last executing test programs: 4.687040828s ago: executing program 0 (id=4205): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) socketpair(0x3, 0x3, 0x2, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$kcm(0xa, 0x5, 0x0) socket$kcm(0xf, 0x3, 0x2) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000380)=ANY=[@ANYRESHEX=r0], &(0x7f0000000180)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x82}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x94) r2 = socket$kcm(0x10, 0x3, 0x10) r3 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x11300}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000002040)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1190e95fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf2255d6a02413bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a202304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a99281000000059f425ec2f8580fe3c6f605f9a00e90ba71cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e0852c8e7536bd1f018fa6be1e4de61fdccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4065903124bff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a8640724a5f4e12ad99012a2e01ce79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae441e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f13dff7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db000000000000e6ed75ca8fcda7ef3ee336189fef3b3ffb9f38fefc5ff39c4e69e3fa1f8b10ee97123e99b61eba065b1ad67530e7c4f11f9da7ae000002000000610101ad7f79cb9bbf64a0fc109f49fe50151f5ddfe51833ec65ece70e07ce8ab5d97db47da8f80000664dc0b86ae2b3ff9d4e220752a6b2f3ea9f793612386496dca5af7b8952aafa332482e6137e994d3f5259b7f51544cdc6d8cb4becc20dd3a57545b0c2621e4c5f94a23f73ee02c22ee7e27c2cc491a85947baac523c347c9b9ede5d6265997f2ad6e9719a"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)="1400000037000b0fd25a806c8c6f94f907000000", 0x14}], 0x1, 0x0, 0x0, 0x20000000}, 0x408e0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x0, 0xe, 0x0, &(0x7f00000001c0)="348b0d151f8218e3c73697e40800", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = openat$cgroup_int(r0, &(0x7f0000000240)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8c, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x1ff) r6 = perf_event_open(&(0x7f0000000000)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12118, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x38, 0x0, 0x1, 0x8, 0x80000086, 0x5, 0x1000}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpu.stat\x00', 0x26e1, 0x0) close(r7) socket$kcm(0x15, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r6, 0x2403, 0x5) write$cgroup_int(r5, &(0x7f0000000100), 0xe) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) 4.63688929s ago: executing program 1 (id=4206): r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1341, 0x0) perf_event_open$cgroup(&(0x7f00000003c0)={0x4, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x800, 0x0, 0x0, 0x0, 0x7, 0xffff, 0x0, 0x0, 0x0, 0xe000000000000000}, 0xffffffffffffffff, 0x80000000000000, r0, 0x0) r2 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r2, &(0x7f0000001280)={&(0x7f00000010c0)=@l2tp6={0xa, 0x0, 0x4, @mcast1, 0x5, 0x4}, 0x80, 0x0}, 0xc810) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x0, 0x0, &(0x7f00000003c0)='GPL\x00'}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_all\x00', 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00800000000000000000004000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000140), 0x1003, r4}, 0x38) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110c230041) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r6, 0xc004743e, 0x110e22fff6) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)) perf_event_open(&(0x7f0000000440)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x8083, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x2c801, 0x2, 0xfffffffe, 0x0, 0x0, 0x1, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ffffffffffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) r8 = socket$kcm(0x15, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r8, 0x89e0, 0xfffffffffffffffd) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x5, 0x3, &(0x7f0000001ac0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169b740ac03d7c64cee49ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d54f45a24effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x800}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r3, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="14000000000000"], 0x28}, 0x0) ioctl$SIOCSIFHWADDR(r10, 0x541b, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000100000000200000003070000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000a0e468adc35f149a75addf30c7c9330820a1dbea06172a63b9fd4296d734c0863f892e5c86ec888efc668688121f11bbc78f1c515ad4096612e92e5ab373945fb21183bb8654e93473214b272a07e1253cacd8a6919a69f4d50ee715b03eec63", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ffffca41b52d368bba1effa413fa25e7eaef9d0000002b37900100e6084c09b5756380eb10cf537b3aab56a6569298caafc820bd5430ec4e8e6b99f2213892cb0932180add863e21d4955cef", @ANYRESOCT=0x0], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="02000000040000000b00", @ANYRES32, @ANYRESDEC=r1], 0x50) 4.445055388s ago: executing program 4 (id=4208): r0 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000240)={&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7, @local, 0x0, 0x3}, 0x80, &(0x7f0000000980)=[{&(0x7f0000000340)="f4001100052b2c25fe80070000000000000000000009ffffffe000"/40, 0xfd1b}], 0x1}, 0x20040000) (fail_nth: 5) 3.757041008s ago: executing program 4 (id=4209): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000140)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f0000000180)=[0x0], &(0x7f00000001c0)=[0x0], 0x0, 0x3d, &(0x7f0000000200)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000240), &(0x7f0000000280), 0x8, 0xbd, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="188000fff800050000bdc70033b0dd4400000000005b0000"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=0xffffffffffffffff, 0x4) r2 = socket$kcm(0x2, 0x2, 0x73) sendmsg$inet(r2, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @empty}, 0x10, &(0x7f0000000100)}, 0x900000004000000) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x4) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40e02, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="09000000070000000080000001"], 0x50) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000780)={'veth0\x00'}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r5}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000001010000ff7f0000cc00000000000000", @ANYBLOB="fdffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000008fb00bad92d72a170f8d6bf0e4da0000"], 0x50) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="d800000018007b7be00212ba0d0505040a003f00000f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b3162700e06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5005ccca262f3d40fad95667e04adcdf63cc1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e0700000004", 0xd5}], 0x1, 0x0, 0x0, 0x2663}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) socket$kcm(0xa, 0x6, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="000000000000364e07485c50be98000000000000000000000000000000230d5b7b5f8e85441fd9cfdbd442cc789a16ddfbafa7872d32a0825b69c39bf480efc3b9045b9762bba202b7becaf895f9702848cd1b8114344c4cc9cd48992ef2e3073445aaf076dd62ea6013b9d04c6a050c7e849c37311dfd86cbac57db558f88df91fb039b4da1df6076e4805ecff8d3bbd1e1036ac80a512e71e6e471b9670000000000000009ac2777b8d8d9493914ac4fb5b1dd3fe02dd5f78dd3e30f4bd8112afc4531598b0c33d80a69fbb49da06a4730bc749a960152751df67e86e94c115fa298113a180c805e55fef6ea54c56713d27524beec9842077426e8c50f37221fed09cbf29e0fe9522ee78967c8035a47a0140d3b0251ff3644cd1639d3c7e719affffb0dec2e54dd257cca6ab184fcb6340cda52efa7efa885e6d9876822d5fd67eccbf651d3cad5c897493d912e", @ANYRES32=0x1, @ANYBLOB="0300"/20, @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="04000000010000000200"/28], 0x50) 3.01476007s ago: executing program 0 (id=4211): r0 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x19) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x1000000000000002, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00'}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x2, 0x5, &(0x7f00000006c0)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x61e5cc96}, 0x94) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r1}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r1, &(0x7f00000004c0)}, 0x20) 2.850669397s ago: executing program 2 (id=4212): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={0x0, &(0x7f0000000200)=""/76, 0x0, 0x4c, 0x1, 0x4}, 0x28) socket$kcm(0xa, 0x1, 0x0) perf_event_open$cgroup(&(0x7f00000000c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x1c052, 0x4e, 0x0, 0x4, 0x3, 0x7, 0xffff, 0x0, 0x3, 0x0, 0x7}, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r1) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x25, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9, 0x1014}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r3, 0x0, 0x0}, 0x20) setsockopt$sock_attach_bpf(r2, 0x29, 0x23, 0x0, 0x39) socket$kcm(0x2, 0x1, 0x84) r4 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f00000006c0)={0x0, 0xffffffffffffff16, 0x0}, 0x44080) sendmsg(r4, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003140)=[{&(0x7f0000002d80)="0f", 0x1}, {0x0, 0x2}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0, 0x4d}, {0x0}], 0x9}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x3, 0x0, &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xffffffff, '\x00', 0x0, r0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x15, 0x1c, &(0x7f0000000780)=ANY=[@ANYBLOB="1808000023000000000000008100000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b706000014000000b7030000000d00008500000005000000bca900000000000035090100000000009500000000000000b7020000000000007b6af8ff00000000b5090000000000007baaf0ff00000000bf8700000000000007080000fffdffffbf2400000000000007060000f0ffffff740200000800000018260000", @ANYRESDEC=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000d6c3e3ccbf98000000000000560800000000000085f7ffff04000000b70000000000000095000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r6, @ANYBLOB="aa000000000000000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="05000000030000000500"/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x0, &(0x7f00000000c0), &(0x7f0000000100)='syzkaller\x00', 0xc, 0x0, 0x0, 0x41100, 0x26, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000000180)={0x1, 0x6, 0x2, 0xfffffff9}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{0x1, 0x1, 0xa, 0xc}], 0x10, 0x200}, 0x94) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000705d25a806c8c6394f90224fc60100005000a000200053582c137153e37000c0180fc0b10000c00", 0x33fe0}], 0x1}, 0x0) 2.818515769s ago: executing program 4 (id=4213): perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @multicast2}, 0x3c, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0x34, 0x600}}, @ip_tos_u8={{0x18, 0x29, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x14}, 0x0) r1 = perf_event_open(&(0x7f0000000d00)={0x2, 0x80, 0x6d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x7, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000040)={0x2, 0x0, [0x0, 0x0]}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xfa, 0x0, &(0x7f0000000100)="b9ff03006044238cb89e14f088a81bffffff00004000633a77fbac14140be934a0a662079f4b4d2f87e5feca6aab845013f288a81a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff40000000000", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x15, 0xe, &(0x7f0000001440)=ANY=[@ANYBLOB="1800"/14, @ANYBLOB], &(0x7f0000000200)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000240)=""/4096}, 0x94) r3 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000, 0x0, 0x0, 0x1, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x40082404, &(0x7f0000001380)=0xfffffffffffffff7) r4 = socket$kcm(0x22, 0x3, 0x0) close(r4) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r4, @ANYBLOB="e104000000000000000000000000000000000400", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000040000000200"/28], 0x50) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r6, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000001240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000012c0), 0x0, 0x7a, &(0x7f0000001280), 0x0, 0x10, &(0x7f0000001280), &(0x7f0000000300), 0x8, 0xe5, 0x8, 0x8, &(0x7f0000001200)}}, 0x10) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x90, 0x90, 0x6, [@union={0xa, 0x1, 0x0, 0x5, 0x0, 0x4, [{0x2, 0x3, 0xfffffff9}]}, @enum64={0x10, 0x2, 0x0, 0x13, 0x1, 0x1a, [{0x6, 0x2, 0x2}, {0x2, 0x5, 0xfffffff7}]}, @const={0x9, 0x0, 0x0, 0xa, 0x1}, @enum64={0x10, 0x5, 0x0, 0x13, 0x1, 0x4, [{0x3, 0x80000001, 0x18b}, {0x2, 0xfffff000, 0x1000}, {0x9, 0x5, 0x1}, {0x4, 0x0, 0xf2}, {0xf, 0x2, 0x4}]}]}, {0x0, [0x0, 0x0, 0x0, 0x30]}}, &(0x7f0000000240)=""/232, 0xae, 0xe8, 0x1, 0x2, 0x10000}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0x9, '\x00', r7, r8, 0x2, 0x2, 0x5}, 0x50) 2.638745466s ago: executing program 1 (id=4214): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x240048c1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) (fail_nth: 2) 2.265669902s ago: executing program 4 (id=4215): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x3a0ffffffff) write$cgroup_subtree(r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@volatile={0xf, 0x0, 0x0, 0x9, 0x2}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x29, 0x0, 0x1, 0x7, 0x10000, @value=r2}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x50, 0x50, 0x2, [@var={0x9, 0x0, 0x0, 0xe, 0x3, 0x1}, @ptr={0xa, 0x0, 0x0, 0x2, 0x3}, @func_proto={0x0, 0x5, 0x0, 0xd, 0x0, [{0x6, 0x1}, {}, {}, {0x9}, {0x1, 0x100003}]}]}}, 0x0, 0x6a, 0x0, 0x0, 0x7fffffff}, 0x28) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r3) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xa, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r3, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$cgroup_procs(r1, 0x0, 0x2, 0x0) r5 = socket$kcm(0x10, 0x7, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a0010000000028000031294", 0x2e}], 0x1}, 0x0) write$cgroup_pid(r4, &(0x7f00000005c0)=r0, 0x12) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000000), 0xe) write$cgroup_int(r7, &(0x7f0000000040)=0x1, 0x12) 2.251299093s ago: executing program 0 (id=4225): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) recvmsg(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x2064) r1 = socket$kcm(0x2, 0x922000000001, 0x106) r2 = socket$kcm(0x10, 0x400000002, 0x0) recvmsg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000004700)=""/4098, 0x1002}, {&(0x7f0000003700)=""/4081, 0xff1}, {&(0x7f00000018c0)=""/4154, 0x103a}, {&(0x7f0000000400)=""/139, 0x8b}], 0x4}, 0x40000000) sendmsg$inet(r1, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x20040840) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a489, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={0x0, 0x5}, 0x2018, 0x0, 0x0, 0x5, 0x1000, 0x80000, 0x7, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x2, 0x90d7}, 0x104a, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffd, 0x0, 0x26, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030031000b12d25a80648c2594f90124fc60100c074002200600053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000200)=@generic={&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', r3}, 0x18) mkdir(&(0x7f00000000c0)='./cgroup/file0/file0\x00', 0x81) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000014c0)) 2.250460663s ago: executing program 3 (id=4216): perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x411, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8}, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x2, 0xffbf}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x3, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000002"], 0x48) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x890c, &(0x7f0000000100)) 2.186588136s ago: executing program 1 (id=4217): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='filemap_set_wb_err\x00', 0xffffffffffffffff, 0x0, 0x9}, 0x18) perf_event_open(&(0x7f0000000100)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, r2, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') perf_event_open(&(0x7f0000000380)={0x5, 0x80, 0x0, 0x6, 0xf3, 0x6, 0x0, 0x0, 0xd006e1258c48358c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x9}, 0x101c21, 0xc8, 0x94a, 0x7, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x4}, 0x0, 0xc, 0xffffffffffffffff, 0xc) r3 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x0, 0x2f, 0x0, 0xfffffffe, 0x40008000}, 0x28) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xf, 0x4, 0x8, 0x2}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r8, &(0x7f0000000300), 0x0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="10000000040000000800", @ANYBLOB="0000ff"], 0x48) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000000000000f37538e486dd630080fc09042c00db5bffffffffff000000060300000023000000000000000000000000ac1414aa2c200007"], 0xfdef) 2.08383739s ago: executing program 4 (id=4218): bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) r0 = socket$kcm(0x2, 0x2, 0x73) sendmsg$inet(r0, 0x0, 0x900000004000000) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40e02, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="09000000070000000080000001"], 0x50) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000780)={'veth0\x00'}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r5}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000001010000ff7f0000cc00000000000000", @ANYRES32, @ANYBLOB="fdffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000008fb00bad92d72a170f8d6bf0e4da0000"], 0x50) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="d800000018007b7be00212ba0d0505040a003f00000f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b3162700e06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5005ccca262f3d40fad95667e04adcdf63cc1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e0700000004000000", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) (fail_nth: 1) 2.032724952s ago: executing program 3 (id=4219): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={0x0, &(0x7f0000000200)=""/76, 0x0, 0x4c, 0x1, 0x4}, 0x28) socket$kcm(0xa, 0x1, 0x0) perf_event_open$cgroup(&(0x7f00000000c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x1c052, 0x4e, 0x0, 0x4, 0x3, 0x7, 0xffff, 0x0, 0x3, 0x0, 0x7}, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r1) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x25, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9, 0x1014}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r3, 0x0, 0x0}, 0x20) setsockopt$sock_attach_bpf(r2, 0x29, 0x23, 0x0, 0x39) socket$kcm(0x2, 0x1, 0x84) r4 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f00000006c0)={0x0, 0xffffffffffffff16, 0x0}, 0x44080) sendmsg(r4, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003140)=[{&(0x7f0000002d80)="0f", 0x1}, {0x0, 0x2}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0, 0x4d}, {0x0}], 0x9}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xffffffff, '\x00', 0x0, r0}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="aa000000000000000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="05000000030000000500"/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x0, &(0x7f00000000c0), &(0x7f0000000100)='syzkaller\x00', 0xc, 0x0, 0x0, 0x41100, 0x26, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000000180)={0x1, 0x6, 0x2, 0xfffffff9}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{0x1, 0x1, 0xa, 0xc}], 0x10, 0x200}, 0x94) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000280)={'wlan0\x00', @multicast}) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000705d25a806c8c6394f90224fc60100005000a000200053582c137153e37000c0180fc0b10000c00", 0x33fe0}], 0x1}, 0x0) 1.718679385s ago: executing program 2 (id=4220): socket$kcm(0xa, 0x922000000003, 0x11) openat$tun(0xffffffffffffff9c, 0x0, 0x100, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) r0 = perf_event_open(&(0x7f0000001240)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000980)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21ca0000cf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c98cda2948ef0f440d7cad29567e15a7d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf225571f2487fc86acc2bff7d5664abebd6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f94306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552d703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8498856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b262341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa086d2a39f13f60b51136a945f780687aad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f91b52fc0b241c2db99a187c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f9ac2f7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db00"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) bpf$BPF_PROG_GET_NEXT_ID(0xb, 0x0, 0x0) r3 = getpid() bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) syz_open_procfs$namespace(r3, &(0x7f00000002c0)='ns/net\x00') socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x1, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x74}], 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0xd, &(0x7f0000000080), 0x24) 1.440530887s ago: executing program 2 (id=4221): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000540)='inet_sock_set_state\x00', r0}, 0x10) close(0xffffffffffffffff) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000280), &(0x7f0000000300)=r3}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x50) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0xa, 0x2, 0x3a) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r4) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x240048c1) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f0000000100)=r6, 0x4) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) 1.408391149s ago: executing program 3 (id=4222): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xaf}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) socket$kcm(0xa, 0x2, 0x0) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000020000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$kcm(0x25, 0x1, 0x0) write$cgroup_subtree(r0, 0x0, 0x14) 1.261278956s ago: executing program 0 (id=4223): perf_event_open(&(0x7f0000004cc0)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x9, 0x400, 0x6, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x40af1d, 0x1, @perf_config_ext={0xff, 0x7}, 0x100410, 0x200, 0x2, 0x1, 0x9, 0x9, 0xfffd, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x5, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x20000811) socket$kcm(0x21, 0x2, 0xa) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="090000000600000004000000fc"], 0x48) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x600) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0), 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x24008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000005}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r2, 0x6, 0x12, &(0x7f0000000200), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f00000001c0)='GPL\x00'}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x4) sendmsg$inet(r1, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1}, 0x3e8) 1.194827098s ago: executing program 1 (id=4224): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f00000001c0)={r2}) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x240048c1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r3, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) 1.028054675s ago: executing program 2 (id=4226): perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @multicast2}, 0x3c, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0x34, 0x600}}, @ip_tos_u8={{0x18, 0x29, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x14}, 0x0) r1 = perf_event_open(&(0x7f0000000d00)={0x2, 0x80, 0x6d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x7, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000040)={0x2, 0x0, [0x0, 0x0]}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xfa, 0x0, &(0x7f0000000100)="b9ff03006044238cb89e14f088a81bffffff00004000633a77fbac14140be934a0a662079f4b4d2f87e5feca6aab845013f288a81a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff40000000000", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x15, 0xe, &(0x7f0000001440)=ANY=[@ANYBLOB="1800"/14, @ANYBLOB], &(0x7f0000000200)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000240)=""/4096}, 0x94) r3 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000, 0x0, 0x0, 0x1, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x40082404, &(0x7f0000001380)=0xfffffffffffffff7) close(0xffffffffffffffff) socket$kcm(0x11, 0x3, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="e104000000000000000000000000000000000400", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000040000000200"/28], 0x50) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r5, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, &(0x7f0000001240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000012c0), 0x0, 0x7a, &(0x7f0000001280), 0x0, 0x10, &(0x7f0000001280), &(0x7f0000000300), 0x8, 0xe5, 0x8, 0x8, &(0x7f0000001200)}}, 0x10) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x90, 0x90, 0x6, [@union={0xa, 0x1, 0x0, 0x5, 0x0, 0x4, [{0x2, 0x3, 0xfffffff9}]}, @enum64={0x10, 0x2, 0x0, 0x13, 0x1, 0x1a, [{0x6, 0x2, 0x2}, {0x2, 0x5, 0xfffffff7}]}, @const={0x9, 0x0, 0x0, 0xa, 0x1}, @enum64={0x10, 0x5, 0x0, 0x13, 0x1, 0x4, [{0x3, 0x80000001, 0x18b}, {0x2, 0xfffff000, 0x1000}, {0x9, 0x5, 0x1}, {0x4, 0x0, 0xf2}, {0xf, 0x2, 0x4}]}]}, {0x0, [0x0, 0x0, 0x0, 0x30]}}, &(0x7f0000000240)=""/232, 0xae, 0xe8, 0x1, 0x2, 0x10000}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0x9, '\x00', r6, r7, 0x2, 0x2, 0x5}, 0x50) 881.571312ms ago: executing program 4 (id=4227): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x7, 0x6, 0xc}, 0x50) r1 = socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0xde, 0x0, 0xe, 0x0, 0x0, 0x0, 0x20, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfc, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x85b5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_bp={0x0}, 0x8, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0x8, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x200000000000003, 0x300) socket$kcm(0x22, 0x2, 0x21) socket$kcm(0x2, 0x1, 0x84) socket$kcm(0x2b, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x1, 0x84) socket$kcm(0x22, 0x2, 0x21) r2 = socket$kcm(0x23, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000002c0)=r3, 0x4) sendmsg$kcm(r2, &(0x7f00000003c0)={&(0x7f0000000000)=@phonet, 0x80, 0x0}, 0x0) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0xf2, 0x2, 0x0, 0x0, 0xfffd}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000030000000000000000000000850000008700000085000000050000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x46) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9557ed387dbe8abc89b6d5bec", 0x0, 0xa71f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10, 0x0, 0x0, &(0x7f00000005c0)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x83, 0x3, "93"}]}}}], 0x18}, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8992, &(0x7f0000000900)={'wg2\x00', @random='\x00\x00\x00 \x00'}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0x4, 0x7, &(0x7f0000000040)=@framed={{}, [@jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0x2}, @call, @call, @jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f00000003c0)='GPL\x00', 0x5, 0xff9, &(0x7f0000000a80)=""/4089}, 0x78) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x408000, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8924, &(0x7f0000000240)={'ipvlan0\x00', @local}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="020000000400000006000000aa0b"], 0x48) 880.779112ms ago: executing program 3 (id=4228): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) openat$tun(0xffffffffffffff9c, 0x0, 0x1c1341, 0x0) r0 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r0, 0x0, 0x7, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_all\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000001900)}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x2, {0x2, 0x0, @empty}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x0) r3 = socket$kcm(0xa, 0x6, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000002280)=ANY=[@ANYBLOB="18020000e2ffffff00000000000000c685000000360000009500001800000000922ae83713ab9600010000801b10fb54a8cb72d232ad558c46fff4208d4990ec11ce9413ac30e00bd0081f8504e19a5183d769676520e98a263345e44d5ad12bca35510100c4d86abeb12303ff1c9fe0d0020000d60400000007d3670000008aff66d6b3181ffc1d62a3954c1198bbc4fa13aee48ca9e8969faebf3183fe803ab3f5024b52dc265b36fc9dae00a09404f01f9504d0976d252bd8d24538556e5e57bee3b8cf464ef3c6a7def8bad3ca6e3abdb21696e340bb8e2a093add57196b40def3858ef569147fa4108328392d322ab5df10a2f69a6bdf72ee7944e810d0223917c3d042410f57466f59544047d6d8ac44060000000000ee16c729300d2301800000000000002b5a8b05fcc154ad5290a8cdb97c343f454ff69dd6cbde49b28a6cb5f4fc0001745cff6e00e7ffffff0000acf3209a08439f1ff01779b6f6df7e02aa6d7760525b595fe1f697bc114ed1778e97a3f0395f946974cfb458be2a34cf924dc37b5592bf17956f3547497aba814382ff67b345b677a9d6523d87008000000400000000003fe8613ca29ff92be0d8deffff7b68136b0046d535dd39c0f35408869e9b342b953f91447e6b9eab304f134306320600a44095254b45a6c1312a13696c7202df5f764713504facc532c5a6d44d99ec7530ed7b0311000000000000e54e9072a22d911f4a2c2e2fa806e63c5cd98a8569a6d6bcfb000064885117e2ad910eae67e0ebe380d0f648713e68153579e02d71c58d147b00821ab9a6475b31e1ebf1369a04000000fbf3983f283f2f00000000992774814d63c933912d000006000000a66acb0a38856929e7d8b1b06c9bd5d7e5490f3b8596b694ea9483bd4bd287c83dd998a74694d18bdd8ad0983bc90770bbd26a82b9d99d5fc04563b523c47ef8c33400e90d02000000000000000edf1147a7afe772cd45af8aeffe2753088e02ca6bb2feec446ce7dbce66f0a93a03371320980865c7c62ea4d8f8a864dce9fa85aeb0454349100296ee2dba39c3f6fd6cf96714e11fe03b5062809a7418b165dd0336d226bac1e1223be1c97b15175d0e664beb126000e96549e1a1228c686edb475b705eaa9515c96f4fc6b3c925ea404e0f1de61026dc6c6618580fd6ce9eac602c1756f6d1056712412131ed9925989e01eae489ec7052e0ed72c326c7a8aa63999e2297c54ce1822d14b7c7699a9d0600f11f2e7f474cffbc35bc8623cd5eb68af82275a940be0400000000423346da092cbe220de96d6a8e9f32f18d1f606b381e4903b500000000000000000000004a2357ba5f03000000000000005dcf4f2aaee86d4802000000000000007cdb686d5da2a42e4b5024b6535811f362201d4f82012e6af704973d04ea923c19e6cb723c1923b3eea2d73e176dff383c9fbbac53dfdcb1a68c98e96fe39eec23963faf3ebed3409144c7c53d6318ced678a621450a9b01e9f2772e5f2999d3435da02556e36c3215d2bd4e96c93bff3ad04a82ff3cfadcf65eb92adc6c68d66b11cb2d7556414a86dfa94bb7aa52c7febb1e9b2efcbbc5bccf9d39bed802f4f056976a9a362ee9cc624ec454b90200fd9603f96908bddc14500000000000000000000000000044d917c62b27679913075731e8fddb07c10c82002d60181588ae63a440454287de9e340f611267f37bdd0f2d21cb06fcaf45a0a297e396f428d43371424b307eef82c5d6d19f3ef0d3b8f7fa51957e3099caab31133b34a1d3eebc0f0c9056df2e9667ba0b55695c7894010079b07e7aef7785e248deb8c83ab6eb2c72c484241dc3b66da78260f800fffd39368b952f6f4a10295c50c887a31d8b543c5d10f2dbd4d0b84eaad43feb6e169a9f2fcff7000000000000000000e011bc6366f56fa787f212c1f8c0f47f5078191c8a02ad436725771738a2a98891971e3b932352896e1ea10f62e8ef7a87e16151b39d6c27575714540d8c293a3fa4b5a825360423c1cbc8b5d19167152823ed853140edda002c16c842b168bb55f6bb713deb57d0aa78d6d4e5fc5be2c402bd77125d98120358900000892b135a92e8c844938aa98ba4839a1408a696454d40e5eed4d4dce481ca86bfac54c330331b7f2cde17cbaeb0377696faf546ecbe742d73d47d726a50f6e752f3325255bd7e8b5923aa3cfb6f7e06494f21ca450139c558000000000000000000000800000000000000000075aa0000000000000000000000005560bd9eb81e839e4992e64b074a66cccccf00334fa94da8477be7d99b558ec6a5b1596ac1e7617c6b32eed0cc70286caf2c5189a103f4b0b04aff171c4d388ccf67fea37e782f025c94c853cde330a193a967d907a8c88fcb033e680f559a72150cb900bafcd536f48797915a2fe9922ce27300009e1b36aa4730117d9b00000000003c630000000000008fbbd11b015c415ca04192fbfb1a8b0e3460af35771dbac10062835c9bab3ad09f7a022c52d8000000000000000000004000000000000000000000000000000000000000000400000000000000000000000000006ec473c54399b7b8aa1ee46132fc45da8292631178cecf19550108b8b8423de4295777a17bf4dfdfee5de0f3e4dadf51ab9562827b762fa611ba5f32861c19dffe1dc9fd5c41cd46cf131fd6b0c2ddad90ac33f768f9ecc70327c59918fa5a249befe98262f53c8182d95f6da3698a6a88c2c31d801a8f1f5e0ce05138d5422da0a6a62b9dfe1f39775d1d0c9186096415f544aaf76b0a1c877a6c826a5adcfb22c4a0e5a46271caa3eaf4f389dd5f3c20dbddc0377a4266d7b9fd61b9287e9b4be0a413ee31be0ddecab0ef7b25cba1fb3654ddf291ecb7768ac1e177042cb4c452fa6b3966950000000000000000c187da23d6855500fe8510b51e13a890e394b84a6ea2cc8d42b97c697c29122298d55e2e1cca8e07abda2606a3f381c64b9fec0000000a7965e4854e8e3572ad5149b3872342dea9252132860c9af1bd5fe263c0313dea5d6e0c11a466d6892ed65f34667dd79b07b5cbdd8aa7dd561a26b5562d4861a7e1b0f48930e0b696ea3bee7eb72794e163d7aeac9a0fa5403ac9cb421eae283b0550f1d0d339cd7b96e71d3ab48ad9d7975e0c9b117f71d3ab80a0c9b0284ecc469fa6181c9c71fce07a6ffb23296a107763138e8d9876291af2076890c47925ac773d95d2ca42acb3e5f3a1550665b898462c139ffd0106bc8a61b6117d252efcab7106b4c3a3c13a70ff452e9d2096142c517b0e91b5cf88332faca5b3ee96363065c3ce32d3d39ec36e20d597e05664f2526bd918090649da11f7299789d00f502cdf1e99d3efecb9b457642fe810370ba4fbe00fa60a28af966a27a1659e448bbe43a1dcd2ea760018b57a36ac41ef2051a7b703d55c0602540663016e20d50385766df4dac47802a55bd38dd767ee9960c6daa704fc5d01a14591f26b7b538c9bb22f6a2f7a34d1b9edfd125a9e25a110228c64253588ff420644dbc0854e69a7bdda72f93ceaccf92cfe7dd6296c950db10f6dd8a5ef9b73cf6a12a1ba16fdc7e35b805f4fd2fcff0a623722149c1465e4de2d53f0f10b14c21865027abc71a12cb1e9f8029c7a20000000eeb0d53a83e518c8d2052c08b515d9d0bde24ac4e798040c7db0bb03c019507d6377f3d5dd94a27abc6d6b120d61f772407e0d2cb50d29168b68aef9f176b4c3aa8b21279d4ea9c1f669aa8c2c17d5b3a8d1dda58d26f1019af04b7774c85d5bce8be010f27c5211938031c3404680b01279c778bd1fe1b48c4b5b8e0fe756e54a8d76b7cec5e3407d93b4eadc446440607de844acf5524a4657e33af2115547b735b57b5092d0bc8fa6acb832509abe0882d570ce400aaebd7baff88526608d6991aac95751671174129457e4a03aca69d82b64b89e6ad6ed1e275ec5002e48170e4c7b4f3971481098dedb88fba90770e44bf404d5a97fefe2fe8e459fe45933b78c7ab5fe985a480193a20fb07da1455fb283df68af569ac82aa6dc703e29bf158931fb79f2abfa6ff7eb8c4f381c9da58bea460e2ead969933e5391970ca4fddd64da2e5df9c4d82044068caaaab771b37bb06bbe673056d849825525f1120b2250f6b8520381f7a74b1c687781cb6b23e67b918844b83dbaeeb559ec8520d710dd6d6b4e64838bd434a36ed03fc0c488b24571032ffbc9f8ce97041e1bc4729d539358dc9599c1266b9ce2cb6dd0ad57a6e9d3d4a11a27f70b2934c96237e2ba09c58eeda678d4d08b6da99b7a86e946215afb1b48792fde54492e306cb5342e2589874b603a1de972b1f09cc350096f5c3e814118af9ba0793cfdf20c77b34eacfdf63ce59ec4d2f867bf884e941559b068d908325667672b5e1cf71f4829c0493e8b141399ed926b822becead7a0a2b4a4c008ab16b616d60f347e4da54f06443507efe57ea62399ef4eb11b2f559e1b056456a53998bf1c6d13c92e75136147f91ae3a75ca15eb1b51bf700b3c0bf54bc3745ff313c5e75dc66386897f6ee45429371b8d0878c442ad2fe9baf85c1390da13efc353ccbef950c29f39ddf436f0d9bf1be1515ed251d8b6f11ecb16b1e8d1ed04196e9b6c2f9e068b7749bb6c1f533e493f22c901662c65cb761dc2eeff2f698bd4dbae83e2dfdc4f1c7f918a00515c1bc189d10ec22b35c92725cbf0ba244fd029c4f026f68e000000060000ab0476c3fd7f7c1e5c000000000000000000000011e43e39d3f4394fbfa13c416b1c443c5e52eea726491ad75100ebad7c6d5a665c59a3fb158e43da904f19e7e8daa4e90390b8da945f6cd78536c0d2be07221f85ad46b180f256d4d84592691d15d65896b66b63a46705338b67b72dc1c3075fcdc5cbffb0366151632ba5be8ae815dfea9fadfd31c473a24a73d3e5116c3023b3563c72d26fbd59877132bde5ca4ef8d92fd3613c768b35223f6fd0b5e9a8b98cccf1e2b4612e620e3a159d6365c9045aaa826aa0ee6d26cf0397ce674c20824584b464ebdc2f3ea26a7aec4570b242a6677a4e9187f8591c3a9bdc0000001a002364bbd93964a8d0bdc802b9be2500"/3636], &(0x7f0000000040)='GPL\x00', 0x4, 0xfdc0, &(0x7f0000000300)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70) setsockopt$sock_attach_bpf(r3, 0x29, 0x22, &(0x7f0000000100)=r4, 0x120) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='T\x00'], 0x88}, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000000000000000000000800000000000000", @ANYRES32, @ANYBLOB="0100"/20, @ANYRES32, @ANYRES32], 0xfffffffffffffe13) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r4, 0xe0, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000001300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000001340)=[0x0], &(0x7f0000001380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x9a, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000001400), &(0x7f0000001440), 0x8, 0x7c, 0x8, 0x8, &(0x7f0000001480)}}, 0x10) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x7, 0x3, &(0x7f0000001d00)=ANY=[@ANYBLOB="180000000000000000000000000000008eb52400000000004973d3bfb6b2c86db11628eb6478c805850a2b8963dd4b2c6e8f1fe1a2dc0b3e8ac31e16fc89db97a81fc4f2d9dae69fdcb4cd0922e3f18d8256bf70f77dc2c4cb2c2855e84bfa2571ef8636bd03ee5e495c310fab42797197df280e87e2e7990f04df13f36afb52673e14a55c93adba51a9e308109abd9949a7c6ec34dc3df89e2911345eaa496b88a603d28ea0ae712572068e04286053ec3fc893d5c6a5e8da99f259662f9c8e2ee7e6311cc1146b5c8de6c7e0605444fd6dc6521ca2e65b79cbe7ee514d2e424a309eabab4a6d1a6a27047298caf9a50000fd3b8c3f6974e21e0b8c720d2e1a954155e20c4074cec232b8a16db627464532d74af8f5d14343aba40df0b96bae117a91426a86557a215f89270a785a1ea8fe43a9eceaaa3a1a0107a7ce34ed5e8bda6cd74dd0aed27ed4384aa44487c0b44761358cd5ab813cb3887eb03a863bf31ef572bdbafe535d7c888d470b8fea32f27f3532b00f4dab545bca0c05629940758ac615c30b636f55e69fd6774910c9e7033f7ef90e20254338b13b2db7da08d99b0f0975296f5cd5e363fad5063a7f96f1e0bcfb2c3a86298421652566fc493fdd04c093e0e46a950725a51e638e1a1b1cdb", @ANYBLOB="1be08cf2fa7cc44f466ffa2fe9897e6aeeff5d2935d9ed0a1796f9a71d1a122b9b6b7cca656e413860f8d1bfe4469d2a9edb6233add1c9765a", @ANYRES64], &(0x7f00000013c0)='syzkaller\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r9, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r10, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0xc, 0x6, &(0x7f0000001940)=ANY=[@ANYBLOB="1800000001000000000000000300000018110f3ab3fbf8a2c500", @ANYBLOB="7765f1d6d938e5dd2d835d577e7ce97317214e21df058e670686b1341ebd69f3c20996bf32bd740627938d5629e166b647821dda9c384c6742eb7d090019b8bbcb904432bc81", @ANYRES32=0x0], &(0x7f0000000240)='GPL\x00', 0xfffffffb, 0x0, 0x0, 0x41100, 0x28, '\x00', r7, @fallback=0x1e, r1, 0x8, &(0x7f0000001600)={0x3, 0x3}, 0x8, 0x10, &(0x7f0000001640)={0x5, 0xf, 0xdc}, 0x10, r8, r4, 0x0, &(0x7f0000001680)=[r6, r2, r2, r2, r1, r2], 0x0, 0x10, 0x7}, 0x94) r11 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r11, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000032000b07d25a806f8c6394f90724fc60ac0e020004000100053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYRES8, @ANYBLOB="00000000030000000300"/28], 0x50) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r13, 0x8914, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000280)={'wlan0\x00', @multicast}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) 820.301074ms ago: executing program 0 (id=4229): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x14, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000050ff850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 601.788564ms ago: executing program 1 (id=4230): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={0x0, &(0x7f0000000200)=""/76, 0x0, 0x4c, 0x1, 0x4}, 0x28) socket$kcm(0xa, 0x1, 0x0) perf_event_open$cgroup(&(0x7f00000000c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x1c052, 0x4e, 0x0, 0x4, 0x3, 0x7, 0xffff, 0x0, 0x3, 0x0, 0x7}, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r1) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x25, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9, 0x1014}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r3, 0x0, 0x0}, 0x20) setsockopt$sock_attach_bpf(r2, 0x29, 0x23, 0x0, 0x39) socket$kcm(0x2, 0x1, 0x84) r4 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f00000006c0)={0x0, 0xffffffffffffff16, 0x0}, 0x44080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x3, 0x0, &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xffffffff, '\x00', 0x0, r0}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="aa000000000000000000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="05000000030000000500"/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x0, &(0x7f00000000c0), &(0x7f0000000100)='syzkaller\x00', 0xc, 0x0, 0x0, 0x41100, 0x26, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000000180)={0x1, 0x6, 0x2, 0xfffffff9}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{0x1, 0x1, 0xa, 0xc}], 0x10, 0x200}, 0x94) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000280)={'wlan0\x00', @multicast}) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000705d25a806c8c6394f90224fc60100005000a000200053582c137153e37000c0180fc0b10000c00", 0x33fe0}], 0x1}, 0x0) 576.334145ms ago: executing program 0 (id=4231): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={0x0, &(0x7f0000000200)=""/76, 0x0, 0x4c, 0x1, 0x4}, 0x28) socket$kcm(0xa, 0x1, 0x0) perf_event_open$cgroup(&(0x7f00000000c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x1c052, 0x4e, 0x0, 0x4, 0x3, 0x7, 0xffff, 0x0, 0x3, 0x0, 0x7}, 0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r1) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x25, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9, 0x1014}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r3, 0x0, 0x0}, 0x20) setsockopt$sock_attach_bpf(r2, 0x29, 0x23, 0x0, 0x39) socket$kcm(0x2, 0x1, 0x84) r4 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f00000006c0)={0x0, 0xffffffffffffff16, 0x0}, 0x44080) sendmsg(r4, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003140)=[{&(0x7f0000002d80)="0f", 0x1}, {0x0, 0x2}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0, 0x4d}, {0x0}], 0x9}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x3, 0x0, &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xffffffff, '\x00', 0x0, r0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x15, 0x1c, &(0x7f0000000780)=ANY=[@ANYBLOB="1808000023000000000000008100000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b706000014000000b7030000000d00008500000005000000bca900000000000035090100000000009500000000000000b7020000000000007b6af8ff00000000b5090000000000007baaf0ff00000000bf8700000000000007080000fffdffffbf2400000000000007060000f0ffffff740200000800000018260000", @ANYRESDEC=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000d6c3e3ccbf98000000000000560800000000000085f7ffff04000000b70000000000000095000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r5, @ANYBLOB="aa000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000030000000500"/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x0, &(0x7f00000000c0), &(0x7f0000000100)='syzkaller\x00', 0xc, 0x0, 0x0, 0x41100, 0x26, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000000180)={0x1, 0x6, 0x2, 0xfffffff9}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{0x1, 0x1, 0xa, 0xc}], 0x10, 0x200}, 0x94) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) r7 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000705d25a806c8c6394f90224fc60100005000a000200053582c137153e37000c0180fc0b10000c00", 0x33fe0}], 0x1}, 0x0) 525.596707ms ago: executing program 3 (id=4232): socket$kcm(0xa, 0x922000000003, 0x11) openat$tun(0xffffffffffffff9c, 0x0, 0x100, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) r0 = perf_event_open(&(0x7f0000001240)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000980)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21ca0000cf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c98cda2948ef0f440d7cad29567e15a7d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf225571f2487fc86acc2bff7d5664abebd6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f94306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552d703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8498856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b262341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa086d2a39f13f60b51136a945f780687aad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f91b52fc0b241c2db99a187c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f9ac2f7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db00"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) bpf$BPF_PROG_GET_NEXT_ID(0xb, 0x0, 0x0) r3 = getpid() bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) syz_open_procfs$namespace(r3, &(0x7f00000002c0)='ns/net\x00') socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x1, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x74}], 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0xd, &(0x7f0000000080), 0x24) 344.985735ms ago: executing program 2 (id=4233): perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x411, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8}, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x2, 0xffbf}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x3, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000002"], 0x48) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x890c, &(0x7f0000000100)) 189.969691ms ago: executing program 2 (id=4234): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000140)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f0000000180)=[0x0], &(0x7f00000001c0)=[0x0], 0x0, 0x3d, &(0x7f0000000200)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000240), &(0x7f0000000280), 0x8, 0xbd, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="188000fff800050000bdc70033b0dd4400000000005b0000"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=0xffffffffffffffff, 0x4) r2 = socket$kcm(0x2, 0x2, 0x73) sendmsg$inet(r2, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @empty}, 0x10, &(0x7f0000000100)}, 0x900000004000000) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x4) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40e02, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="09000000070000000080000001"], 0x50) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000780)={'veth0\x00'}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r5}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000001010000ff7f0000cc00000000000000", @ANYBLOB="fdffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000008fb00bad92d72a170f8d6bf0e4da0000"], 0x50) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="d800000018007b7be00212ba0d0505040a003f00000f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b3162700e06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5005ccca262f3d40fad95667e04adcdf63cc1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e0700000004", 0xd5}], 0x1, 0x0, 0x0, 0x2663}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) socket$kcm(0xa, 0x6, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="000000000000364e07485c50be98000000000000000000000000000000230d5b7b5f8e85441fd9cfdbd442cc789a16ddfbafa7872d32a0825b69c39bf480efc3b9045b9762bba202b7becaf895f9702848cd1b8114344c4cc9cd48992ef2e3073445aaf076dd62ea6013b9d04c6a050c7e849c37311dfd86cbac57db558f88df91fb039b4da1df6076e4805ecff8d3bbd1e1036ac80a512e71e6e471b9670000000000000009ac2777b8d8d9493914ac4fb5b1dd3fe02dd5f78dd3e30f4bd8112afc4531598b0c33d80a69fbb49da06a4730bc749a960152751df67e86e94c115fa298113a180c805e55fef6ea54c56713d27524beec9842077426e8c50f37221fed09cbf29e0fe9522ee78967c8035a47a0140d3b0251ff3644cd1639d3c7e719affffb0dec2e54dd257cca6ab184fcb6340cda52efa7efa885e6d9876822d5fd67eccbf651d3cad5c897493d912e", @ANYRES32=0x1, @ANYBLOB="0300"/20, @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="04000000010000000200"/28], 0x50) 116.857805ms ago: executing program 3 (id=4235): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) recvmsg(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x2064) r1 = socket$kcm(0x2, 0x922000000001, 0x106) r2 = socket$kcm(0x10, 0x400000002, 0x0) recvmsg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000004700)=""/4098, 0x1002}, {&(0x7f0000003700)=""/4081, 0xff1}, {&(0x7f00000018c0)=""/4154, 0x103a}, {&(0x7f0000000400)=""/139, 0x8b}], 0x4}, 0x40000000) sendmsg$inet(r1, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x20040840) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a489, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={0x0, 0x5}, 0x2018, 0x0, 0x0, 0x5, 0x1000, 0x80000, 0x7, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x2, 0x90d7}, 0x104a, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffd, 0x0, 0x26, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030031000b12d25a80648c2594f90124fc60100c074002200600053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000200)=@generic={&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', r3}, 0x18) mkdir(&(0x7f00000000c0)='./cgroup/file0/file0\x00', 0x81) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000014c0)) 0s ago: executing program 1 (id=4236): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='filemap_set_wb_err\x00', 0xffffffffffffffff, 0x0, 0x9}, 0x18) perf_event_open(&(0x7f0000000100)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, r2, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') perf_event_open(&(0x7f0000000380)={0x5, 0x80, 0x0, 0x6, 0xf3, 0x6, 0x0, 0x0, 0xd006e1258c48358c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x9}, 0x101c21, 0xc8, 0x94a, 0x7, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, 0x4}, 0x0, 0xc, 0xffffffffffffffff, 0xc) r3 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x0, 0x2f, 0x0, 0xfffffffe, 0x40008000}, 0x28) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xf, 0x4, 0x8, 0x2}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r8, &(0x7f0000000300), 0x0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="10000000040000000800", @ANYBLOB="0000ff"], 0x48) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000000000000f37538e486dd630080fc09042c00db5bffffffffff000000060300000023000000000000000000000000ac1414aa2c200007"], 0xfdef) kernel console output (not intermixed with test programs): atman_adv: batadv0: Interface activated: batadv_slave_0 [ 335.402929][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 335.456319][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 335.494094][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 335.520797][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 335.530368][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 335.551252][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 335.584212][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 335.604324][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 335.629742][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 335.680280][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 335.699135][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 335.723210][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 335.733055][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 335.763222][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 335.773056][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 335.792666][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 335.813026][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 335.826163][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 335.840306][T12243] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 335.858099][T12243] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 335.872198][T12243] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 335.904025][T12444] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 335.939509][T12444] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 335.962739][T12447] IPv6: Can't replace route, no match found [ 335.972634][T12450] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 335.999462][T12451] device wlan0 entered promiscuous mode [ 336.046018][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 336.066972][ T3082] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 336.097623][T12243] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.133352][T12243] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.142434][T12243] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.172848][T12243] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.372451][T12457] delete_channel: no stack [ 336.453065][ T3082] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.461603][ T3082] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.530794][ T4645] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 336.560638][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 336.605606][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.636383][ T4645] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 336.665170][ T144] wlan1: Trigger new scan to find an IBSS to join [ 336.666675][ T4645] wlan1: Trigger new scan to find an IBSS to join [ 336.752017][T12468] netlink: 'syz.3.3111': attribute type 7 has an invalid length. [ 336.754155][ T4645] wlan1: Trigger new scan to find an IBSS to join [ 336.824572][T12468] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3111'. [ 337.123781][T12482] IPv6: Can't replace route, no match found [ 337.178145][T12488] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 337.510083][T12492] delete_channel: no stack [ 338.055488][T12522] FAULT_INJECTION: forcing a failure. [ 338.055488][T12522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 338.100952][T12523] IPv6: Can't replace route, no match found [ 338.119228][T12522] CPU: 1 PID: 12522 Comm: syz.3.3131 Not tainted syzkaller #0 [ 338.126721][T12522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 338.136771][T12522] Call Trace: [ 338.140035][T12522] [ 338.142950][T12522] dump_stack_lvl+0x168/0x230 [ 338.147632][T12522] ? show_regs_print_info+0x20/0x20 [ 338.152866][T12522] ? load_image+0x3b0/0x3b0 [ 338.157364][T12522] ? lockdep_hardirqs_on+0x94/0x140 [ 338.162573][T12522] ? asm_sysvec_irq_work+0x16/0x20 [ 338.167793][T12522] should_fail+0x38c/0x4c0 [ 338.172213][T12522] strncpy_from_user+0x32/0x360 [ 338.177070][T12522] strncpy_from_user_nofault+0x6d/0x140 [ 338.182610][T12522] bpf_probe_read_user_str+0x26/0x70 [ 338.187891][T12522] bpf_prog_0c70681b89b9d13a+0x60/0x260 [ 338.193421][T12522] bpf_test_run+0x292/0x7d0 [ 338.198002][T12522] ? convert___skb_to_skb+0x4c0/0x4c0 [ 338.203364][T12522] ? eth_get_headlen+0x1f0/0x1f0 [ 338.208293][T12522] ? __build_skb+0x1e2/0x2e0 [ 338.213085][T12522] ? convert___skb_to_skb+0x3d/0x4c0 [ 338.218379][T12522] bpf_prog_test_run_skb+0x9cc/0x1180 [ 338.223762][T12522] ? cpu_online+0x60/0x60 [ 338.228093][T12522] bpf_prog_test_run+0x31e/0x390 [ 338.233037][T12522] __sys_bpf+0x535/0x670 [ 338.237361][T12522] ? bpf_link_show_fdinfo+0x340/0x340 [ 338.242829][T12522] ? rcu_nmi_exit+0x6f/0xf0 [ 338.247334][T12522] ? vtime_user_exit+0x2dc/0x400 [ 338.252610][T12522] __x64_sys_bpf+0x78/0x90 [ 338.257013][T12522] do_syscall_64+0x4c/0xa0 [ 338.261411][T12522] ? clear_bhb_loop+0x30/0x80 [ 338.266072][T12522] ? clear_bhb_loop+0x30/0x80 [ 338.270732][T12522] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 338.276608][T12522] RIP: 0033:0x7f6fb4431749 [ 338.281017][T12522] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 338.300605][T12522] RSP: 002b:00007f6fb2698038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 338.309000][T12522] RAX: ffffffffffffffda RBX: 00007f6fb4687fa0 RCX: 00007f6fb4431749 [ 338.316951][T12522] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 338.324903][T12522] RBP: 00007f6fb2698090 R08: 0000000000000000 R09: 0000000000000000 [ 338.332855][T12522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 338.340806][T12522] R13: 00007f6fb4688038 R14: 00007f6fb4687fa0 R15: 00007fffea213148 [ 338.348770][T12522] [ 338.405406][T12520] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 338.646560][T12538] netlink: 'syz.1.3133': attribute type 7 has an invalid length. [ 338.665185][ T154] wlan1: Trigger new scan to find an IBSS to join [ 338.675316][T12538] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3133'. [ 338.743094][T12497] chnl_net:caif_netlink_parms(): no params data found [ 338.759271][ T154] wlan1: Creating new IBSS network, BSSID 3a:6f:5d:b6:81:d8 [ 338.872788][T12547] netlink: 'syz.3.3138': attribute type 1 has an invalid length. [ 338.883593][T12547] netlink: 'syz.3.3138': attribute type 4 has an invalid length. [ 338.913715][T12547] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.3138'. [ 338.966653][T12547] netlink: 'syz.3.3138': attribute type 1 has an invalid length. [ 338.992641][T12547] netlink: 'syz.3.3138': attribute type 4 has an invalid length. [ 339.023319][T12547] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.3138'. [ 339.041590][T12497] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.049512][T12497] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.058161][T12497] device bridge_slave_0 entered promiscuous mode [ 339.066763][T12497] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.074103][T12497] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.082361][T12497] device bridge_slave_1 entered promiscuous mode [ 339.148874][T12497] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 339.167181][T12497] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 339.237226][T12497] team0: Port device team_slave_0 added [ 339.265546][T12497] team0: Port device team_slave_1 added [ 339.363630][T12497] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 339.373912][T12497] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 339.423194][T12497] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 339.462536][T12497] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 339.521138][T12497] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 339.567796][T12567] FAULT_INJECTION: forcing a failure. [ 339.567796][T12567] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 339.591294][T12497] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 339.633267][T12567] CPU: 1 PID: 12567 Comm: syz.0.3144 Not tainted syzkaller #0 [ 339.640766][T12567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 339.650824][T12567] Call Trace: [ 339.654109][T12567] [ 339.657039][T12567] dump_stack_lvl+0x168/0x230 [ 339.661716][T12567] ? show_regs_print_info+0x20/0x20 [ 339.666907][T12567] ? load_image+0x3b0/0x3b0 [ 339.671407][T12567] ? __lock_acquire+0x7c60/0x7c60 [ 339.676420][T12567] ? __rwlock_init+0x140/0x140 [ 339.681166][T12567] ? _raw_spin_lock_irqsave+0x7f/0xf0 [ 339.686528][T12567] should_fail+0x38c/0x4c0 [ 339.690946][T12567] prepare_alloc_pages+0x1e4/0x5f0 [ 339.696044][T12567] __alloc_pages+0x10e/0x470 [ 339.700619][T12567] ? zone_statistics+0x170/0x170 [ 339.705542][T12567] ? memset+0x1e/0x40 [ 339.709519][T12567] __get_free_pages+0x8/0x30 [ 339.714090][T12567] __genradix_ptr_alloc+0xda/0x350 [ 339.719190][T12567] __genradix_prealloc+0x3e/0x80 [ 339.724110][T12567] sctp_stream_init+0x139/0x400 [ 339.728959][T12567] sctp_association_new+0x10db/0x24a0 [ 339.734323][T12567] sctp_connect_new_asoc+0x2bb/0x690 [ 339.739606][T12567] ? __sctp_connect+0xd20/0xd20 [ 339.744441][T12567] ? __local_bh_enable_ip+0x12a/0x1b0 [ 339.749888][T12567] ? lock_sock_nested+0x68/0x100 [ 339.754813][T12567] ? bpf_lsm_sctp_bind_connect+0x5/0x10 [ 339.760340][T12567] ? security_sctp_bind_connect+0x85/0xb0 [ 339.766059][T12567] sctp_sendmsg+0x15e0/0x2950 [ 339.770745][T12567] ? aa_sk_perm+0x7b4/0x8f0 [ 339.775327][T12567] ? sctp_getsockopt+0x8a0/0x8a0 [ 339.780274][T12567] ? aa_af_perm+0x2b0/0x2b0 [ 339.784777][T12567] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 339.791194][T12567] ? sock_rps_record_flow+0x17/0x3b0 [ 339.796466][T12567] ? inet_send_prepare+0x260/0x260 [ 339.801651][T12567] ? inet_sendmsg+0xe5/0x2f0 [ 339.806230][T12567] ? inet_send_prepare+0x260/0x260 [ 339.811327][T12567] ____sys_sendmsg+0x5a2/0x8c0 [ 339.816080][T12567] ? memset+0x1e/0x40 [ 339.820052][T12567] ? __sys_sendmsg_sock+0x30/0x30 [ 339.825064][T12567] ? import_iovec+0x6f/0xa0 [ 339.829555][T12567] ___sys_sendmsg+0x1f0/0x260 [ 339.834219][T12567] ? __sys_sendmsg+0x250/0x250 [ 339.838984][T12567] ? vfs_write+0x84d/0xd00 [ 339.843395][T12567] ? __fdget+0x18b/0x210 [ 339.847634][T12567] __se_sys_sendmsg+0x190/0x250 [ 339.852558][T12567] ? __x64_sys_sendmsg+0x80/0x80 [ 339.857909][T12567] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 339.863881][T12567] ? lockdep_hardirqs_on+0x94/0x140 [ 339.869062][T12567] do_syscall_64+0x4c/0xa0 [ 339.873458][T12567] ? clear_bhb_loop+0x30/0x80 [ 339.878118][T12567] ? clear_bhb_loop+0x30/0x80 [ 339.882775][T12567] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 339.888650][T12567] RIP: 0033:0x7f1545246749 [ 339.893049][T12567] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 339.912634][T12567] RSP: 002b:00007f15434ad038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 339.921026][T12567] RAX: ffffffffffffffda RBX: 00007f154549cfa0 RCX: 00007f1545246749 [ 339.929155][T12567] RDX: 00000000000080d1 RSI: 0000200000000140 RDI: 0000000000000003 [ 339.937109][T12567] RBP: 00007f15434ad090 R08: 0000000000000000 R09: 0000000000000000 [ 339.945070][T12567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 339.953035][T12567] R13: 00007f154549d038 R14: 00007f154549cfa0 R15: 00007ffdb903ab58 [ 339.961020][T12567] [ 339.964670][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 339.967662][ T4256] Bluetooth: hci2: command 0x0409 tx timeout [ 340.170499][T12573] IPv6: Can't replace route, no match found [ 340.252738][T12497] device hsr_slave_0 entered promiscuous mode [ 340.276458][T12497] device hsr_slave_1 entered promiscuous mode [ 340.295936][T12497] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 340.319236][T12497] Cannot create hsr debugfs directory [ 340.351425][T12570] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 340.457997][T12580] netlink: 'syz.2.3149': attribute type 7 has an invalid length. [ 340.513298][T12580] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3149'. [ 340.666144][ T9] wlan1: Trigger new scan to find an IBSS to join [ 340.666160][ T154] wlan1: Trigger new scan to find an IBSS to join [ 340.812327][T12497] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.072634][T12497] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.238171][T12605] netlink: 'syz.0.3156': attribute type 7 has an invalid length. [ 341.263023][T12497] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.271793][T12605] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.3156'. [ 341.512596][T12497] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.651003][T12615] netlink: 'syz.0.3161': attribute type 7 has an invalid length. [ 341.682305][T12615] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.3161'. [ 341.877553][T12497] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 341.922693][T12497] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 342.005640][T12497] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 342.024201][ T1107] Bluetooth: hci2: command 0x041b tx timeout [ 342.034986][T12497] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 342.083901][T12622] IPv6: Can't replace route, no match found [ 342.171845][T12626] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 342.408560][T12497] 8021q: adding VLAN 0 to HW filter on device bond0 [ 342.457143][T12639] IPv6: Can't replace route, no match found [ 342.663404][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 342.719533][T12639] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 342.732728][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 342.743624][ T3082] wlan1: Trigger new scan to find an IBSS to join [ 342.756061][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 342.783776][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 342.804510][T12497] 8021q: adding VLAN 0 to HW filter on device team0 [ 342.840342][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 342.865926][ T1159] wlan1: Creating new IBSS network, BSSID 7a:08:06:ea:ac:ef [ 342.874590][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 342.903402][ T3101] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.910502][ T3101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 342.954216][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 342.998204][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 343.036595][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 343.083657][ T3101] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.090740][ T3101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 343.203316][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 343.218499][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 343.254291][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 343.272099][T12664] netlink: 'syz.2.3172': attribute type 7 has an invalid length. [ 343.285729][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 343.302646][T12664] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3172'. [ 343.313044][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 343.342738][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 343.379695][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 343.435634][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 343.482158][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 343.521878][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 343.547933][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 343.574320][T12497] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 344.058238][T12683] IPv6: Can't replace route, no match found [ 344.104044][ T1107] Bluetooth: hci2: command 0x040f tx timeout [ 344.158469][T12683] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 344.228763][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 344.243800][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 344.257681][T12497] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 344.295049][T12692] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 344.346550][T12692] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 344.416057][T12692] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 344.465984][T12692] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 344.665111][ T3101] wlan1: Creating new IBSS network, BSSID fe:e1:e3:33:6e:4f [ 344.811785][T12709] netlink: 'syz.1.3188': attribute type 7 has an invalid length. [ 344.939541][T12709] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3188'. [ 345.303997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 345.336981][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 345.408864][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 345.463581][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 345.498278][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 345.526741][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 345.556236][T12497] device veth0_vlan entered promiscuous mode [ 345.702456][T12735] IPv6: Can't replace route, no match found [ 345.734521][T12497] device veth1_vlan entered promiscuous mode [ 345.765965][T12733] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 345.870981][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 345.901463][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 346.014882][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 346.042245][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 346.053607][T12497] device veth0_macvtap entered promiscuous mode [ 346.082299][T12497] device veth1_macvtap entered promiscuous mode [ 346.161568][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.191128][ T4332] Bluetooth: hci2: command 0x0419 tx timeout [ 346.224961][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.273242][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.321269][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.350486][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.402614][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.433346][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.473340][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.493229][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.523369][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.548068][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 346.575692][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 346.612698][T12497] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 346.663579][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 346.663618][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 346.670177][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 346.879515][T12742] device wlan0 entered promiscuous mode [ 346.930330][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 346.964207][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 346.979766][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 346.998978][T12756] netlink: 'syz.2.3203': attribute type 7 has an invalid length. [ 347.030461][T12756] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3203'. [ 347.037139][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 347.100987][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 347.126158][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 347.154472][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 347.174507][T12762] FAULT_INJECTION: forcing a failure. [ 347.174507][T12762] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 347.176872][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 347.187741][T12762] CPU: 1 PID: 12762 Comm: syz.0.3206 Not tainted syzkaller #0 [ 347.205592][T12762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 347.215654][T12762] Call Trace: [ 347.218936][T12762] [ 347.221868][T12762] dump_stack_lvl+0x168/0x230 [ 347.223638][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 347.226552][T12762] ? show_regs_print_info+0x20/0x20 [ 347.226579][T12762] ? load_image+0x3b0/0x3b0 [ 347.246294][T12762] ? _raw_spin_lock_irq+0xab/0xe0 [ 347.249882][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 347.251409][T12762] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 347.251439][T12762] should_fail+0x38c/0x4c0 [ 347.271603][T12762] copy_page_from_iter_atomic+0x436/0x1520 [ 347.275231][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 347.277427][T12762] ? pipe_zero+0x370/0x370 [ 347.277451][T12762] ? __get_user_nocheck_1+0x6/0x10 [ 347.277472][T12762] ? shmem_write_begin+0xcd/0x1a0 [ 347.277494][T12762] generic_perform_write+0x2ff/0x530 [ 347.277523][T12762] ? grab_cache_page_write_begin+0xa0/0xa0 [ 347.277541][T12762] ? file_remove_privs+0x590/0x590 [ 347.277563][T12762] ? read_lock_is_recursive+0x10/0x10 [ 347.277582][T12762] ? preempt_count_add+0x8d/0x190 [ 347.277601][T12762] ? rwsem_write_trylock+0x12f/0x1b0 [ 347.277620][T12762] ? clear_nonspinnable+0x60/0x60 [ 347.277640][T12762] __generic_file_write_iter+0x25f/0x4e0 [ 347.277663][T12762] generic_file_write_iter+0xa6/0x1b0 [ 347.277682][T12762] vfs_write+0x712/0xd00 [ 347.277705][T12762] ? file_end_write+0x250/0x250 [ 347.277729][T12762] ? __fget_files+0x40f/0x480 [ 347.277751][T12762] ? mutex_lock_nested+0x17/0x20 [ 347.302561][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 347.307337][T12762] ? __fdget_pos+0x2bf/0x370 [ 347.307358][T12762] ? ksys_write+0x71/0x250 [ 347.307377][T12762] ksys_write+0x14d/0x250 [ 347.324608][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 347.328620][T12762] ? __ia32_sys_read+0x80/0x80 [ 347.328649][T12762] ? trace_sys_enter+0x1f/0x80 [ 347.355284][T12497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 347.358986][T12762] do_syscall_64+0x4c/0xa0 [ 347.359010][T12762] ? clear_bhb_loop+0x30/0x80 [ 347.359027][T12762] ? clear_bhb_loop+0x30/0x80 [ 347.359045][T12762] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 347.372933][T12497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 347.379161][T12762] RIP: 0033:0x7f1545246749 [ 347.379193][T12762] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 347.379207][T12762] RSP: 002b:00007f15434ad038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 347.379227][T12762] RAX: ffffffffffffffda RBX: 00007f154549cfa0 RCX: 00007f1545246749 [ 347.379239][T12762] RDX: 0000000000040010 RSI: 0000200000000180 RDI: 0000000000000008 [ 347.379250][T12762] RBP: 00007f15434ad090 R08: 0000000000000000 R09: 0000000000000000 [ 347.379261][T12762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 347.379271][T12762] R13: 00007f154549d038 R14: 00007f154549cfa0 R15: 00007ffdb903ab58 [ 347.379295][T12762] [ 347.544554][T12497] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 347.564279][T12758] netlink: 'syz.1.3204': attribute type 19 has an invalid length. [ 347.605998][T12758] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3204'. [ 347.656997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 347.666216][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 347.759627][T12497] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.799725][T12497] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.838705][T12497] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.858177][T12497] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.058372][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 348.086423][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 348.130586][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 348.174033][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 348.206331][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 348.247874][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 348.693322][ T3101] wlan1: Creating new IBSS network, BSSID 0e:7c:3e:9e:e7:a5 [ 348.697325][T12791] netlink: 'syz.0.3213': attribute type 7 has an invalid length. [ 348.791851][T12794] netlink: 'syz.2.3217': attribute type 7 has an invalid length. [ 348.813479][T12791] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.3213'. [ 348.854107][T12794] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3217'. [ 349.359460][T12806] netlink: 'syz.2.3219': attribute type 7 has an invalid length. [ 349.381734][T12806] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3219'. [ 349.717483][ T144] wlan1: Trigger new scan to find an IBSS to join [ 350.580254][T12817] chnl_net:caif_netlink_parms(): no params data found [ 350.743373][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 350.749278][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 350.804823][ T3101] wlan1: Creating new IBSS network, BSSID 2a:89:3b:ee:55:97 [ 350.842937][T12837] netlink: 'syz.3.3230': attribute type 7 has an invalid length. [ 350.877022][T12817] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.901878][T12837] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3230'. [ 350.975074][T12817] bridge0: port 1(bridge_slave_0) entered disabled state [ 351.026608][T12817] device bridge_slave_0 entered promiscuous mode [ 351.056577][T12817] bridge0: port 2(bridge_slave_1) entered blocking state [ 351.064106][T12817] bridge0: port 2(bridge_slave_1) entered disabled state [ 351.072929][T12817] device bridge_slave_1 entered promiscuous mode [ 351.211320][T12817] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 351.325206][T12817] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 351.381382][T12846] netlink: 'syz.4.3231': attribute type 7 has an invalid length. [ 351.420400][T12854] netlink: 'syz.3.3233': attribute type 7 has an invalid length. [ 351.430602][T12846] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.3231'. [ 351.475541][T12854] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3233'. [ 351.506631][T12817] team0: Port device team_slave_0 added [ 351.528160][T12817] team0: Port device team_slave_1 added [ 351.724293][T12817] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 351.731270][T12817] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 351.841635][T12817] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 351.863435][ T21] Bluetooth: hci4: command 0x0409 tx timeout [ 351.915852][T12817] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 351.922834][T12817] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 351.962838][T12817] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 352.139149][T12817] device hsr_slave_0 entered promiscuous mode [ 352.234005][T12817] device hsr_slave_1 entered promiscuous mode [ 352.256377][T12817] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 352.283267][T12817] Cannot create hsr debugfs directory [ 352.534781][T12888] netlink: 'syz.1.3248': attribute type 3 has an invalid length. [ 352.542866][T12888] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3248'. [ 352.663348][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 352.668290][T12890] netlink: 'syz.2.3249': attribute type 7 has an invalid length. [ 352.717676][T12817] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.730201][T12890] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3249'. [ 352.890742][T12817] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.030806][T12817] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.218119][T12817] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.480426][T12817] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 353.525227][T12817] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 353.595474][T12817] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 353.628159][T12817] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 353.723947][ T144] wlan1: Trigger new scan to find an IBSS to join [ 353.965166][ T13] Bluetooth: hci4: command 0x041b tx timeout [ 353.972826][ T1173] wlan1: Creating new IBSS network, BSSID d2:a7:76:50:c3:9a [ 354.147959][T12925] netlink: 'syz.1.3261': attribute type 7 has an invalid length. [ 354.215990][T12925] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3261'. [ 354.309515][T12817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 354.364413][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 354.408734][ T3101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 354.440208][T12817] 8021q: adding VLAN 0 to HW filter on device team0 [ 354.475204][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 354.524523][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 354.534335][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 354.541419][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 354.591449][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 354.622677][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 354.674692][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 354.709252][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 354.716408][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 354.747168][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 354.821890][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 354.873799][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 354.903979][ T144] wlan1: Creating new IBSS network, BSSID 9e:cc:b4:33:79:ed [ 354.934371][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 354.961070][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 354.971009][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 354.980193][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 354.993402][T12951] IPv6: Can't replace route, no match found [ 355.001803][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 355.014309][T12954] netlink: 'syz.4.3268': attribute type 2 has an invalid length. [ 355.101268][T12954] netlink: 'syz.4.3268': attribute type 8 has an invalid length. [ 355.123995][T12954] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3268'. [ 355.225274][T12955] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 355.319489][T12817] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 355.393371][T12817] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 355.427240][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 355.439793][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 355.487332][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 355.524041][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 355.580063][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 355.942920][T12985] netlink: 'syz.2.3280': attribute type 7 has an invalid length. [ 355.974598][T12985] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3280'. [ 356.023722][ T4302] Bluetooth: hci4: command 0x040f tx timeout [ 356.039576][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 356.050418][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 356.090341][T12817] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 356.188090][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 356.210698][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 356.290787][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 356.302662][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 356.339700][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 356.379659][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 356.408329][T12817] device veth0_vlan entered promiscuous mode [ 356.462979][T12817] device veth1_vlan entered promiscuous mode [ 356.546594][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 356.565458][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 356.654275][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 356.685408][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 356.701896][T13005] FAULT_INJECTION: forcing a failure. [ 356.701896][T13005] name failslab, interval 1, probability 0, space 0, times 0 [ 356.714612][T13005] CPU: 1 PID: 13005 Comm: syz.4.3287 Not tainted syzkaller #0 [ 356.722098][T13005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 356.732162][T13005] Call Trace: [ 356.735446][T13005] [ 356.738424][T13005] dump_stack_lvl+0x168/0x230 [ 356.743127][T13005] ? show_regs_print_info+0x20/0x20 [ 356.748333][T13005] ? load_image+0x3b0/0x3b0 [ 356.752931][T13005] ? verify_lock_unused+0x140/0x140 [ 356.758144][T13005] should_fail+0x38c/0x4c0 [ 356.763005][T13005] should_failslab+0x5/0x20 [ 356.767565][T13005] slab_pre_alloc_hook+0x51/0xc0 [ 356.772518][T13005] kmem_cache_alloc_trace+0x47/0x2a0 [ 356.777810][T13005] ? tipc_nametbl_insert_publ+0x60/0x1310 [ 356.783584][T13005] tipc_nametbl_insert_publ+0x60/0x1310 [ 356.789141][T13005] ? do_raw_spin_lock+0x11d/0x280 [ 356.794181][T13005] ? __rwlock_init+0x140/0x140 [ 356.798954][T13005] ? tipc_nametbl_publish+0x73/0x1e0 [ 356.804250][T13005] tipc_nametbl_publish+0xc3/0x1e0 [ 356.809372][T13005] tipc_sk_publish+0x1be/0x440 [ 356.814313][T13005] ? __lock_acquire+0x7c60/0x7c60 [ 356.819344][T13005] ? tipc_sk_withdraw+0x630/0x630 [ 356.824383][T13005] ? tipc_nametbl_build_group+0x451/0x490 [ 356.830108][T13005] ? tipc_group_create+0x36d/0x4f0 [ 356.835222][T13005] tipc_sk_join+0x39b/0x6b0 [ 356.839729][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 356.844929][T13005] ? __tipc_sendstream+0x1260/0x1260 [ 356.850245][T13005] tipc_setsockopt+0x684/0x900 [ 356.855017][T13005] ? tipc_shutdown+0x4d0/0x4d0 [ 356.859784][T13005] ? aa_sock_opt_perm+0x74/0x100 [ 356.864720][T13005] ? bpf_lsm_socket_setsockopt+0x5/0x10 [ 356.870355][T13005] ? security_socket_setsockopt+0x7a/0xa0 [ 356.876178][T13005] ? tipc_shutdown+0x4d0/0x4d0 [ 356.880952][T13005] __sys_setsockopt+0x2bf/0x3d0 [ 356.885898][T13005] __x64_sys_setsockopt+0xb1/0xc0 [ 356.890919][T13005] do_syscall_64+0x4c/0xa0 [ 356.895436][T13005] ? clear_bhb_loop+0x30/0x80 [ 356.900112][T13005] ? clear_bhb_loop+0x30/0x80 [ 356.904785][T13005] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 356.911370][T13005] RIP: 0033:0x7ff3cbc0c749 [ 356.915784][T13005] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 356.935379][T13005] RSP: 002b:00007ff3c9e73038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 356.943785][T13005] RAX: ffffffffffffffda RBX: 00007ff3cbe62fa0 RCX: 00007ff3cbc0c749 [ 356.951746][T13005] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000004 [ 356.959707][T13005] RBP: 00007ff3c9e73090 R08: 00000000000004bd R09: 0000000000000000 [ 356.967675][T13005] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 356.975735][T13005] R13: 00007ff3cbe63038 R14: 00007ff3cbe62fa0 R15: 00007ffd72809588 [ 356.983723][T13005] [ 357.000820][T12817] device veth0_macvtap entered promiscuous mode [ 357.041618][T12817] device veth1_macvtap entered promiscuous mode [ 357.091852][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.120503][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.161824][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.192821][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.204000][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.227369][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.259730][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.311645][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.333918][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.348429][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.365631][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.399560][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.409970][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.423265][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.446646][T12817] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 357.458462][T13015] IPv6: Can't replace route, no match found [ 357.468387][T13017] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 357.479816][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 357.510842][T13023] netlink: 'syz.1.3293': attribute type 7 has an invalid length. [ 357.522260][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 357.533195][T13023] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3293'. [ 357.552432][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.564315][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.574410][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.585290][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.596062][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.606914][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.617553][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.628954][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.639163][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.650030][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.660464][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.671547][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.691995][T12817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.693447][T13024] netlink: 'syz.2.3292': attribute type 3 has an invalid length. [ 357.702917][T12817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.714583][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 357.724737][T12817] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 357.764459][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 357.780878][ T1159] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 357.833581][T13024] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3292'. [ 357.856280][T12817] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.877904][T12817] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.898151][T12817] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.926512][T12817] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.104014][ T2857] Bluetooth: hci4: command 0x0419 tx timeout [ 358.141862][ T3082] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 358.173291][ T3082] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 358.226295][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 358.252100][ T1173] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 358.335068][ T1173] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 358.390972][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 359.389130][T13060] IPv6: Can't replace route, no match found [ 359.414235][T13063] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 360.743459][ T144] wlan1: Trigger new scan to find an IBSS to join [ 361.133399][T13112] netlink: 'syz.3.3324': attribute type 3 has an invalid length. [ 361.173781][T13112] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.3324'. [ 361.216398][T13102] IPv6: Can't replace route, no match found [ 361.417964][T13106] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 361.704261][ T144] wlan1: Trigger new scan to find an IBSS to join [ 362.703359][T13139] netlink: 'syz.0.3335': attribute type 12 has an invalid length. [ 362.754164][ T1159] wlan1: Creating new IBSS network, BSSID 86:b3:ea:0a:27:d3 [ 362.757778][T13139] netlink: 172 bytes leftover after parsing attributes in process `syz.0.3335'. [ 363.003967][T13151] netlink: 'syz.0.3340': attribute type 27 has an invalid length. [ 363.043731][T13151] netlink: 164 bytes leftover after parsing attributes in process `syz.0.3340'. [ 363.076836][T13151] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 363.706209][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 364.333594][T13189] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 364.663467][ T9] wlan1: Trigger new scan to find an IBSS to join [ 365.564142][T13195] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.571639][T13195] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.840291][ T1159] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 365.853397][ T1159] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 367.723238][ T144] wlan1: Trigger new scan to find an IBSS to join [ 367.964377][ T9] wlan1: Creating new IBSS network, BSSID c6:16:a9:3e:9d:54 [ 368.678491][T13268] -: renamed from syzkaller0 [ 369.585181][ T1173] device hsr_slave_0 left promiscuous mode [ 369.683623][ T1173] device hsr_slave_1 left promiscuous mode [ 369.693739][ T1173] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 369.701632][ T1173] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 369.825545][ T1173] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 369.833070][ T1173] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 370.107248][ T1173] device bridge_slave_1 left promiscuous mode [ 370.124801][ T1173] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.308283][ T1173] device bridge_slave_0 left promiscuous mode [ 370.334798][ T1173] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.723686][ T1173] device veth1_macvtap left promiscuous mode [ 370.731035][ T1173] device veth0_macvtap left promiscuous mode [ 370.762863][ T1173] device veth1_vlan left promiscuous mode [ 370.793342][ T1173] device veth0_vlan left promiscuous mode [ 372.118038][ T1173] team0 (unregistering): Port device team_slave_1 removed [ 372.188928][ T1173] team0 (unregistering): Port device team_slave_0 removed [ 372.236898][ T1173] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 372.343639][ T1173] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 372.658815][ T1173] bond0 (unregistering): Released all slaves [ 374.319541][T13320] IPv6: Can't replace route, no match found [ 374.533811][ T3101] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 374.541673][ T3101] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 374.549497][T13320] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 378.425026][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.431349][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.805645][T13408] -: renamed from syzkaller0 [ 379.747298][T13422] IPv6: Can't replace route, no match found [ 379.840435][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 379.840450][T13422] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 379.864313][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 380.565469][T13441] netlink: 'syz.4.3429': attribute type 1 has an invalid length. [ 380.636206][T13441] netlink: 15231 bytes leftover after parsing attributes in process `syz.4.3429'. [ 380.714308][T13449] IPv6: Can't replace route, no match found [ 381.607028][T13449] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 381.633518][T13450] IPv6: Can't replace route, no match found [ 381.645890][T13447] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 383.048869][T13490] netlink: 'syz.2.3445': attribute type 1 has an invalid length. [ 383.116881][T13490] netlink: 15231 bytes leftover after parsing attributes in process `syz.2.3445'. [ 383.155805][T13497] IPv6: Can't replace route, no match found [ 383.210924][T13497] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 383.546420][T13509] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3451'. [ 383.572861][T13509] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 383.703256][ T3082] wlan1: Trigger new scan to find an IBSS to join [ 385.230585][T13535] IPv6: Can't replace route, no match found [ 385.269802][T13535] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 385.596597][T13545] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.3464'. [ 385.670335][T13545] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 385.707413][ T1173] device hsr_slave_0 left promiscuous mode [ 385.733812][ T1173] device hsr_slave_1 left promiscuous mode [ 385.764768][ T1173] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 385.787038][ T1173] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 385.818176][ T1173] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 385.843370][ T1173] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 385.882043][ T1173] device bridge_slave_1 left promiscuous mode [ 385.901800][ T1173] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.951239][ T1173] device bridge_slave_0 left promiscuous mode [ 385.963462][ T1173] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.004865][ T1173] device hsr_slave_0 left promiscuous mode [ 386.086539][ T1173] device hsr_slave_1 left promiscuous mode [ 386.107116][ T1173] device bridge_slave_1 left promiscuous mode [ 386.133335][ T1173] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.234898][ T1173] device bridge_slave_0 left promiscuous mode [ 386.241129][ T1173] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.352234][ T1173] device veth1_macvtap left promiscuous mode [ 386.368745][ T1173] device veth0_macvtap left promiscuous mode [ 386.384498][ T1173] device veth1_vlan left promiscuous mode [ 386.398182][ T1173] device veth0_vlan left promiscuous mode [ 386.409525][ T1173] device veth1_macvtap left promiscuous mode [ 386.429195][ T1173] device veth0_macvtap left promiscuous mode [ 386.447460][ T1173] device veth1_vlan left promiscuous mode [ 386.461445][ T1173] device veth0_vlan left promiscuous mode [ 386.663404][T12593] wlan1: Trigger new scan to find an IBSS to join [ 387.193822][ T1173] team0 (unregistering): Port device team_slave_1 removed [ 387.258033][ T1173] team0 (unregistering): Port device team_slave_0 removed [ 387.283456][ T1173] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 387.453343][ T1173] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 387.466775][ T1173] bond0 (unregistering): Released all slaves [ 387.703517][ T144] wlan1: Trigger new scan to find an IBSS to join [ 387.799330][ T1173] team0 (unregistering): Port device team_slave_1 removed [ 387.844624][ T1173] team0 (unregistering): Port device team_slave_0 removed [ 387.875745][ T1173] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 387.929633][ T1173] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 388.071143][ T1173] bond0 (unregistering): Released all slaves [ 388.160847][T13564] -: renamed from syzkaller0 [ 388.754369][ T144] wlan1: Trigger new scan to find an IBSS to join [ 388.904323][ T144] wlan1: Creating new IBSS network, BSSID 02:47:e7:0c:a0:07 [ 390.922456][T13669] netlink: 'syz.1.3503': attribute type 21 has an invalid length. [ 391.706879][ T3082] wlan1: Trigger new scan to find an IBSS to join [ 391.726955][T13686] netlink: 'syz.3.3509': attribute type 11 has an invalid length. [ 391.986562][T13686] device wlan0 left promiscuous mode [ 392.248644][T13701] IPv6: Can't replace route, no match found [ 392.301231][T13702] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 393.125354][T13721] netlink: 'syz.2.3521': attribute type 10 has an invalid length. [ 393.191957][T13723] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.3521'. [ 393.434539][T13721] team0: Device ipvlan1 failed to register rx_handler [ 393.685935][T13723] netlink: 8454 bytes leftover after parsing attributes in process `syz.2.3521'. [ 393.714340][ T144] wlan1: Creating new IBSS network, BSSID ca:78:cb:ff:6c:75 [ 394.725385][T13759] IPv6: Can't replace route, no match found [ 394.745898][ T3082] wlan1: Trigger new scan to find an IBSS to join [ 394.748765][T13763] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3534'. [ 394.879822][T13763] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 394.965058][T13760] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 395.013422][T13764] netlink: 'syz.2.3535': attribute type 10 has an invalid length. [ 395.042912][T13764] netlink: 55 bytes leftover after parsing attributes in process `syz.2.3535'. [ 396.815129][T13804] FAULT_INJECTION: forcing a failure. [ 396.815129][T13804] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 396.893735][T13802] netlink: 'syz.0.3546': attribute type 11 has an invalid length. [ 396.903401][T13804] CPU: 0 PID: 13804 Comm: syz.2.3547 Not tainted syzkaller #0 [ 396.910892][T13804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 396.920957][T13804] Call Trace: [ 396.924248][T13804] [ 396.927199][T13804] dump_stack_lvl+0x168/0x230 [ 396.931909][T13804] ? show_regs_print_info+0x20/0x20 [ 396.937517][T13804] ? load_image+0x3b0/0x3b0 [ 396.942051][T13804] ? __lock_acquire+0x7c60/0x7c60 [ 396.947116][T13804] should_fail+0x38c/0x4c0 [ 396.951563][T13804] _copy_to_user+0x2e/0x130 [ 396.956096][T13804] simple_read_from_buffer+0xe3/0x150 [ 396.961492][T13804] proc_fail_nth_read+0x19a/0x210 [ 396.966540][T13804] ? proc_fault_inject_write+0x2f0/0x2f0 [ 396.972203][T13804] ? fsnotify_perm+0x254/0x560 [ 396.977077][T13804] ? proc_fault_inject_write+0x2f0/0x2f0 [ 396.982747][T13804] vfs_read+0x2f6/0xcf0 [ 396.986935][T13804] ? kernel_read+0x1e0/0x1e0 [ 396.991555][T13804] ? __fget_files+0x40f/0x480 [ 396.996259][T13804] ? mutex_lock_nested+0x17/0x20 [ 397.001209][T13804] ? __fdget_pos+0x2bf/0x370 [ 397.005822][T13804] ? ksys_read+0x71/0x250 [ 397.010170][T13804] ksys_read+0x14d/0x250 [ 397.014434][T13804] ? vfs_write+0xd00/0xd00 [ 397.018864][T13804] ? lockdep_hardirqs_on+0x94/0x140 [ 397.024097][T13804] do_syscall_64+0x4c/0xa0 [ 397.028522][T13804] ? clear_bhb_loop+0x30/0x80 [ 397.033553][T13804] ? clear_bhb_loop+0x30/0x80 [ 397.038243][T13804] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 397.044145][T13804] RIP: 0033:0x7f73c8b1c15c [ 397.048568][T13804] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 397.068185][T13804] RSP: 002b:00007f73c6d84030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 397.076624][T13804] RAX: ffffffffffffffda RBX: 00007f73c8d73fa0 RCX: 00007f73c8b1c15c [ 397.084621][T13804] RDX: 000000000000000f RSI: 00007f73c6d840a0 RDI: 0000000000000004 [ 397.092613][T13804] RBP: 00007f73c6d84090 R08: 0000000000000000 R09: 0000000000000000 [ 397.100723][T13804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 397.108984][T13804] R13: 00007f73c8d74038 R14: 00007f73c8d73fa0 R15: 00007ffce68882e8 [ 397.117082][T13804] [ 398.207243][T13826] IPv6: Can't replace route, no match found [ 398.234416][T13826] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 398.672595][ T3082] wlan1: Trigger new scan to find an IBSS to join [ 398.679163][T12593] wlan1: Trigger new scan to find an IBSS to join [ 399.839683][ T1173] device hsr_slave_0 left promiscuous mode [ 399.853878][ T1173] device hsr_slave_1 left promiscuous mode [ 400.065854][T13856] netlink: 201392 bytes leftover after parsing attributes in process `syz.4.3564'. [ 400.284067][ T1173] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 400.291581][ T1173] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 400.454899][ T1173] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 400.462445][ T1173] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.556115][ T1173] device bridge_slave_1 left promiscuous mode [ 400.562386][ T1173] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.604464][ T1173] device bridge_slave_0 left promiscuous mode [ 400.610708][ T1173] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.664421][ T3082] wlan1: Creating new IBSS network, BSSID de:8c:b3:3e:e7:f3 [ 400.672348][ T3082] wlan1: Trigger new scan to find an IBSS to join [ 400.749104][ T1173] device veth1_macvtap left promiscuous mode [ 400.793490][ T1173] device veth0_macvtap left promiscuous mode [ 400.811781][ T1173] device veth1_vlan left promiscuous mode [ 400.853987][ T1173] device veth0_vlan left promiscuous mode [ 402.495279][ T1173] team0 (unregistering): Port device team_slave_1 removed [ 402.606803][ T1173] team0 (unregistering): Port device team_slave_0 removed [ 402.703896][ T1173] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 402.754291][T12593] wlan1: Trigger new scan to find an IBSS to join [ 402.760913][T12593] wlan1: Trigger new scan to find an IBSS to join [ 402.782401][ T1173] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 402.953784][ T1159] wlan1: Creating new IBSS network, BSSID 6a:ae:67:a1:5e:52 [ 403.293711][ T1173] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 403.447664][ T1173] bond0 (unregistering): Released all slaves [ 403.840399][T13853] netlink: 'syz.4.3564': attribute type 10 has an invalid length. [ 404.005850][T13853] team0: Device ipvlan1 failed to register rx_handler [ 404.214383][T13873] IPv6: Can't replace route, no match found [ 404.234972][T13856] netlink: 8454 bytes leftover after parsing attributes in process `syz.4.3564'. [ 404.563568][T13873] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 406.170158][T13911] IPv6: Can't replace route, no match found [ 406.240966][T13911] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 406.536609][T13920] netlink: 763 bytes leftover after parsing attributes in process `syz.0.3586'. [ 406.611517][T13920] netlink: 'syz.0.3586': attribute type 2 has an invalid length. [ 406.743438][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 407.707156][T13952] IPv6: Can't replace route, no match found [ 407.930462][T13955] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 408.157825][T13964] FAULT_INJECTION: forcing a failure. [ 408.157825][T13964] name failslab, interval 1, probability 0, space 0, times 0 [ 408.264011][T13964] CPU: 1 PID: 13964 Comm: syz.0.3600 Not tainted syzkaller #0 [ 408.271517][T13964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 408.274772][T13969] netlink: 'syz.0.3600': attribute type 2 has an invalid length. [ 408.281585][T13964] Call Trace: [ 408.281595][T13964] [ 408.295580][T13964] dump_stack_lvl+0x168/0x230 [ 408.300278][T13964] ? show_regs_print_info+0x20/0x20 [ 408.305482][T13964] ? load_image+0x3b0/0x3b0 [ 408.309994][T13964] ? __might_sleep+0xf0/0xf0 [ 408.314586][T13964] ? __lock_acquire+0x7c60/0x7c60 [ 408.319616][T13964] should_fail+0x38c/0x4c0 [ 408.324052][T13964] should_failslab+0x5/0x20 [ 408.328565][T13964] slab_pre_alloc_hook+0x51/0xc0 [ 408.333522][T13964] kmem_cache_alloc_node_trace+0x4a/0x300 [ 408.339253][T13964] ? __get_vm_area_node+0x119/0x2d0 [ 408.344463][T13964] __get_vm_area_node+0x119/0x2d0 [ 408.349498][T13964] __vmalloc_node_range+0xef/0x8b0 [ 408.349522][T13964] ? netlink_sendmsg+0x5dd/0xbc0 [ 408.349539][T13964] ? netlink_data_ready+0x10/0x10 [ 408.349571][T13964] ? netlink_sendmsg+0x5dd/0xbc0 [ 408.349588][T13964] vmalloc+0x75/0x80 [ 408.349606][T13964] ? netlink_sendmsg+0x5dd/0xbc0 [ 408.349623][T13964] netlink_sendmsg+0x5dd/0xbc0 [ 408.349650][T13964] ? netlink_getsockopt+0x560/0x560 [ 408.349671][T13964] ? aa_sock_msg_perm+0x94/0x150 [ 408.349694][T13964] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 408.349712][T13964] ? security_socket_sendmsg+0x7c/0xa0 [ 408.349733][T13964] sock_write_iter+0x29c/0x380 [ 408.349757][T13964] ? sock_read_iter+0x340/0x340 [ 408.349789][T13964] ? memset+0x1e/0x40 [ 408.349810][T13964] ? iov_iter_init+0xb4/0x170 [ 408.349833][T13964] vfs_write+0x712/0xd00 [ 408.349857][T13964] ? file_end_write+0x250/0x250 [ 408.349882][T13964] ? __fget_files+0x40f/0x480 [ 408.349910][T13964] ? __fdget_pos+0x1e2/0x370 [ 408.349926][T13964] ? ksys_write+0x71/0x250 [ 408.349945][T13964] ksys_write+0x14d/0x250 [ 408.349966][T13964] ? __ia32_sys_read+0x80/0x80 [ 408.349988][T13964] ? lockdep_hardirqs_on+0x94/0x140 [ 408.350012][T13964] do_syscall_64+0x4c/0xa0 [ 408.350028][T13964] ? clear_bhb_loop+0x30/0x80 [ 408.350045][T13964] ? clear_bhb_loop+0x30/0x80 [ 408.350064][T13964] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 408.350082][T13964] RIP: 0033:0x7f3b5aa87749 [ 408.350101][T13964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 408.350117][T13964] RSP: 002b:00007f3b58cee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 408.350138][T13964] RAX: ffffffffffffffda RBX: 00007f3b5acddfa0 RCX: 00007f3b5aa87749 [ 408.350152][T13964] RDX: 000000000000fe33 RSI: 00002000000001c0 RDI: 0000000000000005 [ 408.350164][T13964] RBP: 00007f3b58cee090 R08: 0000000000000000 R09: 0000000000000000 [ 408.350176][T13964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 408.350187][T13964] R13: 00007f3b5acde038 R14: 00007f3b5acddfa0 R15: 00007ffe49ef2508 [ 408.350218][T13964] [ 408.395779][T13965] FAULT_INJECTION: forcing a failure. [ 408.395779][T13965] name failslab, interval 1, probability 0, space 0, times 0 [ 408.395809][T13965] CPU: 1 PID: 13965 Comm: syz.1.3609 Not tainted syzkaller #0 [ 408.395827][T13965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 408.395837][T13965] Call Trace: [ 408.395844][T13965] [ 408.395852][T13965] dump_stack_lvl+0x168/0x230 [ 408.395882][T13965] ? show_regs_print_info+0x20/0x20 [ 408.395904][T13965] ? load_image+0x3b0/0x3b0 [ 408.395928][T13965] ? __might_sleep+0xf0/0xf0 [ 408.395947][T13965] ? __lock_acquire+0x7c60/0x7c60 [ 408.395966][T13965] ? mark_lock+0x94/0x320 [ 408.395991][T13965] should_fail+0x38c/0x4c0 [ 408.396019][T13965] should_failslab+0x5/0x20 [ 408.396035][T13965] slab_pre_alloc_hook+0x51/0xc0 [ 408.396056][T13965] __kmalloc+0x6b/0x330 [ 408.396071][T13965] ? tomoyo_realpath_from_path+0x118/0x610 [ 408.396100][T13965] tomoyo_realpath_from_path+0x118/0x610 [ 408.396139][T13965] tomoyo_path_number_perm+0x1d5/0x5d0 [ 408.396175][T13965] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 408.396193][T13965] ? perf_trace_lock+0xdf/0x370 [ 408.396275][T13965] security_file_ioctl+0x6c/0xa0 [ 408.396300][T13965] __se_sys_ioctl+0x48/0x170 [ 408.396325][T13965] do_syscall_64+0x4c/0xa0 [ 408.396341][T13965] ? clear_bhb_loop+0x30/0x80 [ 408.396358][T13965] ? clear_bhb_loop+0x30/0x80 [ 408.396378][T13965] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 408.396396][T13965] RIP: 0033:0x7f6d441e1749 [ 408.396412][T13965] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 408.396428][T13965] RSP: 002b:00007f6d42427038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 408.738117][T13965] RAX: ffffffffffffffda RBX: 00007f6d44438090 RCX: 00007f6d441e1749 [ 408.746110][T13965] RDX: 0000200000000180 RSI: 00000000401054d5 RDI: 0000000000000008 [ 408.754073][T13965] RBP: 00007f6d42427090 R08: 0000000000000000 R09: 0000000000000000 [ 408.762113][T13965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 408.770072][T13965] R13: 00007f6d44438128 R14: 00007f6d44438090 R15: 00007ffd9b21d118 [ 408.778044][T13965] [ 408.810844][ T3082] wlan1: Trigger new scan to find an IBSS to join [ 409.276618][T13964] syz.0.3600: vmalloc error: size 65408, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 409.370788][T13980] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3603'. [ 409.380286][T13964] CPU: 0 PID: 13964 Comm: syz.0.3600 Not tainted syzkaller #0 [ 409.387789][T13964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 409.397854][T13964] Call Trace: [ 409.401143][T13964] [ 409.404084][T13964] dump_stack_lvl+0x168/0x230 [ 409.408774][T13964] ? rcu_lock_release+0x5/0x20 [ 409.413549][T13964] ? show_regs_print_info+0x20/0x20 [ 409.418767][T13964] ? load_image+0x3b0/0x3b0 [ 409.423295][T13964] warn_alloc+0x20e/0x2f0 [ 409.427647][T13964] ? zone_watermark_ok_safe+0x240/0x240 [ 409.433207][T13964] ? kmem_cache_alloc_node_trace+0x16c/0x300 [ 409.439199][T13964] ? __get_vm_area_node+0x119/0x2d0 [ 409.444432][T13964] __vmalloc_node_range+0x2b1/0x8b0 [ 409.449740][T13964] ? netlink_data_ready+0x10/0x10 [ 409.454786][T13964] ? netlink_sendmsg+0x5dd/0xbc0 [ 409.459736][T13964] vmalloc+0x75/0x80 [ 409.463642][T13964] ? netlink_sendmsg+0x5dd/0xbc0 [ 409.468587][T13964] netlink_sendmsg+0x5dd/0xbc0 [ 409.473367][T13964] ? netlink_getsockopt+0x560/0x560 [ 409.478568][T13964] ? aa_sock_msg_perm+0x94/0x150 [ 409.483520][T13964] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 409.488804][T13964] ? security_socket_sendmsg+0x7c/0xa0 [ 409.494358][T13964] sock_write_iter+0x29c/0x380 [ 409.499142][T13964] ? sock_read_iter+0x340/0x340 [ 409.504024][T13964] ? memset+0x1e/0x40 [ 409.508137][T13964] ? iov_iter_init+0xb4/0x170 [ 409.512905][T13964] vfs_write+0x712/0xd00 [ 409.517163][T13964] ? file_end_write+0x250/0x250 [ 409.522033][T13964] ? __fget_files+0x40f/0x480 [ 409.526722][T13964] ? __fdget_pos+0x1e2/0x370 [ 409.531320][T13964] ? ksys_write+0x71/0x250 [ 409.535769][T13964] ksys_write+0x14d/0x250 [ 409.540105][T13964] ? __ia32_sys_read+0x80/0x80 [ 409.544876][T13964] ? lockdep_hardirqs_on+0x94/0x140 [ 409.547298][T13980] netlink: 'syz.2.3603': attribute type 2 has an invalid length. [ 409.550090][T13964] do_syscall_64+0x4c/0xa0 [ 409.550128][T13964] ? clear_bhb_loop+0x30/0x80 [ 409.566892][T13964] ? clear_bhb_loop+0x30/0x80 [ 409.571667][T13964] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 409.577568][T13964] RIP: 0033:0x7f3b5aa87749 [ 409.581988][T13964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 409.601601][T13964] RSP: 002b:00007f3b58cee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 409.610031][T13964] RAX: ffffffffffffffda RBX: 00007f3b5acddfa0 RCX: 00007f3b5aa87749 [ 409.618011][T13964] RDX: 000000000000fe33 RSI: 00002000000001c0 RDI: 0000000000000005 [ 409.625998][T13964] RBP: 00007f3b58cee090 R08: 0000000000000000 R09: 0000000000000000 [ 409.633979][T13964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 409.641960][T13964] R13: 00007f3b5acde038 R14: 00007f3b5acddfa0 R15: 00007ffe49ef2508 [ 409.649958][T13964] [ 409.937096][T13965] ERROR: Out of memory at tomoyo_realpath_from_path. [ 410.142432][T13991] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3605'. [ 410.212460][T13991] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 410.609700][T13964] Mem-Info: [ 410.653163][T13964] active_anon:280 inactive_anon:97050 isolated_anon:0 [ 410.653163][T13964] active_file:25561 inactive_file:35876 isolated_file:0 [ 410.653163][T13964] unevictable:768 dirty:233 writeback:0 [ 410.653163][T13964] slab_reclaimable:21082 slab_unreclaimable:104100 [ 410.653163][T13964] mapped:44995 shmem:93051 pagetables:906 bounce:0 [ 410.653163][T13964] kernel_misc_reclaimable:0 [ 410.653163][T13964] free:1269258 free_pcp:4165 free_cma:0 [ 410.703144][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 410.758401][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 410.926095][T13993] netlink: 6 bytes leftover after parsing attributes in process `syz.2.3606'. [ 411.004481][T13993] openvswitch: netlink: Flow actions attr not present in new flow. [ 411.092261][T13964] Node 0 active_anon:1088kB inactive_anon:397724kB active_file:102044kB inactive_file:143504kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:183576kB dirty:792kB writeback:40kB shmem:380016kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11768kB pagetables:3660kB all_unreclaimable? no [ 411.254381][T13964] Node 1 active_anon:32kB inactive_anon:508kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:4kB shmem:2076kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB all_unreclaimable? no [ 411.513849][T13964] Node 0 DMA free:15360kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 411.710431][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 411.723501][T13964] lowmem_reserve[]: 0 2541 2542 2542 2542 [ 411.768124][T13964] Node 0 DMA32 free:1112780kB min:34800kB low:43500kB high:52200kB reserved_highatomic:0KB active_anon:1092kB inactive_anon:416268kB active_file:102044kB inactive_file:143680kB unevictable:1536kB writepending:1188kB present:3129332kB managed:2608952kB mlocked:0kB bounce:0kB free_pcp:10300kB local_pcp:8100kB free_cma:0kB [ 411.918290][T13964] lowmem_reserve[]: 0 0 0 0 0 [ 411.979539][T13964] Node 0 Normal free:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:916kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 412.119031][T13964] lowmem_reserve[]: 0 0 0 0 0 [ 412.143257][T13964] Node 1 Normal free:3918568kB min:55088kB low:68860kB high:82632kB reserved_highatomic:0KB active_anon:32kB inactive_anon:508kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4119672kB mlocked:0kB bounce:0kB free_pcp:5484kB local_pcp:4872kB free_cma:0kB [ 412.167882][T14014] IPv6: Can't replace route, no match found [ 412.264582][T14016] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 412.264596][ T3101] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 412.307159][ T3101] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 412.460826][T13964] lowmem_reserve[]: 0 0 0 0 0 [ 412.498719][T13964] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 412.644082][T13964] Node 0 DMA32: 2*4kB (UE) 227*8kB (UME) 171*16kB (UE) 2098*32kB (UME) 2760*64kB (UME) 1778*128kB (UME) 712*256kB (UM) 181*512kB (UM) 43*1024kB (UME) 5*2048kB (UM) 71*4096kB (M) = 1095952kB [ 412.704639][ T9] wlan1: Creating new IBSS network, BSSID 9a:42:4b:de:c3:ac [ 412.798491][T13964] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 412.945689][T13964] Node 1 Normal: 184*4kB (UME) 39*8kB (UME) 37*16kB (UME) 184*32kB (UME) 98*64kB (UME) 32*128kB (UE) 13*256kB (UME) 2*512kB (U) 1*1024kB (U) 2*2048kB (ME) 950*4096kB (M) = 3918568kB [ 413.122869][T13964] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 413.168514][T13964] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 413.224937][T13964] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 413.306363][T13964] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 413.337218][T14034] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3621'. [ 413.370511][T13964] 156829 total pagecache pages [ 413.380572][T13964] 0 pages in swap cache [ 413.396227][T13964] Swap cache stats: add 0, delete 0, find 0/0 [ 413.402645][T14034] openvswitch: netlink: Flow actions attr not present in new flow. [ 413.456584][T13964] Free swap = 124996kB [ 413.460795][T13964] Total swap = 124996kB [ 413.513304][T13964] 2097051 pages RAM [ 413.524115][T13964] 0 pages HighMem/MovableOnly [ 413.529139][T13964] 410826 pages reserved [ 413.573128][T13964] 0 pages cma reserved [ 413.720984][ T9] wlan1: Creating new IBSS network, BSSID a2:c8:98:dd:aa:db [ 414.120819][T14053] IPv6: Can't replace route, no match found [ 414.253409][T14053] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 414.262731][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 414.299406][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 414.753421][T12593] wlan1: Trigger new scan to find an IBSS to join [ 415.604235][T14081] netlink: 6 bytes leftover after parsing attributes in process `syz.0.3637'. [ 415.713224][T14081] openvswitch: netlink: Flow actions attr not present in new flow. [ 417.426061][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 417.498621][ T3101] wlan1: Creating new IBSS network, BSSID 3a:53:51:8d:52:97 [ 417.650440][T14095] netlink: 212824 bytes leftover after parsing attributes in process `syz.4.3641'. [ 417.723400][T14097] netlink: 'syz.2.3642': attribute type 1 has an invalid length. [ 417.919483][T14100] IPv6: Can't replace route, no match found [ 418.241593][T14100] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 418.547111][T14105] device syzkaller0 entered promiscuous mode [ 418.749051][T14113] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3647'. [ 418.781434][T14113] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 419.764566][T14145] IPv6: Can't replace route, no match found [ 419.895011][T14148] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 419.989301][T14151] FAULT_INJECTION: forcing a failure. [ 419.989301][T14151] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 420.156772][T14151] CPU: 0 PID: 14151 Comm: syz.2.3658 Not tainted syzkaller #0 [ 420.164276][T14151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 420.174337][T14151] Call Trace: [ 420.177631][T14151] [ 420.180567][T14151] dump_stack_lvl+0x168/0x230 [ 420.185264][T14151] ? show_regs_print_info+0x20/0x20 [ 420.190474][T14151] ? load_image+0x3b0/0x3b0 [ 420.194991][T14151] ? __lock_acquire+0x7c60/0x7c60 [ 420.200039][T14151] should_fail+0x38c/0x4c0 [ 420.204473][T14151] _copy_to_user+0x2e/0x130 [ 420.208990][T14151] simple_read_from_buffer+0xe3/0x150 [ 420.214370][T14151] proc_fail_nth_read+0x19a/0x210 [ 420.219400][T14151] ? proc_fault_inject_write+0x2f0/0x2f0 [ 420.225040][T14151] ? fsnotify_perm+0x254/0x560 [ 420.229817][T14151] ? proc_fault_inject_write+0x2f0/0x2f0 [ 420.235453][T14151] vfs_read+0x2f6/0xcf0 [ 420.239622][T14151] ? kernel_read+0x1e0/0x1e0 [ 420.244217][T14151] ? __fget_files+0x40f/0x480 [ 420.248919][T14151] ? mutex_lock_nested+0x17/0x20 [ 420.254118][T14151] ? __fdget_pos+0x2bf/0x370 [ 420.258712][T14151] ? ksys_read+0x71/0x250 [ 420.263045][T14151] ksys_read+0x14d/0x250 [ 420.267294][T14151] ? vfs_write+0xd00/0xd00 [ 420.271721][T14151] ? trace_sys_enter+0x1f/0x80 [ 420.276505][T14151] do_syscall_64+0x4c/0xa0 [ 420.280924][T14151] ? clear_bhb_loop+0x30/0x80 [ 420.285610][T14151] ? clear_bhb_loop+0x30/0x80 [ 420.290291][T14151] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 420.296186][T14151] RIP: 0033:0x7f73c8b1c15c [ 420.300602][T14151] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 420.317248][T14161] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3662'. [ 420.320200][T14151] RSP: 002b:00007f73c6d84030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 420.337541][T14151] RAX: ffffffffffffffda RBX: 00007f73c8d73fa0 RCX: 00007f73c8b1c15c [ 420.345515][T14151] RDX: 000000000000000f RSI: 00007f73c6d840a0 RDI: 0000000000000004 [ 420.353588][T14151] RBP: 00007f73c6d84090 R08: 0000000000000000 R09: 0000000000000000 [ 420.361562][T14151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 420.369625][T14151] R13: 00007f73c8d74038 R14: 00007f73c8d73fa0 R15: 00007ffce68882e8 [ 420.377616][T14151] [ 420.569182][T14159] netlink: 'syz.3.3662': attribute type 2 has an invalid length. [ 421.679724][T14192] IPv6: Can't replace route, no match found [ 421.775935][T14192] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 422.076755][T14206] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3678'. [ 422.113305][T14206] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 422.419558][T14212] netlink: 'syz.2.3681': attribute type 21 has an invalid length. [ 422.488246][T14212] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3681'. [ 422.663754][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 422.689488][T14222] netlink: 212824 bytes leftover after parsing attributes in process `syz.0.3685'. [ 422.966597][T14227] netlink: 1 bytes leftover after parsing attributes in process `syz.4.3687'. [ 423.006865][T14237] FAULT_INJECTION: forcing a failure. [ 423.006865][T14237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 423.082196][T14237] CPU: 1 PID: 14237 Comm: syz.3.3689 Not tainted syzkaller #0 [ 423.089806][T14237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 423.100046][T14237] Call Trace: [ 423.103349][T14237] [ 423.106295][T14237] dump_stack_lvl+0x168/0x230 [ 423.110989][T14237] ? show_regs_print_info+0x20/0x20 [ 423.116198][T14237] ? load_image+0x3b0/0x3b0 [ 423.120713][T14237] ? __lock_acquire+0x7c60/0x7c60 [ 423.125751][T14237] should_fail+0x38c/0x4c0 [ 423.130186][T14237] _copy_from_user+0x2e/0x170 [ 423.134903][T14237] __copy_msghdr_from_user+0xaf/0x5e0 [ 423.140388][T14237] ? lock_chain_count+0x20/0x20 [ 423.145261][T14237] ? __ia32_sys_shutdown+0x1d0/0x1d0 [ 423.150581][T14237] ? trace_event_raw_event_lock+0x250/0x250 [ 423.156505][T14237] ___sys_sendmsg+0x156/0x260 [ 423.161208][T14237] ? __sys_sendmsg+0x250/0x250 [ 423.166031][T14237] ? __fdget+0x18b/0x210 [ 423.170283][T14237] __se_sys_sendmsg+0x190/0x250 [ 423.175154][T14237] ? __x64_sys_sendmsg+0x80/0x80 [ 423.180096][T14237] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 423.186100][T14237] ? trace_sys_enter+0x1f/0x80 [ 423.190871][T14237] do_syscall_64+0x4c/0xa0 [ 423.195300][T14237] ? clear_bhb_loop+0x30/0x80 [ 423.199982][T14237] ? clear_bhb_loop+0x30/0x80 [ 423.204759][T14237] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 423.210664][T14237] RIP: 0033:0x7f6fb4431749 [ 423.215102][T14237] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 423.234810][T14237] RSP: 002b:00007f6fb2698038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 423.243349][T14237] RAX: ffffffffffffffda RBX: 00007f6fb4687fa0 RCX: 00007f6fb4431749 [ 423.251331][T14237] RDX: 00000000000080d1 RSI: 0000200000000140 RDI: 0000000000000006 [ 423.259314][T14237] RBP: 00007f6fb2698090 R08: 0000000000000000 R09: 0000000000000000 [ 423.267307][T14237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 423.275296][T14237] R13: 00007f6fb4688038 R14: 00007f6fb4687fa0 R15: 00007fffea213148 [ 423.283289][T14237] [ 423.531312][T14242] IPv6: Can't replace route, no match found [ 423.641107][T14242] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 424.225684][T14262] device wlan0 entered promiscuous mode [ 425.492733][T14274] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3702'. [ 425.553479][T14274] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 425.619090][T14276] IPv6: Can't replace route, no match found [ 425.659197][T14277] netlink: 212824 bytes leftover after parsing attributes in process `syz.2.3703'. [ 425.703339][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 425.715227][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 425.770166][T14281] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 426.590303][ T13] Bluetooth: hci5: command 0x0406 tx timeout [ 426.618290][T14295] IPv6: Can't replace route, no match found [ 426.755688][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 426.823842][T14292] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 426.967810][ T144] wlan1: Creating new IBSS network, BSSID b2:d6:21:67:27:0d [ 427.051735][T14305] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3713'. [ 427.129810][T14305] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 427.541880][ T9] device hsr_slave_0 left promiscuous mode [ 427.653967][ T9] device hsr_slave_1 left promiscuous mode [ 427.662404][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 427.691543][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 427.774608][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 427.782094][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 427.820223][ T9] device bridge_slave_1 left promiscuous mode [ 427.862325][T14318] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3717'. [ 427.867517][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.910905][T14318] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 427.933710][ T9] device bridge_slave_0 left promiscuous mode [ 427.935106][T14322] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3715'. [ 427.939944][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.985708][T14322] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 428.020703][ T9] device veth1_macvtap left promiscuous mode [ 428.041682][ T9] device veth0_macvtap left promiscuous mode [ 428.050894][ T9] device veth1_vlan left promiscuous mode [ 428.059896][ T9] device veth0_vlan left promiscuous mode [ 428.552453][ T9] team0 (unregistering): Port device team_slave_1 removed [ 428.593368][ T9] team0 (unregistering): Port device team_slave_0 removed [ 428.621398][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.866522][ T9] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 428.885079][ T9] bond0 (unregistering): Released all slaves [ 429.440000][T14343] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 429.703304][ T144] wlan1: Trigger new scan to find an IBSS to join [ 430.310053][T14366] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3733'. [ 430.407040][T14366] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 430.664159][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 430.932547][T14388] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 430.943127][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 430.950946][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 431.344996][T14401] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3745'. [ 431.703294][T12593] wlan1: Creating new IBSS network, BSSID 76:4a:37:17:ea:12 [ 431.711051][ T144] wlan1: Trigger new scan to find an IBSS to join [ 431.885160][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 431.907843][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 433.126635][ T3101] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 433.134783][T14438] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 433.157226][ T3101] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 433.303525][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 433.311580][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 433.650425][T14459] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3769'. [ 433.676989][T14459] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 433.703307][T12593] wlan1: Trigger new scan to find an IBSS to join [ 434.487843][T14468] device wlan0 left promiscuous mode [ 434.588784][T14472] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.3774'. [ 434.931514][T14484] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 435.330992][T14492] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3781'. [ 435.399165][T14492] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 435.706055][ T9] wlan1: Trigger new scan to find an IBSS to join [ 436.038100][T14511] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.3788'. [ 436.093735][T14511] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 436.476723][T14529] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 436.486847][ T3101] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 436.513327][ T3101] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 436.743248][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 436.823182][ T13] Bluetooth: hci1: command 0x0406 tx timeout [ 436.932769][T14538] device wlan0 entered promiscuous mode [ 437.101060][T14543] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3798'. [ 437.177264][T14543] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 437.623420][T14560] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 437.703592][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 437.704233][ T1159] wlan1: Creating new IBSS network, BSSID 1a:5a:73:59:f8:48 [ 438.043961][T14571] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.3810'. [ 438.137628][T14571] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.3810'. [ 438.347003][T14590] netlink: 'syz.1.3817': attribute type 1 has an invalid length. [ 438.416762][T14590] netlink: 112860 bytes leftover after parsing attributes in process `syz.1.3817'. [ 438.500720][T14590] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3817'. [ 438.512671][T14592] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.3818'. [ 438.529289][T14592] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 438.670026][T14599] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 438.684859][ T9] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 438.692698][ T9] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 438.934807][T14607] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 439.703691][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 439.778401][T14618] netlink: 'syz.0.3826': attribute type 3 has an invalid length. [ 439.865896][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.872237][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.960450][T14618] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3826'. [ 440.245139][T14629] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 440.258285][ T3101] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 440.293151][ T3101] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 440.702276][T14632] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3833'. [ 440.773261][T14632] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 440.957823][T14649] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 441.710157][ T9] wlan1: Trigger new scan to find an IBSS to join [ 441.716962][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 441.802352][T14668] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 441.812398][ T1159] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 441.824254][ T1159] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 442.102092][T14675] netlink: 64967 bytes leftover after parsing attributes in process `syz.1.3849'. [ 442.224115][T14671] device wlan0 left promiscuous mode [ 442.460176][T14683] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3851'. [ 442.533792][T14683] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 442.900017][T14700] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 443.377547][T14720] netlink: 'syz.0.3865': attribute type 33 has an invalid length. [ 443.398891][T14720] netlink: 164 bytes leftover after parsing attributes in process `syz.0.3865'. [ 443.448642][T14719] netlink: 'syz.0.3865': attribute type 33 has an invalid length. [ 443.491394][T14719] netlink: 164 bytes leftover after parsing attributes in process `syz.0.3865'. [ 443.698780][T14731] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3869'. [ 443.708954][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 443.750940][T14731] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 443.772663][T14737] netlink: 'syz.4.3871': attribute type 2 has an invalid length. [ 443.863348][T14737] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3871'. [ 443.985115][T14746] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 445.425621][T14775] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3884'. [ 445.472135][T14775] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 445.662942][T14780] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3887'. [ 445.713188][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 445.713267][T14780] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 445.917330][T14788] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 445.923264][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 445.970437][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 446.170381][T14795] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3892'. [ 446.213593][T14795] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 446.663328][T12593] wlan1: Trigger new scan to find an IBSS to join [ 446.753238][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 447.366664][T14817] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3899'. [ 447.481177][T14817] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 447.560660][T14827] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.3902'. [ 447.680953][T14827] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 447.703240][ T1173] wlan1: Creating new IBSS network, BSSID 06:df:da:d9:a1:20 [ 447.703246][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 447.874668][T14831] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3904'. [ 448.338363][T14836] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 448.752054][ T9] wlan1: Trigger new scan to find an IBSS to join [ 449.176509][T14865] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.3912'. [ 449.274786][T14869] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3915'. [ 449.320198][T14869] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 449.378904][T14870] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3917'. [ 449.473219][T14870] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 449.713636][ T1159] wlan1: Creating new IBSS network, BSSID 42:1c:09:2d:08:20 [ 449.999887][T14880] FAULT_INJECTION: forcing a failure. [ 449.999887][T14880] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 450.125477][T14880] CPU: 0 PID: 14880 Comm: syz.2.3920 Not tainted syzkaller #0 [ 450.132978][T14880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 450.143048][T14880] Call Trace: [ 450.146331][T14880] [ 450.149265][T14880] dump_stack_lvl+0x168/0x230 [ 450.154050][T14880] ? show_regs_print_info+0x20/0x20 [ 450.159255][T14880] ? load_image+0x3b0/0x3b0 [ 450.163772][T14880] ? __lock_acquire+0x7c60/0x7c60 [ 450.168810][T14880] should_fail+0x38c/0x4c0 [ 450.173239][T14880] _copy_from_user+0x2e/0x170 [ 450.177926][T14880] __copy_msghdr_from_user+0xaf/0x5e0 [ 450.183304][T14880] ? verify_lock_unused+0x140/0x140 [ 450.188518][T14880] ? __ia32_sys_shutdown+0x1d0/0x1d0 [ 450.193856][T14880] ___sys_sendmsg+0x156/0x260 [ 450.198546][T14880] ? __sys_sendmsg+0x250/0x250 [ 450.203329][T14880] ? vfs_write+0x84d/0xd00 [ 450.207759][T14880] ? __fdget+0x18b/0x210 [ 450.212092][T14880] __se_sys_sendmsg+0x190/0x250 [ 450.216955][T14880] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 450.223111][T14880] ? __x64_sys_sendmsg+0x80/0x80 [ 450.228068][T14880] ? syscall_enter_from_user_mode+0x2a/0x70 [ 450.233966][T14880] do_syscall_64+0x4c/0xa0 [ 450.238380][T14880] ? clear_bhb_loop+0x30/0x80 [ 450.243057][T14880] ? clear_bhb_loop+0x30/0x80 [ 450.247742][T14880] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 450.253634][T14880] RIP: 0033:0x7f73c8b1d749 [ 450.258048][T14880] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 450.277650][T14880] RSP: 002b:00007f73c6d63038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 450.286422][T14880] RAX: ffffffffffffffda RBX: 00007f73c8d74090 RCX: 00007f73c8b1d749 [ 450.294405][T14880] RDX: 00000000000052cc RSI: 0000200000000040 RDI: 0000000000000005 [ 450.302384][T14880] RBP: 00007f73c6d63090 R08: 0000000000000000 R09: 0000000000000000 [ 450.310360][T14880] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 450.318338][T14880] R13: 00007f73c8d74128 R14: 00007f73c8d74090 R15: 00007ffce68882e8 [ 450.326328][T14880] [ 450.743604][ T9] wlan1: Trigger new scan to find an IBSS to join [ 450.794964][T14890] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 450.803138][ T1159] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 450.812355][ T1159] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 451.711429][T12593] wlan1: Trigger new scan to find an IBSS to join [ 451.859754][T12593] wlan1: Creating new IBSS network, BSSID 42:e3:3d:47:8d:5d [ 452.018370][T14920] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3932'. [ 452.079372][T14920] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 452.176175][T14918] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3931'. [ 452.183163][ T4230] Bluetooth: hci3: command 0x0406 tx timeout [ 452.343650][T14918] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 452.389440][T14924] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.3933'. [ 452.632818][T14924] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.3933'. [ 453.135613][ T1173] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 453.144124][T14937] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 453.157027][ T1173] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 453.693322][T14947] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 454.058978][T14957] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3943'. [ 454.117687][T14957] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 454.193953][T14964] netlink: 'syz.1.3945': attribute type 1 has an invalid length. [ 454.664506][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 455.703333][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 455.807990][T14991] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 456.104917][T15003] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 456.489729][T15006] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3959'. [ 456.697687][T15006] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 457.476060][T15021] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3974'. [ 457.501606][T15021] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 458.554054][T15044] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 458.753534][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 459.280067][T15062] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 459.739292][T15070] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3980'. [ 459.817163][T15068] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3979'. [ 459.829830][T15070] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 459.963388][T15068] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 460.029859][T15072] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3981'. [ 460.103259][T15072] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 460.663322][ T9] wlan1: Trigger new scan to find an IBSS to join [ 460.758688][T15079] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 461.717457][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 461.921307][T15110] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3992'. [ 462.113294][T15110] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 462.503138][T13451] Bluetooth: hci2: command 0x0406 tx timeout [ 462.598933][T15115] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3994'. [ 462.727227][T15115] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 462.754123][T12593] wlan1: Trigger new scan to find an IBSS to join [ 462.825297][T15122] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 463.457458][T15137] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4001'. [ 463.589908][T15137] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 463.643493][T15136] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 464.254469][T15156] netlink: 'syz.4.4007': attribute type 2 has an invalid length. [ 464.287416][T15153] FAULT_INJECTION: forcing a failure. [ 464.287416][T15153] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 464.364020][T15156] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.4007'. [ 464.503281][T15153] CPU: 0 PID: 15153 Comm: syz.1.4005 Not tainted syzkaller #0 [ 464.510788][T15153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 464.520876][T15153] Call Trace: [ 464.524163][T15153] [ 464.527113][T15153] dump_stack_lvl+0x168/0x230 [ 464.531798][T15153] ? show_regs_print_info+0x20/0x20 [ 464.537013][T15153] ? load_image+0x3b0/0x3b0 [ 464.541534][T15153] ? __lock_acquire+0x7c60/0x7c60 [ 464.546578][T15153] should_fail+0x38c/0x4c0 [ 464.551009][T15153] _copy_from_user+0x2e/0x170 [ 464.555693][T15153] kstrtouint_from_user+0xbe/0x200 [ 464.560816][T15153] ? kstrtol_from_user+0x260/0x260 [ 464.565960][T15153] proc_fail_nth_write+0x85/0x1f0 [ 464.571001][T15153] ? proc_fail_nth_read+0x210/0x210 [ 464.576210][T15153] ? common_file_perm+0x171/0x1c0 [ 464.581257][T15153] ? proc_fail_nth_read+0x210/0x210 [ 464.586471][T15153] vfs_write+0x300/0xd00 [ 464.590739][T15153] ? file_end_write+0x250/0x250 [ 464.595615][T15153] ? __fget_files+0x40f/0x480 [ 464.600312][T15153] ? mutex_lock_nested+0x17/0x20 [ 464.605259][T15153] ? __fdget_pos+0x2bf/0x370 [ 464.609854][T15153] ? ksys_write+0x71/0x250 [ 464.614278][T15153] ksys_write+0x14d/0x250 [ 464.618610][T15153] ? __ia32_sys_read+0x80/0x80 [ 464.623377][T15153] ? lockdep_hardirqs_on+0x94/0x140 [ 464.628586][T15153] do_syscall_64+0x4c/0xa0 [ 464.633004][T15153] ? clear_bhb_loop+0x30/0x80 [ 464.637684][T15153] ? clear_bhb_loop+0x30/0x80 [ 464.642375][T15153] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 464.648281][T15153] RIP: 0033:0x7f6d441e01ff [ 464.652718][T15153] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 464.672332][T15153] RSP: 002b:00007f6d42448030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 464.680761][T15153] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6d441e01ff [ 464.688758][T15153] RDX: 0000000000000001 RSI: 00007f6d424480a0 RDI: 0000000000000004 [ 464.688933][T15160] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4006'. [ 464.696748][T15153] RBP: 00007f6d42448090 R08: 0000000000000000 R09: 0000000000000000 [ 464.696786][T15153] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 464.696795][T15153] R13: 00007f6d44438038 R14: 00007f6d44437fa0 R15: 00007ffd9b21d118 [ 464.696826][T15153] [ 464.753307][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 464.753327][ T9] wlan1: Trigger new scan to find an IBSS to join [ 465.219084][T15168] netlink: 'syz.1.4021': attribute type 9 has an invalid length. [ 465.317615][T15168] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.4021'. [ 465.615093][T15160] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 465.703278][ T9] wlan1: Trigger new scan to find an IBSS to join [ 466.416239][T15191] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 466.753804][ T1159] wlan1: Creating new IBSS network, BSSID 5a:cc:1e:9f:f3:c7 [ 466.759817][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 466.852982][ T1173] wlan1: Creating new IBSS network, BSSID 42:4f:67:56:af:8a [ 467.736473][T15223] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4027'. [ 467.834493][T15223] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 468.149790][T15230] syz.3.4029[15230] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 468.149907][T15230] syz.3.4029[15230] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 468.258059][T15229] delete_channel: no stack [ 468.663285][T12593] wlan1: Trigger new scan to find an IBSS to join [ 468.801397][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 468.801408][T15245] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 468.826273][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 469.704247][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 469.867568][T15272] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4042'. [ 469.948250][T15272] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 470.963770][T15292] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 472.663184][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 472.663345][ T4230] Bluetooth: hci4: command 0x0406 tx timeout [ 472.669738][T12593] wlan1: Trigger new scan to find an IBSS to join [ 472.750300][T15327] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4059'. [ 472.863356][T12593] wlan1: Creating new IBSS network, BSSID 8a:f1:f2:bb:21:d7 [ 472.872030][T15327] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 473.174276][T15339] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 473.368908][T15350] netlink: 'syz.2.4065': attribute type 29 has an invalid length. [ 473.527972][T15350] netlink: 'syz.2.4065': attribute type 29 has an invalid length. [ 473.678688][T15354] netlink: 'syz.2.4065': attribute type 29 has an invalid length. [ 473.703226][ T1159] wlan1: Trigger new scan to find an IBSS to join [ 473.944190][T15364] syz.0.4069[15364] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 473.944313][T15364] syz.0.4069[15364] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 474.167324][T15361] delete_channel: no stack [ 474.627175][T15381] netlink: 'syz.3.4073': attribute type 29 has an invalid length. [ 475.003282][T15381] netlink: 'syz.3.4073': attribute type 29 has an invalid length. [ 475.403261][T15383] netlink: 'syz.3.4073': attribute type 29 has an invalid length. [ 475.453489][T15391] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4075'. [ 475.545576][T15391] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 475.707651][T12593] wlan1: Trigger new scan to find an IBSS to join [ 476.328102][T15404] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 477.716009][T15426] FAULT_INJECTION: forcing a failure. [ 477.716009][T15426] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 477.818876][T15426] CPU: 1 PID: 15426 Comm: syz.4.4087 Not tainted syzkaller #0 [ 477.826383][T15426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 477.836456][T15426] Call Trace: [ 477.839749][T15426] [ 477.842687][T15426] dump_stack_lvl+0x168/0x230 [ 477.847390][T15426] ? show_regs_print_info+0x20/0x20 [ 477.852613][T15426] ? load_image+0x3b0/0x3b0 [ 477.857143][T15426] ? __kasan_kmalloc+0xcc/0xf0 [ 477.861925][T15426] ? __lock_acquire+0x7c60/0x7c60 [ 477.866960][T15426] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 477.873060][T15426] should_fail+0x38c/0x4c0 [ 477.877505][T15426] _copy_from_iter+0x22a/0x1150 [ 477.882432][T15426] ? __lock_acquire+0x7c60/0x7c60 [ 477.887486][T15426] ? copy_mc_pipe_to_iter+0x7d0/0x7d0 [ 477.892885][T15426] ? __virt_addr_valid+0x3c6/0x470 [ 477.897993][T15426] ? __phys_addr+0xb6/0x170 [ 477.902504][T15426] ? __phys_addr_symbol+0x2b/0x70 [ 477.907521][T15426] ? __check_object_size+0x30c/0x410 [ 477.912813][T15426] kernfs_fop_write_iter+0x1a4/0x4c0 [ 477.918104][T15426] ? iov_iter_init+0xb4/0x170 [ 477.922788][T15426] vfs_write+0x712/0xd00 [ 477.927048][T15426] ? file_end_write+0x250/0x250 [ 477.932002][T15426] ? __fget_files+0x40f/0x480 [ 477.936681][T15426] ? mutex_lock_nested+0x17/0x20 [ 477.941614][T15426] ? __fdget_pos+0x2bf/0x370 [ 477.946199][T15426] ? ksys_write+0x71/0x250 [ 477.950633][T15426] ksys_write+0x14d/0x250 [ 477.954966][T15426] ? __ia32_sys_read+0x80/0x80 [ 477.959730][T15426] ? lockdep_hardirqs_on+0x94/0x140 [ 477.964939][T15426] do_syscall_64+0x4c/0xa0 [ 477.969787][T15426] ? clear_bhb_loop+0x30/0x80 [ 477.974472][T15426] ? clear_bhb_loop+0x30/0x80 [ 477.979237][T15426] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 477.985124][T15426] RIP: 0033:0x7ff3cbc0c749 [ 477.989543][T15426] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 478.009149][T15426] RSP: 002b:00007ff3c9e73038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 478.017558][T15426] RAX: ffffffffffffffda RBX: 00007ff3cbe62fa0 RCX: 00007ff3cbc0c749 [ 478.025610][T15426] RDX: 000000000000000e RSI: 0000200000000100 RDI: 0000000000000008 [ 478.033577][T15426] RBP: 00007ff3c9e73090 R08: 0000000000000000 R09: 0000000000000000 [ 478.041544][T15426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.049521][T15426] R13: 00007ff3cbe63038 R14: 00007ff3cbe62fa0 R15: 00007ffd72809588 [ 478.057610][T15426] [ 478.476606][T15430] syz.2.4088[15430] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 478.476714][T15430] syz.2.4088[15430] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 478.541181][T15429] delete_channel: no stack [ 478.663252][ T1173] wlan1: Trigger new scan to find an IBSS to join [ 478.837428][T15442] netlink: 'syz.2.4092': attribute type 40 has an invalid length. [ 478.939214][T15442] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.071850][T15440] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4091'. [ 479.169121][T15440] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 479.232003][T15446] device syzkaller0 entered promiscuous mode [ 479.474666][T15452] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 479.536842][T15455] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4095'. [ 479.597563][T15455] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 479.703333][T12593] wlan1: Trigger new scan to find an IBSS to join [ 480.687043][T15456] netlink: 'syz.0.4096': attribute type 40 has an invalid length. [ 480.899656][T15456] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.705177][ T1173] wlan1: Creating new IBSS network, BSSID 6a:18:b4:cd:67:1a [ 481.705711][ T144] wlan1: Trigger new scan to find an IBSS to join [ 481.802098][T15486] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4109'. [ 481.833352][T15486] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 482.483742][T15503] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 482.492990][ T1173] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 482.544530][ T1173] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 482.730677][T15512] netlink: 'syz.2.4115': attribute type 3 has an invalid length. [ 482.803938][T15512] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.4115'. [ 483.199654][T15524] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4121'. [ 483.243226][T15524] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 483.857383][T15538] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 484.241998][T15547] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 484.817540][T15567] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4135'. [ 484.856393][T15567] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 485.490301][T15586] mac80211_hwsim hwsim17 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 485.751874][T15597] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4149'. [ 485.761656][T15597] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 485.996277][T15604] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4152'. [ 486.048096][T15605] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4151'. [ 486.061799][T15604] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 486.103872][T15605] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 486.513715][T15624] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 486.794940][T15629] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4162'. [ 486.911123][T15629] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 487.240391][T15640] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4166'. [ 487.286192][T15640] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 487.337630][T15646] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4167'. [ 487.382222][T15646] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 487.680288][T15657] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4171'. [ 487.712752][ T144] wlan1: Trigger new scan to find an IBSS to join [ 487.833203][T15657] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 488.148564][T15672] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4177'. [ 488.223267][T15672] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 488.663283][T12593] wlan1: Trigger new scan to find an IBSS to join [ 488.665862][T15682] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.4191'. [ 488.720161][T15682] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 488.846828][T15685] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 490.544128][T15713] mac80211_hwsim hwsim21 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 490.637963][T15720] __nla_validate_parse: 2 callbacks suppressed [ 490.637996][T15720] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4195'. [ 490.860858][T15720] net_ratelimit: 2 callbacks suppressed [ 490.860890][T15720] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 491.697080][T15754] FAULT_INJECTION: forcing a failure. [ 491.697080][T15754] name failslab, interval 1, probability 0, space 0, times 0 [ 491.710459][ T9] wlan1: Trigger new scan to find an IBSS to join [ 491.765756][T15754] CPU: 1 PID: 15754 Comm: syz.4.4208 Not tainted syzkaller #0 [ 491.773272][T15754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 491.783347][T15754] Call Trace: [ 491.786644][T15754] [ 491.789603][T15754] dump_stack_lvl+0x168/0x230 [ 491.794342][T15754] ? show_regs_print_info+0x20/0x20 [ 491.799585][T15754] ? load_image+0x3b0/0x3b0 [ 491.804122][T15754] ? __might_sleep+0xf0/0xf0 [ 491.808732][T15754] ? __lock_acquire+0x7c60/0x7c60 [ 491.813803][T15754] should_fail+0x38c/0x4c0 [ 491.818269][T15754] should_failslab+0x5/0x20 [ 491.822796][T15754] slab_pre_alloc_hook+0x51/0xc0 [ 491.827754][T15754] kmem_cache_alloc_node+0x47/0x2d0 [ 491.832968][T15754] ? __alloc_skb+0xf4/0x750 [ 491.837510][T15754] __alloc_skb+0xf4/0x750 [ 491.841870][T15754] alloc_skb_with_frags+0xa7/0x730 [ 491.847025][T15754] sock_alloc_send_pskb+0x853/0x980 [ 491.852292][T15754] ? sock_kzfree_s+0x50/0x50 [ 491.856887][T15754] ? perf_trace_lock+0xdf/0x370 [ 491.861764][T15754] ? trace_event_raw_event_lock+0x250/0x250 [ 491.867693][T15754] rawv6_send_hdrinc+0x2f0/0x16c0 [ 491.872761][T15754] ? rcu_lock_release+0x5/0x20 [ 491.877543][T15754] ? rawv6_probe_proto_opt+0x300/0x300 [ 491.883060][T15754] rawv6_sendmsg+0x1143/0x1710 [ 491.887869][T15754] ? compat_rawv6_ioctl+0x60/0x60 [ 491.892982][T15754] ? aa_af_perm+0x2b0/0x2b0 [ 491.897489][T15754] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 491.903931][T15754] ? sock_rps_record_flow+0x17/0x3b0 [ 491.909229][T15754] ? inet_send_prepare+0x260/0x260 [ 491.914355][T15754] ? inet_sendmsg+0x78/0x2f0 [ 491.918951][T15754] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 491.924246][T15754] ? security_socket_sendmsg+0x7c/0xa0 [ 491.929712][T15754] ? inet_send_prepare+0x260/0x260 [ 491.934837][T15754] ____sys_sendmsg+0x5a2/0x8c0 [ 491.939630][T15754] ? memset+0x1e/0x40 [ 491.943622][T15754] ? __sys_sendmsg_sock+0x30/0x30 [ 491.948683][T15754] ? import_iovec+0x6f/0xa0 [ 491.953211][T15754] ___sys_sendmsg+0x1f0/0x260 [ 491.957924][T15754] ? __sys_sendmsg+0x250/0x250 [ 491.962738][T15754] ? trace_event_raw_event_lock+0x250/0x250 [ 491.968634][T15754] ? vfs_write+0x84d/0xd00 [ 491.973111][T15754] ? __fdget+0x18b/0x210 [ 491.977372][T15754] __se_sys_sendmsg+0x190/0x250 [ 491.982239][T15754] ? __x64_sys_sendmsg+0x80/0x80 [ 491.987177][T15754] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 491.993194][T15754] ? lockdep_hardirqs_on+0x94/0x140 [ 491.998409][T15754] do_syscall_64+0x4c/0xa0 [ 492.002828][T15754] ? clear_bhb_loop+0x30/0x80 [ 492.007511][T15754] ? clear_bhb_loop+0x30/0x80 [ 492.012200][T15754] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 492.018104][T15754] RIP: 0033:0x7ff3cbc0c749 [ 492.022528][T15754] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 492.042137][T15754] RSP: 002b:00007ff3c9e73038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.050563][T15754] RAX: ffffffffffffffda RBX: 00007ff3cbe62fa0 RCX: 00007ff3cbc0c749 [ 492.058538][T15754] RDX: 0000000020040000 RSI: 0000200000000240 RDI: 0000000000000003 [ 492.066511][T15754] RBP: 00007ff3c9e73090 R08: 0000000000000000 R09: 0000000000000000 [ 492.074488][T15754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.082460][T15754] R13: 00007ff3cbe63038 R14: 00007ff3cbe62fa0 R15: 00007ffd72809588 [ 492.090480][T15754] [ 492.743375][ T9] wlan1: Trigger new scan to find an IBSS to join [ 492.749951][T12593] wlan1: Trigger new scan to find an IBSS to join [ 492.995725][T15758] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 493.005069][T12593] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 493.012943][T12593] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 493.411480][T15772] FAULT_INJECTION: forcing a failure. [ 493.411480][T15772] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 493.468888][T15769] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4212'. [ 493.497277][T15772] CPU: 1 PID: 15772 Comm: syz.1.4214 Not tainted syzkaller #0 [ 493.504776][T15772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 493.514853][T15772] Call Trace: [ 493.518133][T15772] [ 493.521062][T15772] dump_stack_lvl+0x168/0x230 [ 493.525754][T15772] ? show_regs_print_info+0x20/0x20 [ 493.530965][T15772] ? load_image+0x3b0/0x3b0 [ 493.533139][T15769] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 493.535480][T15772] ? __lock_acquire+0x7c60/0x7c60 [ 493.548624][T15772] should_fail+0x38c/0x4c0 [ 493.553053][T15772] _copy_from_user+0x2e/0x170 [ 493.557731][T15772] iovec_from_user+0x142/0x370 [ 493.562591][T15772] __import_iovec+0x70/0x490 [ 493.567193][T15772] import_iovec+0x6f/0xa0 [ 493.571623][T15772] ___sys_sendmsg+0x1b9/0x260 [ 493.576311][T15772] ? __sys_sendmsg+0x250/0x250 [ 493.581099][T15772] ? vfs_write+0x84d/0xd00 [ 493.585528][T15772] ? __fdget+0x18b/0x210 [ 493.589772][T15772] __se_sys_sendmsg+0x190/0x250 [ 493.594718][T15772] ? __x64_sys_sendmsg+0x80/0x80 [ 493.599656][T15772] ? lockdep_hardirqs_on_prepare+0x3fc/0x760 [ 493.605658][T15772] ? lockdep_hardirqs_on+0x94/0x140 [ 493.610867][T15772] do_syscall_64+0x4c/0xa0 [ 493.615300][T15772] ? clear_bhb_loop+0x30/0x80 [ 493.619979][T15772] ? clear_bhb_loop+0x30/0x80 [ 493.624666][T15772] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 493.630586][T15772] RIP: 0033:0x7f6d441e1749 [ 493.635093][T15772] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 493.654873][T15772] RSP: 002b:00007f6d42448038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 493.654896][T15772] RAX: ffffffffffffffda RBX: 00007f6d44437fa0 RCX: 00007f6d441e1749 [ 493.654908][T15772] RDX: 00000000000052cc RSI: 0000200000000040 RDI: 0000000000000003 [ 493.654919][T15772] RBP: 00007f6d42448090 R08: 0000000000000000 R09: 0000000000000000 [ 493.654928][T15772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 493.654937][T15772] R13: 00007f6d44438038 R14: 00007f6d44437fa0 R15: 00007ffd9b21d118 [ 493.654960][T15772] [ 494.026016][T15785] IPv6: Can't replace route, no match found [ 494.132690][T15789] FAULT_INJECTION: forcing a failure. [ 494.132690][T15789] name failslab, interval 1, probability 0, space 0, times 0 [ 494.172280][T15785] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 494.181795][ T9] wlan1: Created IBSS using preconfigured BSSID 00:8d:8d:ff:00:00 [ 494.213152][ T9] wlan1: Creating new IBSS network, BSSID 00:8d:8d:ff:00:00 [ 494.252816][T15788] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4219'. [ 494.262910][T15789] CPU: 0 PID: 15789 Comm: syz.4.4218 Not tainted syzkaller #0 [ 494.270384][T15789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 494.280443][T15789] Call Trace: [ 494.283728][T15789] [ 494.286658][T15789] dump_stack_lvl+0x168/0x230 [ 494.291354][T15789] ? show_regs_print_info+0x20/0x20 [ 494.296564][T15789] ? load_image+0x3b0/0x3b0 [ 494.301077][T15789] ? __might_sleep+0xf0/0xf0 [ 494.305669][T15789] ? __lock_acquire+0x7c60/0x7c60 [ 494.310703][T15789] ? mark_lock+0x94/0x320 [ 494.315047][T15789] should_fail+0x38c/0x4c0 [ 494.319487][T15789] should_failslab+0x5/0x20 [ 494.323993][T15789] slab_pre_alloc_hook+0x51/0xc0 [ 494.329288][T15789] __kmalloc+0x6b/0x330 [ 494.333449][T15789] ? tomoyo_realpath_from_path+0x118/0x610 [ 494.339266][T15789] tomoyo_realpath_from_path+0x118/0x610 [ 494.344922][T15789] tomoyo_path_number_perm+0x1d5/0x5d0 [ 494.350475][T15789] ? verify_lock_unused+0x140/0x140 [ 494.355677][T15789] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 494.361148][T15789] ? ksys_write+0x1c7/0x250 [ 494.365702][T15789] security_file_ioctl+0x6c/0xa0 [ 494.370657][T15789] __se_sys_ioctl+0x48/0x170 [ 494.375457][T15789] do_syscall_64+0x4c/0xa0 [ 494.379877][T15789] ? clear_bhb_loop+0x30/0x80 [ 494.384573][T15789] ? clear_bhb_loop+0x30/0x80 [ 494.389259][T15789] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 494.395160][T15789] RIP: 0033:0x7ff3cbc0c749 [ 494.399588][T15789] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 494.419199][T15789] RSP: 002b:00007ff3c9e52038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 494.427631][T15789] RAX: ffffffffffffffda RBX: 00007ff3cbe63090 RCX: 00007ff3cbc0c749 [ 494.435617][T15789] RDX: 0000200000000000 RSI: 0000000000008b04 RDI: 000000000000000b [ 494.443596][T15789] RBP: 00007ff3c9e52090 R08: 0000000000000000 R09: 0000000000000000 [ 494.451579][T15789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.459554][T15789] R13: 00007ff3cbe63128 R14: 00007ff3cbe63090 R15: 00007ffd72809588 [ 494.467549][T15789] [ 494.498294][T15788] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 494.663159][ T144] wlan1: Trigger new scan to find an IBSS to join [ 494.716933][ T144] wlan1: Creating new IBSS network, BSSID 7a:b0:1e:f6:e5:db [ 494.927602][T15789] ERROR: Out of memory at tomoyo_realpath_from_path. [ 495.302750][T15810] device wlan0 entered promiscuous mode [ 495.650492][T15816] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4230'. [ 495.702610][T15816] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 495.712182][T15806] delete_channel: no stack [ 495.717139][ T3101] wlan1: Trigger new scan to find an IBSS to join [ 495.717161][T12593] wlan1: Trigger new scan to find an IBSS to join [ 495.751486][T15806] delete_channel: no stack [ 495.847271][T15820] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4231'. [ 495.857672][T12593] wlan1: Creating new IBSS network, BSSID 66:bc:8c:b0:82:dc [ 495.927987][T15824] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 495.928409][ T144] ------------[ cut here ]------------ [ 495.959400][T15820] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 495.973107][ T144] WARNING: CPU: 1 PID: 144 at net/wireless/ibss.c:37 __cfg80211_ibss_joined+0x418/0x4a0 [ 495.982923][ T144] Modules linked in: [ 496.039816][ T144] CPU: 1 PID: 144 Comm: kworker/u4:1 Not tainted syzkaller #0 [ 496.075096][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 496.122243][ T144] Workqueue: cfg80211 cfg80211_event_work [ 496.138025][ T144] RIP: 0010:__cfg80211_ibss_joined+0x418/0x4a0 [ 496.152221][ T144] Code: 00 00 00 48 3b 84 24 80 00 00 00 75 5c 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 41 70 53 f8 0f 0b eb c3 e8 38 70 53 f8 <0f> 0b 4c 8b 6c 24 20 eb b5 e8 2a 70 53 f8 0f 0b e9 7a fd ff ff e8 [ 496.211606][ T144] RSP: 0018:ffffc9000173faa0 EFLAGS: 00010293 [ 496.232501][ T144] RAX: ffffffff89245bd8 RBX: dffffc0000000000 RCX: ffff888017d9d940 [ 496.278325][ T144] RDX: 0000000000000000 RSI: ffffffff8a0b1c60 RDI: ffffffff8a59e580 [ 496.309186][ T144] RBP: ffffc9000173fb70 R08: dffffc0000000000 R09: fffffbfff1ff7c26 [ 496.338812][ T144] R10: fffffbfff1ff7c26 R11: 1ffffffff1ff7c25 R12: ffff88804d7cb590 [ 496.368342][ T144] R13: 1ffff920002e7f5c R14: 000000000000001f R15: ffff8880658dcc90 [ 496.398831][ T144] FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 [ 496.444340][ T144] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 496.462563][ T144] CR2: 00007f6fb2676f98 CR3: 0000000073208000 CR4: 00000000003506e0 [ 496.480019][ T144] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 496.500523][ T144] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 496.521171][ T144] Call Trace: [ 496.532108][ T144] [ 496.540788][ T144] ? trace_rdev_return_void+0x1c0/0x1c0 [ 496.557774][ T144] ? cfg80211_event_work+0x23/0x40 [ 496.573832][ T144] cfg80211_process_wdev_events+0x3ad/0x4f0 [ 496.593168][ T144] cfg80211_process_rdev_events+0x9d/0x110 [ 496.625667][ T144] cfg80211_event_work+0x2b/0x40 [ 496.640838][ T144] process_one_work+0x863/0x1000 [ 496.656269][ T144] ? worker_detach_from_pool+0x240/0x240 [ 496.675955][ T144] ? lockdep_hardirqs_off+0x70/0x100 [ 496.694011][ T144] ? _raw_spin_lock_irq+0xab/0xe0 [ 496.710339][ T144] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 496.727176][ T144] ? wq_worker_running+0x97/0x170 [ 496.744571][ T144] worker_thread+0xaa8/0x12a0 [ 496.760641][ T144] kthread+0x436/0x520 [ 496.773899][ T144] ? rcu_lock_release+0x20/0x20 [ 496.789979][ T144] ? kthread_blkcg+0xd0/0xd0 [ 496.806074][ T144] ret_from_fork+0x1f/0x30 [ 496.820880][ T144] [ 496.833570][ T144] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 496.840876][ T144] CPU: 1 PID: 144 Comm: kworker/u4:1 Not tainted syzkaller #0 [ 496.848338][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 496.858486][ T144] Workqueue: cfg80211 cfg80211_event_work [ 496.864225][ T144] Call Trace: [ 496.867503][ T144] [ 496.870436][ T144] dump_stack_lvl+0x168/0x230 [ 496.875133][ T144] ? show_regs_print_info+0x20/0x20 [ 496.880347][ T144] ? load_image+0x3b0/0x3b0 [ 496.884874][ T144] panic+0x2c9/0x7f0 [ 496.888782][ T144] ? bpf_jit_dump+0xd0/0xd0 [ 496.893300][ T144] ? ret_from_fork+0x1f/0x30 [ 496.897898][ T144] ? __cfg80211_ibss_joined+0x418/0x4a0 [ 496.903449][ T144] __warn+0x248/0x2b0 [ 496.907439][ T144] ? __cfg80211_ibss_joined+0x418/0x4a0 [ 496.912995][ T144] report_bug+0x1b7/0x2e0 [ 496.917336][ T144] handle_bug+0x3a/0x70 [ 496.921500][ T144] exc_invalid_op+0x16/0x40 [ 496.926014][ T144] asm_exc_invalid_op+0x16/0x20 [ 496.930879][ T144] RIP: 0010:__cfg80211_ibss_joined+0x418/0x4a0 [ 496.937089][ T144] Code: 00 00 00 48 3b 84 24 80 00 00 00 75 5c 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 41 70 53 f8 0f 0b eb c3 e8 38 70 53 f8 <0f> 0b 4c 8b 6c 24 20 eb b5 e8 2a 70 53 f8 0f 0b e9 7a fd ff ff e8 [ 496.956706][ T144] RSP: 0018:ffffc9000173faa0 EFLAGS: 00010293 [ 496.962788][ T144] RAX: ffffffff89245bd8 RBX: dffffc0000000000 RCX: ffff888017d9d940 [ 496.970772][ T144] RDX: 0000000000000000 RSI: ffffffff8a0b1c60 RDI: ffffffff8a59e580 [ 496.978754][ T144] RBP: ffffc9000173fb70 R08: dffffc0000000000 R09: fffffbfff1ff7c26 [ 496.986737][ T144] R10: fffffbfff1ff7c26 R11: 1ffffffff1ff7c25 R12: ffff88804d7cb590 [ 496.994723][ T144] R13: 1ffff920002e7f5c R14: 000000000000001f R15: ffff8880658dcc90 [ 497.002712][ T144] ? __cfg80211_ibss_joined+0x418/0x4a0 [ 497.008294][ T144] ? trace_rdev_return_void+0x1c0/0x1c0 [ 497.013857][ T144] ? cfg80211_event_work+0x23/0x40 [ 497.019072][ T144] cfg80211_process_wdev_events+0x3ad/0x4f0 [ 497.025170][ T144] cfg80211_process_rdev_events+0x9d/0x110 [ 497.030990][ T144] cfg80211_event_work+0x2b/0x40 [ 497.036027][ T144] process_one_work+0x863/0x1000 [ 497.040991][ T144] ? worker_detach_from_pool+0x240/0x240 [ 497.046650][ T144] ? lockdep_hardirqs_off+0x70/0x100 [ 497.051953][ T144] ? _raw_spin_lock_irq+0xab/0xe0 [ 497.056986][ T144] ? _raw_spin_lock_irqsave+0xf0/0xf0 [ 497.062371][ T144] ? wq_worker_running+0x97/0x170 [ 497.067409][ T144] worker_thread+0xaa8/0x12a0 [ 497.072128][ T144] kthread+0x436/0x520 [ 497.076208][ T144] ? rcu_lock_release+0x20/0x20 [ 497.081156][ T144] ? kthread_blkcg+0xd0/0xd0 [ 497.085762][ T144] ret_from_fork+0x1f/0x30 [ 497.090205][ T144] [ 497.093440][ T144] Kernel Offset: disabled [ 497.097897][ T144] Rebooting in 86400 seconds..