last executing test programs: 3.109087041s ago: executing program 1 (id=250): socket$kcm(0x2, 0x1000000000000002, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2c, &(0x7f0000000140), 0x4) 2.898415228s ago: executing program 1 (id=253): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33) 2.707197353s ago: executing program 1 (id=257): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33) 2.478926971s ago: executing program 1 (id=261): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x2080, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000b000000cc000000e800000000000000", @ANYRES32, @ANYBLOB="25b7821400000000000000000000000010000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000040000000000000003000000791904000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x28}, 0x94) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={&(0x7f0000000380)="c1b0", 0x0, 0x0, 0x0, 0x1, r2}, 0x38) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r4}, 0x94) r5 = socket$kcm(0x29, 0x0, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000001000000000000", 0x20}], 0x1}, 0x40000) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x25, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000ff0f0000000000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000006d3319011000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000018120000", @ANYRES32=r2, @ANYBLOB="1700000000000019110000", @ANYRESHEX=r0, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000018170000", @ANYRES32=0x1, @ANYBLOB="0000000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x3, &(0x7f00000002c0)=""/3, 0x40f00, 0x8, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x6, 0xbc59, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000400)=[r2], 0x0, 0x10, 0xa1c}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f00000007c0)={0xffffffffffffffff, r7}) 2.205508343s ago: executing program 1 (id=265): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x13, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000dc090000438e6b9851594fde3929e696b4d1f4"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b, 0x0, 0x0, 0x10, 0x1}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180008008000000000000040000500000029000000850000007d0000009500"/40], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0xe, 0x0, &(0x7f0000000040)="f4b84de4115d64244a0e839e9900", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000200)=""/166}, 0x20) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x81, 0x84a46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext={0x2, 0x3ada}, 0x90c3, 0x5, 0x1000, 0x0, 0x0, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d2f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) syz_clone(0x20000, 0x0, 0x0, 0x0, 0x0, 0x0) 1.910281427s ago: executing program 0 (id=269): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000000000000000000000000000dea10000410000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000400)={r0, 0x58, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb010018000000000000009400000094000000050001005b0400000000000000030000000002000000040000000200000001000000080000130d0000000300000008000000030000000400000080000000643300000b0000005800000001b8a40006000000000000000300000009000000090000000d0000000100000032c50000050000000400000006000000080000000e0000001300000007000000002e002e00"/177], &(0x7f0000000440)=""/46, 0xb1, 0x2e, 0x1, 0x6}, 0x28) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000740)={0xffffffffffffffff, 0xf0000000}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@ldst={0x3, 0x0, 0x0, 0x2, 0x6, 0x10, 0x1}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='syzkaller\x00', 0x7fff, 0xb6, &(0x7f0000000540)=""/182, 0x40f00, 0x10, '\x00', r2, 0x25, r3, 0x8, &(0x7f00000006c0)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000700)={0x3, 0x4, 0x101, 0x7}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000780)=[r4], &(0x7f00000007c0)=[{0x0, 0x2, 0x3, 0xb}], 0x10, 0x2}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7000000}, [@map_val={0x18, 0x0, 0x2, 0x0, r5}, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0xa0}]}, &(0x7f0000000180)='syzkaller\x00', 0x3, 0x122, &(0x7f00000002c0)=""/210, 0x41100, 0x24}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="18000000080000000000000000000000850000002a000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000010000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0xfffc, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r6, &(0x7f0000000a00)=ANY=[@ANYRES8=r1, @ANYBLOB="3ecaa945231408b2bcde11dca6e3d277dd0b509cca6f288b8bac8b8399346c942ee413a4aa7bd25d2f536302303cdfa4a574ca87a4248afad81d0ccca0a43c89aa15f560574c5a4057c91f632eb4e085678a61d000026e5533bb25c35bc11301fb9e51b4c64db0c06f28c8610c52fc0c343324f02c9488c8e023f05c1d21c95431b00064df9fca8b5ed077d3a5fe1326a4ecc71beb306751de3ed6ea1b91357116c009a6efced4707071b509c780913bc02c3b3490816ead41f010182a02335ca93068fa5c5f2cab77e63a6d98a876e224b167b2e1a3decff686243e60a88d40c67f183c9f9438c1", @ANYRES8], 0x9a) 1.74817321s ago: executing program 3 (id=271): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33) 1.636800669s ago: executing program 0 (id=272): socket$kcm(0x2, 0x1000000000000002, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x2c, 0x0, 0x0) 1.545218356s ago: executing program 2 (id=273): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33) 1.468789542s ago: executing program 3 (id=274): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x2080, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000b000000cc000000e800000000000000", @ANYRES32, @ANYBLOB="25b7821400000000000000000000000010000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000040000000000000003000000791904000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x28}, 0x94) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={&(0x7f0000000380)="c1b0", 0x0, 0x0, 0x0, 0x1, r2}, 0x38) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r4}, 0x94) r5 = socket$kcm(0x29, 0x0, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000001000000000000", 0x20}], 0x1}, 0x40000) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x25, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000ff0f0000000000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000006d3319011000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000018120000", @ANYRES32=r2, @ANYBLOB="1700000000000019110000", @ANYRESHEX=r0, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000018170000", @ANYRES32=0x1, @ANYBLOB="0000000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x3, &(0x7f00000002c0)=""/3, 0x40f00, 0x8, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x6, 0xbc59, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000400)=[r2], 0x0, 0x10, 0xa1c}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f00000007c0)={0xffffffffffffffff, r7}) 1.25376486s ago: executing program 3 (id=275): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = socket$kcm(0x11, 0x2, 0x0) sendmsg$sock(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@tipc=@name={0x1e, 0x2, 0x1, {{0x41, 0x2}, 0x3}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x4}}], 0x18}, 0x0) r2 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000240)={'b', ' *:* ', 'rwm\x00'}, 0xa) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5, 0x1000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xa783}, 0x94) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x6a) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r5}, 0x10) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d000c6c7ea60864160af365040041000a001d002b7f6f4c9ee517d34460bc060000f0a705651e6182949a3651f60a84f709d182c5bb5b64f69853362a65a113827e4b4237268a9a", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r6, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df33c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.25297416s ago: executing program 0 (id=283): socket$kcm(0x2, 0x1000000000000002, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x2c, 0x0, 0x0) 1.252340969s ago: executing program 2 (id=276): perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1080a2, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000ac0)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x4, [@decl_tag={0x8, 0x0, 0x0, 0x11, 0x4, 0x2}, @fwd={0xb}]}, {0x0, [0x5f, 0x0]}}, &(0x7f0000004600)=""/98, 0x38, 0x62, 0x1, 0xffff}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001b80)={r1, 0x20, &(0x7f0000001b40)={&(0x7f0000000b00)=""/4096, 0x1000, 0x0, &(0x7f0000001b00)=""/34, 0x22}}, 0x10) setsockopt$sock_attach_bpf(r0, 0x29, 0x41, 0x0, 0x8f00) r2 = socket$kcm(0x10, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000004c0)}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000800000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0x3) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000900)={r3, r4}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000800)={0xffffffffffffffff, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x5, &(0x7f0000000a00)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xba, &(0x7f0000000600)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000180), &(0x7f0000000680), 0x8, 0x4f, 0x8, 0x8, &(0x7f00000009c0)}}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r5}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r6, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc}}) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0xfdef) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r7 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000080)="140000002b000b6c690000000000000000", 0x11}], 0x1}, 0x480c0) r8 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000580)="6700000011008188040f56ecdb4cb9cca7480ef434000000e3bd6efb440009000e000a0010000000ba80010000005a8c3774fa0af3dc59a933c1e7a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f09cdc2649f", 0x67}], 0x1}, 0x0) 1.030136478s ago: executing program 0 (id=277): socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000027b000000950098e868c86e23"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x6, 0x804, 0x0, 0x7}, {0x10400002, 0x2, 0x0, 0x5}], 0x10, 0xfffffffd}, 0x94) r0 = socket$kcm(0x2, 0x5, 0x84) close(r0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x2, 0x4e21, @loopback}, 0x10, 0x0}, 0x4) r1 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r2) setsockopt$sock_attach_bpf(r1, 0x84, 0x64, &(0x7f0000000000), 0x10) sendmsg$inet(r0, &(0x7f0000000140)={&(0x7f0000000100)={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10, &(0x7f0000000500)=[{&(0x7f0000000440)="9c", 0x1}], 0x1}, 0x20004050) 1.022737948s ago: executing program 3 (id=278): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000001600000018110000", @ANYRES32=r0, @ANYRES16=r0, @ANYRES8, @ANYRESOCT=r0, @ANYRES64=r0], 0x0, 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32], 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000001ac0)={r1, 0x0, 0x0}, 0x10) 888.643309ms ago: executing program 2 (id=279): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, 0x0, 0x4}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004081) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000800)={r1, &(0x7f0000000780)}, 0x20) 768.514708ms ago: executing program 0 (id=280): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000000000000000000000000000dea10000410000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000400)={r0, 0x58, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb010018000000000000009400000094000000050001005b0400000000000000030000000002000000040000000200000001000000080000130d0000000300000008000000030000000400000080000000643300000b0000005800000001b8a40006000000000000000300000009000000090000000d0000000100000032c50000050000000400000006000000080000000e0000001300000007000000002e002e00"/177], &(0x7f0000000440)=""/46, 0xb1, 0x2e, 0x1, 0x6}, 0x28) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000740)={0xffffffffffffffff, 0xf0000000}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@ldst={0x3, 0x0, 0x0, 0x2, 0x6, 0x10, 0x1}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='syzkaller\x00', 0x7fff, 0xb6, &(0x7f0000000540)=""/182, 0x40f00, 0x10, '\x00', r2, 0x25, r3, 0x8, &(0x7f00000006c0)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000700)={0x3, 0x4, 0x101, 0x7}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000780)=[r4], &(0x7f00000007c0)=[{0x0, 0x2, 0x3, 0xb}], 0x10, 0x2}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7000000}, [@map_val={0x18, 0x0, 0x2, 0x0, r5}, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0xa0}]}, &(0x7f0000000180)='syzkaller\x00', 0x3, 0x122, &(0x7f00000002c0)=""/210, 0x41100, 0x24}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="18000000080000000000000000000000850000002a000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000010000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r6, &(0x7f0000000a00)=ANY=[@ANYRES8=r1, @ANYBLOB="3ecaa945231408b2bcde11dca6e3d277dd0b509cca6f288b8bac8b8399346c942ee413a4aa7bd25d2f536302303cdfa4a574ca87a4248afad81d0ccca0a43c89aa15f560574c5a4057c91f632eb4e085678a61d000026e5533bb25c35bc11301fb9e51b4c64db0c06f28c8610c52fc0c343324f02c9488c8e023f05c1d21c95431b00064df9fca8b5ed077d3a5fe1326a4ecc71beb306751de3ed6ea1b91357116c009a6efced4707071b509c780913bc02c3b3490816ead41f010182a02335ca93068fa5c5f2cab77e63a6d98a876e224b167b2e1a3decff686243e60a88d40c67f183c9f9438c1", @ANYRES8], 0x9a) 702.438334ms ago: executing program 3 (id=281): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r0, 0x0, 0x0, 0x4}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000800)={r1, &(0x7f0000000780)}, 0x20) 617.20725ms ago: executing program 2 (id=282): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)="5c00000014006b030231a6080c000af32c00000000f800250502000f00e5aa000017d34460bc24eab556bd05251e6182949a2756f475ce36c2d13b48df000000000000ecb8f6ec63c9f4d4938037e786a6d1bdd700e6657594f1817d", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) 502.66019ms ago: executing program 3 (id=284): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x2080, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000b000000cc000000e800000000000000", @ANYRES32, @ANYBLOB="25b7821400000000000000000000000010000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000040000000000000003000000791904000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x28}, 0x94) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={&(0x7f0000000380)="c1b0", 0x0, 0x0, 0x0, 0x1, r2}, 0x38) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r4}, 0x94) r5 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000001000000000000", 0x20}], 0x1}, 0x40000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x25, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000ff0f0000000000000400000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000006d3319011000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000018120000", @ANYRES32=r2, @ANYBLOB="1700000000000019110000", @ANYRESHEX=r0, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000600000018170000", @ANYRES32=0x1, @ANYBLOB="0000000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x3, &(0x7f00000002c0)=""/3, 0x40f00, 0x8, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x6, 0xbc59, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000400)=[r2], 0x0, 0x10, 0xa1c}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f00000007c0)={r6, r7}) 431.077705ms ago: executing program 0 (id=285): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000280)="39000000140081ae0000dc676f97daf01effffff0521018701546fabca1b4e8a06a6580e88370200c5090000009c40ebb3734b49bbc51245e7", 0x39}], 0x1}, 0x0) recvmsg$kcm(r5, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x40010220) recvmsg(r2, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) 430.177935ms ago: executing program 2 (id=286): socket$kcm(0x2, 0x1000000000000002, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x2c, 0x0, 0x0) 388.609139ms ago: executing program 1 (id=287): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000280)="39000000140081ae0000dc676f97daf01effffff0521018701546fabca1b4e8a06a6580e88370200c5090000009c40ebb3734b49bbc51245e7", 0x39}], 0x1}, 0x0) recvmsg$kcm(r5, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x40010220) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33) 0s ago: executing program 2 (id=288): perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1080a2, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000ac0)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x4, [@decl_tag={0x8, 0x0, 0x0, 0x11, 0x4, 0x2}, @fwd={0xb}]}, {0x0, [0x5f, 0x0]}}, &(0x7f0000004600)=""/98, 0x38, 0x62, 0x1, 0xffff}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001b80)={r1, 0x20, &(0x7f0000001b40)={&(0x7f0000000b00)=""/4096, 0x1000, 0x0, &(0x7f0000001b00)=""/34, 0x22}}, 0x10) setsockopt$sock_attach_bpf(r0, 0x29, 0x41, 0x0, 0x8f00) r2 = socket$kcm(0x10, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000004c0)}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000800000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80020}, 0x3) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000900)={r3, r4}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000800)={0xffffffffffffffff, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x5, &(0x7f0000000a00)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xba, &(0x7f0000000600)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000180), &(0x7f0000000680), 0x8, 0x4f, 0x8, 0x8, &(0x7f00000009c0)}}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r5}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r6, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc}}) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0xfdef) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r7 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000080)="140000002b000b6c690000000000000000", 0x11}], 0x1}, 0x480c0) r8 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000580)="6700000011008188040f56ecdb4cb9cca7480ef434000000e3bd6efb440009000e000a0010000000ba80010000005a8c3774fa0af3dc59a933c1e7a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f09cdc2649f", 0x67}], 0x1}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.173' (ED25519) to the list of known hosts. syzkaller login: [ 77.331847][ T5781] cgroup: Unknown subsys name 'net' [ 77.470034][ T5781] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.188411][ T5781] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 81.186758][ T5794] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 81.211718][ T5794] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 81.219932][ T5794] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 81.229881][ T5794] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.241544][ T50] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 81.252971][ T5797] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.261170][ T5797] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 81.281585][ T5802] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 81.318651][ T5799] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 81.327324][ T5799] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 81.333096][ T5106] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 81.336607][ T5799] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 81.350333][ T5799] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.350669][ T5106] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.358803][ T5799] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.372625][ T5799] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 81.380026][ T5799] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.380132][ T5805] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.395961][ T5799] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.396111][ T5805] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.403884][ T5799] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 81.417966][ T5799] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 81.417967][ T5805] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.432572][ T5799] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.831138][ T5795] chnl_net:caif_netlink_parms(): no params data found [ 82.008516][ T5791] chnl_net:caif_netlink_parms(): no params data found [ 82.150853][ T5795] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.158155][ T5795] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.166669][ T5795] bridge_slave_0: entered allmulticast mode [ 82.174464][ T5795] bridge_slave_0: entered promiscuous mode [ 82.199761][ T5795] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.207063][ T5795] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.214561][ T5795] bridge_slave_1: entered allmulticast mode [ 82.221995][ T5795] bridge_slave_1: entered promiscuous mode [ 82.244692][ T5801] chnl_net:caif_netlink_parms(): no params data found [ 82.266322][ T5796] chnl_net:caif_netlink_parms(): no params data found [ 82.317961][ T5795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.331601][ T5795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.394441][ T5791] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.403644][ T5791] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.411077][ T5791] bridge_slave_0: entered allmulticast mode [ 82.418686][ T5791] bridge_slave_0: entered promiscuous mode [ 82.457465][ T5791] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.464888][ T5791] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.472245][ T5791] bridge_slave_1: entered allmulticast mode [ 82.479249][ T5791] bridge_slave_1: entered promiscuous mode [ 82.499613][ T5795] team0: Port device team_slave_0 added [ 82.509194][ T5795] team0: Port device team_slave_1 added [ 82.607046][ T5801] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.614335][ T5801] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.623562][ T5801] bridge_slave_0: entered allmulticast mode [ 82.630602][ T5801] bridge_slave_0: entered promiscuous mode [ 82.640925][ T5791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.653321][ T5791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.675292][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.682759][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.708761][ T5795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.720950][ T5801] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.728371][ T5801] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.735725][ T5801] bridge_slave_1: entered allmulticast mode [ 82.743645][ T5801] bridge_slave_1: entered promiscuous mode [ 82.762753][ T5796] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.769914][ T5796] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.777445][ T5796] bridge_slave_0: entered allmulticast mode [ 82.784756][ T5796] bridge_slave_0: entered promiscuous mode [ 82.793524][ T5796] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.800751][ T5796] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.808328][ T5796] bridge_slave_1: entered allmulticast mode [ 82.815725][ T5796] bridge_slave_1: entered promiscuous mode [ 82.823221][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.830230][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.856784][ T5795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.904650][ T5791] team0: Port device team_slave_0 added [ 82.959539][ T5791] team0: Port device team_slave_1 added [ 82.968326][ T5796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.983176][ T5796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.008033][ T5801] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.072632][ T5801] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.083511][ T5791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.090499][ T5791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.117696][ T5791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.145845][ T5795] hsr_slave_0: entered promiscuous mode [ 83.152907][ T5795] hsr_slave_1: entered promiscuous mode [ 83.172661][ T5791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.179652][ T5791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.205919][ T5791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.220278][ T5796] team0: Port device team_slave_0 added [ 83.229786][ T5796] team0: Port device team_slave_1 added [ 83.257219][ T5801] team0: Port device team_slave_0 added [ 83.290736][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.297793][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.323823][ T5796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.337936][ T5801] team0: Port device team_slave_1 added [ 83.364471][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.371672][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.397784][ T5796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.422173][ T5799] Bluetooth: hci2: command tx timeout [ 83.426300][ T5794] Bluetooth: hci0: command tx timeout [ 83.499359][ T5791] hsr_slave_0: entered promiscuous mode [ 83.506024][ T5791] hsr_slave_1: entered promiscuous mode [ 83.511859][ T5794] Bluetooth: hci3: command tx timeout [ 83.512102][ T5794] Bluetooth: hci1: command tx timeout [ 83.524059][ T5791] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.533561][ T5791] Cannot create hsr debugfs directory [ 83.553977][ T5801] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.560954][ T5801] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.586989][ T5801] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.601154][ T5801] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.608224][ T5801] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.634370][ T5801] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.711134][ T5796] hsr_slave_0: entered promiscuous mode [ 83.717972][ T5796] hsr_slave_1: entered promiscuous mode [ 83.725159][ T5796] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.732898][ T5796] Cannot create hsr debugfs directory [ 83.860510][ T5801] hsr_slave_0: entered promiscuous mode [ 83.867621][ T5801] hsr_slave_1: entered promiscuous mode [ 83.873962][ T5801] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.883093][ T5801] Cannot create hsr debugfs directory [ 84.190217][ T5795] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.208697][ T5795] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.219528][ T5795] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.232771][ T5795] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.306630][ T5791] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.317616][ T5791] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.340591][ T5791] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.353097][ T5791] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.455190][ T5796] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.469100][ T5796] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.480830][ T5796] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.516932][ T5796] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.589049][ T5801] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 84.615553][ T5795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.627821][ T5801] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 84.639688][ T5801] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 84.664628][ T5801] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 84.688872][ T5795] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.747389][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.754787][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.779835][ T5791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.815951][ T141] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.823137][ T141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.857185][ T5791] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.896936][ T1122] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.904165][ T1122] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.955364][ T1086] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.962683][ T1086] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.015244][ T5796] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.115810][ T5796] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.153155][ T5801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.166512][ T1122] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.173738][ T1122] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.264510][ T5801] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.286683][ T2984] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.293879][ T2984] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.356969][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.364205][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.430637][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.437901][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.503494][ T5799] Bluetooth: hci0: command tx timeout [ 85.511611][ T5799] Bluetooth: hci2: command tx timeout [ 85.566838][ T5795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.581811][ T5799] Bluetooth: hci1: command tx timeout [ 85.587471][ T5799] Bluetooth: hci3: command tx timeout [ 85.615358][ T5791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.698409][ T5795] veth0_vlan: entered promiscuous mode [ 85.746561][ T5795] veth1_vlan: entered promiscuous mode [ 85.824642][ T5791] veth0_vlan: entered promiscuous mode [ 85.850203][ T5791] veth1_vlan: entered promiscuous mode [ 85.965336][ T5795] veth0_macvtap: entered promiscuous mode [ 85.978556][ T5795] veth1_macvtap: entered promiscuous mode [ 86.011923][ T5796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.039289][ T5791] veth0_macvtap: entered promiscuous mode [ 86.051006][ T5791] veth1_macvtap: entered promiscuous mode [ 86.064548][ T5801] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.086231][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.104333][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.132636][ T5795] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.147113][ T5795] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.156523][ T5795] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.166209][ T5795] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.188652][ T5791] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.201050][ T5791] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.214908][ T5791] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.275052][ T5791] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.286654][ T5791] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.300843][ T5791] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.343965][ T5791] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.359398][ T5791] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.368476][ T5791] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.377537][ T5791] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.424984][ T5796] veth0_vlan: entered promiscuous mode [ 86.437149][ T5801] veth0_vlan: entered promiscuous mode [ 86.480803][ T5801] veth1_vlan: entered promiscuous mode [ 86.492732][ T2984] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.495504][ T5796] veth1_vlan: entered promiscuous mode [ 86.500796][ T2984] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.585356][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.626401][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.637343][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.660843][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.701835][ T5796] veth0_macvtap: entered promiscuous mode [ 86.724739][ T5801] veth0_macvtap: entered promiscuous mode [ 86.745553][ T5796] veth1_macvtap: entered promiscuous mode [ 86.774522][ T5801] veth1_macvtap: entered promiscuous mode [ 86.817961][ T141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.837040][ T141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.887584][ C0] hrtimer: interrupt took 75736 ns [ 86.895038][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.909595][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.927960][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.940140][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.964644][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.985849][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.012607][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.047476][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.078709][ T5883] syz.2.3 uses obsolete (PF_INET,SOCK_PACKET) [ 87.102214][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.113954][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.128557][ T5801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.149533][ T5801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.160675][ T5801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.173500][ T5801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.191353][ T5801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.203417][ T5801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.225619][ T5801] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.328338][ T5796] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.338514][ T5796] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.349910][ T5796] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.364458][ T5796] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.391020][ T5801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.402964][ T5801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.414267][ T5801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.428152][ T5801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.438448][ T5801] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.449857][ T5801] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.463695][ T5801] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.546003][ T5801] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.574298][ T5801] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.581973][ T5799] Bluetooth: hci2: command tx timeout [ 87.585025][ T5794] Bluetooth: hci0: command tx timeout [ 87.619154][ T5801] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.641350][ T5801] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.661687][ T5794] Bluetooth: hci3: command tx timeout [ 87.661997][ T5799] Bluetooth: hci1: command tx timeout [ 88.018075][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.041600][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.095336][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.109219][ T5895] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 88.113043][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.183995][ T5897] netlink: 'syz.1.7': attribute type 29 has an invalid length. [ 88.214108][ T5897] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7'. [ 88.263322][ T5895] netlink: 'syz.2.6': attribute type 10 has an invalid length. [ 88.276008][ T5899] Driver unsupported XDP return value 0 on prog (id 5) dev N/A, expect packet loss! [ 88.283429][ T5895] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6'. [ 88.315414][ T5895] bond0: entered promiscuous mode [ 88.327027][ T5895] bond_slave_0: entered promiscuous mode [ 88.340993][ T5895] bond_slave_1: entered promiscuous mode [ 88.366400][ T5895] bridge0: port 3(bond0) entered blocking state [ 88.383797][ T5895] bridge0: port 3(bond0) entered disabled state [ 88.405792][ T5895] bond0: entered allmulticast mode [ 88.414884][ T5895] bond_slave_0: entered allmulticast mode [ 88.421042][ T5895] bond_slave_1: entered allmulticast mode [ 88.442640][ T5895] bridge0: port 3(bond0) entered blocking state [ 88.449671][ T5895] bridge0: port 3(bond0) entered forwarding state [ 88.468080][ T5897] netlink: 'syz.1.7': attribute type 29 has an invalid length. [ 88.480653][ T5897] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7'. [ 88.494082][ T5900] netlink: 830 bytes leftover after parsing attributes in process `syz.2.6'. [ 88.524801][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.571953][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.590784][ T141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.614958][ T141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.001368][ C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 89.421605][ T5916] netlink: 'syz.2.9': attribute type 1 has an invalid length. [ 89.460429][ T5916] netlink: 'syz.2.9': attribute type 4 has an invalid length. [ 89.489117][ T5916] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.9'. [ 89.663923][ T5799] Bluetooth: hci0: command tx timeout [ 89.663953][ T5794] Bluetooth: hci2: command tx timeout [ 89.742120][ T5794] Bluetooth: hci1: command tx timeout [ 89.743526][ T5799] Bluetooth: hci3: command tx timeout [ 90.523079][ T5928] Zero length message leads to an empty skb [ 90.633535][ T5930] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13'. [ 92.243403][ T9] cfg80211: failed to load regulatory.db [ 93.858351][ T5925] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.11'. [ 93.901516][ T5930] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13'. [ 93.941425][ T5931] warning: `syz.3.13' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 94.648679][ T5937] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.681294][ T5937] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.729779][ T5937] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.761051][ T5937] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 97.005538][ T5959] netlink: 'syz.1.21': attribute type 10 has an invalid length. [ 97.034509][ T5959] netlink: 55 bytes leftover after parsing attributes in process `syz.1.21'. [ 97.193751][ T5953] tap0: tun_chr_ioctl cmd 1074025677 [ 97.200366][ T5953] tap0: linktype set to 768 [ 97.498136][ T5964] netlink: 'syz.0.22': attribute type 21 has an invalid length. [ 97.521680][ T5964] netlink: 'syz.0.22': attribute type 20 has an invalid length. [ 97.902847][ T5967] netlink: 'syz.2.23': attribute type 1 has an invalid length. [ 98.404644][ T5970] bridge_slave_1: left allmulticast mode [ 98.410438][ T5970] bridge_slave_1: left promiscuous mode [ 98.450674][ T5970] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.574864][ T5970] bridge_slave_0: left allmulticast mode [ 98.580755][ T5970] bridge_slave_0: left promiscuous mode [ 98.635889][ T5970] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.736207][ T5976] netlink: 'syz.2.26': attribute type 10 has an invalid length. [ 100.109293][ T5976] team0: Port device macvlan0 added [ 100.452406][ T5976] syz.2.26 (5976) used greatest stack depth: 19176 bytes left [ 101.661538][ T5794] Bluetooth: hci3: command 0x206a tx timeout [ 101.662286][ T5799] Bluetooth: hci3: Opcode 0x206a failed: -110 [ 114.395242][ T6016] netlink: 'syz.2.40': attribute type 10 has an invalid length. [ 115.512208][ T6027] netlink: 'syz.2.43': attribute type 21 has an invalid length. [ 115.520343][ T6027] netlink: 'syz.2.43': attribute type 1 has an invalid length. [ 115.542421][ T6027] netlink: 100 bytes leftover after parsing attributes in process `syz.2.43'. [ 115.727684][ T6032] FAULT_INJECTION: forcing a failure. [ 115.727684][ T6032] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 115.759284][ T6036] FAULT_INJECTION: forcing a failure. [ 115.759284][ T6036] name failslab, interval 1, probability 0, space 0, times 1 [ 115.776846][ T6032] CPU: 1 PID: 6032 Comm: syz.2.46 Not tainted 6.6.101-syzkaller #0 [ 115.784809][ T6032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 115.794897][ T6032] Call Trace: [ 115.798192][ T6032] [ 115.801181][ T6032] dump_stack_lvl+0x16c/0x230 [ 115.805891][ T6032] ? show_regs_print_info+0x20/0x20 [ 115.811108][ T6032] ? load_image+0x3b0/0x3b0 [ 115.815635][ T6032] ? __might_fault+0xaa/0x120 [ 115.820326][ T6032] ? __lock_acquire+0x7c80/0x7c80 [ 115.825368][ T6032] should_fail_ex+0x39d/0x4d0 [ 115.830071][ T6032] _copy_from_user+0x2f/0xe0 [ 115.834684][ T6032] __sys_bpf+0x1e9/0x800 [ 115.838957][ T6032] ? bpf_link_show_fdinfo+0x350/0x350 [ 115.844709][ T6032] ? lock_chain_count+0x20/0x20 [ 115.849587][ T6032] __x64_sys_bpf+0x7c/0x90 [ 115.854019][ T6032] do_syscall_64+0x55/0xb0 [ 115.858454][ T6032] ? clear_bhb_loop+0x40/0x90 [ 115.863143][ T6032] ? clear_bhb_loop+0x40/0x90 [ 115.867829][ T6032] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 115.873745][ T6032] RIP: 0033:0x7febadb8ebe9 [ 115.878183][ T6032] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 115.897805][ T6032] RSP: 002b:00007febae928038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 115.906231][ T6032] RAX: ffffffffffffffda RBX: 00007febaddb5fa0 RCX: 00007febadb8ebe9 [ 115.914220][ T6032] RDX: 0000000000000050 RSI: 0000200000001b40 RDI: 000000000000000a [ 115.922204][ T6032] RBP: 00007febae928090 R08: 0000000000000000 R09: 0000000000000000 [ 115.930187][ T6032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 115.938190][ T6032] R13: 00007febaddb6038 R14: 00007febaddb5fa0 R15: 00007ffe93685078 [ 115.946205][ T6032] [ 115.952320][ T6036] CPU: 1 PID: 6036 Comm: syz.1.48 Not tainted 6.6.101-syzkaller #0 [ 115.960272][ T6036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 115.970363][ T6036] Call Trace: [ 115.973666][ T6036] [ 115.976622][ T6036] dump_stack_lvl+0x16c/0x230 [ 115.981345][ T6036] ? show_regs_print_info+0x20/0x20 [ 115.986582][ T6036] ? load_image+0x3b0/0x3b0 [ 115.991130][ T6036] ? __might_sleep+0xe0/0xe0 [ 115.995766][ T6036] ? __lock_acquire+0x7c80/0x7c80 [ 116.000925][ T6036] should_fail_ex+0x39d/0x4d0 [ 116.005661][ T6036] should_failslab+0x9/0x20 [ 116.010278][ T6036] slab_pre_alloc_hook+0x59/0x310 [ 116.015383][ T6036] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 116.021167][ T6036] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 116.026943][ T6036] __kmem_cache_alloc_node+0x53/0x260 [ 116.032375][ T6036] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 116.038145][ T6036] __kmalloc+0xa4/0x240 [ 116.042370][ T6036] tomoyo_realpath_from_path+0xe3/0x5d0 [ 116.047992][ T6036] tomoyo_path_number_perm+0x1ea/0x590 [ 116.053529][ T6036] ? tomoyo_path_number_perm+0x1ba/0x590 [ 116.059232][ T6036] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 116.064751][ T6036] ? ksys_write+0x1c1/0x250 [ 116.069352][ T6036] ? __fget_files+0x28/0x4d0 [ 116.074011][ T6036] security_file_ioctl+0x70/0xa0 [ 116.079014][ T6036] __se_sys_ioctl+0x48/0x170 [ 116.083669][ T6036] do_syscall_64+0x55/0xb0 [ 116.088137][ T6036] ? clear_bhb_loop+0x40/0x90 [ 116.093201][ T6036] ? clear_bhb_loop+0x40/0x90 [ 116.097929][ T6036] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 116.104067][ T6036] RIP: 0033:0x7f8b77d8ebe9 [ 116.108529][ T6036] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 116.128703][ T6036] RSP: 002b:00007f8b78c85038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 116.137197][ T6036] RAX: ffffffffffffffda RBX: 00007f8b77fb5fa0 RCX: 00007f8b77d8ebe9 [ 116.145223][ T6036] RDX: 0000200000000080 RSI: 0000000000008922 RDI: 0000000000000006 [ 116.153333][ T6036] RBP: 00007f8b78c85090 R08: 0000000000000000 R09: 0000000000000000 [ 116.161438][ T6036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 116.169549][ T6036] R13: 00007f8b77fb6038 R14: 00007f8b77fb5fa0 R15: 00007ffdfadff448 [ 116.178583][ T6036] [ 116.245738][ T6036] ERROR: Out of memory at tomoyo_realpath_from_path. [ 116.270762][ T6038] netlink: 'syz.3.45': attribute type 21 has an invalid length. [ 116.304646][ T6038] netlink: 156 bytes leftover after parsing attributes in process `syz.3.45'. [ 116.529827][ T6048] bridge_slave_0: entered promiscuous mode [ 116.545095][ T6048] bridge_slave_0: entered allmulticast mode [ 123.344082][ T6104] netlink: 40 bytes leftover after parsing attributes in process `syz.2.74'. [ 123.361569][ T6104] netlink: 40 bytes leftover after parsing attributes in process `syz.2.74'. [ 123.376873][ T6104] netlink: 40 bytes leftover after parsing attributes in process `syz.2.74'. [ 123.412042][ T6104] netlink: 40 bytes leftover after parsing attributes in process `syz.2.74'. [ 126.540071][ T6156] veth0_vlan: entered allmulticast mode [ 126.883208][ T6164] bond0: left allmulticast mode [ 126.888310][ T6164] bond_slave_0: left allmulticast mode [ 126.896609][ T6164] bond_slave_1: left allmulticast mode [ 126.903505][ T6164] bridge0: port 3(bond0) entered disabled state [ 126.923617][ T6164] bridge_slave_1: left allmulticast mode [ 126.935659][ T6164] bridge_slave_1: left promiscuous mode [ 126.942303][ T6164] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.959081][ T6164] bridge_slave_0: left allmulticast mode [ 126.977065][ T6164] bridge_slave_0: left promiscuous mode [ 127.002458][ T6164] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.211508][ T6172] netlink: 'syz.0.101': attribute type 1 has an invalid length. [ 127.579157][ T6180] netlink: 'syz.2.102': attribute type 21 has an invalid length. [ 127.601643][ T6180] netlink: 'syz.2.102': attribute type 20 has an invalid length. [ 129.292089][ T6187] netlink: 'syz.0.116': attribute type 10 has an invalid length. [ 129.332009][ T6187] team0: Port device macvlan0 added [ 129.829031][ T6207] bridge_slave_1: left allmulticast mode [ 129.834966][ T6207] bridge_slave_1: left promiscuous mode [ 129.841024][ T6207] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.892900][ T6207] bridge_slave_0: left allmulticast mode [ 129.898644][ T6207] bridge_slave_0: left promiscuous mode [ 129.928127][ T6207] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.343147][ T6247] bridge_slave_1: left allmulticast mode [ 132.384803][ T6247] bridge_slave_1: left promiscuous mode [ 132.436214][ T6247] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.543046][ T6247] bridge_slave_0: left allmulticast mode [ 132.548800][ T6247] bridge_slave_0: left promiscuous mode [ 132.678666][ T6247] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.021589][ T5799] Bluetooth: hci0: command 0x206a tx timeout [ 133.028511][ T5794] Bluetooth: hci0: Opcode 0x206a failed: -110 [ 133.172292][ T6233] netlink: 'syz.3.123': attribute type 10 has an invalid length. [ 133.186970][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.204192][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.322977][ T6233] team0: Port device macvlan0 added [ 133.592728][ T6254] netlink: 'syz.0.130': attribute type 10 has an invalid length. [ 133.600549][ T6254] netlink: 55 bytes leftover after parsing attributes in process `syz.0.130'. [ 134.332142][ T6267] tap0: tun_chr_ioctl cmd 1074025677 [ 134.337758][ T6267] tap0: linktype set to 768 [ 136.486965][ T6300] netlink: 'syz.2.147': attribute type 10 has an invalid length. [ 136.621504][ T6300] netlink: 55 bytes leftover after parsing attributes in process `syz.2.147'. [ 136.782061][ T5799] Bluetooth: hci2: Opcode 0x206a failed: -110 [ 136.788497][ T5799] Bluetooth: hci2: command 0x206a tx timeout [ 137.590065][ T6295] netlink: 'syz.1.144': attribute type 10 has an invalid length. [ 137.629192][ T6295] team0: Port device macvlan0 added [ 138.294630][ T6333] tap0: tun_chr_ioctl cmd 1074025677 [ 138.300197][ T6333] tap0: linktype set to 768 [ 139.261908][ T5794] Bluetooth: hci1: command 0x206a tx timeout [ 139.269032][ T5799] Bluetooth: hci1: Opcode 0x206a failed: -110 [ 139.672850][ T6347] netlink: 'syz.0.159': attribute type 10 has an invalid length. [ 139.682931][ T6347] netlink: 55 bytes leftover after parsing attributes in process `syz.0.159'. [ 140.726851][ T6364] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 140.752802][ T6364] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 140.784222][ T6364] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 140.805517][ T6364] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 141.345476][ T6377] netlink: 'syz.3.172': attribute type 10 has an invalid length. [ 141.369269][ T6377] netlink: 55 bytes leftover after parsing attributes in process `syz.3.172'. [ 141.529784][ T6384] netlink: 60 bytes leftover after parsing attributes in process `syz.0.173'. [ 141.579501][ T6384] netlink: 60 bytes leftover after parsing attributes in process `syz.0.173'. [ 141.639584][ T6381] netlink: 60 bytes leftover after parsing attributes in process `syz.0.173'. [ 143.525165][ T6411] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 143.536406][ T6411] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 143.579465][ T6411] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 143.651624][ T6411] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 143.881651][ T6424] netlink: 'syz.1.190': attribute type 10 has an invalid length. [ 143.889452][ T6424] netlink: 55 bytes leftover after parsing attributes in process `syz.1.190'. [ 144.131659][ T6434] netlink: 60 bytes leftover after parsing attributes in process `syz.1.193'. [ 144.140647][ T6434] netlink: 60 bytes leftover after parsing attributes in process `syz.1.193'. [ 144.199704][ T6429] netlink: 60 bytes leftover after parsing attributes in process `syz.1.193'. [ 144.742794][ T6452] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.200'. [ 144.757166][ T6446] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.200'. [ 144.791536][ T6453] netlink: 'syz.0.202': attribute type 10 has an invalid length. [ 144.799545][ T6453] netlink: 55 bytes leftover after parsing attributes in process `syz.0.202'. [ 146.802563][ T6472] netlink: 'syz.0.209': attribute type 1 has an invalid length. [ 146.810361][ T6472] netlink: 'syz.0.209': attribute type 4 has an invalid length. [ 146.818820][ T6472] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.209'. [ 147.035779][ T6482] netlink: 'syz.0.214': attribute type 10 has an invalid length. [ 147.051316][ T6482] netlink: 55 bytes leftover after parsing attributes in process `syz.0.214'. [ 147.203841][ T6491] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.216'. [ 147.232042][ T6489] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.216'. [ 148.064443][ T6508] netlink: 'syz.3.224': attribute type 1 has an invalid length. [ 148.085291][ T6508] netlink: 'syz.3.224': attribute type 4 has an invalid length. [ 148.103379][ T6508] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.224'. [ 150.593587][ T6516] netlink: 'syz.3.228': attribute type 10 has an invalid length. [ 150.601714][ T6516] netlink: 55 bytes leftover after parsing attributes in process `syz.3.228'. [ 151.124836][ T6545] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.238'. [ 151.151551][ T6546] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.240'. [ 151.781567][ T6561] netlink: 'syz.0.246': attribute type 29 has an invalid length. [ 151.805947][ T6561] netlink: 44 bytes leftover after parsing attributes in process `syz.0.246'. [ 151.835549][ T6561] netlink: 'syz.0.246': attribute type 29 has an invalid length. [ 151.872294][ T6561] netlink: 44 bytes leftover after parsing attributes in process `syz.0.246'. [ 152.007239][ T6551] netlink: 'syz.1.243': attribute type 1 has an invalid length. [ 152.041877][ T6551] netlink: 'syz.1.243': attribute type 4 has an invalid length. [ 152.069701][ T6551] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.243'. [ 152.556519][ T6577] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.253'. [ 152.791574][ T6587] netlink: 'syz.2.258': attribute type 29 has an invalid length. [ 152.802923][ T6589] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.257'. [ 152.816456][ T6587] netlink: 44 bytes leftover after parsing attributes in process `syz.2.258'. [ 152.838676][ T6587] netlink: 'syz.2.258': attribute type 29 has an invalid length. [ 152.867405][ T6587] netlink: 44 bytes leftover after parsing attributes in process `syz.2.258'. [ 153.013183][ T6592] netlink: 'syz.0.260': attribute type 10 has an invalid length. [ 153.051847][ T6592] bond0: entered promiscuous mode [ 153.057474][ T6592] bond_slave_0: entered promiscuous mode [ 153.075887][ T6592] bond_slave_1: entered promiscuous mode [ 154.232750][ T6635] netlink: 'syz.3.275': attribute type 29 has an invalid length. [ 154.242958][ T6635] netlink: 'syz.3.275': attribute type 29 has an invalid length. [ 171.360578][ T5794] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 171.380639][ T5794] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 171.389105][ T5794] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 171.398857][ T5794] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 171.407305][ T5794] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 171.420016][ T5794] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 172.455746][ T6661] chnl_net:caif_netlink_parms(): no params data found [ 173.462313][ T5794] Bluetooth: hci4: command tx timeout [ 175.511690][ T5794] Bluetooth: hci4: command tx timeout [ 177.611821][ T5794] Bluetooth: hci4: command tx timeout [ 179.662004][ T5794] Bluetooth: hci4: command tx timeout [ 194.689292][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.695839][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 206.982072][ T50] Bluetooth: hci1: command 0x206a tx timeout [ 206.988219][ T50] Bluetooth: hci3: command 0x206a tx timeout [ 206.994382][ T5805] Bluetooth: hci2: command 0x206a tx timeout [ 256.070496][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.077024][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 260.161191][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 260.168240][ C0] rcu: 1-....: (1 GPs behind) idle=d09c/1/0x4000000000000000 softirq=16219/16220 fqs=2100 [ 260.179189][ C0] rcu: hardirqs softirqs csw/system [ 260.185664][ C0] rcu: number: 9909042 0 0 [ 260.192128][ C0] rcu: cputime: 5679 46837 0 ==> 52500(ms) [ 260.199984][ C0] rcu: (detected by 0, t=10505 jiffies, g=17865, q=1111 ncpus=2) [ 260.207889][ C0] Sending NMI from CPU 0 to CPUs 1: [ 260.213158][ C1] NMI backtrace for cpu 1 [ 260.213179][ C1] CPU: 1 PID: 6654 Comm: syz.3.284 Not tainted 6.6.101-syzkaller #0 [ 260.213195][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 260.213207][ C1] RIP: 0010:native_apic_msr_write+0x39/0x50 [ 260.213240][ C1] Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 c3 f3 0f 1e fa 89 f6 31 d2 e9 87 56 18 03 0f 1f 80 00 00 00 [ 260.213253][ C1] RSP: 0018:ffffc900001f05d0 EFLAGS: 00000046 [ 260.213271][ C1] RAX: 00000000000000f6 RBX: 0000000000000200 RCX: 000000000000083f [ 260.213281][ C1] RDX: 0000000000000000 RSI: 00000000000000f6 RDI: 000000000000083f [ 260.213290][ C1] RBP: 0000000000000001 R08: ffffc900001f0527 R09: 1ffff9200003e0a4 [ 260.213300][ C1] R10: dffffc0000000000 R11: fffff5200003e0a5 R12: 0000000000000000 [ 260.213311][ C1] R13: dffffc0000000001 R14: 0000000000000000 R15: 0000000000000001 [ 260.213321][ C1] FS: 00007fd6903346c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 260.213334][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 260.213344][ C1] CR2: 0000001b2ec22ff8 CR3: 000000005e8e3000 CR4: 00000000003506e0 [ 260.213358][ C1] Call Trace: [ 260.213365][ C1] [ 260.213374][ C1] arch_irq_work_raise+0x68/0x70 [ 260.213404][ C1] irq_work_queue_on+0x122/0x220 [ 260.213427][ C1] rcu_read_unlock_special+0x3a7/0x4c0 [ 260.213462][ C1] ? __rcu_read_unlock+0xd0/0xd0 [ 260.213487][ C1] ? __perf_cgroup_move+0x60/0x60 [ 260.213515][ C1] ? read_lock_is_recursive+0x20/0x20 [ 260.213546][ C1] __rcu_read_unlock+0x7c/0xd0 [ 260.213578][ C1] perf_event_output_forward+0x2e6/0x3a0 [ 260.213598][ C1] ? perf_event_output_forward+0x94/0x3a0 [ 260.213615][ C1] ? perf_prepare_header+0x1e0/0x1e0 [ 260.213637][ C1] ? perf_event_output_forward+0x2f7/0x3a0 [ 260.213655][ C1] ? perf_event_output_forward+0x94/0x3a0 [ 260.213677][ C1] ? __perf_event_account_interrupt+0x187/0x280 [ 260.213699][ C1] __perf_event_overflow+0x447/0x630 [ 260.213716][ C1] ? mark_lock+0x94/0x320 [ 260.213742][ C1] perf_swevent_event+0x2f5/0x5c0 [ 260.213768][ C1] ? perf_tp_event+0x13a0/0x13a0 [ 260.213798][ C1] perf_tp_event+0x4f9/0x13a0 [ 260.213824][ C1] ? perf_trace_run_bpf_submit+0x1c0/0x1c0 [ 260.213842][ C1] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 260.213891][ C1] ? irq_work_single+0x122/0x230 [ 260.213917][ C1] ? sched_clock+0x3f/0x60 [ 260.213935][ C1] ? sched_clock_cpu+0x75/0x430 [ 260.213949][ C1] ? irq_work_single+0x122/0x230 [ 260.213968][ C1] ? __lock_acquire+0x7c80/0x7c80 [ 260.213989][ C1] ? flush_tlb_func+0x51b/0x650 [ 260.214014][ C1] perf_trace_run_bpf_submit+0xf4/0x1c0 [ 260.214041][ C1] perf_trace_preemptirq_template+0x281/0x340 [ 260.214068][ C1] ? asm_sysvec_irq_work+0x1a/0x20 [ 260.214086][ C1] ? trace_event_raw_event_preemptirq_template+0x1e0/0x1e0 [ 260.214109][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 260.214125][ C1] ? irq_exit_rcu+0x20/0x20 [ 260.214147][ C1] ? asm_sysvec_irq_work+0x1a/0x20 [ 260.214165][ C1] trace_irq_enable+0xbf/0xe0 [ 260.214189][ C1] trace_hardirqs_on+0x18/0x40 [ 260.214210][ C1] asm_sysvec_irq_work+0x1a/0x20 [ 260.214225][ C1] RIP: 0010:handle_softirqs+0x1b0/0x820 [ 260.214242][ C1] Code: 89 64 24 2c 0f b7 db 48 c7 c7 a0 b2 a9 8a e8 d7 99 1b 09 65 66 c7 05 1d 25 b2 7e 00 00 e8 a8 63 3a 00 fb 49 c7 c6 c0 a0 a0 8c <89> 5c 24 34 b8 ff ff ff ff 0f bc 44 24 34 41 89 c5 41 ff c5 0f 84 [ 260.214254][ C1] RSP: 0018:ffffc900001f0e40 EFLAGS: 00000286 [ 260.214266][ C1] RAX: fe03349d9d1f0300 RBX: 0000000000000200 RCX: fe03349d9d1f0300 [ 260.214277][ C1] RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780 [ 260.214289][ C1] RBP: ffffc900001f0f50 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d [ 260.214300][ C1] R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 000000000000000a [ 260.214310][ C1] R13: 0000000000000000 R14: ffffffff8ca0a0c0 R15: ffff8880276e8000 [ 260.214344][ C1] ? lapic_next_event+0x11/0x20 [ 260.214365][ C1] ? __irq_exit_rcu+0xc7/0x190 [ 260.214388][ C1] ? do_softirq+0x180/0x180 [ 260.214410][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 260.214436][ C1] __irq_exit_rcu+0xc7/0x190 [ 260.214452][ C1] ? irq_exit_rcu+0x20/0x20 [ 260.214478][ C1] irq_exit_rcu+0x9/0x20 [ 260.214491][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 260.214517][ C1] [ 260.214521][ C1] [ 260.214527][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 260.214554][ C1] RIP: 0010:rcu_read_unlock_special+0x88/0x4c0 [ 260.214579][ C1] Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 a9 4e 93 7e 41 f7 c6 00 00 f0 00 74 45 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b [ 260.214591][ C1] RSP: 0018:ffffc900037e7400 EFLAGS: 00000206 [ 260.214603][ C1] RAX: fe03349d9d1f0300 RBX: 1ffff920006fce88 RCX: fe03349d9d1f0300 [ 260.214615][ C1] RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780 [ 260.214626][ C1] RBP: ffffc900037e7500 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d [ 260.214638][ C1] R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8cd35400 [ 260.214649][ C1] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002 [ 260.214685][ C1] ? migrate_enable+0x2bb/0x3c0 [ 260.214711][ C1] ? __rcu_read_unlock+0xd0/0xd0 [ 260.214740][ C1] ? migrate_disable+0x180/0x180 [ 260.214767][ C1] ? trace_call_bpf+0xf8/0x690 [ 260.214798][ C1] __rcu_read_unlock+0x7c/0xd0 [ 260.214821][ C1] ? trace_call_bpf+0xc3/0x690 [ 260.214847][ C1] trace_call_bpf+0x59f/0x690 [ 260.214870][ C1] ? trace_call_bpf+0xc3/0x690 [ 260.214894][ C1] ? trace_call_bpf+0xc3/0x690 [ 260.214925][ C1] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 260.214956][ C1] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 260.214993][ C1] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 260.215018][ C1] perf_trace_lock+0x2ed/0x380 [ 260.215053][ C1] ? trace_event_raw_event_lock+0x230/0x230 [ 260.215084][ C1] ? trace_event_raw_event_lock+0x230/0x230 [ 260.215114][ C1] ? pfn_valid+0xf4/0x450 [ 260.215135][ C1] ? pfn_valid+0xf4/0x450 [ 260.215156][ C1] lock_release+0x857/0x8b0 [ 260.215181][ C1] ? pfn_valid+0xf4/0x450 [ 260.215204][ C1] ? __lock_acquire+0x7c80/0x7c80 [ 260.215223][ C1] ? mod_memcg_page_state+0x97/0x910 [ 260.215247][ C1] ? __lock_acquire+0x7c80/0x7c80 [ 260.215266][ C1] ? lock_chain_count+0x20/0x20 [ 260.215284][ C1] ? pfn_valid+0xf4/0x450 [ 260.215305][ C1] ? pfn_valid+0xf4/0x450 [ 260.215329][ C1] pfn_valid+0x3ee/0x450 [ 260.215354][ C1] __vmap_pages_range_noflush+0x486/0x930 [ 260.215399][ C1] __vmalloc_node_range+0xef6/0x1320 [ 260.215455][ C1] ? free_vm_area+0x50/0x50 [ 260.215478][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x110 [ 260.215505][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 260.215535][ C1] bpf_map_area_alloc+0xf1/0x110 [ 260.215560][ C1] ? prealloc_init+0x136/0x830 [ 260.215579][ C1] prealloc_init+0x136/0x830 [ 260.215613][ C1] htab_map_alloc+0x84d/0xe50 [ 260.215643][ C1] map_create+0x877/0x1110 [ 260.215664][ C1] ? security_bpf+0x7e/0xa0 [ 260.215687][ C1] __sys_bpf+0x5f0/0x800 [ 260.215708][ C1] ? bpf_link_show_fdinfo+0x350/0x350 [ 260.215745][ C1] ? lock_chain_count+0x20/0x20 [ 260.215774][ C1] __x64_sys_bpf+0x7c/0x90 [ 260.215792][ C1] do_syscall_64+0x55/0xb0 [ 260.215809][ C1] ? clear_bhb_loop+0x40/0x90 [ 260.215823][ C1] ? clear_bhb_loop+0x40/0x90 [ 260.215841][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 260.215866][ C1] RIP: 0033:0x7fd68f58ebe9 [ 260.215887][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 260.215899][ C1] RSP: 002b:00007fd690334038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 260.215913][ C1] RAX: ffffffffffffffda RBX: 00007fd68f7b5fa0 RCX: 00007fd68f58ebe9 [ 260.215924][ C1] RDX: 0000000000000048 RSI: 0000200000000140 RDI: 0000000000000000 [ 260.215933][ C1] RBP: 00007fd68f611e19 R08: 0000000000000000 R09: 0000000000000000 [ 260.215943][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 260.215951][ C1] R13: 00007fd68f7b6038 R14: 00007fd68f7b5fa0 R15: 00007fff30546208 [ 260.215986][ C1]