T9304] ? show_regs_print_info+0x12/0x12 [ 386.801495][ T9307] netlink: 'syz.2.1505': attribute type 29 has an invalid length. [ 386.805136][ T9304] ? load_image+0x410/0x410 [ 386.805175][ T9304] ? __lock_acquire+0x7bd0/0x7bd0 [ 386.805205][ T9304] should_fail_ex+0x390/0x4c0 [ 386.805227][ T9304] _copy_from_user+0x2c/0x170 [ 386.805251][ T9304] csum_and_copy_from_iter+0x492/0x1380 [ 386.805279][ T9304] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 386.805310][ T9304] ip_generic_getfrag+0x150/0x2e0 [ 386.805331][ T9304] ? ip_skb_dst_mtu+0x9b0/0x9b0 [ 386.805345][ T9304] ? raw6_getfrag+0xe6/0x300 [ 386.805365][ T9304] ? __alloc_skb+0x4e6/0x7d0 [ 386.805380][ T9304] ? skb_put+0x10e/0x200 [ 386.805402][ T9304] __ip6_append_data+0x2f43/0x3ed0 [ 386.805451][ T9304] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 386.805479][ T9304] ? ip6_setup_cork+0xff0/0xff0 [ 386.805499][ T9304] ? ip6_setup_cork+0xa4a/0xff0 [ 386.805523][ T9304] ip6_append_data+0x1c8/0x3d0 [ 386.805548][ T9304] ? rawv6_send_hdrinc+0x16a0/0x16a0 [ 386.805572][ T9304] rawv6_sendmsg+0x1221/0x1710 [ 386.805611][ T9304] ? compat_rawv6_ioctl+0x60/0x60 [ 386.886871][ T9307] netlink: 'syz.2.1505': attribute type 29 has an invalid length. [ 386.889587][ T9304] ? aa_sk_perm+0x81f/0x950 [ 386.889638][ T9304] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 386.928610][ T9304] ? inet_sendmsg+0x7a/0x2a0 [ 386.933587][ T9304] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 386.938977][ T9304] ? inet_send_prepare+0x250/0x250 [ 386.944320][ T9304] ____sys_sendmsg+0x5ed/0x9a0 [ 386.949158][ T9304] ? __sys_sendmsg_sock+0x30/0x30 [ 386.954221][ T9304] ? __import_iovec+0x306/0x510 [ 386.959204][ T9304] ? import_iovec+0x6f/0xa0 [ 386.963758][ T9304] ___sys_sendmsg+0x2a2/0x360 [ 386.968574][ T9304] ? __sys_sendmsg+0x2a0/0x2a0 [ 386.973420][ T9304] ? __lock_acquire+0x7bd0/0x7bd0 [ 386.978520][ T9304] __se_sys_sendmsg+0x1c3/0x2b0 [ 386.983521][ T9304] ? ct_nmi_exit+0x145/0x1c0 [ 386.988248][ T9304] ? __x64_sys_sendmsg+0x80/0x80 [ 386.993366][ T9304] ? lockdep_hardirqs_on+0x94/0x140 [ 386.998732][ T9304] do_syscall_64+0x4c/0xa0 [ 387.003244][ T9304] ? clear_bhb_loop+0x60/0xb0 [ 387.008219][ T9304] ? clear_bhb_loop+0x60/0xb0 [ 387.012944][ T9304] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 387.019019][ T9304] RIP: 0033:0x7f6d3c19ce59 [ 387.023557][ T9304] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 387.044377][ T9304] RSP: 002b:00007f6d3d006028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 387.053182][ T9304] RAX: ffffffffffffffda RBX: 00007f6d3c415fa0 RCX: 00007f6d3c19ce59 [ 387.061194][ T9304] RDX: 0000000000000060 RSI: 0000200000000080 RDI: 0000000000000003 [ 387.069381][ T9304] RBP: 00007f6d3d006090 R08: 0000000000000000 R09: 0000000000000000 [ 387.078174][ T9304] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 387.086192][ T9304] R13: 00007f6d3c416038 R14: 00007f6d3c415fa0 R15: 00007ffef9779698 [ 387.094472][ T9304] [ 387.433906][ T9323] netlink: 'syz.4.1511': attribute type 3 has an invalid length. [ 387.442601][ T9323] netlink: 'syz.4.1511': attribute type 4 has an invalid length. [ 387.624310][ T9323] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1511'. [ 388.110947][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 388.283563][ T9360] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1518'. [ 388.853261][ T9369] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1522'. [ 388.907749][ T9370] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1522'. [ 390.654799][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 391.633742][ T9427] can: request_module (can-proto-0) failed. [ 393.128224][ T9468] validate_nla: 1 callbacks suppressed [ 393.128260][ T9468] netlink: 'syz.3.1553': attribute type 21 has an invalid length. [ 393.224188][ T9468] netlink: 'syz.3.1553': attribute type 1 has an invalid length. [ 393.326515][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 394.335239][ T9491] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1557'. [ 394.386482][ T9480] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1557'. [ 394.510746][ T9494] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 394.606922][ T9494] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 394.830376][ T9498] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1562'. [ 394.859785][ T9497] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1562'. [ 395.259739][ T9510] netlink: 'syz.0.1567': attribute type 12 has an invalid length. [ 395.293743][ T9510] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1567'. [ 395.328131][ T9510] netlink: 65055 bytes leftover after parsing attributes in process `syz.0.1567'. [ 395.554398][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 396.467786][ T9532] netlink: 'syz.0.1574': attribute type 6 has an invalid length. [ 396.508341][ T9532] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1574'. [ 397.176955][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 398.145531][ T9578] netlink: 'syz.1.1591': attribute type 10 has an invalid length. [ 398.180011][ T9578] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1591'. [ 398.368409][ T9578] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1591'. [ 398.420284][ T9578] netlink: 'syz.1.1591': attribute type 12 has an invalid length. [ 398.453946][ T9578] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1591'. [ 398.651011][ T9583] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.182325][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 403.637065][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 405.576071][ T9706] FAULT_INJECTION: forcing a failure. [ 405.576071][ T9706] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 405.683714][ T9706] CPU: 1 PID: 9706 Comm: syz.4.1636 Not tainted syzkaller #0 [ 405.693050][ T9706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 405.707078][ T9706] Call Trace: [ 405.710528][ T9706] [ 405.713589][ T9706] dump_stack_lvl+0x188/0x24e [ 405.720304][ T9706] ? show_regs_print_info+0x12/0x12 [ 405.726680][ T9706] ? load_image+0x410/0x410 [ 405.731941][ T9706] ? __lock_acquire+0x7bd0/0x7bd0 [ 405.737904][ T9706] should_fail_ex+0x390/0x4c0 [ 405.742995][ T9706] _copy_from_user+0x2c/0x170 [ 405.749935][ T9706] __sys_bpf+0x2ea/0x780 [ 405.756028][ T9706] ? bpf_link_show_fdinfo+0x380/0x380 [ 405.763723][ T9706] ? lock_chain_count+0x20/0x20 [ 405.769639][ T9706] __x64_sys_bpf+0x78/0x90 [ 405.774636][ T9706] do_syscall_64+0x4c/0xa0 [ 405.780415][ T9706] ? clear_bhb_loop+0x60/0xb0 [ 405.786737][ T9706] ? clear_bhb_loop+0x60/0xb0 [ 405.792672][ T9706] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 405.800102][ T9706] RIP: 0033:0x7f887679ce59 [ 405.806414][ T9706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.829361][ T9706] RSP: 002b:00007f88775ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 405.840349][ T9706] RAX: ffffffffffffffda RBX: 00007f8876a15fa0 RCX: 00007f887679ce59 [ 405.849136][ T9706] RDX: 0000000000000021 RSI: 0000200000000140 RDI: 0000000000000005 [ 405.859220][ T9706] RBP: 00007f88775ae090 R08: 0000000000000000 R09: 0000000000000000 [ 405.867605][ T9706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 405.876693][ T9706] R13: 00007f8876a16038 R14: 00007f8876a15fa0 R15: 00007fff359c6f98 [ 405.886116][ T9706] [ 406.111728][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 406.737687][ T9726] netlink: 4079 bytes leftover after parsing attributes in process `syz.2.1643'. [ 406.987191][ T9736] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.1648'. [ 407.282264][ T9359] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 408.057141][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 408.377229][ T9763] netlink: 'syz.0.1656': attribute type 21 has an invalid length. [ 408.472797][ T9763] netlink: 176 bytes leftover after parsing attributes in process `syz.0.1656'. [ 408.936554][ T9775] FAULT_INJECTION: forcing a failure. [ 408.936554][ T9775] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 408.986674][ T9775] CPU: 0 PID: 9775 Comm: syz.3.1660 Not tainted syzkaller #0 [ 408.995510][ T9775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 409.006255][ T9775] Call Trace: [ 409.010016][ T9775] [ 409.013028][ T9775] dump_stack_lvl+0x188/0x24e [ 409.017756][ T9775] ? show_regs_print_info+0x12/0x12 [ 409.023015][ T9775] ? load_image+0x410/0x410 [ 409.027831][ T9775] ? __lock_acquire+0x7bd0/0x7bd0 [ 409.030147][ T9783] netlink: 'syz.1.1663': attribute type 10 has an invalid length. [ 409.032979][ T9775] should_fail_ex+0x390/0x4c0 [ 409.033017][ T9775] strncpy_from_user+0x32/0x340 [ 409.033047][ T9775] bpf_prog_load+0x200/0x1530 [ 409.033083][ T9775] ? map_freeze+0x390/0x390 [ 409.033108][ T9775] ? __might_fault+0xa6/0x120 [ 409.066570][ T9775] ? __might_fault+0xa6/0x120 [ 409.071649][ T9775] ? __might_fault+0xc2/0x120 [ 409.076906][ T9775] ? __might_fault+0xa6/0x120 [ 409.082398][ T9775] ? bpf_lsm_bpf+0x5/0x10 [ 409.087404][ T9775] ? security_bpf+0x7a/0xa0 [ 409.092080][ T9775] __sys_bpf+0x5b8/0x780 [ 409.096468][ T9775] ? bpf_link_show_fdinfo+0x380/0x380 [ 409.102455][ T9775] ? lock_chain_count+0x20/0x20 [ 409.108209][ T9775] __x64_sys_bpf+0x78/0x90 [ 409.115043][ T9775] do_syscall_64+0x4c/0xa0 [ 409.120315][ T9775] ? clear_bhb_loop+0x60/0xb0 [ 409.125208][ T9775] ? clear_bhb_loop+0x60/0xb0 [ 409.129939][ T9775] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 409.136090][ T9775] RIP: 0033:0x7f592859ce59 [ 409.140930][ T9775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.162920][ T9775] RSP: 002b:00007f5929517028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 409.171639][ T9775] RAX: ffffffffffffffda RBX: 00007f5928815fa0 RCX: 00007f592859ce59 [ 409.180632][ T9775] RDX: 0000000000000021 RSI: 0000200000000140 RDI: 0000000000000005 [ 409.188902][ T9775] RBP: 00007f5929517090 R08: 0000000000000000 R09: 0000000000000000 [ 409.197571][ T9775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 409.205763][ T9775] R13: 00007f5928816038 R14: 00007f5928815fa0 R15: 00007fff5532d198 [ 409.214152][ T9775] [ 410.503423][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 412.226435][ T9845] netlink: 'syz.1.1685': attribute type 2 has an invalid length. [ 412.318315][ T9845] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1685'. [ 412.370973][ T9846] netlink: 'syz.1.1685': attribute type 10 has an invalid length. [ 412.711290][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 413.823021][ T9871] netlink: 'syz.1.1696': attribute type 4 has an invalid length. [ 413.916288][ T9874] netlink: 'syz.1.1696': attribute type 13 has an invalid length. [ 413.992668][ T9874] netlink: 24643 bytes leftover after parsing attributes in process `syz.1.1696'. [ 414.072366][ T9877] netlink: 'syz.1.1696': attribute type 13 has an invalid length. [ 414.129479][ T9877] netlink: 24643 bytes leftover after parsing attributes in process `syz.1.1696'. [ 415.045207][ T9889] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.236684][ T9900] netlink: 'syz.2.1704': attribute type 10 has an invalid length. [ 415.264121][ T9900] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1704'. [ 415.297544][ T9900] device bond0 entered promiscuous mode [ 415.316573][ T9900] device bond_slave_0 entered promiscuous mode [ 415.323056][ T9900] device bond_slave_1 entered promiscuous mode [ 415.343312][ T9900] bridge0: port 4(bond0) entered blocking state [ 415.354801][ T9900] bridge0: port 4(bond0) entered disabled state [ 415.378154][ T9900] bridge0: port 4(bond0) entered blocking state [ 415.385083][ T9900] bridge0: port 4(bond0) entered forwarding state [ 415.410268][ T9909] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1707'. [ 415.423988][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 415.966419][ T9900] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1704'. [ 416.046453][ T9904] netlink: 'syz.2.1704': attribute type 12 has an invalid length. [ 416.104395][ T9904] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1704'. [ 416.161853][ T9900] bridge0: port 4(bond0) entered disabled state [ 416.173333][ T9900] bridge0: port 3(dummy0) entered disabled state [ 416.184307][ T9900] bridge0: port 2(bridge_slave_1) entered disabled state [ 416.198739][ T9900] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.306701][ T4277] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 419.444353][ T9986] netlink: 'syz.3.1734': attribute type 15 has an invalid length. [ 419.528820][ T9986] netlink: 'syz.3.1734': attribute type 7 has an invalid length. [ 419.861422][ T9999] netlink: 'syz.1.1737': attribute type 2 has an invalid length. [ 420.012371][ T9999] netlink: 'syz.1.1737': attribute type 16 has an invalid length. [ 420.023118][ T9999] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1737'. [ 420.443546][T10015] netlink: 65055 bytes leftover after parsing attributes in process `syz.2.1744'. [ 420.582750][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 422.907830][T10075] IPv6: NLM_F_CREATE should be specified when creating new route [ 426.086194][T10088] netlink: 'syz.3.1771': attribute type 2 has an invalid length. [ 426.164420][T10088] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1771'. [ 426.629114][T10103] netlink: 'syz.4.1775': attribute type 3 has an invalid length. [ 426.661299][T10103] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.1775'. [ 430.766443][T10143] netlink: 'syz.3.1787': attribute type 2 has an invalid length. [ 430.788600][T10143] netlink: 'syz.3.1787': attribute type 8 has an invalid length. [ 430.820040][T10143] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1787'. [ 431.373507][T10164] netlink: 'syz.2.1795': attribute type 10 has an invalid length. [ 434.469911][T10175] netlink: 'syz.3.1797': attribute type 21 has an invalid length. [ 434.480369][T10177] netlink: 63503 bytes leftover after parsing attributes in process `syz.4.1800'. [ 434.835757][ T4277] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 435.789767][T10219] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1814'. [ 438.309579][ T5175] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 438.370207][T10213] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1814'. [ 438.425254][T10233] netlink: 'syz.3.1819': attribute type 21 has an invalid length. [ 438.810874][T10241] netlink: 'syz.0.1822': attribute type 3 has an invalid length. [ 438.825535][T10241] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1822'. [ 439.328979][T10262] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1829'. [ 439.528538][T10267] netlink: 'syz.2.1831': attribute type 10 has an invalid length. [ 439.562416][T10267] device dummy0 left promiscuous mode [ 439.597131][T10267] bridge0: port 3(dummy0) entered disabled state [ 439.994350][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.002032][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.986788][T10287] netlink: 'syz.2.1836': attribute type 21 has an invalid length. [ 443.241902][T10303] netlink: 'syz.2.1840': attribute type 3 has an invalid length. [ 443.273889][T10303] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1840'. [ 443.413205][T10311] netlink: 128 bytes leftover after parsing attributes in process `syz.4.1844'. [ 443.426729][T10311] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 443.472842][T10311] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 444.460679][T10332] netlink: 'syz.0.1850': attribute type 21 has an invalid length. [ 447.594411][T10349] netlink: 'syz.4.1855': attribute type 3 has an invalid length. [ 447.623848][T10349] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.1855'. [ 447.759009][T10360] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.1860'. [ 451.958890][T10400] netlink: 'syz.0.1872': attribute type 3 has an invalid length. [ 452.013501][T10400] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1872'. [ 452.192162][T10406] netlink: 'syz.2.1869': attribute type 21 has an invalid length. [ 452.521933][T10411] netlink: 'syz.0.1874': attribute type 16 has an invalid length. [ 452.565498][T10411] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1874'. [ 452.655077][T10411] netlink: 'syz.0.1874': attribute type 10 has an invalid length. [ 452.816419][T10411] team0: Port device macvlan0 added [ 453.077573][T10425] netlink: 'syz.3.1877': attribute type 16 has an invalid length. [ 453.109265][T10425] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1877'. [ 453.159779][T10425] netlink: 'syz.3.1877': attribute type 10 has an invalid length. [ 453.350738][T10425] device macvlan0 entered promiscuous mode [ 453.396486][T10425] team0: Port device macvlan0 added [ 454.089263][T10447] netlink: 'syz.3.1884': attribute type 3 has an invalid length. [ 454.111753][T10447] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.1884'. [ 454.234964][T10449] netlink: 'syz.4.1894': attribute type 10 has an invalid length. [ 454.263848][T10449] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1894'. [ 454.308289][T10449] netlink: 'syz.4.1894': attribute type 10 has an invalid length. [ 457.029099][T10458] device syzkaller0 entered promiscuous mode [ 457.344558][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 460.286848][T10490] netlink: 'syz.2.1896': attribute type 21 has an invalid length. [ 460.342688][T10490] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1896'. [ 460.718205][T10498] netlink: 16211 bytes leftover after parsing attributes in process `syz.0.1899'. [ 460.860315][T10506] netlink: 'syz.3.1900': attribute type 21 has an invalid length. [ 461.275931][T10525] netlink: 'syz.2.1906': attribute type 16 has an invalid length. [ 461.291542][T10525] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1906'. [ 461.310889][T10525] netlink: 'syz.2.1906': attribute type 10 has an invalid length. [ 461.969333][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 464.062806][T10568] netlink: 'syz.1.1918': attribute type 21 has an invalid length. [ 464.483492][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 465.199752][T10583] netlink: 'syz.4.1923': attribute type 16 has an invalid length. [ 465.224066][T10583] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1923'. [ 467.491100][T10583] netlink: 'syz.4.1923': attribute type 10 has an invalid length. [ 468.023322][T10594] netlink: 'syz.4.1928': attribute type 41 has an invalid length. [ 468.192636][T10607] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1931'. [ 468.967161][T10626] netlink: 'syz.1.1934': attribute type 21 has an invalid length. [ 469.185285][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 469.239848][ T4349] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 470.245302][T10645] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.1942'. [ 473.336260][T10658] netlink: 'syz.2.1946': attribute type 3 has an invalid length. [ 473.351688][T10658] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1946'. [ 473.988765][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 476.760113][T10689] netlink: 'syz.4.1952': attribute type 21 has an invalid length. [ 477.142025][T10702] netlink: 'syz.1.1960': attribute type 21 has an invalid length. [ 477.161520][T10702] netlink: 'syz.1.1960': attribute type 22 has an invalid length. [ 477.177998][T10702] netlink: 'syz.1.1960': attribute type 13 has an invalid length. [ 477.202879][T10702] netlink: 6188 bytes leftover after parsing attributes in process `syz.1.1960'. [ 477.229155][T10703] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1960'. [ 479.845619][T10705] netlink: 'syz.1.1960': attribute type 25 has an invalid length. [ 479.854305][T10705] netlink: 'syz.1.1960': attribute type 28 has an invalid length. [ 480.349004][T10715] netlink: 'syz.0.1963': attribute type 3 has an invalid length. [ 480.370483][ T4277] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 480.391608][T10715] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1963'. [ 480.421569][T10720] netlink: 'syz.1.1965': attribute type 10 has an invalid length. [ 480.886552][T10732] netlink: 'syz.0.1971': attribute type 11 has an invalid length. [ 484.214430][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 484.296821][T10758] netlink: 'syz.3.1978': attribute type 3 has an invalid length. [ 484.353980][T10758] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.1978'. [ 484.624979][T10768] netlink: 'syz.1.1980': attribute type 21 has an invalid length. [ 485.085145][T10779] netlink: 'syz.3.1986': attribute type 11 has an invalid length. [ 485.489976][T10795] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1991'. [ 485.512528][T10797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1991'. [ 485.676119][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 485.741007][T10802] netlink: 'syz.2.1993': attribute type 3 has an invalid length. [ 485.769287][T10802] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1993'. [ 488.550686][T10822] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2001'. [ 488.590580][T10822] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2001'. [ 488.642674][T10826] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2001'. [ 489.130367][T10836] netlink: 'syz.0.2004': attribute type 21 has an invalid length. [ 489.264951][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 489.891850][T10841] netlink: 'syz.2.2007': attribute type 11 has an invalid length. [ 493.715502][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 493.827602][T10887] FAULT_INJECTION: forcing a failure. [ 493.827602][T10887] name failslab, interval 1, probability 0, space 0, times 0 [ 493.883812][T10887] CPU: 0 PID: 10887 Comm: syz.1.2022 Not tainted syzkaller #0 [ 493.895403][T10887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 493.906150][T10887] Call Trace: [ 493.911306][T10887] [ 493.914505][T10887] dump_stack_lvl+0x188/0x24e [ 493.919271][T10887] ? show_regs_print_info+0x12/0x12 [ 493.926726][T10887] ? load_image+0x410/0x410 [ 493.932360][T10887] ? __might_sleep+0xd0/0xd0 [ 493.938676][T10887] ? __lock_acquire+0x7bd0/0x7bd0 [ 493.947062][T10887] should_fail_ex+0x390/0x4c0 [ 493.952781][T10887] should_failslab+0x5/0x20 [ 493.959641][T10887] slab_pre_alloc_hook+0x59/0x300 [ 493.967116][T10887] kmem_cache_alloc_node+0x5a/0x310 [ 493.973150][T10887] ? __alloc_skb+0xf9/0x7d0 [ 493.979417][T10887] __alloc_skb+0xf9/0x7d0 [ 493.985902][T10887] alloc_skb_with_frags+0xa7/0x710 [ 493.992257][T10887] ? trace_call_bpf+0xbf/0x6b0 [ 493.997837][T10887] ? __lock_acquire+0x7bd0/0x7bd0 [ 494.003157][T10887] sock_alloc_send_pskb+0x87f/0x9a0 [ 494.009287][T10887] ? migrate_enable+0x148/0x220 [ 494.014616][T10887] ? sock_kzfree_s+0x50/0x50 [ 494.019990][T10887] tun_get_user+0x800/0x3c20 [ 494.024944][T10887] ? trace_event_raw_event_lock+0x140/0x230 [ 494.031881][T10887] ? rcu_read_unlock+0xa0/0xa0 [ 494.037011][T10887] ? tun_get+0x1c/0x2e0 [ 494.042306][T10887] ? __lock_acquire+0x7bd0/0x7bd0 [ 494.050048][T10887] ? tun_get+0x1c/0x2e0 [ 494.055015][T10887] tun_chr_write_iter+0x112/0x1f0 [ 494.061426][T10887] vfs_write+0x482/0x9a0 [ 494.066567][T10887] ? file_end_write+0x250/0x250 [ 494.071764][T10887] ? __fget_files+0x3fc/0x460 [ 494.077308][T10887] ? __fdget_pos+0x1d4/0x360 [ 494.082067][T10887] ? ksys_write+0x70/0x260 [ 494.086767][T10887] ksys_write+0x14d/0x260 [ 494.091568][T10887] ? __ia32_sys_read+0x80/0x80 [ 494.096660][T10887] ? lockdep_hardirqs_on+0x94/0x140 [ 494.105461][T10887] do_syscall_64+0x4c/0xa0 [ 494.110551][T10887] ? clear_bhb_loop+0x60/0xb0 [ 494.116105][T10887] ? clear_bhb_loop+0x60/0xb0 [ 494.121078][T10887] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 494.127839][T10887] RIP: 0033:0x7fb842f9ce59 [ 494.132430][T10887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 494.153927][T10887] RSP: 002b:00007fb843eee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 494.163114][T10887] RAX: ffffffffffffffda RBX: 00007fb843215fa0 RCX: 00007fb842f9ce59 [ 494.172800][T10887] RDX: 000000000000cfa4 RSI: 00002000000006c0 RDI: 00000000000000c8 [ 494.184819][T10887] RBP: 00007fb843eee090 R08: 0000000000000000 R09: 0000000000000000 [ 494.193711][T10887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.203981][T10887] R13: 00007fb843216038 R14: 00007fb843215fa0 R15: 00007ffe65ee3608 [ 494.213356][T10887] [ 497.633867][T10908] device wlan1 left promiscuous mode [ 497.684326][T10908] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2028'. [ 497.914321][T10917] netlink: 'syz.1.2029': attribute type 10 has an invalid length. [ 497.950061][T10917] team0: Device hsr_slave_0 failed to register rx_handler [ 498.188683][T10925] FAULT_INJECTION: forcing a failure. [ 498.188683][T10925] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 498.277422][T10925] CPU: 1 PID: 10925 Comm: syz.3.2033 Not tainted syzkaller #0 [ 498.286715][T10925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 498.298112][T10925] Call Trace: [ 498.302035][T10925] [ 498.305963][T10925] dump_stack_lvl+0x188/0x24e [ 498.311492][T10925] ? show_regs_print_info+0x12/0x12 [ 498.317025][T10925] ? load_image+0x410/0x410 [ 498.324051][T10925] ? __lock_acquire+0x7bd0/0x7bd0 [ 498.330000][T10925] should_fail_ex+0x390/0x4c0 [ 498.336662][T10925] _copy_from_user+0x2c/0x170 [ 498.343642][T10925] __sys_bpf+0x2ea/0x780 [ 498.349185][T10925] ? bpf_link_show_fdinfo+0x380/0x380 [ 498.355784][T10925] ? lock_chain_count+0x20/0x20 [ 498.361510][T10925] __x64_sys_bpf+0x78/0x90 [ 498.366504][T10925] do_syscall_64+0x4c/0xa0 [ 498.371122][T10925] ? clear_bhb_loop+0x60/0xb0 [ 498.377105][T10925] ? clear_bhb_loop+0x60/0xb0 [ 498.383792][T10925] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 498.390118][T10925] RIP: 0033:0x7f592859ce59 [ 498.396484][T10925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.422025][T10925] RSP: 002b:00007f5929517028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 498.431896][T10925] RAX: ffffffffffffffda RBX: 00007f5928815fa0 RCX: 00007f592859ce59 [ 498.442290][T10925] RDX: 000000000000000c RSI: 0000200000000cc0 RDI: 000000000000000a [ 498.451885][T10925] RBP: 00007f5929517090 R08: 0000000000000000 R09: 0000000000000000 [ 498.461099][T10925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.470971][T10925] R13: 00007f5928816038 R14: 00007f5928815fa0 R15: 00007fff5532d198 [ 498.479229][T10925] [ 499.188624][T10926] netlink: 'syz.0.2030': attribute type 21 has an invalid length. [ 499.475832][T10944] netlink: 'syz.3.2039': attribute type 21 has an invalid length. [ 499.652565][T10952] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2042'. [ 501.426409][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.433287][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.026331][ T9346] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 503.610710][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 504.089371][T10995] netlink: 'syz.1.2054': attribute type 21 has an invalid length. [ 504.695972][T11001] netlink: 'syz.0.2059': attribute type 10 has an invalid length. [ 504.773504][T11003] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.2060'. [ 504.820789][T11003] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2060'. [ 507.448113][T11001] team0: Device hsr_slave_0 failed to register rx_handler [ 507.526374][T11018] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 507.551360][T11018] device syzkaller0 entered promiscuous mode [ 507.913191][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 508.076415][T11036] netlink: 'syz.4.2070': attribute type 3 has an invalid length. [ 508.114779][T11036] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2070'. [ 510.020449][T11028] netlink: 'syz.2.2068': attribute type 4 has an invalid length. [ 510.031570][T11028] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2068'. [ 510.041397][T11028] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 510.068662][T11030] netlink: 'syz.0.2067': attribute type 2 has an invalid length. [ 510.084084][T11030] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2067'. [ 510.406526][T11054] netlink: 'syz.1.2071': attribute type 21 has an invalid length. [ 510.849722][T11065] netlink: 'syz.2.2078': attribute type 10 has an invalid length. [ 514.087581][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 514.181853][T11084] netlink: 'syz.0.2085': attribute type 3 has an invalid length. [ 514.273930][T11084] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2085'. [ 515.113329][T11106] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2093'. [ 515.494498][T11118] netlink: 'syz.4.2098': attribute type 21 has an invalid length. [ 515.529217][T11118] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2098'. [ 515.622877][T11118] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2098'. [ 515.687998][T11119] netlink: 'syz.4.2098': attribute type 21 has an invalid length. [ 515.707770][T11119] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2098'. [ 515.774447][T11119] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2098'. [ 518.657901][T11128] netlink: 'syz.0.2100': attribute type 3 has an invalid length. [ 518.708666][T11128] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2100'. [ 518.734587][T11137] netlink: 'syz.1.2101': attribute type 21 has an invalid length. [ 518.808880][ T4277] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 523.328695][T11176] netlink: 'syz.1.2117': attribute type 3 has an invalid length. [ 523.397426][T11176] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2117'. [ 523.431286][T11180] Dead loop on virtual device ip6_vti0, fix it urgently! [ 523.526232][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 523.844862][T11189] netlink: 'syz.3.2121': attribute type 21 has an invalid length. [ 527.977029][T11224] netlink: 'syz.0.2133': attribute type 3 has an invalid length. [ 527.987769][T11224] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2133'. [ 528.860741][T11229] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2134'. [ 528.902392][T11229] syzkaller0: tun_chr_ioctl cmd 2147767519 [ 529.052264][ T4277] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 529.498111][T11243] netlink: 'syz.0.2137': attribute type 21 has an invalid length. [ 530.962520][T11269] netlink: 'syz.0.2147': attribute type 3 has an invalid length. [ 530.980421][T11269] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2147'. [ 531.146717][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 533.917055][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 534.061414][ T9347] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 534.336014][T11297] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2155'. [ 534.576121][T11300] netlink: 17861 bytes leftover after parsing attributes in process `syz.3.2156'. [ 534.945535][T11302] netlink: 'syz.2.2157': attribute type 21 has an invalid length. [ 538.577582][T11347] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2168'. [ 539.397799][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 539.433411][T11360] netlink: 'syz.2.2170': attribute type 10 has an invalid length. [ 540.536251][T11368] netlink: 'syz.0.2174': attribute type 21 has an invalid length. [ 540.961145][T11370] netlink: 'syz.3.2175': attribute type 3 has an invalid length. [ 541.011610][T11370] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.2175'. [ 541.320242][T11383] netlink: 'syz.4.2180': attribute type 3 has an invalid length. [ 541.341565][T11383] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2180'. [ 542.968079][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 544.461771][T11405] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2187'. [ 545.316612][T11425] netlink: 'syz.4.2194': attribute type 3 has an invalid length. [ 545.357287][T11425] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2194'. [ 545.395573][T11427] netlink: 'syz.1.2193': attribute type 3 has an invalid length. [ 545.409436][T11427] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2193'. [ 546.121741][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 547.041595][T11454] netlink: 'syz.1.2202': attribute type 21 has an invalid length. [ 549.789949][T11471] netlink: 'syz.0.2210': attribute type 1 has an invalid length. [ 549.909633][T11480] netlink: 'syz.1.2211': attribute type 3 has an invalid length. [ 549.995334][T11480] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2211'. [ 550.732211][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 553.426929][T11509] netlink: 'syz.3.2218': attribute type 21 has an invalid length. [ 557.537553][T11537] netlink: 126612 bytes leftover after parsing attributes in process `syz.4.2228'. [ 557.638934][T11537] netlink: 17 bytes leftover after parsing attributes in process `syz.4.2228'. [ 557.699426][T11540] netlink: 'syz.2.2229': attribute type 6 has an invalid length. [ 558.904036][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 560.185831][T11568] netlink: 'syz.0.2237': attribute type 21 has an invalid length. [ 562.856481][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.863104][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.609258][T11583] netlink: 'syz.2.2242': attribute type 3 has an invalid length. [ 563.636407][T11583] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.2242'. [ 563.836187][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 564.316156][T11595] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2247'. [ 565.183275][ T9347] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 567.993414][T11623] netlink: 180 bytes leftover after parsing attributes in process `syz.2.2257'. [ 568.103453][T11623] netlink: 'syz.2.2257': attribute type 27 has an invalid length. [ 568.143277][T11625] netlink: 'syz.1.2259': attribute type 3 has an invalid length. [ 568.164156][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 568.178241][T11625] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2259'. [ 568.287307][T11623] netlink: 'syz.2.2257': attribute type 3 has an invalid length. [ 568.328330][T11623] netlink: 199824 bytes leftover after parsing attributes in process `syz.2.2257'. [ 568.444709][T11636] netlink: 'syz.3.2260': attribute type 21 has an invalid length. [ 569.000722][T11642] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.2263'. [ 572.623486][T11677] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2276'. [ 572.670278][T11677] netlink: 'syz.1.2276': attribute type 27 has an invalid length. [ 572.796776][T11677] netlink: 'syz.1.2276': attribute type 3 has an invalid length. [ 572.828179][T11677] netlink: 199824 bytes leftover after parsing attributes in process `syz.1.2276'. [ 572.986930][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 574.308885][T11698] netlink: 'syz.3.2284': attribute type 21 has an invalid length. [ 574.750332][T11701] netlink: 'syz.0.2275': attribute type 3 has an invalid length. [ 574.869626][T11701] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2275'. [ 576.060826][T11731] netlink: 'syz.0.2291': attribute type 21 has an invalid length. [ 577.995324][T11737] netlink: 180 bytes leftover after parsing attributes in process `syz.0.2292'. [ 578.068973][T11737] netlink: 'syz.0.2292': attribute type 27 has an invalid length. [ 578.269365][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 580.449066][T11772] netlink: 'syz.2.2302': attribute type 21 has an invalid length. [ 580.690914][T11773] netlink: 'syz.4.2301': attribute type 21 has an invalid length. [ 583.085385][T11786] netlink: 'syz.0.2307': attribute type 10 has an invalid length. [ 583.109455][T11786] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2307'. [ 583.134939][T11786] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 583.352619][T11795] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2311'. [ 583.370602][T11795] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 583.388134][T11795] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 583.814944][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 584.804385][T11813] sctp: [Deprecated]: syz.0.2317 (pid 11813) Use of int in max_burst socket option deprecated. [ 584.804385][T11813] Use struct sctp_assoc_value instead [ 588.325323][T11848] netlink: 'syz.2.2326': attribute type 21 has an invalid length. [ 588.754377][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 590.274270][T11877] sctp: [Deprecated]: syz.3.2335 (pid 11877) Use of int in max_burst socket option deprecated. [ 590.274270][T11877] Use struct sctp_assoc_value instead [ 590.621857][T11893] netlink: 'syz.1.2339': attribute type 21 has an invalid length. [ 590.654127][T11893] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2339'. [ 591.749360][T11908] netlink: 'syz.0.2344': attribute type 21 has an invalid length. [ 592.548526][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 594.378378][T11940] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2356'. [ 594.682642][T11950] netlink: 'syz.4.2358': attribute type 21 has an invalid length. [ 594.813583][T11952] sctp: [Deprecated]: syz.1.2361 (pid 11952) Use of int in max_burst socket option deprecated. [ 594.813583][T11952] Use struct sctp_assoc_value instead [ 597.175574][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 597.746869][ T9347] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 599.300186][T12003] netlink: 'syz.0.2377': attribute type 3 has an invalid length. [ 599.323446][T12003] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2377'. [ 599.378355][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 600.128578][T12022] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 607.108378][T12123] tap0: tun_chr_ioctl cmd 1074025677 [ 607.138238][T12123] tap0: linktype set to 805 [ 607.302420][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.329983][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.350613][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.370091][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.391546][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.409359][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.443263][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.462586][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.483907][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 607.501252][T12131] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 608.117941][T12142] device virt_wifi0 entered promiscuous mode [ 612.336311][T12167] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2424'. [ 612.559321][T12179] netlink: 'syz.0.2427': attribute type 3 has an invalid length. [ 612.664993][T12179] netlink: 'syz.0.2427': attribute type 1 has an invalid length. [ 612.773838][T12179] netlink: 198452 bytes leftover after parsing attributes in process `syz.0.2427'. [ 613.434594][T12189] netlink: 144 bytes leftover after parsing attributes in process `syz.2.2431'. [ 613.959316][T12204] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2438'. [ 614.298796][T12217] netlink: 'syz.0.2441': attribute type 10 has an invalid length. [ 614.345438][T12217] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2441'. [ 614.351193][T12212] netlink: 'syz.3.2439': attribute type 27 has an invalid length. [ 614.383956][T12217] device team0 entered promiscuous mode [ 614.390332][T12217] device team_slave_0 entered promiscuous mode [ 614.481796][T12212] netlink: 164 bytes leftover after parsing attributes in process `syz.3.2439'. [ 614.517053][T12217] device team_slave_1 entered promiscuous mode [ 614.594353][T12217] device geneve1 entered promiscuous mode [ 614.635295][T12217] device macvlan0 entered promiscuous mode [ 614.670548][T12217] bridge0: port 3(team0) entered blocking state [ 614.722727][T12217] bridge0: port 3(team0) entered disabled state [ 614.779893][T12217] bridge0: port 3(team0) entered blocking state [ 614.792964][T12217] bridge0: port 3(team0) entered forwarding state [ 616.396012][T12262] netlink: 196 bytes leftover after parsing attributes in process `syz.4.2452'. [ 616.440965][T12261] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2453'. [ 618.371288][T12299] netlink: 'syz.2.2465': attribute type 3 has an invalid length. [ 618.432721][T12299] netlink: 'syz.2.2465': attribute type 1 has an invalid length. [ 618.454589][T12299] netlink: 198452 bytes leftover after parsing attributes in process `syz.2.2465'. [ 623.572664][T12354] netlink: 'syz.3.2482': attribute type 3 has an invalid length. [ 623.664113][T12354] netlink: 'syz.3.2482': attribute type 1 has an invalid length. [ 623.673052][T12354] netlink: 198452 bytes leftover after parsing attributes in process `syz.3.2482'. [ 624.297468][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.305288][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.928842][T12376] netlink: 'syz.2.2490': attribute type 33 has an invalid length. [ 624.978153][T12376] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2490'. [ 627.615135][T12389] netlink: 'syz.2.2493': attribute type 7 has an invalid length. [ 627.708255][T12395] netlink: 'syz.2.2493': attribute type 29 has an invalid length. [ 627.810487][T12395] netlink: 'syz.2.2493': attribute type 29 has an invalid length. [ 627.889819][T12389] netlink: 'syz.2.2493': attribute type 29 has an invalid length. [ 628.566536][T12407] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2503'. [ 628.680438][T12413] netlink: 'syz.3.2504': attribute type 10 has an invalid length. [ 628.719064][T12413] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2504'. [ 628.782667][ T9349] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 628.823934][T12413] batman_adv: batadv0: Adding interface: vlan1 [ 628.899687][T12413] batman_adv: batadv0: The MTU of interface vlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 629.144561][T12413] batman_adv: batadv0: Interface activated: vlan1 [ 629.279117][T12417] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2503'. [ 629.371927][T12419] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2502'. [ 629.855003][T12428] netlink: 61211 bytes leftover after parsing attributes in process `syz.0.2507'. [ 632.893114][T12456] device bridge_slave_0 left promiscuous mode [ 632.921074][T12456] bridge0: port 1(bridge_slave_0) entered disabled state [ 634.121065][ T4277] Bluetooth: hci3: unexpected subevent 0x0e length: 150 > 15 [ 634.274004][T12499] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2526'. [ 634.550885][ C1] hsr0: VLAN not yet supported [ 638.858287][T12553] TCP: TCP_TX_DELAY enabled [ 641.719478][T12585] netlink: 'syz.2.2552': attribute type 4 has an invalid length. [ 641.797158][T12589] netlink: 'syz.0.2551': attribute type 10 has an invalid length. [ 641.821888][T12589] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2551'. [ 641.951024][T12592] netlink: 'syz.2.2552': attribute type 4 has an invalid length. [ 646.131468][T12618] netlink: 154020 bytes leftover after parsing attributes in process `syz.2.2559'. [ 646.148914][T12618] net_ratelimit: 6138 callbacks suppressed [ 646.148928][T12618] openvswitch: netlink: ufid size 48894 bytes exceeds the range (1, 16) [ 646.209723][T12619] netlink: 'syz.2.2559': attribute type 1 has an invalid length. [ 646.220551][T12619] netlink: 181400 bytes leftover after parsing attributes in process `syz.2.2559'. [ 652.653366][T12637] device syzkaller0 entered promiscuous mode [ 652.754331][T12661] netlink: 154020 bytes leftover after parsing attributes in process `syz.1.2571'. [ 652.800830][T12661] openvswitch: netlink: ufid size 48894 bytes exceeds the range (1, 16) [ 660.048255][T12682] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 660.100161][T12682] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 660.119949][ T30] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 660.298552][T12682] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 660.351897][T12682] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 661.164185][T12706] netlink: 130181 bytes leftover after parsing attributes in process `syz.0.2585'. [ 661.312343][ T4277] Bluetooth: hci3: ISO packet for unknown connection handle 3152 [ 662.247232][T12716] netlink: 'syz.3.2589': attribute type 7 has an invalid length. [ 662.415838][T12728] netlink: 'syz.1.2591': attribute type 3 has an invalid length. [ 662.466214][T12728] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2591'. [ 663.876728][T12746] netlink: 154020 bytes leftover after parsing attributes in process `syz.0.2596'. [ 663.948033][T12746] openvswitch: netlink: ufid size 48894 bytes exceeds the range (1, 16) [ 663.968079][T12749] netlink: 'syz.0.2596': attribute type 1 has an invalid length. [ 664.224457][T12749] netlink: 181400 bytes leftover after parsing attributes in process `syz.0.2596'. [ 666.100692][ T4277] Bluetooth: hci1: ISO packet for unknown connection handle 3152 [ 671.459763][T12838] netlink: 'syz.2.2625': attribute type 1 has an invalid length. [ 671.540495][T12838] netlink: 105120 bytes leftover after parsing attributes in process `syz.2.2625'. [ 671.592191][T12842] netlink: 'syz.4.2626': attribute type 3 has an invalid length. [ 671.628700][T12842] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2626'. [ 676.276390][T12875] netlink: 65055 bytes leftover after parsing attributes in process `syz.0.2635'. [ 677.343522][T12883] netlink: 'syz.0.2638': attribute type 3 has an invalid length. [ 677.360907][T12883] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2638'. [ 677.611990][T12892] netlink: 'syz.4.2641': attribute type 27 has an invalid length. [ 677.638394][T12892] netlink: 'syz.4.2641': attribute type 4 has an invalid length. [ 677.770857][T12892] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2641'. [ 677.916880][ T4277] Bluetooth: hci3: ISO packet for unknown connection handle 3327 [ 682.110487][T12920] netlink: 'syz.3.2651': attribute type 1 has an invalid length. [ 682.147586][T12920] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2651'. [ 682.148665][T12926] netlink: 'syz.2.2654': attribute type 3 has an invalid length. [ 682.184399][T12926] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.2654'. [ 682.607964][T12938] netlink: 14593 bytes leftover after parsing attributes in process `syz.3.2656'. [ 682.685352][T12938] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2656'. [ 685.739106][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.746884][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.513888][T12987] netlink: 134056 bytes leftover after parsing attributes in process `syz.0.2669'. [ 687.741983][T12980] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 687.760863][T12985] netlink: 'syz.3.2668': attribute type 3 has an invalid length. [ 687.843245][T12985] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.2668'. [ 689.316911][T13006] can: request_module (can-proto-0) failed. [ 690.226798][T13020] netlink: 'syz.3.2679': attribute type 10 has an invalid length. [ 690.285047][T13020] netlink: 'syz.3.2679': attribute type 19 has an invalid length. [ 690.339204][T13020] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2679'. [ 690.442700][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 691.237608][ T9352] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 692.701836][T13038] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2683'. [ 692.848112][T13041] netlink: 'syz.0.2685': attribute type 3 has an invalid length. [ 692.876316][T13041] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2685'. [ 700.681754][T13083] netlink: 'syz.0.2699': attribute type 3 has an invalid length. [ 700.738246][T13083] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2699'. [ 701.518828][T13106] netlink: 'syz.2.2705': attribute type 1 has an invalid length. [ 701.600073][T13106] netlink: 116376 bytes leftover after parsing attributes in process `syz.2.2705'. [ 702.110483][T13118] netlink: 'syz.1.2707': attribute type 10 has an invalid length. [ 704.513482][T13118] team0: Port device geneve1 added [ 705.098087][T13142] netlink: 'syz.3.2714': attribute type 4 has an invalid length. [ 705.161211][T13142] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.2714'. [ 705.445184][ T4277] Bluetooth: hci2: ISO packet for unknown connection handle 3078 [ 708.905159][T13219] netlink: 'syz.2.2745': attribute type 3 has an invalid length. [ 708.967332][T13219] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.2745'. [ 711.794963][ T4277] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 711.822083][T13243] netlink: 'syz.0.2751': attribute type 3 has an invalid length. [ 711.975677][T13243] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2751'. [ 712.743109][T13258] netlink: 'syz.4.2754': attribute type 4 has an invalid length. [ 712.767131][T13260] netlink: 4079 bytes leftover after parsing attributes in process `syz.0.2755'. [ 713.591827][T13273] netlink: 'syz.0.2760': attribute type 3 has an invalid length. [ 713.646057][T13273] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2760'. [ 714.241428][T13282] FAULT_INJECTION: forcing a failure. [ 714.241428][T13282] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 714.293942][T13282] CPU: 0 PID: 13282 Comm: syz.1.2762 Not tainted syzkaller #0 [ 714.307901][T13282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 714.325938][T13282] Call Trace: [ 714.329706][T13282] [ 714.336298][T13282] dump_stack_lvl+0x188/0x24e [ 714.343530][T13282] ? show_regs_print_info+0x12/0x12 [ 714.353335][T13282] ? load_image+0x410/0x410 [ 714.359231][T13282] ? __lock_acquire+0x7bd0/0x7bd0 [ 714.367078][T13282] should_fail_ex+0x390/0x4c0 [ 714.375951][T13282] _copy_from_user+0x2c/0x170 [ 714.387020][T13282] __sys_bpf+0x2ea/0x780 [ 714.393662][T13282] ? bpf_link_show_fdinfo+0x380/0x380 [ 714.400056][T13282] ? lock_chain_count+0x20/0x20 [ 714.407438][T13282] __x64_sys_bpf+0x78/0x90 [ 714.416023][T13282] do_syscall_64+0x4c/0xa0 [ 714.423046][T13282] ? clear_bhb_loop+0x60/0xb0 [ 714.432400][T13282] ? clear_bhb_loop+0x60/0xb0 [ 714.438989][T13282] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 714.448095][T13282] RIP: 0033:0x7fb842f9ce59 [ 714.457768][T13282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 714.489846][T13282] RSP: 002b:00007fb843eee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 714.503132][T13282] RAX: ffffffffffffffda RBX: 00007fb843215fa0 RCX: 00007fb842f9ce59 [ 714.516715][T13282] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 714.529431][T13282] RBP: 00007fb843eee090 R08: 0000000000000000 R09: 0000000000000000 [ 714.546884][T13282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 714.565761][T13282] R13: 00007fb843216038 R14: 00007fb843215fa0 R15: 00007ffe65ee3608 [ 714.576290][T13282] [ 716.931858][T13303] netlink: 'syz.4.2770': attribute type 2 has an invalid length. [ 716.954723][T13303] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2770'. [ 718.676910][T13330] netlink: 'syz.1.2777': attribute type 3 has an invalid length. [ 718.771718][T13330] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2777'. [ 719.238651][T13337] FAULT_INJECTION: forcing a failure. [ 719.238651][T13337] name failslab, interval 1, probability 0, space 0, times 0 [ 719.313715][T13337] CPU: 0 PID: 13337 Comm: syz.2.2780 Not tainted syzkaller #0 [ 719.323263][T13337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 719.335711][T13337] Call Trace: [ 719.340431][T13337] [ 719.343955][T13337] dump_stack_lvl+0x188/0x24e [ 719.351844][T13337] ? show_regs_print_info+0x12/0x12 [ 719.359678][T13337] ? load_image+0x410/0x410 [ 719.364294][T13337] ? __lock_acquire+0x7bd0/0x7bd0 [ 719.371434][T13337] should_fail_ex+0x390/0x4c0 [ 719.380774][T13337] should_failslab+0x5/0x20 [ 719.386721][T13337] slab_pre_alloc_hook+0x59/0x300 [ 719.393385][T13337] ? bpf_prog_test_run_skb+0x23e/0x18e0 [ 719.403391][T13337] __kmem_cache_alloc_node+0x4f/0x270 [ 719.413763][T13337] ? bpf_prog_test_run_skb+0x23e/0x18e0 [ 719.422179][T13337] __kmalloc+0xa3/0x240 [ 719.427669][T13337] bpf_prog_test_run_skb+0x23e/0x18e0 [ 719.435276][T13337] ? __fget_files+0x28/0x460 [ 719.441313][T13337] ? __fget_files+0x3fc/0x460 [ 719.449737][T13337] ? cpu_online+0xa0/0xa0 [ 719.455279][T13337] bpf_prog_test_run+0x31c/0x390 [ 719.463607][T13337] __sys_bpf+0x62b/0x780 [ 719.470000][T13337] ? bpf_link_show_fdinfo+0x380/0x380 [ 719.477927][T13337] ? lock_chain_count+0x20/0x20 [ 719.487753][T13337] __x64_sys_bpf+0x78/0x90 [ 719.497148][T13337] do_syscall_64+0x4c/0xa0 [ 719.503913][T13337] ? clear_bhb_loop+0x60/0xb0 [ 719.512104][T13337] ? clear_bhb_loop+0x60/0xb0 [ 719.517793][T13337] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 719.527662][T13337] RIP: 0033:0x7ffba1b9ce59 [ 719.536751][T13337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 719.564261][T13337] RSP: 002b:00007ffba29d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 719.577430][T13337] RAX: ffffffffffffffda RBX: 00007ffba1e15fa0 RCX: 00007ffba1b9ce59 [ 719.589395][T13337] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 719.602904][T13337] RBP: 00007ffba29d4090 R08: 0000000000000000 R09: 0000000000000000 [ 719.614296][T13337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 719.624476][T13337] R13: 00007ffba1e16038 R14: 00007ffba1e15fa0 R15: 00007ffde63f8cb8 [ 719.637128][T13337] [ 722.081876][ T4277] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 722.368688][ T30] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 723.079627][T13381] netlink: 'syz.2.2793': attribute type 3 has an invalid length. [ 723.159197][T13381] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.2793'. [ 723.188014][T13384] FAULT_INJECTION: forcing a failure. [ 723.188014][T13384] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 723.258056][T13384] CPU: 0 PID: 13384 Comm: syz.0.2795 Not tainted syzkaller #0 [ 723.268405][T13384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 723.283975][T13384] Call Trace: [ 723.288283][T13384] [ 723.291836][T13384] dump_stack_lvl+0x188/0x24e [ 723.298036][T13384] ? show_regs_print_info+0x12/0x12 [ 723.305001][T13384] ? load_image+0x410/0x410 [ 723.312380][T13384] ? __lock_acquire+0x7bd0/0x7bd0 [ 723.320664][T13384] should_fail_ex+0x390/0x4c0 [ 723.328981][T13384] _copy_from_user+0x2c/0x170 [ 723.335532][T13384] bpf_prog_test_run_skb+0x263/0x18e0 [ 723.344724][T13384] ? __fget_files+0x28/0x460 [ 723.354692][T13384] ? __fget_files+0x3fc/0x460 [ 723.360148][T13384] ? cpu_online+0xa0/0xa0 [ 723.366496][T13384] bpf_prog_test_run+0x31c/0x390 [ 723.373783][T13384] __sys_bpf+0x62b/0x780 [ 723.378179][T13384] ? bpf_link_show_fdinfo+0x380/0x380 [ 723.386470][T13384] ? lock_chain_count+0x20/0x20 [ 723.393742][T13384] __x64_sys_bpf+0x78/0x90 [ 723.398725][T13384] do_syscall_64+0x4c/0xa0 [ 723.403653][T13384] ? clear_bhb_loop+0x60/0xb0 [ 723.409610][T13384] ? clear_bhb_loop+0x60/0xb0 [ 723.415668][T13384] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 723.425098][T13384] RIP: 0033:0x7f6d3c19ce59 [ 723.431070][T13384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 723.459677][T13384] RSP: 002b:00007f6d3d006028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 723.470301][T13384] RAX: ffffffffffffffda RBX: 00007f6d3c415fa0 RCX: 00007f6d3c19ce59 [ 723.480991][T13384] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 723.492472][T13384] RBP: 00007f6d3d006090 R08: 0000000000000000 R09: 0000000000000000 [ 723.502653][T13384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 723.514262][T13384] R13: 00007f6d3c416038 R14: 00007f6d3c415fa0 R15: 00007ffef9779698 [ 723.528558][T13384] [ 726.776998][T13400] netlink: 'syz.3.2800': attribute type 2 has an invalid length. [ 727.924442][T13422] FAULT_INJECTION: forcing a failure. [ 727.924442][T13422] name failslab, interval 1, probability 0, space 0, times 0 [ 728.043841][T13422] CPU: 0 PID: 13422 Comm: syz.2.2808 Not tainted syzkaller #0 [ 728.054319][T13422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 728.073091][T13422] Call Trace: [ 728.078836][T13422] [ 728.083628][T13422] dump_stack_lvl+0x188/0x24e [ 728.090091][T13422] ? show_regs_print_info+0x12/0x12 [ 728.097642][T13422] ? load_image+0x410/0x410 [ 728.106125][T13422] ? __might_sleep+0xd0/0xd0 [ 728.114294][T13422] ? __lock_acquire+0x7bd0/0x7bd0 [ 728.122914][T13422] should_fail_ex+0x390/0x4c0 [ 728.130252][T13422] should_failslab+0x5/0x20 [ 728.141537][T13422] slab_pre_alloc_hook+0x59/0x300 [ 728.150895][T13422] ? sk_prot_alloc+0xe7/0x210 [ 728.161804][T13422] __kmem_cache_alloc_node+0x4f/0x270 [ 728.171660][T13422] ? sk_prot_alloc+0xe7/0x210 [ 728.179354][T13422] __kmalloc+0xa3/0x240 [ 728.188779][T13422] sk_prot_alloc+0xe7/0x210 [ 728.195713][T13422] ? sk_alloc+0x20/0x330 [ 728.202415][T13422] sk_alloc+0x36/0x330 [ 728.209451][T13422] ? bpf_ctx_init+0x154/0x190 [ 728.215197][T13422] bpf_prog_test_run_skb+0x36d/0x18e0 [ 728.224446][T13422] ? __fget_files+0x28/0x460 [ 728.230122][T13422] ? __fget_files+0x3fc/0x460 [ 728.238040][T13422] ? cpu_online+0xa0/0xa0 [ 728.242880][T13422] bpf_prog_test_run+0x31c/0x390 [ 728.250085][T13422] __sys_bpf+0x62b/0x780 [ 728.256354][T13422] ? bpf_link_show_fdinfo+0x380/0x380 [ 728.264524][T13422] ? lock_chain_count+0x20/0x20 [ 728.270989][T13422] __x64_sys_bpf+0x78/0x90 [ 728.278516][T13422] do_syscall_64+0x4c/0xa0 [ 728.286266][T13422] ? clear_bhb_loop+0x60/0xb0 [ 728.293079][T13422] ? clear_bhb_loop+0x60/0xb0 [ 728.299118][T13422] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 728.305732][T13422] RIP: 0033:0x7ffba1b9ce59 [ 728.310892][T13422] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 728.341824][T13422] RSP: 002b:00007ffba29d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 728.351647][T13422] RAX: ffffffffffffffda RBX: 00007ffba1e15fa0 RCX: 00007ffba1b9ce59 [ 728.361326][T13422] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 728.373582][T13422] RBP: 00007ffba29d4090 R08: 0000000000000000 R09: 0000000000000000 [ 728.384246][T13422] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 728.396000][T13422] R13: 00007ffba1e16038 R14: 00007ffba1e15fa0 R15: 00007ffde63f8cb8 [ 728.406539][T13422] [ 728.418890][T13428] netlink: 'syz.0.2809': attribute type 21 has an invalid length. [ 728.605043][T13427] netlink: 'syz.3.2810': attribute type 3 has an invalid length. [ 728.626167][T13427] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.2810'. [ 728.661590][ T4277] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 730.242596][T13459] netlink: 'syz.3.2820': attribute type 2 has an invalid length. [ 730.462598][T13459] netlink: 198300 bytes leftover after parsing attributes in process `syz.3.2820'. [ 730.909817][T13472] netlink: 'syz.0.2825': attribute type 3 has an invalid length. [ 731.045407][T13472] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2825'. [ 731.349039][T13477] FAULT_INJECTION: forcing a failure. [ 731.349039][T13477] name failslab, interval 1, probability 0, space 0, times 0 [ 731.479400][T13477] CPU: 0 PID: 13477 Comm: syz.3.2826 Not tainted syzkaller #0 [ 731.489128][T13477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 731.504906][T13477] Call Trace: [ 731.510042][T13477] [ 731.514294][T13477] dump_stack_lvl+0x188/0x24e [ 731.521083][T13477] ? show_regs_print_info+0x12/0x12 [ 731.531959][T13477] ? load_image+0x410/0x410 [ 731.542495][T13477] ? __might_sleep+0xd0/0xd0 [ 731.550947][T13477] ? __lock_acquire+0x7bd0/0x7bd0 [ 731.558600][T13477] should_fail_ex+0x390/0x4c0 [ 731.564146][T13477] should_failslab+0x5/0x20 [ 731.571292][T13477] slab_pre_alloc_hook+0x59/0x300 [ 731.579841][T13477] ? apparmor_sk_alloc_security+0x74/0x100 [ 731.586097][T13477] __kmem_cache_alloc_node+0x4f/0x270 [ 731.593094][T13477] ? apparmor_sk_alloc_security+0x74/0x100 [ 731.604797][T13477] kmalloc_trace+0x26/0xe0 [ 731.610259][T13477] apparmor_sk_alloc_security+0x74/0x100 [ 731.620534][T13477] security_sk_alloc+0x6a/0xa0 [ 731.627899][T13477] sk_prot_alloc+0x101/0x210 [ 731.638330][T13477] ? sk_alloc+0x20/0x330 [ 731.646779][T13477] sk_alloc+0x36/0x330 [ 731.652853][T13477] ? bpf_ctx_init+0x154/0x190 [ 731.658830][T13477] bpf_prog_test_run_skb+0x36d/0x18e0 [ 731.667709][T13477] ? __fget_files+0x28/0x460 [ 731.673257][T13477] ? __fget_files+0x3fc/0x460 [ 731.681504][T13477] ? cpu_online+0xa0/0xa0 [ 731.687932][T13477] bpf_prog_test_run+0x31c/0x390 [ 731.696068][T13477] __sys_bpf+0x62b/0x780 [ 731.704750][T13477] ? bpf_link_show_fdinfo+0x380/0x380 [ 731.714523][T13477] ? lock_chain_count+0x20/0x20 [ 731.722236][T13477] __x64_sys_bpf+0x78/0x90 [ 731.730344][T13477] do_syscall_64+0x4c/0xa0 [ 731.735168][T13477] ? clear_bhb_loop+0x60/0xb0 [ 731.744553][T13477] ? clear_bhb_loop+0x60/0xb0 [ 731.751300][T13477] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 731.763320][T13477] RIP: 0033:0x7f592859ce59 [ 731.770856][T13477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 731.802422][T13477] RSP: 002b:00007f5929517028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 731.816307][T13477] RAX: ffffffffffffffda RBX: 00007f5928815fa0 RCX: 00007f592859ce59 [ 731.831063][T13477] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 731.842333][T13477] RBP: 00007f5929517090 R08: 0000000000000000 R09: 0000000000000000 [ 731.853235][T13477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 731.864792][T13477] R13: 00007f5928816038 R14: 00007f5928815fa0 R15: 00007fff5532d198 [ 731.880820][T13477] [ 734.159131][T13500] netlink: 'syz.0.2834': attribute type 2 has an invalid length. [ 734.263412][T13500] device .*! entered promiscuous mode [ 735.436260][T13521] netlink: 'syz.1.2842': attribute type 3 has an invalid length. [ 735.495189][T13521] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.2842'. [ 738.097970][T13537] netlink: 'syz.2.2847': attribute type 2 has an invalid length. [ 738.201287][T13537] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2847'. [ 738.525936][ T4277] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 739.279714][T13564] netlink: 'syz.1.2854': attribute type 21 has an invalid length. [ 739.323894][T13564] netlink: 'syz.1.2854': attribute type 22 has an invalid length. [ 739.353906][T13564] netlink: 'syz.1.2854': attribute type 13 has an invalid length. [ 739.377716][T13564] netlink: 6188 bytes leftover after parsing attributes in process `syz.1.2854'. [ 739.793175][T13571] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.2856'. [ 740.131079][T13577] netlink: 'syz.4.2859': attribute type 3 has an invalid length. [ 740.182564][T13577] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2859'. [ 742.887741][T13632] Ÿë: port 1(veth0_to_team) entered blocking state [ 742.931162][T13632] Ÿë: port 1(veth0_to_team) entered disabled state [ 742.970015][T13632] device veth0_to_team entered promiscuous mode [ 744.405235][ T4277] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 744.517824][T13664] netlink: 122896 bytes leftover after parsing attributes in process `syz.1.2886'. [ 745.469843][T13683] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 745.484902][T13683] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 745.497403][T13683] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 745.513966][T13683] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 745.544304][T13683] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 745.558025][T13683] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 745.708822][T13690] netlink: 'syz.3.2893': attribute type 3 has an invalid length. [ 745.726481][T13690] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.2893'. [ 745.770033][ T9352] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.964053][ T9352] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.117445][ T9352] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.327070][ T9352] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 747.178996][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.191801][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.215301][T13678] chnl_net:caif_netlink_parms(): no params data found [ 747.514267][T13683] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 747.653850][T13683] Bluetooth: hci1: command 0x0409 tx timeout [ 748.265427][T13678] bridge0: port 1(bridge_slave_0) entered blocking state [ 748.313234][T13678] bridge0: port 1(bridge_slave_0) entered disabled state [ 748.345728][T13678] device bridge_slave_0 entered promiscuous mode [ 748.450328][T13678] bridge0: port 2(bridge_slave_1) entered blocking state [ 748.510387][T13678] bridge0: port 2(bridge_slave_1) entered disabled state [ 748.535356][T13678] device bridge_slave_1 entered promiscuous mode [ 748.704720][T13678] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 748.779242][T13747] netlink: 'syz.0.2906': attribute type 3 has an invalid length. [ 748.846814][T13747] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2906'. [ 748.905463][T13678] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 749.320689][T13678] team0: Port device team_slave_0 added [ 749.474296][T13678] team0: Port device team_slave_1 added [ 749.569032][T13762] netlink: 'syz.1.2909': attribute type 5 has an invalid length. [ 749.635556][T13765] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2911'. [ 749.734392][T13683] Bluetooth: hci1: command 0x041b tx timeout [ 749.862454][T13678] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 749.885319][T13678] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 749.933432][T13678] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 750.066330][T13771] IPv6: pim6reg1: Disabled Multicast RS [ 750.138844][T13678] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 750.158976][T13678] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 750.261172][T13678] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 750.637942][T13678] device hsr_slave_0 entered promiscuous mode [ 750.650826][T13678] device hsr_slave_1 entered promiscuous mode [ 750.671351][T13678] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 750.708080][T13678] Cannot create hsr debugfs directory [ 751.452519][ T9352] device hsr_slave_0 left promiscuous mode [ 751.498034][ T9352] device hsr_slave_1 left promiscuous mode [ 751.541622][ T9352] bridge0: port 4(bond0) entered disabled state [ 751.605434][ T9352] device bridge_slave_1 left promiscuous mode [ 751.612491][ T9352] bridge0: port 2(bridge_slave_1) entered disabled state [ 751.708058][ T9352] device bridge_slave_0 left promiscuous mode [ 751.752642][ T9352] bridge0: port 1(bridge_slave_0) entered disabled state [ 751.824006][T13683] Bluetooth: hci1: command 0x040f tx timeout [ 751.888924][ T9352] device veth1_vlan left promiscuous mode [ 751.912900][ T9352] device veth0_vlan left promiscuous mode [ 752.000455][T13800] netlink: 'syz.4.2919': attribute type 3 has an invalid length. [ 752.045551][T13800] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2919'. [ 753.339472][ T9352] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 753.360089][ T9352] device bond_slave_1 left promiscuous mode [ 753.442978][ T9352] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 753.456447][ T9352] device bond_slave_0 left promiscuous mode [ 753.910438][T13683] Bluetooth: hci1: command 0x0419 tx timeout [ 754.008621][ T9352] bond0 (unregistering): Released all slaves [ 755.453063][ T9346] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 756.165306][T13678] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 756.234916][T13678] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 756.365011][T13678] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 756.494241][T13678] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 757.510267][T13678] 8021q: adding VLAN 0 to HW filter on device bond0 [ 757.629905][T13678] 8021q: adding VLAN 0 to HW filter on device team0 [ 757.732316][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 757.828821][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 757.919220][T13866] delete_channel: no stack [ 757.953927][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 758.055258][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 758.115184][ T9352] bridge0: port 1(bridge_slave_0) entered blocking state [ 758.125583][ T9352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 758.437314][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 758.492106][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 758.522909][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 758.626935][ T9352] bridge0: port 2(bridge_slave_1) entered blocking state [ 758.637835][ T9352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 758.710993][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 758.859637][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 758.915501][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 759.021543][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 759.109592][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 759.150741][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 759.263262][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 759.302551][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 759.392272][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 759.476525][T13678] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 759.574920][T13678] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 759.619042][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 759.716010][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 760.049355][T13900] netlink: 'syz.3.2944': attribute type 3 has an invalid length. [ 760.095893][T13900] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.2944'. [ 761.025565][T13916] netlink: 'syz.4.2946': attribute type 29 has an invalid length. [ 761.071566][T13916] netlink: 'syz.4.2946': attribute type 29 has an invalid length. [ 761.362695][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 761.392295][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 761.458429][T13678] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 761.633339][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 761.661258][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 761.702945][T13928] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2949'. [ 761.821769][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 761.888690][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 761.997160][T13678] device veth0_vlan entered promiscuous mode [ 762.054316][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 762.106609][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 762.172613][T13678] device veth1_vlan entered promiscuous mode [ 762.404774][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 762.426938][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 762.599607][T13678] device veth0_macvtap entered promiscuous mode [ 762.641918][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 762.760271][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 762.838729][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 762.930285][T13678] device veth1_macvtap entered promiscuous mode [ 763.066642][T13678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 763.171851][T13678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 763.284834][T13678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 763.389096][T13678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 763.455668][T13678] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 763.546650][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 763.622815][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 763.727040][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 763.803494][T13678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 763.847735][T13678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 763.914047][T13678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 763.947874][T13678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 763.998802][T13678] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 764.032500][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 764.077116][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 764.132365][T13678] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.176733][T13954] netlink: 'syz.0.2957': attribute type 3 has an invalid length. [ 764.219361][T13678] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.274290][T13954] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2957'. [ 764.323707][T13678] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.416203][T13678] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.888909][ T9346] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 764.974442][ T9346] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 765.147789][ T9346] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 765.224656][ T9353] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 765.285031][ T9353] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 765.355453][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 765.718516][T13970] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2961'. [ 767.598189][ T4277] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 767.622460][ T4277] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 767.644486][ T4277] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 767.668361][ T4277] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 767.683365][ T4277] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 767.701540][ T4277] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 768.568415][T14016] netlink: 'syz.0.2970': attribute type 3 has an invalid length. [ 768.584922][T14016] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.2970'. [ 768.958313][T12469] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.358965][T12469] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.464420][T14003] chnl_net:caif_netlink_parms(): no params data found [ 769.816959][ T4277] Bluetooth: hci3: command 0x0409 tx timeout [ 769.966531][T12469] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.750191][T14003] bridge0: port 1(bridge_slave_0) entered blocking state [ 770.774259][T14003] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.810632][T14003] device bridge_slave_0 entered promiscuous mode [ 770.875617][T14003] bridge0: port 2(bridge_slave_1) entered blocking state [ 770.918489][T14003] bridge0: port 2(bridge_slave_1) entered disabled state [ 770.985326][T14003] device bridge_slave_1 entered promiscuous mode [ 771.242014][T14003] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 771.327779][T14003] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 771.382361][T12469] tipc: Left network mode [ 771.541200][T14003] team0: Port device team_slave_0 added [ 771.601016][T14003] team0: Port device team_slave_1 added [ 771.876554][T14003] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 771.893917][ T4277] Bluetooth: hci3: command 0x041b tx timeout [ 771.937226][T14003] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 772.100702][T14003] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 773.983714][ T4277] Bluetooth: hci3: command 0x040f tx timeout [ 774.172594][T14003] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 774.215866][T14003] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 774.627807][T14003] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 775.253093][T14089] IPv6: Can't replace route, no match found [ 775.399274][T14094] netlink: 'syz.2.2986': attribute type 3 has an invalid length. [ 775.540056][T14003] device hsr_slave_0 entered promiscuous mode [ 775.543710][T14094] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.2986'. [ 775.636415][T14003] device hsr_slave_1 entered promiscuous mode [ 775.675289][T14003] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 775.722443][T14003] Cannot create hsr debugfs directory [ 776.065116][ T4277] Bluetooth: hci3: command 0x0419 tx timeout [ 777.342472][T14118] netlink: 'syz.4.2992': attribute type 10 has an invalid length. [ 779.113932][T12469] team0: Port device wlan1 removed [ 779.350032][T14003] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 779.399117][T14155] netlink: 'syz.4.2999': attribute type 3 has an invalid length. [ 779.543962][T14155] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.2999'. [ 779.802271][T14003] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 779.860301][T14003] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 779.904475][T14003] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 780.018796][T12469] device hsr_slave_0 left promiscuous mode [ 780.062547][T12469] device hsr_slave_1 left promiscuous mode [ 780.206440][T12469] device veth1_macvtap left promiscuous mode [ 780.252254][T12469] device veth0_macvtap left promiscuous mode [ 780.294068][T12469] device veth1_vlan left promiscuous mode [ 780.303110][T12469] device veth0_vlan left promiscuous mode [ 781.163346][T12469] team0 (unregistering): Port device geneve1 removed [ 782.135971][T12469] team0 (unregistering): Port device team_slave_1 removed [ 782.242078][T12469] team0 (unregistering): Port device team_slave_0 removed [ 783.386650][T14003] 8021q: adding VLAN 0 to HW filter on device bond0 [ 783.457022][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 783.576260][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 783.636889][T14003] 8021q: adding VLAN 0 to HW filter on device team0 [ 783.706821][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 783.815461][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 783.898867][ T9352] bridge0: port 1(bridge_slave_0) entered blocking state [ 783.909160][ T9352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 783.995079][T14200] netlink: 'syz.3.3011': attribute type 10 has an invalid length. [ 784.055518][T14200] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3011'. [ 784.064979][T14205] netlink: 'syz.4.3012': attribute type 3 has an invalid length. [ 784.116081][T14200] device dummy0 entered promiscuous mode [ 784.128895][T14200] bridge0: port 5(dummy0) entered blocking state [ 784.137238][T14200] bridge0: port 5(dummy0) entered disabled state [ 784.148615][T14200] bridge0: port 5(dummy0) entered blocking state [ 784.152167][T14205] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3012'. [ 784.162302][T14200] bridge0: port 5(dummy0) entered forwarding state [ 784.202487][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 784.222778][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 784.275305][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 784.328576][ T9352] bridge0: port 2(bridge_slave_1) entered blocking state [ 784.339686][ T9352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 784.461571][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 784.488377][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 784.556688][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 784.585559][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 784.693481][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 784.767285][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 784.825344][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 784.861779][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 784.974438][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 785.121347][T14003] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 785.142459][T14219] netlink: 'syz.3.3014': attribute type 1 has an invalid length. [ 785.163512][T14219] netlink: 127868 bytes leftover after parsing attributes in process `syz.3.3014'. [ 785.177931][T14003] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 785.298558][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 785.331569][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 786.470620][ T9358] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 786.756628][T13683] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 787.127078][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 787.171893][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 787.237294][T14257] netlink: 'syz.3.3024': attribute type 3 has an invalid length. [ 787.257578][T14257] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.3024'. [ 787.277330][T14259] netlink: 'syz.0.3023': attribute type 3 has an invalid length. [ 787.291895][T14259] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3023'. [ 787.312883][T14003] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 787.389392][T14258] netlink: 'syz.0.3023': attribute type 3 has an invalid length. [ 787.429798][ T9359] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 787.450580][T14258] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3023'. [ 787.503400][ T9359] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 787.682221][ T9359] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 787.720111][ T9359] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 787.793256][T14003] device veth0_vlan entered promiscuous mode [ 787.835206][ T9359] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 787.864767][ T9359] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 787.911319][T14273] netlink: 'syz.3.3027': attribute type 21 has an invalid length. [ 787.963726][T14003] device veth1_vlan entered promiscuous mode [ 788.154319][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 788.209657][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 788.266141][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 788.302884][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 788.367307][T14003] device veth0_macvtap entered promiscuous mode [ 788.432750][T14003] device veth1_macvtap entered promiscuous mode [ 788.622466][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 788.663369][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 788.679493][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 788.692924][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 788.714073][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 788.739554][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 788.768553][T14003] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 788.936442][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 788.975707][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 789.010726][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 789.108982][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 789.143099][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.163277][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 789.206550][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.233906][T14003] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 789.254839][T14003] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 789.271344][T14003] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 789.320769][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 789.342221][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 789.369698][T14003] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 789.392978][T14003] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 789.409400][T14003] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 789.454565][T14003] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 789.660800][T14303] netlink: 'syz.2.3036': attribute type 3 has an invalid length. [ 789.744422][T14303] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3036'. [ 789.878511][ T9352] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 789.934789][ T9352] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 790.046453][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 790.108521][ T9352] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.165417][ T9352] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 790.200265][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 790.313551][T14314] netlink: 'syz.4.3039': attribute type 3 has an invalid length. [ 790.346841][T14314] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3039'. [ 790.440534][T14322] sctp: [Deprecated]: syz.1.2962 (pid 14322) Use of struct sctp_assoc_value in delayed_ack socket option. [ 790.440534][T14322] Use struct sctp_sack_info instead [ 791.399824][T13683] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 791.411686][T14338] netlink: 'syz.1.3047': attribute type 4 has an invalid length. [ 792.349865][T14346] netlink: 'syz.0.3049': attribute type 3 has an invalid length. [ 792.373998][T14346] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3049'. [ 792.401949][ T4277] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 792.417148][ T4277] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 792.431771][ T4277] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 792.445728][ T4277] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 792.457253][ T4277] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 792.472689][ T4277] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 793.085751][T14348] chnl_net:caif_netlink_parms(): no params data found [ 793.340781][T14348] bridge0: port 1(bridge_slave_0) entered blocking state [ 793.366861][T14348] bridge0: port 1(bridge_slave_0) entered disabled state [ 793.403237][T14348] device bridge_slave_0 entered promiscuous mode [ 793.427279][T14348] bridge0: port 2(bridge_slave_1) entered blocking state [ 793.449192][T14348] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.473876][T14348] device bridge_slave_1 entered promiscuous mode [ 793.549398][T14348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 793.572513][T14348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 793.684515][T14348] team0: Port device team_slave_0 added [ 793.708637][T14348] team0: Port device team_slave_1 added [ 793.794714][T14348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 793.803513][T14348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 793.873751][T14348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 793.908368][T14348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 793.927583][T14348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 794.011928][T14348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 794.539033][T13683] Bluetooth: hci5: command 0x0409 tx timeout [ 794.719230][T14348] device hsr_slave_0 entered promiscuous mode [ 794.758158][T14348] device hsr_slave_1 entered promiscuous mode [ 794.799667][T14348] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 794.816057][T14348] Cannot create hsr debugfs directory [ 794.871701][T14368] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.3053'. [ 795.186162][ T9359] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 795.449884][ T9359] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 795.785181][ T9359] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 796.613849][T13683] Bluetooth: hci5: command 0x041b tx timeout [ 796.778527][ T9359] device .*! left promiscuous mode [ 796.790418][T14391] netlink: 'syz.1.3060': attribute type 3 has an invalid length. [ 796.867705][T14391] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3060'. [ 797.052761][ T9359] device 0 left promiscuous mode [ 797.319310][ T9359] tipc: Left network mode [ 798.454423][T14425] netlink: 'syz.0.3066': attribute type 2 has an invalid length. [ 798.505388][T14425] netlink: 'syz.0.3066': attribute type 8 has an invalid length. [ 798.585175][T14425] netlink: 197344 bytes leftover after parsing attributes in process `syz.0.3066'. [ 798.693792][T13683] Bluetooth: hci5: command 0x040f tx timeout [ 799.202630][T14348] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 799.456802][T14348] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 799.490822][T14348] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 799.692316][T14348] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 800.019001][T14444] netlink: 'syz.2.3072': attribute type 3 has an invalid length. [ 800.062750][T14444] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3072'. [ 800.774720][T13683] Bluetooth: hci5: command 0x0419 tx timeout [ 801.801446][T14348] 8021q: adding VLAN 0 to HW filter on device bond0 [ 801.904024][ T9359] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 801.960041][ T9359] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 802.066752][ T9359] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 802.151999][T14477] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 802.166819][ T9359] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 802.234960][ T9359] batman_adv: batadv0: Interface deactivated: vlan1 [ 802.255570][ T9359] batman_adv: batadv0: Removing interface: vlan1 [ 802.334059][ T9359] bridge0: port 2(bridge_slave_1) entered disabled state [ 802.469516][ T9359] device bridge_slave_0 left promiscuous mode [ 802.525095][ T9359] bridge0: port 1(bridge_slave_0) entered disabled state [ 802.845359][ T9359] device veth1_macvtap left promiscuous mode [ 802.878158][ T9359] device veth1_vlan left promiscuous mode [ 802.931227][ T9359] device veth0_vlan left promiscuous mode [ 803.268279][T14500] netlink: 'syz.2.3082': attribute type 3 has an invalid length. [ 803.306814][T14500] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3082'. [ 805.457737][T14348] 8021q: adding VLAN 0 to HW filter on device team0 [ 805.470270][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 805.481863][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 805.581673][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 805.627071][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 805.704392][ T9353] bridge0: port 1(bridge_slave_0) entered blocking state [ 805.713775][ T9353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 805.801102][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 805.888388][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 805.978515][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 806.060093][ T9353] bridge0: port 2(bridge_slave_1) entered blocking state [ 806.070707][ T9353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 806.229775][T14513] netlink: 'syz.0.3086': attribute type 10 has an invalid length. [ 807.228726][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 807.282825][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 807.470842][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 807.497564][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 807.552035][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 807.599992][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 807.647848][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 807.709312][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 807.770575][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 807.856288][T14348] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 807.925470][T14348] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 807.979972][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 808.004117][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 808.364789][T14530] netlink: 'syz.0.3090': attribute type 5 has an invalid length. [ 808.616563][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.627174][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.916365][T14536] netlink: 'syz.0.3092': attribute type 22 has an invalid length. [ 808.941203][T14536] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3092'. [ 808.983152][T14536] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3092'. [ 809.365782][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 809.375230][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 809.379204][T14546] netlink: 'syz.0.3095': attribute type 3 has an invalid length. [ 809.400604][T14546] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3095'. [ 809.411194][T14348] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 810.979501][T14594] netlink: 'syz.0.3107': attribute type 2 has an invalid length. [ 811.037235][T14594] netlink: 10 bytes leftover after parsing attributes in process `syz.0.3107'. [ 811.202239][T14594] netlink: 'syz.0.3107': attribute type 10 has an invalid length. [ 811.252690][T14594] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 811.430976][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 811.462625][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 811.624009][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 811.670726][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 811.726419][T14348] device veth0_vlan entered promiscuous mode [ 811.765455][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 811.789393][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 811.894707][T14348] device veth1_vlan entered promiscuous mode [ 812.033550][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 812.071479][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 812.131335][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 812.181714][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 812.227286][T14600] netlink: 164 bytes leftover after parsing attributes in process `syz.0.3109'. [ 812.245251][T14348] device veth0_macvtap entered promiscuous mode [ 812.292694][T14348] device veth1_macvtap entered promiscuous mode [ 812.464276][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 812.480256][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 812.492797][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 812.541602][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.587364][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 812.622628][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.701089][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 812.752159][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.772173][T14348] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 812.809535][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 812.851457][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 812.896329][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 812.968854][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 813.020043][T14604] netlink: 'syz.2.3110': attribute type 3 has an invalid length. [ 813.041444][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 813.079635][T14604] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3110'. [ 813.119491][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 813.160118][T14348] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 813.217783][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 813.271767][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 813.293057][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 813.307720][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 813.359032][T14348] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 813.430604][T14348] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 813.483793][T14348] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 813.526164][T14348] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 813.581148][T14608] netlink: 'syz.0.3111': attribute type 10 has an invalid length. [ 813.726886][T14608] team0: Port device macvlan0 removed [ 813.817735][T14608] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 814.125141][ T9350] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 814.167949][ T9350] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 814.185127][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 814.246124][T14623] FAULT_INJECTION: forcing a failure. [ 814.246124][T14623] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 814.291552][T12469] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 814.306226][T12469] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 814.366377][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 814.493727][T14623] CPU: 1 PID: 14623 Comm: syz.3.3116 Not tainted syzkaller #0 [ 814.505045][T14623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 814.521563][T14623] Call Trace: [ 814.525524][T14623] [ 814.529016][T14623] dump_stack_lvl+0x188/0x24e [ 814.534805][T14623] ? show_regs_print_info+0x12/0x12 [ 814.540171][T14623] ? load_image+0x410/0x410 [ 814.545668][T14623] ? __lock_acquire+0x7bd0/0x7bd0 [ 814.551675][T14623] ? snprintf+0xe5/0x140 [ 814.560730][T14623] should_fail_ex+0x390/0x4c0 [ 814.565904][T14623] _copy_to_user+0x2c/0x130 [ 814.572284][T14623] simple_read_from_buffer+0xe3/0x150 [ 814.579382][T14623] proc_fail_nth_read+0x1a6/0x220 [ 814.586148][T14623] ? proc_fault_inject_write+0x310/0x310 [ 814.595644][T14623] ? fsnotify_perm+0x248/0x550 [ 814.603275][T14623] ? proc_fault_inject_write+0x310/0x310 [ 814.609917][T14623] vfs_read+0x2db/0x960 [ 814.616307][T14623] ? kernel_read+0x1e0/0x1e0 [ 814.621007][T14623] ? __fget_files+0x28/0x460 [ 814.625798][T14623] ? __fget_files+0x3fc/0x460 [ 814.632549][T14623] ? __fdget_pos+0x2ae/0x360 [ 814.637639][T14623] ? ksys_read+0x70/0x260 [ 814.642893][T14623] ksys_read+0x14d/0x260 [ 814.648747][T14623] ? vfs_write+0x9a0/0x9a0 [ 814.655755][T14623] ? lockdep_hardirqs_on+0x94/0x140 [ 814.664746][T14623] do_syscall_64+0x4c/0xa0 [ 814.673668][T14623] ? clear_bhb_loop+0x60/0xb0 [ 814.680165][T14623] ? clear_bhb_loop+0x60/0xb0 [ 814.686489][T14623] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 814.692905][T14623] RIP: 0033:0x7f592855d68e [ 814.698342][T14623] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 814.720708][T14623] RSP: 002b:00007f5929516fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 814.730840][T14623] RAX: ffffffffffffffda RBX: 00007f59295176c0 RCX: 00007f592855d68e [ 814.739563][T14623] RDX: 000000000000000f RSI: 00007f59295170a0 RDI: 0000000000000008 [ 814.748722][T14623] RBP: 00007f5929517090 R08: 0000000000000000 R09: 0000000000000000 [ 814.758668][T14623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 814.768298][T14623] R13: 00007f5928816038 R14: 00007f5928815fa0 R15: 00007fff5532d198 [ 814.778260][T14623] [ 815.456185][T14648] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3120'. [ 815.807131][ T4277] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 815.821335][ T4277] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 815.832874][ T4277] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 815.857465][ T4277] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 815.876251][ T4277] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 815.885450][ T4277] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 816.040478][T14657] netlink: 'syz.4.3121': attribute type 3 has an invalid length. [ 816.106577][T14657] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3121'. [ 817.372288][T14649] chnl_net:caif_netlink_parms(): no params data found [ 817.927976][ T9358] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 817.977077][ T4277] Bluetooth: hci4: command 0x0409 tx timeout [ 818.401814][ T9358] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 818.786678][ T9358] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 819.172211][ T9358] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 819.327555][T14649] bridge0: port 1(bridge_slave_0) entered blocking state [ 819.430114][T14649] bridge0: port 1(bridge_slave_0) entered disabled state [ 819.457514][T14649] device bridge_slave_0 entered promiscuous mode [ 819.489225][T14649] bridge0: port 2(bridge_slave_1) entered blocking state [ 819.513866][T14649] bridge0: port 2(bridge_slave_1) entered disabled state [ 819.546803][T14649] device bridge_slave_1 entered promiscuous mode [ 819.690571][T14649] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 819.823886][T14649] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 820.054501][ T4277] Bluetooth: hci4: command 0x041b tx timeout [ 820.297204][T14649] team0: Port device team_slave_0 added [ 820.327700][T14649] team0: Port device team_slave_1 added [ 822.135550][ T4277] Bluetooth: hci4: command 0x040f tx timeout [ 822.844245][T14649] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 822.851365][T14649] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 822.891987][T14707] netlink: 'syz.0.3135': attribute type 3 has an invalid length. [ 822.912252][T14707] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3135'. [ 822.950741][T14649] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 822.995883][T14649] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 823.002902][T14649] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 823.112924][T14649] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 823.570618][T14649] device hsr_slave_0 entered promiscuous mode [ 823.580362][T14649] device hsr_slave_1 entered promiscuous mode [ 823.600636][T14649] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 823.629740][T14649] Cannot create hsr debugfs directory [ 823.744216][T14719] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3138'. [ 824.022389][T14719] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 824.140194][T14719] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 824.218177][ T4277] Bluetooth: hci4: command 0x0419 tx timeout [ 824.229623][T14719] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 824.332994][T14719] bond0 (unregistering): Released all slaves [ 825.174862][T14731] delete_channel: no stack [ 826.171513][T14750] netlink: 'syz.1.3147': attribute type 3 has an invalid length. [ 826.212578][T14750] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3147'. [ 826.382633][T14649] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 826.430311][T14649] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 826.461911][T14649] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 826.600301][T14649] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 827.152899][T14770] netlink: 16098 bytes leftover after parsing attributes in process `syz.4.3151'. [ 827.239798][T14770] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 827.248359][T14770] dvmrp1: linktype set to 768 [ 827.447891][ T9358] device veth0_to_team left promiscuous mode [ 827.468145][ T9358] Ÿë: port 1(veth0_to_team) entered disabled state [ 827.485514][ T9358] device hsr_slave_0 left promiscuous mode [ 827.511130][ T9358] device hsr_slave_1 left promiscuous mode [ 827.521366][ T9358] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 827.532163][ T9358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 827.549451][ T9358] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 827.559837][ T9358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 827.573006][ T9358] batman_adv: batadv0: Interface deactivated: vlan1 [ 827.582169][ T9358] batman_adv: batadv0: Removing interface: vlan1 [ 827.591886][ T9358] bridge0: port 5(dummy0) entered disabled state [ 827.607824][ T9358] bridge0: port 4(hsr0) entered disabled state [ 827.621380][ T9358] bridge0: port 3(team0) entered disabled state [ 827.663309][ T9358] device bridge_slave_1 left promiscuous mode [ 827.671480][ T9358] bridge0: port 2(bridge_slave_1) entered disabled state [ 827.682814][ T9358] device bridge_slave_0 left promiscuous mode [ 827.689629][ T9358] bridge0: port 1(bridge_slave_0) entered disabled state [ 827.709730][ T9358] device veth1_macvtap left promiscuous mode [ 827.716809][ T9358] device veth1_vlan left promiscuous mode [ 827.722947][ T9358] device veth0_vlan left promiscuous mode [ 828.129051][ T9358] device macvlan0 left promiscuous mode [ 828.139851][ T9358] team0 (unregistering): Port device macvlan0 removed [ 828.550272][ T9358] device team_slave_1 left promiscuous mode [ 828.558478][ T9358] team0 (unregistering): Port device team_slave_1 removed [ 828.611473][ T9358] device team_slave_0 left promiscuous mode [ 828.619465][ T9358] team0 (unregistering): Port device team_slave_0 removed [ 828.667255][ T9358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 828.728607][ T9358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 829.178532][ T9358] bond0 (unregistering): Released all slaves [ 829.547532][T14649] 8021q: adding VLAN 0 to HW filter on device bond0 [ 829.659181][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 829.675410][ T9353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 829.710307][T14649] 8021q: adding VLAN 0 to HW filter on device team0 [ 829.821717][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 829.858649][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 829.891687][ T9348] bridge0: port 1(bridge_slave_0) entered blocking state [ 829.900677][ T9348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 829.969958][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 829.986983][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 830.017958][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 830.030406][T14787] netlink: 'syz.4.3157': attribute type 3 has an invalid length. [ 830.054591][ T9348] bridge0: port 2(bridge_slave_1) entered blocking state [ 830.062509][ T9348] bridge0: port 2(bridge_slave_1) entered forwarding state [ 830.071216][T14787] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3157'. [ 830.139351][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 830.159076][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 830.206979][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 830.234483][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 830.245117][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 830.274929][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 830.305144][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 830.335211][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 830.370239][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 830.466944][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 830.491882][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 830.541859][T14649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 830.647100][T14802] netlink: 'syz.4.3160': attribute type 3 has an invalid length. [ 830.686058][T14802] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3160'. [ 831.869105][T14825] netlink: 9286 bytes leftover after parsing attributes in process `syz.1.3163'. [ 831.964487][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 832.014614][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 832.029979][T14649] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 832.177038][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 832.191788][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 832.247162][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 832.261358][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 832.277836][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 832.291225][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 832.333006][T14649] device veth0_vlan entered promiscuous mode [ 832.395378][T14649] device veth1_vlan entered promiscuous mode [ 832.547631][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 832.566094][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 832.582494][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 832.600899][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 832.632101][T14649] device veth0_macvtap entered promiscuous mode [ 832.664244][T14649] device veth1_macvtap entered promiscuous mode [ 832.735542][T14649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 832.764067][T14649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 832.795629][T14649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 832.825507][T14649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 832.857947][T14649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 832.883737][T14649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 832.906168][T14649] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 832.944096][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 832.966010][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 832.993406][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 833.030770][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 833.058499][T14649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 833.083542][T14649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 833.105358][T14649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 833.135531][T14649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 833.163151][T14649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 833.189912][T14649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 833.214850][T14649] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 833.227554][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 833.246020][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 833.277741][T14649] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.302880][T14649] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.332129][T14649] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.359831][T14649] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 835.048111][ T9354] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 835.079326][ T9354] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 835.112851][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 835.191535][ T9354] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 835.204215][T14837] delete_channel: no stack [ 835.242195][ T9354] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 835.283547][ T9348] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 836.710843][T13683] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 836.721607][T13683] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 836.731526][T13683] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 836.740154][T13683] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 836.752930][T13683] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 836.760663][T13683] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 836.825740][T14864] netlink: 'syz.4.3173': attribute type 3 has an invalid length. [ 836.835575][T14864] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3173'. [ 837.270519][T14875] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.3178'. [ 837.367486][T14875] netlink: 'syz.2.3178': attribute type 21 has an invalid length. [ 837.394043][T14875] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3178'. [ 837.463267][T14859] chnl_net:caif_netlink_parms(): no params data found [ 837.556641][T14886] netlink: 'syz.3.3180': attribute type 10 has an invalid length. [ 837.646562][T14886] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 837.943353][T14899] FAULT_INJECTION: forcing a failure. [ 837.943353][T14899] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 837.979535][T14899] CPU: 0 PID: 14899 Comm: syz.1.3182 Not tainted syzkaller #0 [ 837.987261][T14899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 837.998045][T14899] Call Trace: [ 838.001388][T14899] [ 838.004332][T14899] dump_stack_lvl+0x188/0x24e [ 838.010610][T14899] ? show_regs_print_info+0x12/0x12 [ 838.016475][T14899] ? load_image+0x410/0x410 [ 838.021569][T14899] ? __lock_acquire+0x7bd0/0x7bd0 [ 838.027728][T14899] should_fail_ex+0x390/0x4c0 [ 838.032566][T14899] _copy_from_user+0x2c/0x170 [ 838.037513][T14899] ___sys_sendmsg+0x1c3/0x360 [ 838.043049][T14899] ? __sys_sendmsg+0x2a0/0x2a0 [ 838.048568][T14899] ? trace_call_bpf+0xbf/0x6b0 [ 838.053863][T14899] __se_sys_sendmsg+0x1c3/0x2b0 [ 838.059240][T14899] ? perf_trace_preemptirq_template+0x268/0x320 [ 838.065678][T14899] ? __x64_sys_sendmsg+0x80/0x80 [ 838.072499][T14899] ? lockdep_hardirqs_on+0x94/0x140 [ 838.078945][T14899] do_syscall_64+0x4c/0xa0 [ 838.084290][T14899] ? clear_bhb_loop+0x60/0xb0 [ 838.089555][T14899] ? clear_bhb_loop+0x60/0xb0 [ 838.095584][T14899] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 838.102215][T14899] RIP: 0033:0x7fbdbe39ce59 [ 838.107014][T14899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 838.129968][T14899] RSP: 002b:00007fbdbf267028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 838.138707][T14899] RAX: ffffffffffffffda RBX: 00007fbdbe616090 RCX: 00007fbdbe39ce59 [ 838.147160][T14899] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 000000000000000b [ 838.156622][T14899] RBP: 00007fbdbf267090 R08: 0000000000000000 R09: 0000000000000000 [ 838.165292][T14899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 838.176237][T14899] R13: 00007fbdbe616128 R14: 00007fbdbe616090 R15: 00007ffcfbbd9c88 [ 838.184816][T14899] [ 838.300440][ T9354] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 838.450912][T14859] bridge0: port 1(bridge_slave_0) entered blocking state [ 838.481627][T14859] bridge0: port 1(bridge_slave_0) entered disabled state [ 838.554690][T14859] device bridge_slave_0 entered promiscuous mode [ 838.587070][T14859] bridge0: port 2(bridge_slave_1) entered blocking state [ 838.596701][T14859] bridge0: port 2(bridge_slave_1) entered disabled state [ 838.610483][T14859] device bridge_slave_1 entered promiscuous mode [ 838.672159][ T9354] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 838.709872][ T9353] tipc: Subscription rejected, illegal request [ 838.711598][T14914] netlink: 'syz.3.3187': attribute type 7 has an invalid length. [ 838.737438][T14859] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 838.752228][T14914] netlink: 126644 bytes leftover after parsing attributes in process `syz.3.3187'. [ 838.774965][T13683] Bluetooth: hci0: command 0x0409 tx timeout [ 838.876416][ T9354] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 838.904389][T14859] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 839.090721][T14921] device lo entered promiscuous mode [ 839.138383][T14921] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 839.165603][T14925] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3192'. [ 839.185911][T14859] team0: Port device team_slave_0 added [ 839.197596][T14925] openvswitch: netlink: Message has 6 unknown bytes. [ 839.232132][T14859] team0: Port device team_slave_1 added [ 839.359925][T14859] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 839.381768][T14859] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 839.437952][T14859] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 839.467397][T14922] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 839.482325][T14922] device syzkaller0 entered promiscuous mode [ 839.505408][T14859] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 839.523894][T14859] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 839.551822][T14859] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 839.758705][ T9354] device .*! left promiscuous mode [ 839.869234][T14859] device hsr_slave_0 entered promiscuous mode [ 840.853998][T13683] Bluetooth: hci0: command 0x041b tx timeout [ 842.202632][T14859] device hsr_slave_1 entered promiscuous mode [ 842.251726][T14859] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 842.260073][T14859] Cannot create hsr debugfs directory [ 842.289361][T14951] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3197'. [ 842.303295][T14957] netlink: 'syz.4.3196': attribute type 13 has an invalid length. [ 842.317467][T14957] netlink: 152 bytes leftover after parsing attributes in process `syz.4.3196'. [ 842.327865][T14957] erspan0: refused to change device tx_queue_len [ 842.337531][T14957] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 842.380002][ T9354] tipc: Left network mode [ 842.933913][T13683] Bluetooth: hci0: command 0x040f tx timeout [ 843.017681][T14990] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.3201'. [ 843.054121][T14990] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3201'. [ 843.600740][T15006] netlink: 'syz.3.3204': attribute type 21 has an invalid length. [ 844.069566][T15016] netlink: 'syz.1.3208': attribute type 1 has an invalid length. [ 844.131636][T15016] netlink: 127868 bytes leftover after parsing attributes in process `syz.1.3208'. [ 844.292369][T15016] netlink: 'syz.1.3208': attribute type 29 has an invalid length. [ 844.483688][T15022] FAULT_INJECTION: forcing a failure. [ 844.483688][T15022] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 844.592931][T15022] CPU: 0 PID: 15022 Comm: syz.2.3209 Not tainted syzkaller #0 [ 844.601427][T15022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 844.612241][T15022] Call Trace: [ 844.616422][T15022] [ 844.619429][T15022] dump_stack_lvl+0x188/0x24e [ 844.624235][T15022] ? show_regs_print_info+0x12/0x12 [ 844.629483][T15022] ? load_image+0x410/0x410 [ 844.634731][T15022] ? __lock_acquire+0x7bd0/0x7bd0 [ 844.641165][T15022] should_fail_ex+0x390/0x4c0 [ 844.646037][T15022] _copy_from_user+0x2c/0x170 [ 844.650793][T15022] iovec_from_user+0x143/0x360 [ 844.656504][T15022] __import_iovec+0x6c/0x510 [ 844.661169][T15022] import_iovec+0x6f/0xa0 [ 844.665539][T15022] ___sys_sendmsg+0x252/0x360 [ 844.671044][T15022] ? __sys_sendmsg+0x2a0/0x2a0 [ 844.676095][T15022] ? trace_call_bpf+0xbf/0x6b0 [ 844.681278][T15022] __se_sys_sendmsg+0x1c3/0x2b0 [ 844.686524][T15022] ? perf_trace_preemptirq_template+0x268/0x320 [ 844.693577][T15022] ? __x64_sys_sendmsg+0x80/0x80 [ 844.698664][T15022] ? lockdep_hardirqs_on+0x94/0x140 [ 844.703904][T15022] do_syscall_64+0x4c/0xa0 [ 844.708526][T15022] ? clear_bhb_loop+0x60/0xb0 [ 844.713297][T15022] ? clear_bhb_loop+0x60/0xb0 [ 844.718021][T15022] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 844.723946][T15022] RIP: 0033:0x7f5fb219ce59 [ 844.728504][T15022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 844.748356][T15022] RSP: 002b:00007f5fb3052028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 844.757167][T15022] RAX: ffffffffffffffda RBX: 00007f5fb2416090 RCX: 00007f5fb219ce59 [ 844.766590][T15022] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 000000000000000b [ 844.776278][T15022] RBP: 00007f5fb3052090 R08: 0000000000000000 R09: 0000000000000000 [ 844.784971][T15022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 844.792974][T15022] R13: 00007f5fb2416128 R14: 00007f5fb2416090 R15: 00007ffd4072de88 [ 844.801083][T15022] [ 844.827129][T15016] netlink: 'syz.1.3208': attribute type 29 has an invalid length. [ 845.014268][T13683] Bluetooth: hci0: command 0x0419 tx timeout [ 845.226975][T15037] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.3213'. [ 845.459188][T14859] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 845.510853][T14859] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 845.715702][T14859] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 845.726069][T14859] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 845.778617][ T9354] device hsr_slave_0 left promiscuous mode [ 845.786113][ T9354] device hsr_slave_1 left promiscuous mode [ 845.801364][ T9354] bridge0: port 3(team0) entered disabled state [ 845.812156][ T9354] device bridge_slave_1 left promiscuous mode [ 845.819112][ T9354] bridge0: port 2(bridge_slave_1) entered disabled state [ 845.829756][ T9354] device bridge_slave_0 left promiscuous mode [ 845.843920][ T9354] bridge0: port 1(bridge_slave_0) entered disabled state [ 846.155309][T15049] netlink: 212908 bytes leftover after parsing attributes in process `syz.4.3215'. [ 846.171387][T15049] netlink: zone id is out of range [ 846.178332][ T9354] device geneve1 left promiscuous mode [ 846.186806][ T9354] team0 (unregistering): Port device geneve1 removed [ 846.780960][ T9354] device team_slave_1 left promiscuous mode [ 846.792266][ T9354] team0 (unregistering): Port device team_slave_1 removed [ 846.849836][ T9354] device team_slave_0 left promiscuous mode [ 846.858844][ T9354] team0 (unregistering): Port device team_slave_0 removed [ 847.558978][T14859] 8021q: adding VLAN 0 to HW filter on device bond0 [ 847.620067][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 847.646342][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 847.679816][T14859] 8021q: adding VLAN 0 to HW filter on device team0 [ 847.722001][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 847.745571][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 847.784609][ T9358] bridge0: port 1(bridge_slave_0) entered blocking state [ 847.792399][ T9358] bridge0: port 1(bridge_slave_0) entered forwarding state [ 847.931278][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 847.959282][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 847.985773][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 848.025747][ T9358] bridge0: port 2(bridge_slave_1) entered blocking state [ 848.032917][ T9358] bridge0: port 2(bridge_slave_1) entered forwarding state [ 848.080841][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 848.102636][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 848.145271][T15067] netlink: 10 bytes leftover after parsing attributes in process `syz.3.3219'. [ 848.194059][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 848.203355][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 848.246359][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 848.267068][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 848.291301][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 848.336985][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 848.380387][T15069] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3219'. [ 848.399735][T14859] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 848.464514][T14859] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 848.625040][T15081] netlink: 'syz.3.3221': attribute type 29 has an invalid length. [ 848.652089][T15071] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3220'. [ 848.698303][T15071] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 848.770469][T15071] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 848.885504][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 848.920250][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 848.943532][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 848.978676][T15081] netlink: 'syz.3.3221': attribute type 29 has an invalid length. [ 849.004054][T15082] netlink: 'syz.3.3221': attribute type 29 has an invalid length. [ 849.321481][T15097] netlink: 'syz.3.3224': attribute type 10 has an invalid length. [ 849.548853][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 849.565163][ T9354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 849.644739][T14859] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 849.755835][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 849.801003][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 850.244539][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 850.256222][T15118] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.3226'. [ 850.280456][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 850.336638][T14859] device veth0_vlan entered promiscuous mode [ 850.349304][T15109] netlink: 'syz.3.3228': attribute type 21 has an invalid length. [ 850.361221][T15109] netlink: 'syz.3.3228': attribute type 1 has an invalid length. [ 850.433762][T15109] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3228'. [ 850.533346][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 850.557025][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 850.619515][T15114] netlink: 180 bytes leftover after parsing attributes in process `syz.3.3228'. [ 850.658229][T14859] device veth1_vlan entered promiscuous mode [ 850.805779][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 850.830403][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 850.849250][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 850.870184][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 850.937892][T14859] device veth0_macvtap entered promiscuous mode [ 851.129234][T14859] device veth1_macvtap entered promiscuous mode [ 851.160152][T15127] netlink: 'syz.2.3229': attribute type 21 has an invalid length. [ 851.347182][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 851.360560][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 851.386443][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 851.415388][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 851.431138][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 851.452516][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 851.470079][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 851.480926][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 851.507047][T15140] FAULT_INJECTION: forcing a failure. [ 851.507047][T15140] name failslab, interval 1, probability 0, space 0, times 0 [ 851.522258][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 851.541509][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 851.563441][T15140] CPU: 0 PID: 15140 Comm: syz.3.3231 Not tainted syzkaller #0 [ 851.571524][T15140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 851.583740][T15140] Call Trace: [ 851.587344][T15140] [ 851.591457][T15140] dump_stack_lvl+0x188/0x24e [ 851.598049][T15140] ? show_regs_print_info+0x12/0x12 [ 851.605192][T15140] ? load_image+0x410/0x410 [ 851.610756][T15140] ? __might_sleep+0xd0/0xd0 [ 851.615514][T15140] ? __lock_acquire+0x7bd0/0x7bd0 [ 851.621639][T15140] should_fail_ex+0x390/0x4c0 [ 851.626354][T15140] should_failslab+0x5/0x20 [ 851.631255][T15140] slab_pre_alloc_hook+0x59/0x300 [ 851.636371][T15140] kmem_cache_alloc_node+0x5a/0x310 [ 851.641966][T15140] ? __alloc_skb+0xf9/0x7d0 [ 851.646604][T15140] __alloc_skb+0xf9/0x7d0 [ 851.650982][T15140] netlink_sendmsg+0x654/0xbd0 [ 851.655790][T15140] ? netlink_getsockopt+0x550/0x550 [ 851.661037][T15140] ? aa_sock_msg_perm+0x94/0x150 [ 851.666018][T15140] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 851.671358][T15140] ? security_socket_sendmsg+0x7c/0xa0 [ 851.676870][T15140] ? netlink_getsockopt+0x550/0x550 [ 851.682375][T15140] ____sys_sendmsg+0x5ed/0x9a0 [ 851.687281][T15140] ? __sys_sendmsg_sock+0x30/0x30 [ 851.692792][T15140] ? __import_iovec+0x306/0x510 [ 851.699893][T15140] ? import_iovec+0x6f/0xa0 [ 851.705880][T15140] ___sys_sendmsg+0x2a2/0x360 [ 851.714173][T14859] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 851.715955][T15140] ? __sys_sendmsg+0x2a0/0x2a0 [ 851.716088][T15140] ? __lock_acquire+0x7bd0/0x7bd0 [ 851.736015][T15140] __se_sys_sendmsg+0x1c3/0x2b0 [ 851.740919][T15140] ? __x64_sys_sendmsg+0x80/0x80 [ 851.746087][T15140] ? lockdep_hardirqs_on+0x94/0x140 [ 851.751339][T15140] do_syscall_64+0x4c/0xa0 [ 851.758349][T15140] ? clear_bhb_loop+0x60/0xb0 [ 851.763082][T15140] ? clear_bhb_loop+0x60/0xb0 [ 851.767911][T15140] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 851.773855][T15140] RIP: 0033:0x7f42e199ce59 [ 851.778449][T15140] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 851.798527][T15140] RSP: 002b:00007f42e286e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 851.806981][T15140] RAX: ffffffffffffffda RBX: 00007f42e1c16180 RCX: 00007f42e199ce59 [ 851.815164][T15140] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 000000000000000b [ 851.823523][T15140] RBP: 00007f42e286e090 R08: 0000000000000000 R09: 0000000000000000 [ 851.831700][T15140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 851.839704][T15140] R13: 00007f42e1c16218 R14: 00007f42e1c16180 R15: 00007ffe07d3ba68 [ 851.847729][T15140] [ 851.956632][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 851.996649][ T9350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 852.046830][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 852.079302][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 852.109889][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 852.169329][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 852.210864][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 852.240042][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 852.266190][T14859] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 852.298946][T14859] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 852.332638][T14859] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 852.391169][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 852.418613][T12469] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 852.448711][T14859] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.469000][T14859] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.485603][T14859] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.498436][T14859] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.800191][ T9358] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.813732][ T9358] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.840590][ T9358] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 852.900882][ T9348] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.941956][ T9348] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.967455][ T9352] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 853.731335][T15174] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3239'. [ 854.888683][T15207] netlink: 'syz.1.3247': attribute type 3 has an invalid length. [ 854.923063][T15207] netlink: 114680 bytes leftover after parsing attributes in process `syz.1.3247'. [ 855.436864][T15232] netlink: 168 bytes leftover after parsing attributes in process `syz.3.3254'. [ 855.764600][T15245] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.3259'. [ 856.337854][T15254] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3260'. [ 856.950812][T15264] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3263'. [ 858.007532][T15280] netlink: 'syz.3.3265': attribute type 21 has an invalid length. [ 858.024512][T15290] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3272'. [ 858.065898][T15290] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 860.544410][T15343] netlink: 'syz.1.3290': attribute type 21 has an invalid length. [ 860.552436][T15343] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3290'. [ 860.829854][T15353] netlink: 'syz.0.3289': attribute type 21 has an invalid length. [ 860.866737][T15355] netlink: 'syz.3.3291': attribute type 21 has an invalid length. [ 862.723964][T15384] netlink: 'syz.2.3303': attribute type 27 has an invalid length. [ 862.902948][T15384] netlink: 'syz.2.3303': attribute type 4 has an invalid length. [ 863.012503][T15384] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3303'. [ 864.772685][T15411] netlink: 'syz.2.3312': attribute type 2 has an invalid length. [ 864.836568][T15411] netlink: 'syz.2.3312': attribute type 8 has an invalid length. [ 864.873378][T15411] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3312'. [ 865.330758][T15417] netlink: 'syz.1.3316': attribute type 21 has an invalid length. [ 867.512705][T15430] tipc: Started in network mode [ 867.517886][T15430] tipc: Node identity 9215a268, cluster identity 4711 [ 867.533266][T15430] tipc: Node number set to 2450891368 [ 867.564120][T15419] netlink: 'syz.3.3314': attribute type 21 has an invalid length. [ 867.572149][T15445] netlink: 'syz.1.3321': attribute type 21 has an invalid length. [ 870.146976][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.153347][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.775151][T15500] tipc: Started in network mode [ 870.796379][T15500] tipc: Node identity 9215a268, cluster identity 4711 [ 870.839195][T15500] tipc: Node number set to 2450891368 [ 871.187474][T15505] netlink: 'syz.4.3335': attribute type 21 has an invalid length. [ 871.223793][T15505] IPv6: NLM_F_CREATE should be specified when creating new route [ 871.232170][T15505] IPv6: Can't replace route, no match found [ 871.276147][T15508] netlink: 'syz.4.3335': attribute type 1 has an invalid length. [ 871.387013][T15508] netlink: 13439 bytes leftover after parsing attributes in process `syz.4.3335'. [ 871.426590][T15512] netlink: 'syz.0.3337': attribute type 21 has an invalid length. [ 871.580490][T15513] netlink: 'syz.3.3339': attribute type 10 has an invalid length. [ 871.612814][T15513] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.3339'. [ 872.791178][T15546] netlink: 16399 bytes leftover after parsing attributes in process `syz.4.3348'. [ 876.528175][T15597] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3364'. [ 877.369297][T15607] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3366'. [ 878.232669][T15626] device syzkaller0 entered promiscuous mode [ 882.234930][T15642] netlink: 'syz.3.3377': attribute type 21 has an invalid length. [ 882.242815][T15642] IPv6: NLM_F_CREATE should be specified when creating new route [ 882.256303][T15642] IPv6: Can't replace route, no match found [ 882.262328][T15643] netlink: 'syz.3.3377': attribute type 21 has an invalid length. [ 882.270361][T15643] IPv6: NLM_F_CREATE should be specified when creating new route [ 882.316391][T15643] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 882.323722][T15643] IPv6: NLM_F_CREATE should be set when creating new route [ 882.331110][T15643] IPv6: NLM_F_CREATE should be set when creating new route [ 882.338598][T15643] IPv6: NLM_F_CREATE should be set when creating new route [ 882.578702][T15653] netlink: 'syz.4.3380': attribute type 4 has an invalid length. [ 882.615361][T15653] netlink: 168 bytes leftover after parsing attributes in process `syz.4.3380'. [ 883.306684][T15681] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3385'. [ 884.026204][T15685] netlink: 10 bytes leftover after parsing attributes in process `syz.0.3386'. [ 884.654288][T15743] netlink: 'syz.1.3391': attribute type 21 has an invalid length. [ 884.997369][T15753] netlink: 'syz.3.3393': attribute type 10 has an invalid length. [ 885.238034][T15753] team0 (unregistering): Port device team_slave_0 removed [ 885.273166][T15753] team0 (unregistering): Port device team_slave_1 removed [ 885.297659][T15755] netlink: 'syz.3.3393': attribute type 25 has an invalid length. [ 885.305996][T15755] netlink: 'syz.3.3393': attribute type 25 has an invalid length. [ 885.350775][T15765] : port 1(ip6gretap0) entered blocking state [ 885.370002][T15765] : port 1(ip6gretap0) entered disabled state [ 885.401297][T15765] device ip6gretap0 entered promiscuous mode [ 885.443128][T15766] device ip6gretap0 left promiscuous mode [ 885.467214][T15766] : port 1(ip6gretap0) entered disabled state [ 886.099570][T13683] Bluetooth: hci5: unexpected event 0x05 length: 15 > 4 [ 886.456469][T15817] netlink: 'syz.1.3413': attribute type 10 has an invalid length. [ 886.521085][T15817] netlink: 168 bytes leftover after parsing attributes in process `syz.1.3413'. [ 886.563756][T15822] netlink: 'syz.1.3413': attribute type 10 has an invalid length. [ 886.651597][T15822] team0: Port device wlan1 added [ 887.007363][T15826] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3415'. [ 888.224275][T15861] netlink: 14568 bytes leftover after parsing attributes in process `syz.4.3425'. [ 889.048031][T15884] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3432'. [ 889.163384][T15886] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3432'. [ 889.229675][T15886] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 889.846470][T15908] netlink: 9286 bytes leftover after parsing attributes in process `syz.1.3436'. [ 890.194083][T13683] Bluetooth: hci3: ACL packet for unknown connection handle 0 [ 890.215905][T15917] netlink: 'syz.0.3439': attribute type 33 has an invalid length. [ 890.293993][T15917] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3439'. [ 890.350525][T15917] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3439'. [ 890.772616][T15931] device syzkaller0 entered promiscuous mode [ 890.913348][T15944] netlink: 'syz.4.3443': attribute type 1 has an invalid length. [ 890.931403][T15944] netlink: 105120 bytes leftover after parsing attributes in process `syz.4.3443'. [ 892.614521][ T4277] Bluetooth: hci3: command 0x0406 tx timeout [ 896.043922][T15970] netlink: 'syz.4.3455': attribute type 10 has an invalid length. [ 896.084749][T15970] team0: Device ipvlan1 failed to register rx_handler [ 896.137544][T15983] netlink: 'syz.0.3459': attribute type 10 has an invalid length. [ 896.291862][T15983] team0 (unregistering): Port device team_slave_0 removed [ 896.341996][T15983] team0 (unregistering): Port device team_slave_1 removed [ 898.485246][T16041] netlink: 'syz.0.3475': attribute type 21 has an invalid length. [ 899.695319][T16057] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.3482'. [ 901.941822][T16072] device syzkaller0 entered promiscuous mode [ 902.110591][T16090] netlink: 14568 bytes leftover after parsing attributes in process `syz.4.3490'. [ 902.126893][T16093] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3490'. [ 902.814225][T16109] netlink: 'syz.1.3492': attribute type 21 has an invalid length. [ 903.276378][T16125] mac80211_hwsim hwsim34 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 903.505982][T16129] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.3500'. [ 904.763914][T16147] netlink: 'syz.3.3505': attribute type 3 has an invalid length. [ 904.809588][T16147] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.3505'. [ 906.495534][T16203] FAULT_INJECTION: forcing a failure. [ 906.495534][T16203] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 906.624053][T16203] CPU: 0 PID: 16203 Comm: syz.3.3520 Not tainted syzkaller #0 [ 906.631596][T16203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 906.641686][T16203] Call Trace: [ 906.644985][T16203] [ 906.647936][T16203] dump_stack_lvl+0x188/0x24e [ 906.652644][T16203] ? show_regs_print_info+0x12/0x12 [ 906.657876][T16203] ? load_image+0x410/0x410 [ 906.662419][T16203] ? __lock_acquire+0x7bd0/0x7bd0 [ 906.667482][T16203] should_fail_ex+0x390/0x4c0 [ 906.672193][T16203] _copy_from_user+0x2c/0x170 [ 906.676906][T16203] ___sys_recvmsg+0x170/0x590 [ 906.681620][T16203] ? __sys_recvmsg+0x2a0/0x2a0 [ 906.686413][T16203] ? common_file_perm+0x171/0x1c0 [ 906.691478][T16203] ? __fget_files+0x3fc/0x460 [ 906.696199][T16203] __x64_sys_recvmsg+0x20d/0x2e0 [ 906.701179][T16203] ? ___sys_recvmsg+0x590/0x590 [ 906.706115][T16203] ? lockdep_hardirqs_on+0x94/0x140 [ 906.711338][T16203] do_syscall_64+0x4c/0xa0 [ 906.715771][T16203] ? clear_bhb_loop+0x60/0xb0 [ 906.720464][T16203] ? clear_bhb_loop+0x60/0xb0 [ 906.725154][T16203] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 906.731065][T16203] RIP: 0033:0x7f42e199ce59 [ 906.735481][T16203] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 906.755283][T16203] RSP: 002b:00007f42e288f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 906.763719][T16203] RAX: ffffffffffffffda RBX: 00007f42e1c16090 RCX: 00007f42e199ce59 [ 906.771700][T16203] RDX: 0000000040002002 RSI: 0000200000000000 RDI: 0000000000000005 [ 906.779874][T16203] RBP: 00007f42e288f090 R08: 0000000000000000 R09: 0000000000000000 [ 906.788077][T16203] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 906.796057][T16203] R13: 00007f42e1c16128 R14: 00007f42e1c16090 R15: 00007ffe07d3ba68 [ 906.804065][T16203] [ 908.151554][T16221] netlink: 'syz.1.3525': attribute type 25 has an invalid length. [ 908.195168][T16221] netlink: 'syz.1.3525': attribute type 29 has an invalid length. [ 908.288915][T16224] netlink: 5 bytes leftover after parsing attributes in process `syz.1.3525'. [ 908.350066][T16223] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3535'. [ 908.523142][T16226] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3535'. [ 909.461289][T16239] device syzkaller0 entered promiscuous mode [ 911.159120][T16261] netlink: 'syz.3.3531': attribute type 21 has an invalid length. [ 911.907225][T16285] netlink: 'syz.1.3539': attribute type 21 has an invalid length. [ 911.984263][T16285] netlink: 'syz.1.3539': attribute type 10 has an invalid length. [ 911.992351][T16285] netlink: 'syz.1.3539': attribute type 12 has an invalid length. [ 912.093971][T16285] netlink: 'syz.1.3539': attribute type 13 has an invalid length. [ 912.102081][T16285] netlink: 'syz.1.3539': attribute type 14 has an invalid length. [ 912.233790][T16285] netlink: 'syz.1.3539': attribute type 15 has an invalid length. [ 912.241952][T16285] netlink: 'syz.1.3539': attribute type 16 has an invalid length. [ 912.333949][T16285] netlink: 12226 bytes leftover after parsing attributes in process `syz.1.3539'. [ 915.378894][T16318] device syzkaller0 entered promiscuous mode [ 915.906647][T16343] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 917.089259][T16367] validate_nla: 6 callbacks suppressed [ 917.089282][T16367] netlink: 'syz.3.3561': attribute type 7 has an invalid length. [ 917.103087][T16367] netlink: 'syz.3.3561': attribute type 7 has an invalid length. [ 917.111546][T16367] netlink: 198580 bytes leftover after parsing attributes in process `syz.3.3561'. [ 918.144378][T16329] mac80211_hwsim hwsim23 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 918.213753][T13683] Bluetooth: hci5: command 0x0406 tx timeout [ 923.600740][T16428] netlink: 'syz.3.3576': attribute type 3 has an invalid length. [ 923.618441][T16427] netlink: 'syz.3.3576': attribute type 11 has an invalid length. [ 923.623571][T16428] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.3576'. [ 923.627790][T16427] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3576'. [ 924.399210][T16426] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 925.293360][T16449] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3583'. [ 925.711802][T16464] device sit0 entered promiscuous mode [ 925.961606][T16467] netlink: 'syz.1.3588': attribute type 29 has an invalid length. [ 926.021945][T16467] netlink: 'syz.1.3588': attribute type 29 has an invalid length. [ 926.059818][T16467] netlink: 'syz.1.3588': attribute type 29 has an invalid length. [ 926.068331][T16474] netlink: 'syz.2.3590': attribute type 39 has an invalid length. [ 926.743523][T16467] netlink: 'syz.1.3588': attribute type 29 has an invalid length. [ 926.793659][T16489] netlink: 'syz.4.3594': attribute type 21 has an invalid length. [ 927.069298][T16495] device bond_slave_1 entered promiscuous mode [ 927.120256][T16505] netlink: 54695 bytes leftover after parsing attributes in process `syz.0.3599'. [ 927.191778][T16491] netlink: 'syz.3.3597': attribute type 1 has an invalid length. [ 927.220657][T16491] netlink: 105120 bytes leftover after parsing attributes in process `syz.3.3597'. [ 927.512737][T16519] netlink: 'syz.4.3602': attribute type 1 has an invalid length. [ 927.541927][T16519] netlink: 83992 bytes leftover after parsing attributes in process `syz.4.3602'. [ 927.569881][T16523] netlink: 'syz.2.3603': attribute type 11 has an invalid length. [ 927.579524][T16523] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3603'. [ 927.601801][T16523] netlink: 'syz.2.3603': attribute type 3 has an invalid length. [ 927.610703][T16523] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3603'. [ 927.659763][T16529] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3603'. [ 928.437310][T16520] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 929.299854][T16529] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3603'. [ 929.318996][T16534] netlink: 'syz.1.3606': attribute type 25 has an invalid length. [ 929.333789][T16534] netlink: 'syz.1.3606': attribute type 29 has an invalid length. [ 929.363096][T16536] netlink: 5 bytes leftover after parsing attributes in process `syz.1.3606'. [ 929.392772][T16538] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 929.444007][T16540] netlink: 'syz.4.3607': attribute type 40 has an invalid length. [ 929.828815][T16554] netlink: 'syz.2.3609': attribute type 29 has an invalid length. [ 929.981886][T16560] netlink: 'syz.4.3611': attribute type 1 has an invalid length. [ 930.001605][T16560] netlink: 105120 bytes leftover after parsing attributes in process `syz.4.3611'. [ 930.026374][T16557] netlink: 'syz.3.3612': attribute type 21 has an invalid length. [ 930.035900][T16554] netlink: 'syz.2.3609': attribute type 29 has an invalid length. [ 930.082741][T16559] netlink: 'syz.2.3609': attribute type 29 has an invalid length. [ 930.151563][T16563] netlink: 'syz.2.3609': attribute type 29 has an invalid length. [ 930.228191][T16547] netlink: 'syz.2.3609': attribute type 29 has an invalid length. [ 930.482394][T16574] GPL: port 1(syz_tun) entered blocking state [ 930.524141][T16574] GPL: port 1(syz_tun) entered disabled state [ 930.553162][T16574] device syz_tun entered promiscuous mode [ 930.593929][T16580] device syz_tun left promiscuous mode [ 930.614460][T16580] GPL: port 1(syz_tun) entered disabled state [ 930.632388][T16587] sctp: [Deprecated]: syz.1.3620 (pid 16587) Use of struct sctp_assoc_value in delayed_ack socket option. [ 930.632388][T16587] Use struct sctp_sack_info instead [ 931.184808][T16609] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3626'. [ 931.497539][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.503955][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.646386][T16619] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3628'. [ 932.324942][T16648] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3635'. [ 933.612519][T16659] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.3639'. [ 934.093466][T16660] netlink: 35840 bytes leftover after parsing attributes in process `syz.0.3639'. [ 934.345145][T16662] delete_channel: no stack [ 934.872904][T16677] delete_channel: no stack [ 935.343129][T16695] validate_nla: 7 callbacks suppressed [ 935.343147][T16695] netlink: 'syz.4.3650': attribute type 29 has an invalid length. [ 935.374729][T16696] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3648'. [ 935.451828][T16693] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3648'. [ 935.542787][T16695] netlink: 'syz.4.3650': attribute type 29 has an invalid length. [ 935.641586][T16702] netlink: 'syz.1.3645': attribute type 17 has an invalid length. [ 935.661410][T16702] netlink: 'syz.1.3645': attribute type 16 has an invalid length. [ 935.679730][T16702] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3645'. [ 935.828669][T16689] netlink: 'syz.4.3650': attribute type 29 has an invalid length. [ 935.882171][T16698] netlink: 'syz.4.3650': attribute type 29 has an invalid length. [ 935.927055][T16693] netlink: 'syz.2.3648': attribute type 21 has an invalid length. [ 936.170357][T16713] netlink: 'syz.1.3654': attribute type 3 has an invalid length. [ 936.200298][T16713] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3654'. [ 936.225554][T16717] netlink: 35840 bytes leftover after parsing attributes in process `syz.1.3654'. [ 936.566922][T16733] netlink: 'syz.0.3657': attribute type 21 has an invalid length. [ 938.693889][ T4277] Bluetooth: hci4: command 0x0406 tx timeout [ 939.740621][T16744] netlink: 'syz.3.3665': attribute type 10 has an invalid length. [ 939.945114][T16759] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3669'. [ 939.960730][T16759] netlink: 35840 bytes leftover after parsing attributes in process `syz.2.3669'. [ 941.140468][T16796] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 941.148370][T16796] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 941.550144][T16802] validate_nla: 1 callbacks suppressed [ 941.550182][T16802] netlink: 'syz.4.3683': attribute type 3 has an invalid length. [ 941.641923][T16802] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3683'. [ 941.713424][T16805] netlink: 35840 bytes leftover after parsing attributes in process `syz.4.3683'. [ 942.614685][T16828] netlink: 'syz.3.3690': attribute type 1 has an invalid length. [ 942.622479][T16828] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3690'. [ 942.956671][T16824] netlink: 'syz.4.3689': attribute type 10 has an invalid length. [ 943.023505][T16835] netlink: 'syz.1.3692': attribute type 3 has an invalid length. [ 943.052161][T16835] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3692'. [ 943.302023][T16824] device veth0_vlan left promiscuous mode [ 943.330354][T16824] device veth0_vlan entered promiscuous mode [ 943.370467][T16824] team0: Device veth0_vlan failed to register rx_handler [ 943.414218][T16842] netlink: 'syz.2.3694': attribute type 8 has an invalid length. [ 943.422175][T16842] netlink: 'syz.2.3694': attribute type 4 has an invalid length. [ 943.460762][T16842] netlink: 'syz.2.3694': attribute type 7 has an invalid length. [ 943.469667][T16842] netlink: 'syz.2.3694': attribute type 8 has an invalid length. [ 943.478709][T16842] netlink: 'syz.2.3694': attribute type 7 has an invalid length. [ 943.487678][T16842] netlink: 125876 bytes leftover after parsing attributes in process `syz.2.3694'. [ 943.566297][T16839] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3693'. [ 944.102247][T16855] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3699'. [ 945.699655][T16877] netlink: 87536 bytes leftover after parsing attributes in process `syz.2.3706'. [ 946.116998][T16876] netlink: 14207 bytes leftover after parsing attributes in process `syz.3.3705'. [ 946.612283][T16894] netlink: 'syz.1.3710': attribute type 3 has an invalid length. [ 946.636195][T16894] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3710'. [ 947.096322][T16906] netlink: 'syz.1.3715': attribute type 1 has an invalid length. [ 947.138296][T16906] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3715'. [ 947.709714][T16928] device syzkaller0 entered promiscuous mode [ 947.810285][T16933] netlink: 'syz.3.3721': attribute type 2 has an invalid length. [ 948.328744][T16946] netlink: 'syz.4.3725': attribute type 3 has an invalid length. [ 948.354053][T16946] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.3725'. [ 951.331997][T16933] device 0 entered promiscuous mode [ 951.520317][T16960] netlink: 763 bytes leftover after parsing attributes in process `syz.4.3728'. [ 951.545476][T16962] device macsec0 entered promiscuous mode [ 951.731670][T16972] netlink: 'syz.1.3732': attribute type 10 has an invalid length. [ 951.837487][T16968] can: request_module (can-proto-3) failed. [ 951.981969][T16972] team0 (unregistering): Port device team_slave_0 removed [ 952.023553][T16972] team0 (unregistering): Port device team_slave_1 removed [ 952.080362][T16972] team0 (unregistering): Port device wlan1 removed [ 952.091910][T16981] netlink: 'syz.0.3733': attribute type 1 has an invalid length. [ 952.119722][T16981] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3733'. [ 952.243003][T16985] netlink: 111 bytes leftover after parsing attributes in process `syz.2.3736'. [ 952.605703][T16993] netlink: 'syz.2.3739': attribute type 3 has an invalid length. [ 952.651807][T16993] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3739'. [ 953.810214][T17042] netlink: 'syz.3.3755': attribute type 10 has an invalid length. [ 953.895537][T17045] syz.1.3756[17045] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 954.099047][T17054] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.3759'. [ 954.583317][T17060] netlink: 'syz.2.3761': attribute type 21 has an invalid length. [ 954.613971][T17060] netlink: 'syz.2.3761': attribute type 6 has an invalid length. [ 954.653818][T17060] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3761'. [ 955.115363][T17080] syz.3.3766[17080] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 955.115894][T17080] syz.3.3766[17080] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 955.152318][T17078] netlink: 'syz.4.3764': attribute type 7 has an invalid length. [ 955.206748][T17085] device macsec0 entered promiscuous mode [ 955.304478][T17078] netlink: 'syz.4.3764': attribute type 1 has an invalid length. [ 955.312273][T17078] netlink: 184904 bytes leftover after parsing attributes in process `syz.4.3764'. [ 955.880746][T17101] netlink: 16399 bytes leftover after parsing attributes in process `syz.3.3774'. [ 955.932726][T17110] netlink: 'syz.3.3774': attribute type 1 has an invalid length. [ 956.063824][T17110] netlink: 181400 bytes leftover after parsing attributes in process `syz.3.3774'. [ 957.390350][T17151] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3785'. [ 957.478036][T17153] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3785'. [ 957.594120][T17157] device syzkaller0 entered promiscuous mode [ 958.205529][T17177] netlink: 196 bytes leftover after parsing attributes in process `syz.2.3794'. [ 959.173839][T13683] Bluetooth: hci0: command 0x0406 tx timeout [ 965.645750][T17228] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.3809'. [ 965.852648][T17235] netlink: 'syz.2.3812': attribute type 3 has an invalid length. [ 965.871429][T17237] netlink: 'syz.1.3813': attribute type 1 has an invalid length. [ 965.889865][T17235] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3812'. [ 965.921500][T17237] netlink: 'syz.1.3813': attribute type 3 has an invalid length. [ 965.974043][T17237] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3813'. [ 966.159498][T17254] netlink: 143932 bytes leftover after parsing attributes in process `syz.0.3817'. [ 966.161748][T17258] netlink: 143932 bytes leftover after parsing attributes in process `syz.0.3817'. [ 966.180556][T17258] netlink: zone id is out of range [ 966.222830][T17258] netlink: zone id is out of range [ 966.229664][T17258] netlink: zone id is out of range [ 966.236805][T17254] netlink: zone id is out of range [ 966.273722][T17258] netlink: zone id is out of range [ 966.278943][T17258] netlink: zone id is out of range [ 966.293881][T17254] netlink: zone id is out of range [ 966.294707][T17258] netlink: zone id is out of range [ 966.324094][T17254] netlink: zone id is out of range [ 966.329818][T17258] netlink: zone id is out of range [ 966.607536][T17284] netlink: 'syz.3.3823': attribute type 2 has an invalid length. [ 966.683801][T17284] netlink: 178412 bytes leftover after parsing attributes in process `syz.3.3823'. [ 967.464339][T17290] netlink: 'syz.1.3826': attribute type 3 has an invalid length. [ 967.472162][T17290] netlink: 'syz.1.3826': attribute type 1 has an invalid length. [ 967.492816][T17290] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3826'. [ 967.536694][T17302] netlink: 'syz.4.3830': attribute type 4 has an invalid length. [ 967.563768][T17302] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.3830'. [ 967.702448][T17307] netlink: 'syz.1.3832': attribute type 3 has an invalid length. [ 967.720642][T17307] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3832'. [ 967.844731][T17315] netlink: 'syz.4.3834': attribute type 25 has an invalid length. [ 967.883908][T17315] netlink: 'syz.4.3834': attribute type 29 has an invalid length. [ 968.070015][T17319] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3833'. [ 968.465572][T17319] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 968.573516][T17319] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 968.639683][T17319] bond0 (unregistering): Released all slaves [ 968.768503][T17343] device veth0_macvtap left promiscuous mode [ 969.830757][T17379] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 971.929164][T17394] __nla_validate_parse: 2 callbacks suppressed [ 971.929182][T17394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3857'. [ 971.945906][T17394] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3857'. [ 971.964192][T17394] netlink: 33 bytes leftover after parsing attributes in process `syz.2.3857'. [ 971.976807][T17394] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3857'. [ 971.991943][T17394] netlink: 33 bytes leftover after parsing attributes in process `syz.2.3857'. [ 972.006369][T17394] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3857'. [ 972.015840][T17394] netlink: 33 bytes leftover after parsing attributes in process `syz.2.3857'. [ 972.027345][T17395] validate_nla: 3 callbacks suppressed [ 972.027385][T17395] netlink: 'syz.0.3858': attribute type 10 has an invalid length. [ 972.041548][T17395] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3858'. [ 972.872736][T17420] netlink: 'syz.3.3868': attribute type 13 has an invalid length. [ 972.932147][T17420] netlink: 14581 bytes leftover after parsing attributes in process `syz.3.3868'. [ 973.066544][T17423] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.3867'. Stopping sshd: [ 975.772602][ T46] tipc: Subscription rejected, illegal request stopped /usr/sbin/sshd (pid 4031) OK Stopping crond: stopped /usr/sbin/crond (pid 4013) OK Stopping dhcpcd... stopped /sbin/dhcpcd (pid 3934) Stopping network: [ 978.920804][T17500] __nla_validate_parse: 2 callbacks suppressed [ 978.920822][T17500] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3883'. [ 979.030477][T17506] netlink: 'syz.3.3884': attribute type 10 has an invalid length. [ 979.108927][T17509] netlink: 'syz.1.3885': attribute type 3 has an invalid length. [ 979.243829][T17509] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3885'. [ 979.553054][T17521] netlink: 'syz.4.3887': attribute type 21 has an invalid length. [ 979.864971][T17516] netlink: 'syz.0.3886': attribute type 7 has an invalid length. OK Stopping iptables: [ 980.487851][T17558] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.3896'. OK [ 980.866124][T17571] netlink: 'syz.3.3899': attribute type 3 has an invalid length. Stopping system message bus: [ 980.908680][T17571] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.3899'. [ 981.518451][T17595] device sit0 entered promiscuous mode [ 981.618212][T17602] sctp: [Deprecated]: syz.3.3904 (pid 17602) Use of struct sctp_assoc_value in delayed_ack socket option. [ 981.618212][T17602] Use struct sctp_sack_info instead [ 981.814072][T17599] netlink: 'syz.3.3904': attribute type 21 has an invalid length. done [ 982.481632][T17624] netlink: 'syz.3.3909': attribute type 3 has an invalid length. [ 982.503261][T17624] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.3909'. [ 983.127299][T17642] device pim6reg1 entered promiscuous mode [ 983.316485][T17650] netlink: 'syz.3.3916': attribute type 1 has an invalid length. [ 983.373684][T17650] netlink: 105120 bytes leftover after parsing attributes in process `syz.3.3916'. [ 983.443004][T17650] netlink: 'syz.3.3916': attribute type 1 has an invalid length. [ 983.516832][T17650] netlink: 105120 bytes leftover after parsing attributes in process `syz.3.3916'. [ 983.608376][T17660] netlink: 64535 bytes leftover after parsing attributes in process `syz.4.3918'. [ 983.657369][T17656] netlink: 'syz.2.3915': attribute type 3 has an invalid length. [ 983.717369][T17656] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.3915'. Stopping klogd: [ 984.064948][T17679] netlink: 'syz.1.3922': attribute type 3 has an invalid length. [ 984.084537][T17679] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.3922'. OK Stopping acpid: [ 984.640127][T17701] net_ratelimit: 7087 callbacks suppressed [ 984.640165][T17701] sock: sock_set_timeout: `syz.0.3929' (pid 17701) tries to set negative timeout [ 984.837104][T17706] netlink: 'syz.0.3929': attribute type 13 has an invalid length. [ 984.853325][T17706] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3929'. [ 984.874025][T17706] syz_tun: refused to change device tx_queue_len [ 984.881902][T17706] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 984.974531][T17716] netlink: 'syz.0.3929': attribute type 13 has an invalid length. [ 985.188462][T17716] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3929'. [ 985.208463][T17716] syz_tun: refused to change device tx_queue_len [ 985.273831][T17716] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. OK Stopping syslogd: stopped /sbin/syslogd (pid 3622) OK umount: can't remount debugfs read-only umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes Connection to 10.128.1.124 closed by remote host. Sent SIGKILL to all processes Requesting system poweroff [ 990.180591][T15732] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.230771][T15732] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.277870][T15732] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.319831][T15732] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.417266][T15732] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.488956][T15732] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.528339][T15732] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.615321][T15732] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.709283][T17742] kvm: exiting hardware virtualization [ 990.711342][T15732] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.737489][T17742] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 990.748809][T17742] ACPI: PM: Preparing to enter system sleep state S5 [ 990.758040][T17742] reboot: Power down serialport: VM disconnected.