last executing test programs: 5.122407114s ago: executing program 2 (id=3380): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x1061c1, 0x4, 0x0, 0x4, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0xa, 0x6, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}, 0x2062) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={0x0, 0x0, 0x0}, 0x0) 4.936751139s ago: executing program 2 (id=3383): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000180)={0x2, 0xa0, 0x5, 0x2, 0x0, 0x0, 0x0, 0x9, 0x4022, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0xfffffffc, 0x5, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x90}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_to_bond\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, 0x0) 4.741332154s ago: executing program 2 (id=3387): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x200000000000003, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x3, 0x8, 0x2, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000001, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x7, 0x2}, 0x8386, 0x4, 0x9, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1c, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa16ae, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x90, 0xa4, 0x2, 0x5, 0xa1, 0x9b9b, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) syz_clone(0x2300, 0x0, 0x0, 0x0, 0x0, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x1f4, 0x7, 0x0, &(0x7f0000000100)="ff412f66b0833e", 0x0, 0x300, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x2}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000"], 0x0}, 0x94) r5 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0), 0x8) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r6, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x300080c1) setsockopt$sock_attach_bpf(r6, 0x1, 0x9, &(0x7f0000000800)=r5, 0x4) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="d800000018007b7be00212ba0d0505040a003f00000f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b3162700e06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5005ccca262f3d40fad95667e04adcdf63cc1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e0700000004000000", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x0) 4.49306652s ago: executing program 3 (id=3390): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x20800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) close(r0) 4.364374253s ago: executing program 2 (id=3392): sendmsg$inet(0xffffffffffffffff, 0x0, 0x3000c085) r0 = socket$kcm(0x10, 0x2, 0x10) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_bp={0x0}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) socket$kcm(0x2, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0x10, &(0x7f0000000b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) socketpair$unix(0x1, 0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext={0x0, 0x1000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x0) socket$kcm(0x2b, 0x1, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f00000000c0)={0x4, &(0x7f0000000000)=[{0x20}, {}, {}, {0x6}]}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300)={0x0, r0}, 0x8) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x7, 0xc, &(0x7f0000000340)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5d, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000001300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@func_proto={0x0, 0x0, 0x0, 0x2, 0x3}, @fwd={0x2}, @struct={0x0, 0x0, 0x0, 0x9, 0x0, 0x2}]}, {0x0, [0x0, 0x51]}}, 0x0, 0x40, 0x0, 0x1}, 0x28) r5 = perf_event_open$cgroup(&(0x7f0000000280)={0x4, 0x80, 0x4, 0xf8, 0x0, 0xc, 0x0, 0x7, 0x340, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0xffff5be3, 0x2, @perf_config_ext={0x0, 0x8}, 0xcc, 0x2, 0x5, 0x4, 0x9, 0x7, 0x400, 0x0, 0x61, 0x0, 0x9}, 0xffffffffffffffff, 0xe, 0xffffffffffffffff, 0xa218ef6f8a3e33bf) r6 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x400000, 0x6, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, r5, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0xb27f, 0x829b0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe11b, 0x0, @perf_bp={0x0, 0x1}, 0xc486d19d431ce5be, 0x5, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xe9}, 0x0, 0xd, r6, 0x8) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$kcm(r7, &(0x7f0000000200)={&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000140)}], 0x1, &(0x7f00000001c0)=""/20, 0x14}, 0x10000) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8940, &(0x7f0000000080)) 4.334302674s ago: executing program 3 (id=3393): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={0x0, 0x0, 0x0}, 0x200040c4) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0xfffffffffffffffd}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0xf, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x1ff, 0x200}, 0x8000, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) close(r3) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) write$cgroup_freezer_state(r4, &(0x7f0000000340)='FROZEN\x00', 0x7) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x7, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000010000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = perf_event_open(&(0x7f00000014c0)={0x7, 0x80, 0x0, 0xfe, 0xff, 0x5, 0x0, 0x1, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x1590, 0x0, 0x8, 0x3, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r5) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="1802004320ab32595e0263000000000085000000d000000095000000000000001047a206d613904ad056aa0e8cf3774ea74bc8e1c2d6e2388beabb04204fc4c4887db8042994fb7334665e5a628fafa832e3920da5ddc91335646be2a0f2361408"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0xe, 0x0, &(0x7f0000000300)="131c8701feaa16bca4ac74ab821d", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) perf_event_open(&(0x7f0000000580)={0x2, 0x80, 0xed, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xb11d, 0x0, 0x1000000, 0x0, 0x400, 0x7, 0x4}, 0x0, 0x0, r6, 0x6) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="09000000060000000800000008000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000d2c22327c756e6370665775b2a03cd503eb6977d5a354bbe4b9e1afa748eaa8d7bac85e7626c446bbf09c1680016f6da2b81844c8b2064c538df7b6b99eea055684e9f78d4", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r8}, 0x38) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x1}, 0x0, 0x1, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = socket$kcm(0xa, 0x3, 0x73) setsockopt$sock_attach_bpf(r9, 0x29, 0x21, &(0x7f0000000200), 0x4) sendmsg$kcm(r9, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xff, @remote}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000290000000b000000000000000000000010000000000000000a010000080000"], 0x28}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000280)=@o_path={&(0x7f0000000240)='./file0\x00', r7, 0x4000, r6}, 0x18) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb9200a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) 4.306331634s ago: executing program 0 (id=3394): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x1061c1, 0x4, 0x0, 0x4, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0xa, 0x6, 0x0) socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)}, 0x2062) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e21, @multicast1}, 0x10, 0x0}, 0x0) 3.811145246s ago: executing program 1 (id=3396): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r0], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000500)="b9ffe4306844ebe99b554e0fe9ad", 0x0, 0x4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.789702537s ago: executing program 3 (id=3397): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x1061c1, 0x4, 0x0, 0x4, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0xa, 0x6, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}, 0x2062) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r5 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x3e, &(0x7f00000002c0)=r4, 0x161) sendmsg$inet(r5, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e21, @multicast1}, 0x10, 0x0}, 0x0) 3.68076341s ago: executing program 1 (id=3398): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000180)={0x2, 0xa0, 0x5, 0x2, 0x0, 0x0, 0x0, 0x9, 0x4022, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0xfffffffc, 0x5, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) r1 = socket$kcm(0x28, 0x5, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="d8000000180081054e81f782db0cb904021d080406037c09e8fe55a10a0015400400142603600e122f0009002b000400a8000600200003400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb5b277470703152b414f872766247a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x800) setsockopt$sock_attach_bpf(r1, 0x28, 0x8, 0x0, 0xff79) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x90}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_to_bond\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8946, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, 0x0) 3.65714876s ago: executing program 0 (id=3399): socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x80100, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000300000000000000c29c18120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400000001ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x80, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0xc}, 0x100084, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x10, 0x400000002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b87, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0x5, 0x43a1bd76, 0x1, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$unix(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) recvmsg(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/112, 0x70}, 0x42) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1f, 0x14, &(0x7f00000010c0)=ANY=[@ANYBLOB="180000000000000000000000fdffffff18010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000800000085000000b000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000163b00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1fffff}, 0x94) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@o_path={&(0x7f0000000040)='./file0\x00', 0x0, 0x10, r5}, 0x18) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)=@o_path={0x0}, 0x18) r6 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r6, 0x29, 0x30, &(0x7f0000000100)=r4, 0x33eb) 3.475574655s ago: executing program 0 (id=3400): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x5, &(0x7f0000000900)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=r0, @ANYRES64=r0, @ANYRESDEC=r0], 0x0}, 0x94) r1 = socket$kcm(0xa, 0x2, 0x3a) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x11, 0x5, &(0x7f0000000f00)=ANY=[@ANYRES64, @ANYRES8=0x0, @ANYRES64=r1, @ANYBLOB="8ad1bba8a91d68662030de3c5b432dfc9cc7a93ede8cd9962a0de78b5b0fe5e2e62fda1c0b973bd2ae8b40bb877613c094cac7de10b1550acf8d6fa3a5a39c390a960c621f8372547d6dfbb52cf7bf30abc91eb5bd4ffef5d959d0e69acea5ad6eb586d321f74dceafc57bfb2b8c2e912b7736be085a43b7282bc7d36f0ea3c4364447cb207e32ad21567721b99619b0a707814b81d38255b1c72457a12acaf3ccddcba6951552430eaf1acc264fe5d914ee39733467d00fde23b17fdfcf89bce1dba8208b866f52ae8fa6a6d23988e9e5e2ac2f15ca62e8d679920b9637f7272f0b0b60e7eb633f6236f5ee", @ANYRESOCT=r2, @ANYRES16=r2], &(0x7f0000000680)='GPL\x00', 0x4, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r0, 0x0, 0x19, 0x0, &(0x7f0000000340)="4da7cfb12bd91aef6eb3a2d1688fbbe880a2a3a4029b3378b2", 0x0, 0x5, 0x0, 0x48, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r3, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r3, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x76, 0x8, 0x0, 0x0}}, 0x10) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYBLOB="fbf0528dcb9c84b7ad6b1419b11fa459a5ae3b00179a2108fd25990cf641c91f0769e644a447a1c1d02f5e8b0a07d7145c38428dc07895c839440f76393417c430250a669ea247f77fcc0492532c47c5df5536ee21d2263b8f9a6a0204110d19ab7de2041aa4bdf8ec4ee33c16eede9db37469b95c19686a9d267198efc9f688f03973c5a64454b3dded812cf0bdf714aac16c1d2a22057e6a3e6c987e60c167ab0641317944d7facd25bdcffcc709b7e2f348063bf37bc9763444f2d975276fb76ab865ab477b272f1fc4b062f456365c10752cac6bc18aa6a737e1a4f42b099e02", @ANYBLOB="08000000000000000000000000000200000000001f3ca402800116bfa5a8d414fca725cfcb67a6311790ae4e8abb62bc2bdc5da0e82fe452935a60e3dd612cbdd58693db1a3f762a", @ANYRES32=r5, @ANYRES32=r1, @ANYBLOB='\x00'/28], 0x50) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb0100180000000000000100f6ff0000000000020000000000"], 0x0, 0x1a, 0x0, 0x1}, 0x28) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0xb, 0x64639, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x2, @perf_bp={0x0, 0x2}, 0x8020, 0x4, 0x6cdf, 0x6, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000cc0)=ANY=[@ANYRES64, @ANYRES32=r2, @ANYBLOB="000000fb92886bac619f83e43eb8dd63bf3a230000004ade0500a2d42170000000000010", @ANYRES32=r5, @ANYRES32, @ANYRES32=0x0, @ANYRES32=r7, @ANYRES8=r5], 0x50) sendmsg$kcm(r1, &(0x7f00000005c0)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0xd7, &(0x7f0000000080), 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000001040)=ANY=[@ANYRES8=r4], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0), 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40408, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000001, 0x1, @perf_bp={0x0}, 0x8061, 0x3, 0x0, 0x0, 0x0, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r8, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000024c0)={&(0x7f0000000a00)="4064b1687523bbfc10720d0dc02eb29176c33dfd5d22b278b61de7f3ddcfbc50b63c3c2e31bbe08e3d69f707b63d5d179aa20fd8c4f8dda2ef602a9f9b8165eb8be41d643ccecac4dd69f37f1ef88321e3f94766d90a1b4dd16fb350538507534dd30aa249d36d4575642561b361f82d173aea2ad57aefaff80936c4c3e1cb24521e8b1cf9a5384d89ee17a3ad469b36426f44abb00fc9b6315871dea784082cd5a02c18dfe662f5bf7ba17e808bfbaf05a610851283ffbaec784d8af875ad4d2cd11d14a7845e4935d5a1a941eecf09a2bfef6393d156eb9e1d50047b2aa05eabe2f9", &(0x7f0000000b00)=""/222, &(0x7f0000001480)="1a4fa828a7e8c8d0a41a49e1cf1c7e0b58d9029adfe82974d58cf10bd7e1a98521286ea341be95d3c3870a5f067f64b98d3b50c91890a907f4cd8a75aa7fff90d63f6df0066bbf9e931a1f0fded8fa81deb420988b7bb00f9bd6c281f3d17533b90257f40309c5f4b5e8832961d5c60024beb0cfaf19cf198288f947f798c9f7f1d1e9abae1c12120c655055d02d6a45ff0e766ee62f4b486eda9ff9df973b6ed887cf1f30917c65dae20c961a75da5413e851fcdbad68925b21770a25d0da5402137b12ec723ca365ee009719ec2164dbd1c15c4f74c856e9362c49000c6dcb26301096c2d1f1f3a7778ae6a54fc1ec3e78e3ab91ebb9510e11adc365040fba775fae9a07b1db49306a545b13f913d1e0c64b50b8a1b74d20e34d5cb7711529832d04f9e7f15363ecadb9a420cf2a17d2dea6a4770d88933904998b83239f38e3f285362915f43bb1eb8abeae919ab9100d29d6c3df0f393379c56a4f67afc082ba1857cd335cd6702c8dc86fe83ef8eae3db05cae74a2aa51e5ea6e55ee6390d317ede82419093577fe51cf9704fe6dee4aeb868fed34f4e3a960c365f6ad33d06c5b4ccfdc9ed57469e97d781879b99782250851b1c61823f1fdb60df53444892064a80fc9162d9c1fa822672a24a075266011940bf10ae0737d3055f6286893d8422557c8c0340140ca638af057601eaf3f161e624107fc371301ff2d8af03e1252946c82d2995bac2bc8d1b36682b550733a234867c75494a3abd08b98f735f46d64b67a75e5ea5f5d15c725e8d760d257aa6351e248100543e03690400b97c20947481af48839d976ae16ec1bd88e76dafd688c1d635c37d680b31e8b409b835d1be8cafb4547d5b9486ce7207998554f83ff6a73263613764aa196e5f2058861cc360bb0db1b07e64264a1874745efb976e2b498460e2f48f9bf90025264cd4b523279d66696e4975e531e049875d9f512f7c0d65c41ac792694db4409df06c265a4b10d249066981b126df7802f862b664501613ead308f11bf06a931bf1fe151e2c52cb75fe5d07006fa5619500ab6a51a0c5fadddf0deb3e731ddefdd10a2482de4bfef28c598ca5fa46ec9755de01d7af5a884a0dc5e78d6770397ba767f4a5dfd7eb6a75e16327df6d946034bb954b14bd90958beff6dec93d84be86a3e84b9728c59c0be7fa8dc45543789d28b1802ed2be593161fd6ff129391d37817560b2d1f240891e91611e02c97b5408ed7276dacf97a2d912069cf7f6359d7e3cea935994df1c055833d530403dc6fdfe294cf3f4114a3c0188c682fb66f99525ac6367fa70eaa0a32035b21033502298943361d0e02fd899dd94f16303a0b46c848b537d9151e2377aa8459e2379f5370da475b5f1a7ac4edf9860eda981d6e4f8f4e36d92cff002626ad74878caaa6614f17ba1060b0b93666b43e2675ab478671b8e1d417b77e56cc60fb65720228f3f9f3fce3e1267ba6bf93e8e7e9e9f5ffe6811344a4490eb592fb2778be2a9813464ef86f3a149e7c38965f6d1e4561112d717fea5a13128a5e3403f6fb17804ce70a7a8890e3c07ec667359249ec66e79ae5767781bedee18a659558e246b24aae72e463b8ac4dc9a1aae7628c22a54551ad538758d73368564296d035a18247108b8da95345a08c137d5e9bc5d5b717fd9947792a9b51d704a830be3d3a96cad6e399cbeee53abd409eabbc96821e12443e8b54e3bc35f674f9c8be85798f4632cbeb6dfc9b68c50e80765f7aa95b998c9b226666f0cd398f70cd44ba51845104279434f865f8cfb6290fd944d80ce8db158e50f5080f0c447b4cb3f06abe4f575815337090de1322006ada7c4467dda4f7288d4a79319e04b714187e05503af147cfb085236acdcc3c3cd6989f7c7ad8730658450a94a5768eafaf67d4fa8b2d7d2f4ddb28d709cc3c23e1179d6fbe21a6f9a34e39ae20133530baf039f9e1ed437a2753d037b5689dfd4fdf618100481d399bc1ceeebbb07af0eaae457756913aa6ac3648452ffc2e9e7f4a74263bc9ace55e67d2ee8cd177a4e87e40fdca05197eea8f3a6250e9983a04365490a1e7e607a25dd7fb4cad7d2660fd2569358fe128058284ecafb5e46d12966948388bdc09dd3e521e9628129452cf5a9bf058cbdc471a27094991bf372cee0cac5a8773ce92df02a80c1ae73c34db7e51402ee823914e8e95d84b6aab76cf473306f48f313a51a41888978bf2a269dfc54225005633081f673b141391bc35ec54df792820ecbf8559917b30c3b9813ef0bb9292937708fe410b69a4a5255abf5b7c440f413705598fa36ab7a195e3308159a21e9adac9c9d06db40c2d1aa4e629d062f0981e706295dab08006ab6a6784d75f308c63a0604b27421fd80f301f5694d80114f0cf58c2a353f0258996dac11d46343576323841b4f41719fec4d53898af7b90f0a96e1bfcb68ee12c5af89f3f14dc59c05e9b919cf784dfa283a26acad2d37870ecc5ed32e25cc492c418b058c419856d22eeee321376be5a3886628999a034f6d27c0e1de1c27d646784d7733e113fbd7809cfe89ac6a3d2c6e990a58eaa4d074d84750ad2141920f05e8d65c2dffd2dc5ba7927190deb7d5bc56941dd4776cd23c548f6bbd1585c0dba3d58f70d5d1952a8451fba7b1a18818e17dbd120f3888f180a8586a668959018fea2c45942b1d7e36cb1b3d5822dea4b1e3650daabd553fb57e524c8249b2ff5211b2832b11d41db205216ed66af4ae6e25d5a6598c16e4515b1a5f1cf4fe42a9a7411f75ef02996629edf87e13d170688e2b43fd773afe05854ea24c20a38ceb715dc19a2f4d0d123848aa3dec09debf8d75c5e681b8f4d475207f87f7df80af8fbf5897fbec921e5d96180dc1f06ea547a05a967ed30016bbfa9c85f2cab264077a3088ac43144ccf7a62bd6b3c90826cf6945c38d8573566d55c137a0f8302f1096b6bfcf9c3a242aff4f26af9a38871931dcbd2b8fe4409139ad60aac7e7c5c20da98e80f43d1eeaa5e30e4668aa04b4dcc5a03c2bfaa46006f6bfe596e2de36b3f4b2420714f045f0222d27ecc32ff331f5839455e07bf43da687ebfdaf8d3346b70da3f4bb267bf8b6745a7774d49a43491f60a29b6cab82eaa6e7ee4ba284fffdec91cfbf507f665b172a0f3f96de83533e6449b939cd46812dc47da8503b014f1aa14d705e0c51074f76e062af2a167438135766abd404915f492812c35817d8b2188bda649971e007bf8d4eafc10d0a8a4f179bc549d9870a72e9c8079abe3b2f9a2571b66fd6b3c72401d3beeff3440924224d417376974821ac58474b9bb306222927005df22573bb4352fb01f40f37ac85797d1687c3d1fab84a914b22c739d01a6e266407f80799213a715f6232a060fcf24b00bd235765cb302d42d60c732845ebe34f36aad986df37985ce1010c0fc68c2fd26a09531d766a38f2d32f23594ecf0785021923d3b166e16a7abd7431794da1e25d41027204a4dddba790627218f7bb27269d033865f62773a5e3766bb9ca34d715cef0a7330de26b37c6150647a66aeda2d8af081f8beeb105bd247e9c956572c475a26f6c018dc75cd79179ee87b8c2b16b30aa201a702dcda0aa206d918c1a8b313febda27c2b1b86c0ab3d57a2aa4c1bac4217972babbda95becf8a7dc6a084a8bdffe2c8f99b099638da0545c1cc174557d61da53fa39a03de956f7089185671a36bb63c5ef08b63bdf0de6b52dea753d2e8e50cc4a6f48ab469e1762dc02c6714a2bf61a21467fd06e1a5b9e9f12c83d7107de1ff8688a99a089bac5939006e4bc1b70e482f13a0c09839faa72f1190b8fd560d837acf805aa34d8f60413262c3ebbb7728ff14093e687e882857c55b976b2c1969aaa157dc8e7ccd57b22dd6829a1b343ceb6868258d80ba10350942f6dd7a52f11460bb5a7af6c39a98942ac49ca7acbf256803611929c3115e3948c019d440abc1007c4834155b234bad58431ee5c29f601bba4279dfbe00e275a25b4f2b71065604f6c0446d1f476125ef8f31c9d9adcc0af536fc4fd87a27a7c41fae6281f3100f31a99040b119d66d668e8ff8d10d578c5c2c5a6fd409faf85e2130ba660d5c0b15b2c59ca3a53c65b1c6ccb0eca782d21424d9eba7e5f483e38b26867e5195687111293ef73d609864b58378b53d8b499ecbc32fac0a4b6e84299f24b2004c2e4b5d5601a7112ee2f38b6137e748a6320960651163e3683949fbe5163cc69b31b46a3b6ac988d58b2cc1529b496c4fb71480126a501c9e5cf76d51d1a3912dec6467fc09b08c8a3e5c507d47a345c4438404a949fe589ca1b7fe75f3990739d2ec44da66dba56eaf4bbad4ceb21c536172fe512bc08249d8a080b9151d46455382260c44148526b176499e4d0dec3e2c2a0d17eac80cea49c4e79ecda88aa3793f63d391a54b4ead4a337bbfe0495fe790bb9817f973db31ae00beaa68fedb08268c99fbebfe852c383a0b688d17c5c805c9984fb74866e739d3303f7ba8722880e3af47b2487a9d41e37def80095b2b915b167f00c354a5f04ac328b858d79f18242b33a8b450cd01efefdb73a29bafec4c2bb15485b882c5ec607e0c9e3d20e67341eb4f241fdf5decbb56b8413e8838a61ff544bab569524d3f449adff4e9512d1bceb3992d0ca8c9145019d2b4debd0ca1f6b0dfae1ae749b67acb1e15549e374238aa3f8b0f6593b9ed2c881b431154b3528f337aba36b6e6fe385cbdbb3df16b2e8372b0206b4aabfd51f8aead891fb6b654599e69a843c3f13e124ce97694f3db8550a1050e618f3b8cddf2b6da589da6a30384877d6407cc6bb159cc2fd4c0f34b45212384ccf68149d90a855aa06c47fcde64278777558c6ed32cbc884a36b787287e56767bad09dd47a3776f8d2377b1d9e04eace045ffd290189cc5219bc788d720bb348033a4261fd523cb72940f3da3bcaeee42aa45d8dfada162b1d8cf6680eb7a49829d4d159f605155b05ee9c143a7f36a747329b85db9af9951d51722b5532a1ee5c5e482261983a5144cc7c90ef7a12647edd66065f0f02c030e4917efc291965881adb371502eb50348a61c1278c4fb5ab9e6b3b7b9dfbd4cbf7ceb54be978b9952205a7803d23b506bbb3b11dfb78dbd1c5f9e8fd5131575296742ee87faca159b77470255c0fe2fdee2241202690374652832c6a0eefbb4bf794c01a2c0425232b9d8cf12ccba81009175951dc1b44de203c78f2c9cbb56e480dd138fea7115b45368acff46b9a024feb47162433e0539559470c0d2db431ed8c300873a7228a036493277a9485d49954b6418decbf32aac92f117fbb0556e7ffdc2cff4e8f9ab275dae97b37afaf19017dd78154d89b218e597b7f13504f811223be0e9e6d863f32303794afabfc0d5da776b4364e20e7e3d59b531a7d047f58c29cc099106136178fc15ed4c47c462ced062887df6c69e3bf0923691f6fe97da3be1d6b1a6b17237e23ff275dd42043790be10e4baeded004f5154ff572f2f44581e8870a21d3622435e822fb77bda46e0f97f44708066955c56f40840587921bf21780cbd6181a04e09b233bf173eacc6cbe97739406b16967a40ce25af841435b5891c603b33fc763ca5ac621d48da6b8d383e4506f275b59675ebbd8baa5f657660a4cd40c6238727ab2b78e9b1ec4797f4ae89e50be7a2fea78e195084da6c87ad9bc2746475ad8672ac2cad6b5e61fa476c3e761a0a8a6b2ffda1a288b88623ee80fa938f50991f177e687cb9fb127a8dda3cc", &(0x7f0000002480)="b904e7c968759acfb329fc3a886348e028d80a44bef859938d8ba4c3b5bfc3126ad789f25172af3ba4aac0b1b33ec2d9c41f7e6f", 0x40, r6, 0x4}, 0x38) 3.475423455s ago: executing program 1 (id=3401): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x20800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) close(r0) 3.475067395s ago: executing program 3 (id=3402): r0 = socket$kcm(0xa, 0x2, 0x3a) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17001000ff"], 0x48) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x101, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b35, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030036000b05d25a806c8c6f94f90424fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f00000003c0)=ANY=[@ANYRES64=r1], &(0x7f00000000c0)='GPL\x00', 0xfffffffc}, 0x94) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000003c80)="d800000019008111e0020f060d8107040a60000000020000000455a12a001e0008000699e3ffffff1e000500fe80817806000500000000000074d67f6f9400f7d1d9bbe94fa27108a007a240c77f01896034277ce06bbace8037cb39b62ee5a7cef4090000001fb791643a5e83d42365f003724a2366e4b11602b2a10000000014d6d930dfe1d9c322fe040000005025acca262f3d40fad96267e004dcdf634c1f215ce3bb9ad809d50b69b42a9ecbee5de6ccd44242f4d643f6fd0f26187b51f9ffffff000000000000000000f49956e4f98b53ced9802b", 0xd8}], 0x1}, 0x4008040) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x50) recvmsg$kcm(r4, &(0x7f0000004f00)={0x0, 0x0, &(0x7f0000004ec0)=[{&(0x7f0000003d80)=""/4096, 0x1000}, {&(0x7f0000004d80)=""/91, 0x5b}, {&(0x7f0000004e00)=""/137, 0x89}], 0x3}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xf, &(0x7f0000000880)=ANY=[@ANYBLOB="18000000000000000000000000000000181c0000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100030000009500000000000000bf71000000000000b7020000000000008500000000000000b7000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x8, 0xffd, &(0x7f0000004f40)=""/4093, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) socket$kcm(0x11, 0x200000000000002, 0x300) r5 = socket$kcm(0x11, 0x0, 0x0) r6 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r6, 0x107, 0x12, &(0x7f00000000c0)=r5, 0x8) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000800)=@hci={0x1f, 0x0, 0x6}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000480)="d1", 0x1}], 0x1}, 0x4c081) perf_event_open(&(0x7f0000000200)={0x3, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r8 = openat$cgroup_int(r7, &(0x7f0000000800)='cpuset.mems\x00', 0x2, 0x0) r9 = openat$cgroup_procs(r7, &(0x7f0000000840)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r9, &(0x7f0000000380), 0x12) write$cgroup_int(r8, &(0x7f0000000040)=0x2c, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES64, @ANYRES8, @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}, 0xfffffffffffffedf) r10 = syz_clone(0x200000, &(0x7f0000000280)="17edd7bb5682cceb32d4e651d7ea4722a8763d5fb74b548c0c4dcec5b1b99f3ddf034bfccad1147759676f3918ce30f1c8f7228d7516c61ecf7bf2b9726c295fdf871d1f00144f9010991117877c18f6d36ab8ec0ac88c4dd6d60bfe5ada277b9c8eeba15758181e85b3764ace6209229fdd3107d5e627e5af37e5", 0x7b, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000500)="c1c0b6b91e15fc37afc15dc3db5e257e058369c8a6f4a3f26a3bc29a5090c553732f3cf54a36f06422c931d709a2305c393d192b6811d16c9de57e2c9191c02d77630ba9d81f473ae7") write$cgroup_pid(r9, &(0x7f0000000580)=r10, 0x12) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={0x0, 0x2, 0x10}, 0xc) 3.310210759s ago: executing program 2 (id=3403): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa, 0x1, @perf_config_ext={0x76, 0x9}, 0x11efa, 0x4, 0x98, 0x0, 0x5, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socket$kcm(0x2c, 0x3, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x76c2}, {0x85, 0x0, 0x0, 0x23}}]}, &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x0, 0xe, 0x0, &(0x7f00000003c0)="c274386d178550cb864bd57221bc", 0x0, 0x1200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000014006b030231a6080c000af32c00009d31fc0000f800250f02000f00e5aa000017d34460bc24eab556bd05251e6182949a2756f475ce36c2d13b48df000000000000ecb8f6ec63c9f4d4938037e786a6d1bdd700e6657594", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000003580)={0x0, 0x0, 0x0}, 0x0) r3 = socket$kcm(0x11, 0x200000000000003, 0x300) ioctl$TUNGETVNETLE(r0, 0x800454dd, &(0x7f00000001c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) setsockopt$sock_attach_bpf(r3, 0x107, 0x8, &(0x7f0000000100), 0x4) socket$kcm(0x10, 0x2, 0x10) r5 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffd}, 0x888a4, 0x0, 0x0, 0x0, 0x6, 0x2f07}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x42, &(0x7f0000000040), 0x3b) perf_event_open(0x0, 0x0, 0xffffffffffffdfff, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={0xffffffffffffffff, &(0x7f0000000340), 0x0}, 0x20) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8993, &(0x7f0000001000)='lo:\x96o8\x14d\xa1\xba\xda\xd1\xa0J\x12tQ\xb16\xe3\xd7\\b\x8b\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed@n\x00\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x02\b\x00\x00\xda\xf3\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xeb\xe1\xde\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xfc\xfa 6(%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x9c\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc50xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)}, 0x2062) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e21, @multicast1}, 0x10, 0x0}, 0x0) 2.316737223s ago: executing program 1 (id=3408): socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x80100, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000300000000000000c29c18120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400000001ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x80, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0xc}, 0x100084, 0x10000, 0x0, 0x1, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x10, 0x400000002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b87, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0x5, 0x43a1bd76, 0x1, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$unix(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) recvmsg(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/112, 0x70}, 0x42) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1f, 0x14, &(0x7f00000010c0)=ANY=[@ANYBLOB="180000000000000000000000fdffffff18010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000800000085000000b000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000163b00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1fffff}, 0x94) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@o_path={&(0x7f0000000040)='./file0\x00', 0x0, 0x10, r5}, 0x18) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)=@o_path={0x0}, 0x18) r6 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r6, 0x29, 0x30, &(0x7f0000000100)=r4, 0x33eb) 123.016106ms ago: executing program 0 (id=3409): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x1061c1, 0x4, 0x0, 0x4, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0xa, 0x6, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}, 0x2062) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r5 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x3e, &(0x7f00000002c0)=r4, 0x161) sendmsg$inet(r5, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e21, @multicast1}, 0x10, 0x0}, 0x0) 103.356467ms ago: executing program 3 (id=3410): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$kcm(0x23, 0x2, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0xb}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11540}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x9, 0x1, 0x7fe2, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x9, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r3) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') perf_event_open(&(0x7f0000000040)={0x5, 0x6c, 0x2, 0x2, 0x8, 0x9, 0x0, 0x6, 0x0, 0xc, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_bp={0x0, 0x8}, 0x2000, 0xff, 0x9, 0x0, 0x4, 0x145d, 0x1, 0x0, 0x3f8, 0x0, 0x100}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) write$cgroup_type(r4, &(0x7f0000000180), 0xfffffe51) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40305829, &(0x7f0000000040)) sendmsg$kcm(r0, &(0x7f00000003c0)={&(0x7f0000000000)=@phonet, 0x80, &(0x7f0000000180)=[{0x0, 0xea}], 0x1}, 0x0) 1.25352ms ago: executing program 1 (id=3411): recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x10002) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x1c1440, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r0, 0x400454ce, 0xa) ioctl$TUNGETVNETBE(r0, 0x800454df, &(0x7f0000000000)) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1, 0x9, 0x5, 0x4, 0xc1, 0xffffffffffffffff, 0x1000000}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000380), 0x3d, r2}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000200)={r2, &(0x7f0000000140)="ec7e78ca488ad1cd78e397bbfce35700330fbea95b8d995c164ca69f619d9b6536966d52b7d5cf682466bfe613a4fb45fbd69e8174f4a879ba7f90cf0afd18224dd983f64fd28a6a8e1f89e3e82583496e5e89db1a77820f016e7c960b9b9800897d4b423dbf63a41f862e2319e3", &(0x7f00000001c0)=""/57}, 0x20) sendmsg$inet(r1, &(0x7f0000000b40)={&(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000000000), 0x0, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xc}, @remote}}}], 0x20}, 0xe900) sendmsg$kcm(r1, &(0x7f00000009c0)={0x0, 0x0, 0x0}, 0x854) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x4) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 0s ago: executing program 2 (id=3412): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (fail_nth: 4) kernel console output (not intermixed with test programs): 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.798739][T13578] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 491.807180][T13578] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 491.815168][T13578] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 0000000000000005 [ 491.823160][T13578] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 491.831154][T13578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.839154][T13578] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 491.847163][T13578] [ 492.038389][T13588] bridge0: port 1(bridge_slave_0) entered forwarding state [ 492.557821][T13603] netlink: 'syz.3.2754': attribute type 10 has an invalid length. [ 492.574554][T13603] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.584682][T13603] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.638563][T13603] bridge0: port 2(bridge_slave_1) entered blocking state [ 492.646895][T13603] bridge0: port 2(bridge_slave_1) entered forwarding state [ 492.656749][T13603] bridge0: port 1(bridge_slave_0) entered blocking state [ 492.664569][T13603] bridge0: port 1(bridge_slave_0) entered forwarding state [ 492.687879][T13603] team0: Port device bridge0 added [ 492.708110][T13601] netlink: 'syz.2.2761': attribute type 10 has an invalid length. [ 492.747216][T13601] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.768982][T13601] bridge_slave_1: left allmulticast mode [ 492.779354][T13601] bridge_slave_1: left promiscuous mode [ 492.787120][T13601] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.823892][T13601] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 493.254995][T13623] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 493.260745][T13623] dvmrp1: linktype set to 768 [ 493.508147][T13632] netlink: 'syz.1.2768': attribute type 10 has an invalid length. [ 493.542099][T13632] bridge0: port 2(bridge_slave_1) entered disabled state [ 493.551190][T13632] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.609064][T13636] netlink: 'syz.3.2770': attribute type 10 has an invalid length. [ 493.617329][T13636] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2770'. [ 493.637530][T13636] team0: entered promiscuous mode [ 493.647119][T13636] team_slave_0: entered promiscuous mode [ 493.653637][T13636] team_slave_1: entered promiscuous mode [ 493.659563][T13636] geneve1: entered promiscuous mode [ 493.666973][T13636] bridge0: entered promiscuous mode [ 493.672561][T13636] team0: entered allmulticast mode [ 493.679555][T13636] team_slave_0: entered allmulticast mode [ 493.685709][T13636] team_slave_1: entered allmulticast mode [ 493.691735][T13636] geneve1: entered allmulticast mode [ 493.699921][T13636] bridge0: entered allmulticast mode [ 493.708988][T13636] bond0: (slave team0): Releasing backup interface [ 493.756699][T13636] bridge0: port 3(team0) entered blocking state [ 493.763745][T13636] bridge0: port 3(team0) entered disabled state [ 493.775955][T13636] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 494.006499][T13651] FAULT_INJECTION: forcing a failure. [ 494.006499][T13651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 494.019776][T13651] CPU: 1 PID: 13651 Comm: syz.1.2775 Not tainted syzkaller #0 [ 494.027314][T13651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 494.037408][T13651] Call Trace: [ 494.040714][T13651] [ 494.043667][T13651] dump_stack_lvl+0x18c/0x250 [ 494.048386][T13651] ? show_regs_print_info+0x20/0x20 [ 494.053603][T13651] ? load_image+0x420/0x420 [ 494.058137][T13651] ? __might_fault+0xaa/0x120 [ 494.062834][T13651] ? __lock_acquire+0x7d80/0x7d80 [ 494.067896][T13651] should_fail_ex+0x394/0x4c0 [ 494.072603][T13651] _copy_from_user+0x2f/0xe0 [ 494.077223][T13651] ___sys_sendmsg+0x1c7/0x360 [ 494.081931][T13651] ? __sys_sendmsg+0x2b0/0x2b0 [ 494.086762][T13651] ? trace_call_bpf+0xc3/0x6c0 [ 494.091559][T13651] __se_sys_sendmsg+0x1d0/0x2c0 [ 494.096439][T13651] ? perf_trace_preemptirq_template+0x269/0x330 [ 494.102718][T13651] ? __x64_sys_sendmsg+0x80/0x80 [ 494.107699][T13651] ? lockdep_hardirqs_on+0x98/0x150 [ 494.112929][T13651] do_syscall_64+0x55/0xb0 [ 494.117392][T13651] ? clear_bhb_loop+0x40/0x90 [ 494.122102][T13651] ? clear_bhb_loop+0x40/0x90 [ 494.126799][T13651] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 494.132712][T13651] RIP: 0033:0x7fd71e59e0d9 [ 494.137155][T13651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 494.156781][T13651] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 494.165225][T13651] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 494.173221][T13651] RDX: 0000000000004014 RSI: 00002000000000c0 RDI: 0000000000000003 [ 494.181214][T13651] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 494.189201][T13651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.197190][T13651] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 494.205199][T13651] [ 494.481592][T13663] FAULT_INJECTION: forcing a failure. [ 494.481592][T13663] name failslab, interval 1, probability 0, space 0, times 0 [ 494.494946][T13663] CPU: 1 PID: 13663 Comm: syz.1.2780 Not tainted syzkaller #0 [ 494.502454][T13663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 494.512558][T13663] Call Trace: [ 494.515881][T13663] [ 494.518861][T13663] dump_stack_lvl+0x18c/0x250 [ 494.523590][T13663] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 494.530854][T13663] ? show_regs_print_info+0x20/0x20 [ 494.536108][T13663] ? load_image+0x420/0x420 [ 494.540682][T13663] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 494.546894][T13663] ? lockdep_hardirqs_on+0x98/0x150 [ 494.552141][T13663] should_fail_ex+0x394/0x4c0 [ 494.556874][T13663] should_failslab+0x9/0x20 [ 494.561435][T13663] slab_pre_alloc_hook+0x59/0x300 [ 494.566512][T13663] ? netif_skb_features+0xb87/0x17f0 [ 494.571864][T13663] kmem_cache_alloc+0x5a/0x2c0 [ 494.576674][T13663] ? skb_clone+0x1eb/0x370 [ 494.581137][T13663] skb_clone+0x1eb/0x370 [ 494.585455][T13663] ? dev_queue_xmit_nit+0x204/0xba0 [ 494.590722][T13663] dev_queue_xmit_nit+0x23f/0xba0 [ 494.595812][T13663] ? dev_queue_xmit_nit+0x2d/0xba0 [ 494.601018][T13663] dev_hard_start_xmit+0x150/0x790 [ 494.606207][T13663] ? __dev_queue_xmit+0x275/0x3630 [ 494.611371][T13663] __dev_queue_xmit+0x198c/0x3630 [ 494.616458][T13663] ? __dev_queue_xmit+0x275/0x3630 [ 494.621652][T13663] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 494.627863][T13663] ? netdev_core_pick_tx+0x370/0x370 [ 494.633211][T13663] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 494.639327][T13663] ? __copy_skb_header+0xa3/0x4a0 [ 494.644395][T13663] ? __asan_memcpy+0x40/0x70 [ 494.649034][T13663] ? __skb_clone+0x5c/0x6c0 [ 494.653572][T13663] ? __skb_clone+0x446/0x6c0 [ 494.658198][T13663] ? skb_clone+0x21f/0x370 [ 494.662638][T13663] __netlink_deliver_tap+0x579/0x7f0 [ 494.667956][T13663] ? netlink_deliver_tap+0x2e/0x1b0 [ 494.673178][T13663] netlink_deliver_tap+0x19c/0x1b0 [ 494.678336][T13663] netlink_unicast+0x77b/0x930 [ 494.683141][T13663] netlink_sendmsg+0x8d0/0xbf0 [ 494.687945][T13663] ? netlink_getsockopt+0x590/0x590 [ 494.693164][T13663] ? apparmor_socket_sendmsg+0x8e/0x330 [ 494.698732][T13663] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 494.704041][T13663] ? security_socket_sendmsg+0x80/0xa0 [ 494.709515][T13663] ? netlink_getsockopt+0x590/0x590 [ 494.714733][T13663] ____sys_sendmsg+0x61b/0x980 [ 494.719522][T13663] ? __asan_memset+0x22/0x40 [ 494.724137][T13663] ? __sys_sendmsg_sock+0x30/0x30 [ 494.729185][T13663] ? __import_iovec+0x5f2/0x850 [ 494.734071][T13663] ? import_iovec+0x73/0xa0 [ 494.738603][T13663] ___sys_sendmsg+0x2a6/0x360 [ 494.743312][T13663] ? __sys_sendmsg+0x2b0/0x2b0 [ 494.748139][T13663] __se_sys_sendmsg+0x1d0/0x2c0 [ 494.753014][T13663] ? __x64_sys_sendmsg+0x80/0x80 [ 494.758019][T13663] ? syscall_enter_from_user_mode+0x2e/0x80 [ 494.763981][T13663] do_syscall_64+0x55/0xb0 [ 494.768430][T13663] ? clear_bhb_loop+0x40/0x90 [ 494.773129][T13663] ? clear_bhb_loop+0x40/0x90 [ 494.777883][T13663] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 494.783807][T13663] RIP: 0033:0x7fd71e59e0d9 [ 494.788258][T13663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 494.807902][T13663] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 494.816345][T13663] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 494.824349][T13663] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000009 [ 494.832364][T13663] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 494.840372][T13663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.848366][T13663] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 494.856372][T13663] [ 494.883311][T13663] netlink: 'syz.1.2780': attribute type 10 has an invalid length. [ 494.891523][T13663] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2780'. [ 494.902344][T13663] ipvlan1: entered promiscuous mode [ 494.908096][T13663] ipvlan1: entered allmulticast mode [ 494.915528][T13663] veth0_vlan: entered allmulticast mode [ 494.965336][T13663] bridge0: port 3(ipvlan1) entered blocking state [ 494.977448][T13663] bridge0: port 3(ipvlan1) entered disabled state [ 495.019119][T13663] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 495.158461][T13673] FAULT_INJECTION: forcing a failure. [ 495.158461][T13673] name failslab, interval 1, probability 0, space 0, times 0 [ 495.172656][T13673] CPU: 1 PID: 13673 Comm: syz.2.2785 Not tainted syzkaller #0 [ 495.180206][T13673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 495.190343][T13673] Call Trace: [ 495.193693][T13673] [ 495.196698][T13673] dump_stack_lvl+0x18c/0x250 [ 495.201475][T13673] ? show_regs_print_info+0x20/0x20 [ 495.206741][T13673] ? load_image+0x420/0x420 [ 495.211349][T13673] ? __might_sleep+0xe0/0xe0 [ 495.216019][T13673] ? __lock_acquire+0x7d80/0x7d80 [ 495.221130][T13673] should_fail_ex+0x394/0x4c0 [ 495.225902][T13673] should_failslab+0x9/0x20 [ 495.230505][T13673] slab_pre_alloc_hook+0x59/0x300 [ 495.235882][T13673] ? security_sk_alloc+0x4b/0x130 [ 495.240973][T13673] ? security_sk_alloc+0x4b/0x130 [ 495.246061][T13673] __kmem_cache_alloc_node+0x53/0x250 [ 495.251519][T13673] ? security_sk_alloc+0x4b/0x130 [ 495.256591][T13673] __kmalloc+0xa7/0x240 [ 495.260840][T13673] security_sk_alloc+0x4b/0x130 [ 495.265809][T13673] sk_prot_alloc+0x101/0x210 [ 495.270497][T13673] sk_alloc+0x3a/0x350 [ 495.274653][T13673] ? sock_alloc+0xfe/0x220 [ 495.279259][T13673] kcm_ioctl+0x213/0xfd0 [ 495.283614][T13673] ? kcm_release+0x5a0/0x5a0 [ 495.288275][T13673] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 495.293971][T13673] ? tomoyo_path_number_perm+0x217/0x5e0 [ 495.299672][T13673] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 495.305234][T13673] sock_do_ioctl+0xfc/0x310 [ 495.309812][T13673] ? sock_show_fdinfo+0xb0/0xb0 [ 495.314826][T13673] sock_ioctl+0x5be/0x7e0 [ 495.319256][T13673] ? sock_poll+0x3e0/0x3e0 [ 495.323797][T13673] ? bpf_lsm_file_ioctl+0x9/0x10 [ 495.328829][T13673] ? security_file_ioctl+0x80/0xa0 [ 495.334040][T13673] ? sock_poll+0x3e0/0x3e0 [ 495.338553][T13673] __se_sys_ioctl+0xfd/0x170 [ 495.343222][T13673] do_syscall_64+0x55/0xb0 [ 495.347687][T13673] ? clear_bhb_loop+0x40/0x90 [ 495.352417][T13673] ? clear_bhb_loop+0x40/0x90 [ 495.357148][T13673] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 495.363157][T13673] RIP: 0033:0x7ff21299e0d9 [ 495.367644][T13673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.387323][T13673] RSP: 002b:00007ff2137ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 495.395795][T13673] RAX: ffffffffffffffda RBX: 00007ff212c25fa0 RCX: 00007ff21299e0d9 [ 495.403836][T13673] RDX: 0000200000001c40 RSI: 00000000000089e2 RDI: 0000000000000006 [ 495.411850][T13673] RBP: 00007ff2137ff090 R08: 0000000000000000 R09: 0000000000000000 [ 495.419905][T13673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 495.427932][T13673] R13: 00007ff212c26038 R14: 00007ff212c25fa0 R15: 00007ffdb52467e8 [ 495.436048][T13673] [ 495.547981][T13675] FAULT_INJECTION: forcing a failure. [ 495.547981][T13675] name failslab, interval 1, probability 0, space 0, times 0 [ 495.561393][T13675] CPU: 0 PID: 13675 Comm: syz.1.2784 Not tainted syzkaller #0 [ 495.568915][T13675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 495.579032][T13675] Call Trace: [ 495.582334][T13675] [ 495.585290][T13675] dump_stack_lvl+0x18c/0x250 [ 495.590086][T13675] ? show_regs_print_info+0x20/0x20 [ 495.595310][T13675] ? load_image+0x420/0x420 [ 495.599871][T13675] ? __asan_memset+0x22/0x40 [ 495.604503][T13675] should_fail_ex+0x394/0x4c0 [ 495.609212][T13675] should_failslab+0x9/0x20 [ 495.613780][T13675] slab_pre_alloc_hook+0x59/0x300 [ 495.618838][T13675] ? __debug_object_init+0xec/0x450 [ 495.624063][T13675] kmem_cache_alloc+0x5a/0x2c0 [ 495.628850][T13675] ? slab_build_skb+0x28/0x3e0 [ 495.633649][T13675] slab_build_skb+0x28/0x3e0 [ 495.638295][T13675] bpf_prog_test_run_skb+0x38f/0x18f0 [ 495.643705][T13675] ? __fget_files+0x28/0x460 [ 495.648335][T13675] ? __fget_files+0x3fc/0x460 [ 495.653043][T13675] ? cpu_online+0x60/0x60 [ 495.657393][T13675] bpf_prog_test_run+0x31f/0x390 [ 495.662376][T13675] __sys_bpf+0x49d/0x890 [ 495.666665][T13675] ? read_tsc+0x9/0x20 [ 495.670765][T13675] ? bpf_link_show_fdinfo+0x390/0x390 [ 495.676173][T13675] ? lock_chain_count+0x20/0x20 [ 495.681053][T13675] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 495.687070][T13675] __x64_sys_bpf+0x7c/0x90 [ 495.691507][T13675] do_syscall_64+0x55/0xb0 [ 495.695950][T13675] ? clear_bhb_loop+0x40/0x90 [ 495.700649][T13675] ? clear_bhb_loop+0x40/0x90 [ 495.705351][T13675] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 495.711255][T13675] RIP: 0033:0x7fd71e59e0d9 [ 495.715689][T13675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.735315][T13675] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 495.743758][T13675] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 495.751747][T13675] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 495.759737][T13675] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 495.767723][T13675] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 495.775718][T13675] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 495.783745][T13675] [ 496.281323][T13691] netlink: 'syz.1.2792': attribute type 27 has an invalid length. [ 501.840117][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.846564][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.918858][T13716] FAULT_INJECTION: forcing a failure. [ 502.918858][T13716] name failslab, interval 1, probability 0, space 0, times 0 [ 502.962975][T13716] CPU: 0 PID: 13716 Comm: syz.1.2802 Not tainted syzkaller #0 [ 502.970513][T13716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 502.980606][T13716] Call Trace: [ 502.983907][T13716] [ 502.986855][T13716] dump_stack_lvl+0x18c/0x250 [ 502.991561][T13716] ? show_regs_print_info+0x20/0x20 [ 502.996797][T13716] ? load_image+0x420/0x420 [ 503.001330][T13716] ? __might_sleep+0xe0/0xe0 [ 503.005950][T13716] ? __lock_acquire+0x7d80/0x7d80 [ 503.010997][T13716] ? __asan_memset+0x22/0x40 [ 503.015641][T13716] should_fail_ex+0x394/0x4c0 [ 503.020360][T13716] should_failslab+0x9/0x20 [ 503.024906][T13716] slab_pre_alloc_hook+0x59/0x300 [ 503.029973][T13716] kmem_cache_alloc+0x5a/0x2c0 [ 503.034774][T13716] ? security_inode_alloc+0x34/0x110 [ 503.040095][T13716] security_inode_alloc+0x34/0x110 [ 503.045267][T13716] inode_init_always+0x914/0xc90 [ 503.050232][T13716] new_inode_pseudo+0x95/0x1d0 [ 503.055026][T13716] __sock_create+0x12d/0x940 [ 503.059646][T13716] mptcp_subflow_create_socket+0x10c/0xad0 [ 503.065594][T13716] ? verify_lock_unused+0x140/0x140 [ 503.070827][T13716] ? __mptcp_subflow_connect+0x14d0/0x14d0 [ 503.076667][T13716] ? mark_lock+0x94/0x320 [ 503.081032][T13716] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 503.087054][T13716] __mptcp_nmpc_sk+0x157/0x720 [ 503.091843][T13716] ? __bpf_trace_subflow_check_data_avail+0x160/0x160 [ 503.098620][T13716] ? __local_bh_enable_ip+0x13a/0x1c0 [ 503.104013][T13716] ? lockdep_hardirqs_on+0x98/0x150 [ 503.109236][T13716] ? __local_bh_enable_ip+0x13a/0x1c0 [ 503.114636][T13716] mptcp_sendmsg_fastopen+0x7c/0x4c0 [ 503.119989][T13716] mptcp_sendmsg+0x144c/0x1670 [ 503.124805][T13716] ? aa_sk_perm+0x83c/0x970 [ 503.129353][T13716] ? aa_sk_perm+0x83c/0x970 [ 503.133889][T13716] ? aa_af_perm+0x330/0x330 [ 503.138431][T13716] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 503.144875][T13716] ? mptcp_shutdown+0x80/0x80 [ 503.149666][T13716] ? inet_send_prepare+0xb2/0x250 [ 503.154763][T13716] ? inet6_sendmsg+0x5f/0xd0 [ 503.159390][T13716] ? inet6_compat_ioctl+0x3c0/0x3c0 [ 503.164627][T13716] ____sys_sendmsg+0x61b/0x980 [ 503.169424][T13716] ? __asan_memset+0x22/0x40 [ 503.174045][T13716] ? __sys_sendmsg_sock+0x30/0x30 [ 503.179098][T13716] ? __import_iovec+0x3fa/0x850 [ 503.184028][T13716] ? import_iovec+0x73/0xa0 [ 503.188567][T13716] ___sys_sendmsg+0x2a6/0x360 [ 503.193270][T13716] ? get_pid_task+0x20/0x1e0 [ 503.197917][T13716] ? __sys_sendmsg+0x2b0/0x2b0 [ 503.202731][T13716] ? __lock_acquire+0x7d80/0x7d80 [ 503.207802][T13716] __se_sys_sendmsg+0x1d0/0x2c0 [ 503.212677][T13716] ? __x64_sys_sendmsg+0x80/0x80 [ 503.217659][T13716] ? lockdep_hardirqs_on+0x98/0x150 [ 503.222905][T13716] do_syscall_64+0x55/0xb0 [ 503.227366][T13716] ? clear_bhb_loop+0x40/0x90 [ 503.232078][T13716] ? clear_bhb_loop+0x40/0x90 [ 503.236785][T13716] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 503.242706][T13716] RIP: 0033:0x7fd71e59e0d9 [ 503.247159][T13716] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 503.266792][T13716] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 503.275239][T13716] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 503.283238][T13716] RDX: 0000000020040010 RSI: 00002000000019c0 RDI: 0000000000000003 [ 503.291231][T13716] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 503.299221][T13716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.307239][T13716] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 503.315247][T13716] [ 503.342362][T13716] socket: no more sockets [ 503.405517][T13718] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.2803'. [ 503.463669][T13718] netlink: 'syz.0.2803': attribute type 10 has an invalid length. [ 503.471885][T13718] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2803'. [ 503.492418][T13718] ipvlan1: entered promiscuous mode [ 503.501677][T13718] ipvlan1: entered allmulticast mode [ 503.509095][T13718] veth0_vlan: entered allmulticast mode [ 503.564438][T13718] bridge0: port 4(ipvlan1) entered blocking state [ 503.573084][T13718] bridge0: port 4(ipvlan1) entered disabled state [ 503.618963][T13718] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 503.701702][T13728] netlink: 'syz.3.2806': attribute type 27 has an invalid length. [ 505.156554][T13750] netlink: 197344 bytes leftover after parsing attributes in process `syz.0.2811'. [ 507.668105][T13771] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2819'. [ 507.754884][T13771] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 508.131380][T13783] FAULT_INJECTION: forcing a failure. [ 508.131380][T13783] name failslab, interval 1, probability 0, space 0, times 0 [ 508.157263][T13780] netlink: 197344 bytes leftover after parsing attributes in process `syz.3.2822'. [ 508.177217][T13783] CPU: 1 PID: 13783 Comm: syz.0.2823 Not tainted syzkaller #0 [ 508.184849][T13783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 508.194942][T13783] Call Trace: [ 508.198250][T13783] [ 508.201212][T13783] dump_stack_lvl+0x18c/0x250 [ 508.205948][T13783] ? show_regs_print_info+0x20/0x20 [ 508.211182][T13783] ? load_image+0x420/0x420 [ 508.215737][T13783] ? __lock_acquire+0x7d80/0x7d80 [ 508.220785][T13783] should_fail_ex+0x394/0x4c0 [ 508.225500][T13783] should_failslab+0x9/0x20 [ 508.230061][T13783] slab_pre_alloc_hook+0x59/0x300 [ 508.235177][T13783] ? ____sys_sendmsg+0x61b/0x980 [ 508.240183][T13783] ? ___sys_sendmsg+0x2a6/0x360 [ 508.245057][T13783] ? __se_sys_sendmsg+0x1d0/0x2c0 [ 508.250133][T13783] kmem_cache_alloc_node+0x5e/0x310 [ 508.255395][T13783] ? alloc_vmap_area+0x1b4/0x1e50 [ 508.260497][T13783] alloc_vmap_area+0x1b4/0x1e50 [ 508.265436][T13783] ? vm_map_ram+0xcf0/0xcf0 [ 508.270004][T13783] ? rcu_is_watching+0x15/0xb0 [ 508.274833][T13783] __get_vm_area_node+0x162/0x370 [ 508.279950][T13783] __vmalloc_node_range+0x36f/0x1320 [ 508.285294][T13783] ? netlink_sendmsg+0x602/0xbf0 [ 508.290278][T13783] ? netlink_insert+0x1094/0x1390 [ 508.295375][T13783] ? netlink_insert+0x2ba/0x1390 [ 508.300381][T13783] ? free_vm_area+0x50/0x50 [ 508.304976][T13783] ? netlink_sendmsg+0x602/0xbf0 [ 508.309954][T13783] vmalloc+0x79/0x90 [ 508.313900][T13783] ? netlink_sendmsg+0x602/0xbf0 [ 508.318875][T13783] netlink_sendmsg+0x602/0xbf0 [ 508.323703][T13783] ? netlink_getsockopt+0x590/0x590 [ 508.328943][T13783] ? apparmor_socket_sendmsg+0x8e/0x330 [ 508.334550][T13783] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 508.339895][T13783] ? security_socket_sendmsg+0x80/0xa0 [ 508.345423][T13783] ? netlink_getsockopt+0x590/0x590 [ 508.350688][T13783] ____sys_sendmsg+0x61b/0x980 [ 508.355517][T13783] ? __asan_memset+0x22/0x40 [ 508.360200][T13783] ? __sys_sendmsg_sock+0x30/0x30 [ 508.365279][T13783] ? __import_iovec+0x5f2/0x850 [ 508.370194][T13783] ? import_iovec+0x73/0xa0 [ 508.374766][T13783] ___sys_sendmsg+0x2a6/0x360 [ 508.379493][T13783] ? get_pid_task+0x20/0x1e0 [ 508.384148][T13783] ? __sys_sendmsg+0x2b0/0x2b0 [ 508.388990][T13783] ? __lock_acquire+0x7d80/0x7d80 [ 508.394083][T13783] __se_sys_sendmsg+0x1d0/0x2c0 [ 508.398983][T13783] ? __x64_sys_sendmsg+0x80/0x80 [ 508.403979][T13783] ? lockdep_hardirqs_on+0x98/0x150 [ 508.409235][T13783] do_syscall_64+0x55/0xb0 [ 508.413707][T13783] ? clear_bhb_loop+0x40/0x90 [ 508.418433][T13783] ? clear_bhb_loop+0x40/0x90 [ 508.423168][T13783] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 508.429106][T13783] RIP: 0033:0x7fcbf7d9e0d9 [ 508.433551][T13783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.453194][T13783] RSP: 002b:00007fcbf8d32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 508.461646][T13783] RAX: ffffffffffffffda RBX: 00007fcbf8025fa0 RCX: 00007fcbf7d9e0d9 [ 508.469634][T13783] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 508.477626][T13783] RBP: 00007fcbf8d32090 R08: 0000000000000000 R09: 0000000000000000 [ 508.485621][T13783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.493618][T13783] R13: 00007fcbf8026038 R14: 00007fcbf8025fa0 R15: 00007fffedb8ba78 [ 508.501627][T13783] [ 508.535577][T13783] warn_alloc: 1 callbacks suppressed [ 508.535596][T13783] syz.0.2823: vmalloc error: size 65600, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 508.558629][T13783] CPU: 1 PID: 13783 Comm: syz.0.2823 Not tainted syzkaller #0 [ 508.566153][T13783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 508.576248][T13783] Call Trace: [ 508.579573][T13783] [ 508.582542][T13783] dump_stack_lvl+0x18c/0x250 [ 508.587254][T13783] ? show_regs_print_info+0x20/0x20 [ 508.592536][T13783] ? load_image+0x420/0x420 [ 508.597093][T13783] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 508.603588][T13783] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 508.610137][T13783] warn_alloc+0x246/0x340 [ 508.614550][T13783] ? slab_free_freelist_hook+0x130/0x1a0 [ 508.620231][T13783] ? zone_watermark_ok_safe+0x230/0x230 [ 508.625817][T13783] ? __get_vm_area_node+0x17b/0x370 [ 508.631082][T13783] ? __get_vm_area_node+0x17b/0x370 [ 508.636338][T13783] __vmalloc_node_range+0x394/0x1320 [ 508.641672][T13783] ? netlink_insert+0x1094/0x1390 [ 508.646754][T13783] ? netlink_insert+0x2ba/0x1390 [ 508.651738][T13783] ? free_vm_area+0x50/0x50 [ 508.656308][T13783] ? netlink_sendmsg+0x602/0xbf0 [ 508.661333][T13783] vmalloc+0x79/0x90 [ 508.665285][T13783] ? netlink_sendmsg+0x602/0xbf0 [ 508.670270][T13783] netlink_sendmsg+0x602/0xbf0 [ 508.675093][T13783] ? netlink_getsockopt+0x590/0x590 [ 508.680335][T13783] ? apparmor_socket_sendmsg+0x8e/0x330 [ 508.685934][T13783] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 508.691275][T13783] ? security_socket_sendmsg+0x80/0xa0 [ 508.696774][T13783] ? netlink_getsockopt+0x590/0x590 [ 508.702019][T13783] ____sys_sendmsg+0x61b/0x980 [ 508.706838][T13783] ? __asan_memset+0x22/0x40 [ 508.711474][T13783] ? __sys_sendmsg_sock+0x30/0x30 [ 508.716530][T13783] ? __import_iovec+0x5f2/0x850 [ 508.721428][T13783] ? import_iovec+0x73/0xa0 [ 508.725993][T13783] ___sys_sendmsg+0x2a6/0x360 [ 508.730711][T13783] ? get_pid_task+0x20/0x1e0 [ 508.735357][T13783] ? __sys_sendmsg+0x2b0/0x2b0 [ 508.740180][T13783] ? __lock_acquire+0x7d80/0x7d80 [ 508.745272][T13783] __se_sys_sendmsg+0x1d0/0x2c0 [ 508.750174][T13783] ? __x64_sys_sendmsg+0x80/0x80 [ 508.755178][T13783] ? lockdep_hardirqs_on+0x98/0x150 [ 508.760423][T13783] do_syscall_64+0x55/0xb0 [ 508.764884][T13783] ? clear_bhb_loop+0x40/0x90 [ 508.769607][T13783] ? clear_bhb_loop+0x40/0x90 [ 508.774349][T13783] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 508.780286][T13783] RIP: 0033:0x7fcbf7d9e0d9 [ 508.784739][T13783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.804360][T13783] RSP: 002b:00007fcbf8d32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 508.812791][T13783] RAX: ffffffffffffffda RBX: 00007fcbf8025fa0 RCX: 00007fcbf7d9e0d9 [ 508.820790][T13783] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 508.828782][T13783] RBP: 00007fcbf8d32090 R08: 0000000000000000 R09: 0000000000000000 [ 508.836770][T13783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.844756][T13783] R13: 00007fcbf8026038 R14: 00007fcbf8025fa0 R15: 00007fffedb8ba78 [ 508.852775][T13783] [ 508.863130][T13783] Mem-Info: [ 508.867208][T13783] active_anon:9964 inactive_anon:0 isolated_anon:0 [ 508.867208][T13783] active_file:21356 inactive_file:40121 isolated_file:0 [ 508.867208][T13783] unevictable:768 dirty:123 writeback:0 [ 508.867208][T13783] slab_reclaimable:10414 slab_unreclaimable:95348 [ 508.867208][T13783] mapped:25192 shmem:1361 pagetables:533 [ 508.867208][T13783] sec_pagetables:0 bounce:0 [ 508.867208][T13783] kernel_misc_reclaimable:0 [ 508.867208][T13783] free:1336033 free_pcp:5712 free_cma:0 [ 508.924786][T13783] Node 0 active_anon:39856kB inactive_anon:0kB active_file:85424kB inactive_file:160280kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100768kB dirty:492kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10264kB pagetables:2132kB sec_pagetables:0kB all_unreclaimable? no [ 508.958812][T13783] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 508.990796][T13783] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 509.019048][T13783] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 509.047606][T13783] Node 0 DMA32 free:1429268kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:39716kB inactive_anon:0kB active_file:85424kB inactive_file:159460kB unevictable:1536kB writepending:492kB present:3129332kB managed:2586828kB mlocked:0kB bounce:0kB free_pcp:4400kB local_pcp:3972kB free_cma:0kB [ 509.079307][T13783] lowmem_reserve[]: 0 0 0 0 0 [ 509.085292][T13783] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:820kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:0kB free_cma:0kB [ 509.112731][T13783] lowmem_reserve[]: 0 0 0 0 0 [ 509.117934][T13783] Node 1 Normal free:3898564kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:18368kB local_pcp:13184kB free_cma:0kB [ 509.150535][T13783] lowmem_reserve[]: 0 0 0 0 0 [ 509.156022][T13783] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 509.173674][T13783] Node 0 DMA32: 1697*4kB (UME) 686*8kB (UME) 960*16kB (UME) 817*32kB (UME) 1210*64kB (UME) 383*128kB (UME) 197*256kB (UME) 75*512kB (UM) 31*1024kB (UM) 7*2048kB (UME) 272*4096kB (UM) = 1429268kB [ 509.193635][T13783] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 509.205741][T13783] Node 1 Normal: 281*4kB (UM) 58*8kB (UME) 41*16kB (UME) 180*32kB (UME) 38*64kB (UE) 6*128kB (UME) 1*256kB (U) 2*512kB (ME) 1*1024kB (E) 1*2048kB (E) 948*4096kB (M) = 3898564kB [ 509.224117][T13783] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 509.234983][T13783] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 509.252858][T13783] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 509.263048][T13783] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 509.272403][T13783] 62838 total pagecache pages [ 509.277187][T13783] 0 pages in swap cache [ 509.281368][T13783] Free swap = 124996kB [ 509.286838][T13783] Total swap = 124996kB [ 509.291061][T13783] 2097051 pages RAM [ 509.295195][T13783] 0 pages HighMem/MovableOnly [ 509.299931][T13783] 416958 pages reserved [ 509.313180][T13783] 0 pages cma reserved [ 509.466249][T13798] netlink: 'syz.2.2826': attribute type 27 has an invalid length. [ 510.037406][T13810] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2831'. [ 512.545915][T13813] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.2832'. [ 512.717201][T13823] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.2837'. [ 512.835407][T13827] FAULT_INJECTION: forcing a failure. [ 512.835407][T13827] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 512.852864][T13827] CPU: 1 PID: 13827 Comm: syz.3.2838 Not tainted syzkaller #0 [ 512.860394][T13827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 512.871197][T13827] Call Trace: [ 512.874523][T13827] [ 512.877524][T13827] dump_stack_lvl+0x18c/0x250 [ 512.882255][T13827] ? show_regs_print_info+0x20/0x20 [ 512.887497][T13827] ? load_image+0x420/0x420 [ 512.892046][T13827] ? __might_fault+0xaa/0x120 [ 512.896756][T13827] ? __lock_acquire+0x7d80/0x7d80 [ 512.901844][T13827] should_fail_ex+0x394/0x4c0 [ 512.906574][T13827] _copy_from_iter+0x1cd/0x1290 [ 512.911477][T13827] ? rcu_is_watching+0x15/0xb0 [ 512.916296][T13827] ? copyout_mc+0x70/0x70 [ 512.920683][T13827] ? __virt_addr_valid+0x10c/0x380 [ 512.925872][T13827] ? __virt_addr_valid+0x10c/0x380 [ 512.931033][T13827] ? __virt_addr_valid+0x10c/0x380 [ 512.936197][T13827] ? __check_object_size+0x4fc/0xa40 [ 512.941553][T13827] netlink_sendmsg+0x76b/0xbf0 [ 512.946372][T13827] ? netlink_getsockopt+0x590/0x590 [ 512.951628][T13827] ? apparmor_socket_sendmsg+0x8e/0x330 [ 512.957234][T13827] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 512.962562][T13827] ? security_socket_sendmsg+0x80/0xa0 [ 512.968054][T13827] ? netlink_getsockopt+0x590/0x590 [ 512.973285][T13827] ____sys_sendmsg+0x61b/0x980 [ 512.978090][T13827] ? __asan_memset+0x22/0x40 [ 512.982720][T13827] ? __sys_sendmsg_sock+0x30/0x30 [ 512.987785][T13827] ? __import_iovec+0x5f2/0x850 [ 512.992686][T13827] ? import_iovec+0x73/0xa0 [ 512.997280][T13827] ___sys_sendmsg+0x2a6/0x360 [ 513.002006][T13827] ? __sys_sendmsg+0x2b0/0x2b0 [ 513.006854][T13827] ? ktime_get+0x7f/0x280 [ 513.011228][T13827] ? trace_call_bpf+0xc3/0x6c0 [ 513.016055][T13827] __se_sys_sendmsg+0x1d0/0x2c0 [ 513.020949][T13827] ? perf_trace_preemptirq_template+0x269/0x330 [ 513.027238][T13827] ? __x64_sys_sendmsg+0x80/0x80 [ 513.032231][T13827] ? lockdep_hardirqs_on+0x98/0x150 [ 513.037491][T13827] do_syscall_64+0x55/0xb0 [ 513.041944][T13827] ? clear_bhb_loop+0x40/0x90 [ 513.046672][T13827] ? clear_bhb_loop+0x40/0x90 [ 513.051389][T13827] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 513.057318][T13827] RIP: 0033:0x7efca939e0d9 [ 513.061788][T13827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 513.081428][T13827] RSP: 002b:00007efcaa2cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 513.089911][T13827] RAX: ffffffffffffffda RBX: 00007efca9625fa0 RCX: 00007efca939e0d9 [ 513.097918][T13827] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 513.105922][T13827] RBP: 00007efcaa2cf090 R08: 0000000000000000 R09: 0000000000000000 [ 513.113922][T13827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 513.121930][T13827] R13: 00007efca9626038 R14: 00007efca9625fa0 R15: 00007fff9ff939e8 [ 513.129957][T13827] [ 513.458271][T13838] sit0: entered allmulticast mode [ 513.467285][T13839] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.2843'. [ 513.522504][T13838] sit0: entered promiscuous mode [ 513.664251][T13841] netlink: 'syz.0.2844': attribute type 27 has an invalid length. [ 514.014057][T13856] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2849'. [ 514.025601][T13856] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2849'. [ 514.035918][T13852] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2849'. [ 514.053348][T13853] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2849'. [ 516.890134][T13868] netlink: 164 bytes leftover after parsing attributes in process `syz.2.2853'. [ 516.960343][T13873] FAULT_INJECTION: forcing a failure. [ 516.960343][T13873] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 516.975349][T13873] CPU: 0 PID: 13873 Comm: syz.3.2854 Not tainted syzkaller #0 [ 516.982846][T13873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 516.992943][T13873] Call Trace: [ 516.996262][T13873] [ 516.999251][T13873] dump_stack_lvl+0x18c/0x250 [ 517.004011][T13873] ? show_regs_print_info+0x20/0x20 [ 517.009254][T13873] ? load_image+0x420/0x420 [ 517.013827][T13873] ? __lock_acquire+0x7d80/0x7d80 [ 517.019001][T13873] should_fail_ex+0x394/0x4c0 [ 517.023732][T13873] prepare_alloc_pages+0x1e1/0x5b0 [ 517.028919][T13873] __alloc_pages+0x134/0x460 [ 517.033563][T13873] ? zone_statistics+0x170/0x170 [ 517.038573][T13873] __pmd_alloc+0x9a/0x8c0 [ 517.042961][T13873] ? mt_find+0x169/0x640 [ 517.047281][T13873] ? __lock_acquire+0x7d80/0x7d80 [ 517.052353][T13873] ? __pud_alloc+0x200/0x200 [ 517.057088][T13873] ? hugepage_vma_check+0x471/0x560 [ 517.062342][T13873] handle_mm_fault+0xb75/0x4a50 [ 517.067245][T13873] ? handle_mm_fault+0xe6/0x4a50 [ 517.072240][T13873] ? numa_migrate_prep+0x350/0x350 [ 517.077499][T13873] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 517.082838][T13873] do_user_addr_fault+0x736/0x12d0 [ 517.088011][T13873] exc_page_fault+0x64/0x100 [ 517.092672][T13873] asm_exc_page_fault+0x26/0x30 [ 517.097569][T13873] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 517.103437][T13873] Code: f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 [ 517.123099][T13873] RSP: 0018:ffffc9000ff2fa10 EFLAGS: 00050216 [ 517.129219][T13873] RAX: ffffffff8433a801 RBX: 0000000000000020 RCX: 0000000000000020 [ 517.137291][T13873] RDX: 0000000000000001 RSI: 000000110c230000 RDI: ffff888060836140 [ 517.145288][T13873] RBP: ffffc9000ff2fba8 R08: ffff88806083615f R09: 1ffff1100c106c2b [ 517.153307][T13873] R10: dffffc0000000000 R11: ffffed100c106c2c R12: 000000110c230020 [ 517.161318][T13873] R13: ffff888060836140 R14: ffff888060836140 R15: 000000110c230000 [ 517.169337][T13873] ? _copy_from_user+0x11/0xe0 [ 517.174155][T13873] _copy_from_user+0x8b/0xe0 [ 517.178815][T13873] ioctl_standard_iw_point+0x5f8/0xd50 [ 517.184439][T13873] ? cfg80211_wext_giwap+0x120/0x120 [ 517.189766][T13873] ? iw_handler_get_iwstats+0x110/0x110 [ 517.195362][T13873] ? wext_ioctl_dispatch+0x106/0x650 [ 517.200692][T13873] ? mutex_lock_nested+0x20/0x20 [ 517.205793][T13873] ioctl_standard_call+0xae/0x250 [ 517.210872][T13873] ? cfg80211_wext_giwap+0x120/0x120 [ 517.216199][T13873] ? cfg80211_wext_giwap+0x120/0x120 [ 517.221537][T13873] wext_ioctl_dispatch+0x51a/0x650 [ 517.226701][T13873] ? __lock_acquire+0x7d80/0x7d80 [ 517.231794][T13873] ? wext_ioctl_dispatch+0x650/0x650 [ 517.237103][T13873] ? iw_handler_get_private+0x1f0/0x1f0 [ 517.242691][T13873] ? wext_handle_ioctl+0x1e0/0x1e0 [ 517.247847][T13873] ? __might_fault+0xaa/0x120 [ 517.252554][T13873] ? __might_fault+0xc6/0x120 [ 517.257269][T13873] ? __might_fault+0xaa/0x120 [ 517.262002][T13873] wext_handle_ioctl+0x118/0x1e0 [ 517.267003][T13873] ? call_commit_handler+0xf0/0xf0 [ 517.272178][T13873] sock_ioctl+0x15d/0x7e0 [ 517.276584][T13873] ? sock_poll+0x3e0/0x3e0 [ 517.281094][T13873] ? bpf_lsm_file_ioctl+0x9/0x10 [ 517.286089][T13873] ? security_file_ioctl+0x80/0xa0 [ 517.291258][T13873] ? sock_poll+0x3e0/0x3e0 [ 517.295725][T13873] __se_sys_ioctl+0xfd/0x170 [ 517.300370][T13873] do_syscall_64+0x55/0xb0 [ 517.304865][T13873] ? clear_bhb_loop+0x40/0x90 [ 517.309613][T13873] ? clear_bhb_loop+0x40/0x90 [ 517.314349][T13873] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 517.320306][T13873] RIP: 0033:0x7efca939e0d9 [ 517.324772][T13873] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 517.344428][T13873] RSP: 002b:00007efcaa2cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 517.352936][T13873] RAX: ffffffffffffffda RBX: 00007efca9625fa0 RCX: 00007efca939e0d9 [ 517.360955][T13873] RDX: 0000200000000000 RSI: 0000000000008b1a RDI: 0000000000000004 [ 517.368968][T13873] RBP: 00007efcaa2cf090 R08: 0000000000000000 R09: 0000000000000000 [ 517.376972][T13873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 517.384997][T13873] R13: 00007efca9626038 R14: 00007efca9625fa0 R15: 00007fff9ff939e8 [ 517.393029][T13873] [ 517.414433][T13873] mac80211_hwsim hwsim51 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 518.111777][T13891] netlink: 'syz.1.2860': attribute type 10 has an invalid length. [ 518.138935][T13891] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2860'. [ 518.162225][T13891] bridge0: port 3(ipvlan1) entered blocking state [ 518.181117][T13891] bridge0: port 3(ipvlan1) entered disabled state [ 518.216109][T13891] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 518.262091][T13895] netlink: 'syz.0.2863': attribute type 27 has an invalid length. [ 518.849351][T13916] netlink: 144316 bytes leftover after parsing attributes in process `syz.2.2870'. [ 518.862077][T13916] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2870'. [ 518.924098][T13921] netlink: 'syz.3.2871': attribute type 10 has an invalid length. [ 518.932209][T13921] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2871'. [ 518.941521][T13921] netlink: 'syz.3.2871': attribute type 10 has an invalid length. [ 518.949676][T13921] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2871'. [ 518.961474][T13919] netlink: 'syz.3.2871': attribute type 10 has an invalid length. [ 518.977626][T13919] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2871'. [ 519.065199][T13924] netlink: 15487 bytes leftover after parsing attributes in process `syz.2.2872'. [ 519.110260][T13924] netlink: 'syz.2.2872': attribute type 10 has an invalid length. [ 519.125007][T13924] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2872'. [ 519.138142][T13924] ipvlan1: entered promiscuous mode [ 519.144955][T13924] ipvlan1: entered allmulticast mode [ 519.151164][T13924] veth0_vlan: entered allmulticast mode [ 519.236026][T13924] bridge0: port 2(ipvlan1) entered blocking state [ 519.259981][T13924] bridge0: port 2(ipvlan1) entered disabled state [ 519.358883][T13924] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 519.445189][T13924] syz.2.2872 (13924) used greatest stack depth: 16552 bytes left [ 519.549778][T13930] netlink: 'syz.3.2874': attribute type 27 has an invalid length. [ 519.854683][T13938] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.2879'. [ 519.981756][T13938] netlink: 'syz.1.2879': attribute type 10 has an invalid length. [ 520.028265][T13945] netlink: 'syz.3.2881': attribute type 10 has an invalid length. [ 520.053046][T13938] bridge0: port 3(ipvlan1) entered blocking state [ 520.061537][T13938] bridge0: port 3(ipvlan1) entered disabled state [ 520.130355][T13938] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 520.153252][T13945] netlink: 'syz.3.2881': attribute type 10 has an invalid length. [ 520.887635][T13970] FAULT_INJECTION: forcing a failure. [ 520.887635][T13970] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 520.903975][T13970] CPU: 0 PID: 13970 Comm: syz.1.2891 Not tainted syzkaller #0 [ 520.911579][T13970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 520.921675][T13970] Call Trace: [ 520.924996][T13970] [ 520.927964][T13970] dump_stack_lvl+0x18c/0x250 [ 520.932690][T13970] ? show_regs_print_info+0x20/0x20 [ 520.937929][T13970] ? load_image+0x420/0x420 [ 520.942454][T13970] ? __lock_acquire+0x7d80/0x7d80 [ 520.947487][T13970] should_fail_ex+0x394/0x4c0 [ 520.952172][T13970] _copy_from_user+0x2f/0xe0 [ 520.956765][T13970] __copy_msghdr+0x388/0x560 [ 520.961366][T13970] ___sys_sendmsg+0x214/0x360 [ 520.966059][T13970] ? __sys_sendmsg+0x2b0/0x2b0 [ 520.970847][T13970] ? trace_call_bpf+0xc3/0x6c0 [ 520.975640][T13970] __se_sys_sendmsg+0x1d0/0x2c0 [ 520.980499][T13970] ? perf_trace_preemptirq_template+0x269/0x330 [ 520.986753][T13970] ? __x64_sys_sendmsg+0x80/0x80 [ 520.991703][T13970] ? lockdep_hardirqs_on+0x98/0x150 [ 520.996969][T13970] do_syscall_64+0x55/0xb0 [ 521.001415][T13970] ? clear_bhb_loop+0x40/0x90 [ 521.006122][T13970] ? clear_bhb_loop+0x40/0x90 [ 521.010823][T13970] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 521.016761][T13970] RIP: 0033:0x7fd71e59e0d9 [ 521.021241][T13970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 521.040911][T13970] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 521.049387][T13970] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 521.057438][T13970] RDX: 0000000020000044 RSI: 00002000000025c0 RDI: 0000000000000003 [ 521.065455][T13970] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 521.073468][T13970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 521.081497][T13970] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 521.089522][T13970] [ 521.565967][T13989] FAULT_INJECTION: forcing a failure. [ 521.565967][T13989] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 521.594718][T13989] CPU: 1 PID: 13989 Comm: syz.2.2899 Not tainted syzkaller #0 [ 521.602331][T13989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 521.612424][T13989] Call Trace: [ 521.615741][T13989] [ 521.618718][T13989] dump_stack_lvl+0x18c/0x250 [ 521.623445][T13989] ? show_regs_print_info+0x20/0x20 [ 521.628679][T13989] ? load_image+0x420/0x420 [ 521.633241][T13989] ? __lock_acquire+0x7d80/0x7d80 [ 521.638318][T13989] should_fail_ex+0x394/0x4c0 [ 521.643045][T13989] prepare_alloc_pages+0x1e1/0x5b0 [ 521.648290][T13989] __alloc_pages+0x134/0x460 [ 521.652919][T13989] ? zone_statistics+0x170/0x170 [ 521.657890][T13989] __pmd_alloc+0x9a/0x8c0 [ 521.662247][T13989] ? mt_find+0x169/0x640 [ 521.666519][T13989] ? __lock_acquire+0x7d80/0x7d80 [ 521.671562][T13989] ? __pud_alloc+0x200/0x200 [ 521.676172][T13989] ? hugepage_vma_check+0x471/0x560 [ 521.681421][T13989] handle_mm_fault+0xb75/0x4a50 [ 521.686293][T13989] ? handle_mm_fault+0xe6/0x4a50 [ 521.691268][T13989] ? numa_migrate_prep+0x350/0x350 [ 521.696408][T13989] ? perf_trace_lock+0xfc/0x3b0 [ 521.701292][T13989] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 521.706599][T13989] do_user_addr_fault+0x736/0x12d0 [ 521.711740][T13989] exc_page_fault+0x64/0x100 [ 521.716357][T13989] asm_exc_page_fault+0x26/0x30 [ 521.721235][T13989] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 521.727063][T13989] Code: f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 [ 521.746692][T13989] RSP: 0018:ffffc90003587a10 EFLAGS: 00050216 [ 521.752825][T13989] RAX: ffffffff8433a801 RBX: 0000000000000020 RCX: 0000000000000020 [ 521.760829][T13989] RDX: 0000000000000001 RSI: 000000110c230000 RDI: ffff888019ed19c0 [ 521.768854][T13989] RBP: ffffc90003587ba8 R08: ffff888019ed19df R09: 1ffff110033da33b [ 521.776856][T13989] R10: dffffc0000000000 R11: ffffed10033da33c R12: 000000110c230020 [ 521.784849][T13989] R13: ffff888019ed19c0 R14: ffff888019ed19c0 R15: 000000110c230000 [ 521.792853][T13989] ? _copy_from_user+0x11/0xe0 [ 521.797652][T13989] _copy_from_user+0x8b/0xe0 [ 521.802280][T13989] ioctl_standard_iw_point+0x5f8/0xd50 [ 521.807777][T13989] ? cfg80211_wext_giwap+0x120/0x120 [ 521.813092][T13989] ? iw_handler_get_iwstats+0x110/0x110 [ 521.818653][T13989] ? wext_ioctl_dispatch+0x106/0x650 [ 521.823963][T13989] ? mutex_lock_nested+0x20/0x20 [ 521.828932][T13989] ? apparmor_capable+0x137/0x1a0 [ 521.833983][T13989] ioctl_standard_call+0xae/0x250 [ 521.839028][T13989] ? cfg80211_wext_giwap+0x120/0x120 [ 521.844331][T13989] ? cfg80211_wext_giwap+0x120/0x120 [ 521.849633][T13989] wext_ioctl_dispatch+0x51a/0x650 [ 521.854782][T13989] ? __lock_acquire+0x7d80/0x7d80 [ 521.859835][T13989] ? wext_ioctl_dispatch+0x650/0x650 [ 521.865154][T13989] ? iw_handler_get_private+0x1f0/0x1f0 [ 521.870736][T13989] ? wext_handle_ioctl+0x1e0/0x1e0 [ 521.875900][T13989] ? __might_fault+0xaa/0x120 [ 521.880603][T13989] ? __might_fault+0xc6/0x120 [ 521.885309][T13989] ? __might_fault+0xaa/0x120 [ 521.890032][T13989] wext_handle_ioctl+0x118/0x1e0 [ 521.894999][T13989] ? call_commit_handler+0xf0/0xf0 [ 521.900144][T13989] sock_ioctl+0x15d/0x7e0 [ 521.904508][T13989] ? sock_poll+0x3e0/0x3e0 [ 521.908952][T13989] ? bpf_lsm_file_ioctl+0x9/0x10 [ 521.913915][T13989] ? security_file_ioctl+0x80/0xa0 [ 521.919081][T13989] ? sock_poll+0x3e0/0x3e0 [ 521.923548][T13989] __se_sys_ioctl+0xfd/0x170 [ 521.928167][T13989] do_syscall_64+0x55/0xb0 [ 521.932617][T13989] ? clear_bhb_loop+0x40/0x90 [ 521.937316][T13989] ? clear_bhb_loop+0x40/0x90 [ 521.942015][T13989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 521.947967][T13989] RIP: 0033:0x7ff21299e0d9 [ 521.952404][T13989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 521.972035][T13989] RSP: 002b:00007ff2137ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 521.980474][T13989] RAX: ffffffffffffffda RBX: 00007ff212c25fa0 RCX: 00007ff21299e0d9 [ 521.988484][T13989] RDX: 0000200000000000 RSI: 0000000000008b1a RDI: 0000000000000005 [ 521.996480][T13989] RBP: 00007ff2137ff090 R08: 0000000000000000 R09: 0000000000000000 [ 522.004488][T13989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 522.012482][T13989] R13: 00007ff212c26038 R14: 00007ff212c25fa0 R15: 00007ffdb52467e8 [ 522.020504][T13989] [ 522.035492][T13989] mac80211_hwsim hwsim55 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 522.084926][T13994] FAULT_INJECTION: forcing a failure. [ 522.084926][T13994] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 522.101117][T13994] CPU: 1 PID: 13994 Comm: syz.0.2901 Not tainted syzkaller #0 [ 522.108666][T13994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 522.118771][T13994] Call Trace: [ 522.122171][T13994] [ 522.125138][T13994] dump_stack_lvl+0x18c/0x250 [ 522.129880][T13994] ? show_regs_print_info+0x20/0x20 [ 522.135136][T13994] ? load_image+0x420/0x420 [ 522.139696][T13994] ? __lock_acquire+0x7d80/0x7d80 [ 522.144773][T13994] ? snprintf+0xe9/0x140 [ 522.149091][T13994] should_fail_ex+0x394/0x4c0 [ 522.153839][T13994] _copy_to_user+0x2f/0xa0 [ 522.158355][T13994] simple_read_from_buffer+0xe7/0x150 [ 522.163773][T13994] proc_fail_nth_read+0x1e8/0x260 [ 522.168887][T13994] ? proc_fault_inject_write+0x360/0x360 [ 522.174571][T13994] ? fsnotify_perm+0x271/0x5e0 [ 522.179380][T13994] ? proc_fault_inject_write+0x360/0x360 [ 522.185062][T13994] vfs_read+0x298/0x990 [ 522.189275][T13994] ? kernel_read+0x1e0/0x1e0 [ 522.193927][T13994] ? __fget_files+0x28/0x460 [ 522.198559][T13994] ? __fget_files+0x3fc/0x460 [ 522.203294][T13994] ? __fdget_pos+0x2a3/0x330 [ 522.207935][T13994] ? ksys_read+0x74/0x260 [ 522.212313][T13994] ksys_read+0x151/0x260 [ 522.216602][T13994] ? vfs_write+0x9a0/0x9a0 [ 522.221068][T13994] ? lockdep_hardirqs_on+0x98/0x150 [ 522.226336][T13994] do_syscall_64+0x55/0xb0 [ 522.230792][T13994] ? clear_bhb_loop+0x40/0x90 [ 522.235511][T13994] ? clear_bhb_loop+0x40/0x90 [ 522.240230][T13994] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 522.246175][T13994] RIP: 0033:0x7fcbf7d5e90e [ 522.250633][T13994] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 522.270307][T13994] RSP: 002b:00007fcbf8d31fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 522.278779][T13994] RAX: ffffffffffffffda RBX: 00007fcbf8d326c0 RCX: 00007fcbf7d5e90e [ 522.286793][T13994] RDX: 000000000000000f RSI: 00007fcbf8d320a0 RDI: 0000000000000004 [ 522.294818][T13994] RBP: 00007fcbf8d32090 R08: 0000000000000000 R09: 0000000000000000 [ 522.302843][T13994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 522.303500][T13999] __nla_validate_parse: 9 callbacks suppressed [ 522.303538][T13999] netlink: 14552 bytes leftover after parsing attributes in process `syz.1.2902'. [ 522.310833][T13994] R13: 00007fcbf8026038 R14: 00007fcbf8025fa0 R15: 00007fffedb8ba78 [ 522.310871][T13994] [ 522.341211][T14000] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2903'. [ 522.392877][T14000] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2903'. [ 522.411410][T13998] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2903'. [ 522.592052][T14010] FAULT_INJECTION: forcing a failure. [ 522.592052][T14010] name failslab, interval 1, probability 0, space 0, times 0 [ 522.621715][T14010] CPU: 1 PID: 14010 Comm: syz.1.2907 Not tainted syzkaller #0 [ 522.629268][T14010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 522.639366][T14010] Call Trace: [ 522.642676][T14010] [ 522.645641][T14010] dump_stack_lvl+0x18c/0x250 [ 522.650396][T14010] ? show_regs_print_info+0x20/0x20 [ 522.655647][T14010] ? load_image+0x420/0x420 [ 522.660214][T14010] ? __might_sleep+0xe0/0xe0 [ 522.664874][T14010] ? __lock_acquire+0x7d80/0x7d80 [ 522.669960][T14010] should_fail_ex+0x394/0x4c0 [ 522.674697][T14010] should_failslab+0x9/0x20 [ 522.679254][T14010] slab_pre_alloc_hook+0x59/0x300 [ 522.684335][T14010] ? allocate_cgrp_cset_links+0xaa/0x320 [ 522.690026][T14010] __kmem_cache_alloc_node+0x53/0x250 [ 522.695478][T14010] ? allocate_cgrp_cset_links+0xaa/0x320 [ 522.701178][T14010] kmalloc_trace+0x2a/0xe0 [ 522.705644][T14010] allocate_cgrp_cset_links+0xaa/0x320 [ 522.711157][T14010] find_css_set+0xa12/0x15c0 [ 522.715778][T14010] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 522.721602][T14010] ? cgroup_migrate_prepare_dst+0x610/0x610 [ 522.727532][T14010] cgroup_migrate_prepare_dst+0x118/0x610 [ 522.733289][T14010] cgroup_attach_task+0x5a6/0x8e0 [ 522.738374][T14010] ? cgroup_attach_task+0x25d/0x8e0 [ 522.743593][T14010] ? cgroup_migrate_execute+0xf20/0xf20 [ 522.749180][T14010] ? get_task_cred+0x23/0x300 [ 522.753869][T14010] ? get_task_cred+0x2c1/0x300 [ 522.758638][T14010] ? get_task_cred+0x23/0x300 [ 522.763332][T14010] __cgroup1_procs_write+0x2ed/0x3e0 [ 522.768649][T14010] ? cgroup_pidlist_destroy_work_fn+0x1f0/0x1f0 [ 522.774920][T14010] ? cgroup_pidlist_stop+0xf0/0xf0 [ 522.780074][T14010] cgroup_file_write+0x2cd/0x6a0 [ 522.785031][T14010] ? kernfs_fop_write_iter+0x1dc/0x520 [ 522.790511][T14010] ? cgroup_seqfile_stop+0xd0/0xd0 [ 522.795640][T14010] ? __virt_addr_valid+0x10c/0x380 [ 522.800771][T14010] ? __virt_addr_valid+0x10c/0x380 [ 522.805908][T14010] ? cgroup_seqfile_stop+0xd0/0xd0 [ 522.811030][T14010] kernfs_fop_write_iter+0x3a4/0x520 [ 522.816352][T14010] vfs_write+0x474/0x9a0 [ 522.820638][T14010] ? file_end_write+0x250/0x250 [ 522.825509][T14010] ? __fget_files+0x3fc/0x460 [ 522.830230][T14010] ? __fdget_pos+0x2a3/0x330 [ 522.834846][T14010] ? ksys_write+0x74/0x260 [ 522.839269][T14010] ksys_write+0x151/0x260 [ 522.843631][T14010] ? __ia32_sys_read+0x90/0x90 [ 522.848409][T14010] ? lockdep_hardirqs_on+0x98/0x150 [ 522.853635][T14010] do_syscall_64+0x55/0xb0 [ 522.858073][T14010] ? clear_bhb_loop+0x40/0x90 [ 522.862794][T14010] ? clear_bhb_loop+0x40/0x90 [ 522.867503][T14010] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 522.873408][T14010] RIP: 0033:0x7fd71e59e0d9 [ 522.877832][T14010] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 522.897485][T14010] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 522.905917][T14010] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 522.913936][T14010] RDX: 0000000000000012 RSI: 0000200000000100 RDI: 0000000000000008 [ 522.921934][T14010] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 522.929913][T14010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 522.937920][T14010] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 522.945913][T14010] [ 523.263491][T14018] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.2910'. [ 523.331121][T14018] validate_nla: 10 callbacks suppressed [ 523.331162][T14018] netlink: 'syz.3.2910': attribute type 10 has an invalid length. [ 523.373119][T14018] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2910'. [ 523.411843][T14018] ipvlan1: entered promiscuous mode [ 523.418623][T14018] ipvlan1: entered allmulticast mode [ 523.425093][T14018] veth0_vlan: entered allmulticast mode [ 523.483082][T14018] bridge0: port 3(ipvlan1) entered blocking state [ 523.495557][T14018] bridge0: port 3(ipvlan1) entered disabled state [ 523.577635][T14018] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 523.781435][T14031] netlink: 'syz.0.2914': attribute type 10 has an invalid length. [ 523.796340][T14031] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2914'. [ 523.806609][T14031] netlink: 'syz.0.2914': attribute type 10 has an invalid length. [ 523.815008][T14031] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2914'. [ 523.825131][T14030] netlink: 'syz.0.2914': attribute type 10 has an invalid length. [ 523.843493][T14030] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2914'. [ 523.899101][T14033] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2915'. [ 524.102807][T14039] netlink: 'syz.2.2918': attribute type 39 has an invalid length. [ 524.409550][T14039] hsr_slave_1 (unregistering): left promiscuous mode [ 524.621577][T14046] sit0: entered allmulticast mode [ 524.651359][T14047] sit0: entered promiscuous mode [ 524.757275][T14049] bridge_slave_1: left allmulticast mode [ 524.773146][T14049] bridge0: port 2(bridge_slave_1) entered disabled state [ 524.785950][T14049] bridge_slave_0: left allmulticast mode [ 524.795156][T14049] bridge_slave_0: left promiscuous mode [ 524.800996][T14049] bridge0: port 1(bridge_slave_0) entered disabled state [ 524.855668][T14049] team0: Port device bridge0 removed [ 525.055562][T14066] netlink: 'syz.3.2925': attribute type 10 has an invalid length. [ 525.099701][T14066] netlink: 'syz.3.2925': attribute type 10 has an invalid length. [ 525.120450][T14063] netlink: 'syz.3.2925': attribute type 10 has an invalid length. [ 525.247179][T14075] netlink: 'syz.2.2928': attribute type 27 has an invalid length. [ 525.303228][T14077] netlink: 'syz.3.2930': attribute type 10 has an invalid length. [ 525.323370][T14077] team0: left promiscuous mode [ 525.331425][T14077] team_slave_0: left promiscuous mode [ 525.342092][T14077] team_slave_1: left promiscuous mode [ 525.348231][T14077] geneve1: left promiscuous mode [ 525.354470][T14077] bridge0: left promiscuous mode [ 525.359647][T14077] team0: left allmulticast mode [ 525.365698][T14077] team_slave_0: left allmulticast mode [ 525.371201][T14077] team_slave_1: left allmulticast mode [ 525.378095][T14077] geneve1: left allmulticast mode [ 525.385330][T14077] bridge0: left allmulticast mode [ 525.394120][T14077] 8021q: adding VLAN 0 to HW filter on device team0 [ 525.405356][T14077] bond0: (slave team0): Enslaving as an active interface with an up link [ 525.729377][T14093] sit0: entered allmulticast mode [ 525.830881][T14096] sit0: entered promiscuous mode [ 526.260326][T14107] bridge0: port 2(ipvlan1) entered blocking state [ 526.269219][T14107] bridge0: port 2(ipvlan1) entered disabled state [ 526.330337][T14107] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 526.477643][T14114] FAULT_INJECTION: forcing a failure. [ 526.477643][T14114] name failslab, interval 1, probability 0, space 0, times 0 [ 526.503479][T14114] CPU: 0 PID: 14114 Comm: syz.1.2944 Not tainted syzkaller #0 [ 526.511040][T14114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 526.521156][T14114] Call Trace: [ 526.524476][T14114] [ 526.527449][T14114] dump_stack_lvl+0x18c/0x250 [ 526.532189][T14114] ? show_regs_print_info+0x20/0x20 [ 526.537448][T14114] ? load_image+0x420/0x420 [ 526.542004][T14114] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 526.548039][T14114] ? __asan_memset+0x22/0x40 [ 526.552685][T14114] should_fail_ex+0x394/0x4c0 [ 526.557419][T14114] should_failslab+0x9/0x20 [ 526.561966][T14114] slab_pre_alloc_hook+0x59/0x300 [ 526.567042][T14114] ? __debug_object_init+0xec/0x450 [ 526.572303][T14114] kmem_cache_alloc+0x5a/0x2c0 [ 526.577147][T14114] ? slab_build_skb+0x28/0x3e0 [ 526.581958][T14114] slab_build_skb+0x28/0x3e0 [ 526.586589][T14114] bpf_prog_test_run_skb+0x38f/0x18f0 [ 526.592018][T14114] ? __fget_files+0x28/0x460 [ 526.596653][T14114] ? __fget_files+0x3fc/0x460 [ 526.601385][T14114] ? cpu_online+0x60/0x60 [ 526.605764][T14114] bpf_prog_test_run+0x31f/0x390 [ 526.610744][T14114] __sys_bpf+0x49d/0x890 [ 526.615042][T14114] ? bpf_link_show_fdinfo+0x390/0x390 [ 526.620484][T14114] ? lock_chain_count+0x20/0x20 [ 526.625395][T14114] __x64_sys_bpf+0x7c/0x90 [ 526.629862][T14114] do_syscall_64+0x55/0xb0 [ 526.634324][T14114] ? clear_bhb_loop+0x40/0x90 [ 526.639051][T14114] ? clear_bhb_loop+0x40/0x90 [ 526.643779][T14114] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 526.649722][T14114] RIP: 0033:0x7fd71e59e0d9 [ 526.654172][T14114] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.673830][T14114] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 526.682316][T14114] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 526.691301][T14114] RDX: 0000000000000050 RSI: 0000200000000380 RDI: 000000000000000a [ 526.699323][T14114] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 526.707344][T14114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.715371][T14114] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 526.723414][T14114] [ 526.747988][T14117] FAULT_INJECTION: forcing a failure. [ 526.747988][T14117] name failslab, interval 1, probability 0, space 0, times 0 [ 526.761351][T14117] CPU: 0 PID: 14117 Comm: syz.3.2945 Not tainted syzkaller #0 [ 526.768876][T14117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 526.778988][T14117] Call Trace: [ 526.782311][T14117] [ 526.785274][T14117] dump_stack_lvl+0x18c/0x250 [ 526.790004][T14117] ? show_regs_print_info+0x20/0x20 [ 526.795247][T14117] ? load_image+0x420/0x420 [ 526.799780][T14117] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 526.805792][T14117] ? __asan_memset+0x22/0x40 [ 526.810428][T14117] should_fail_ex+0x394/0x4c0 [ 526.815151][T14117] should_failslab+0x9/0x20 [ 526.819716][T14117] slab_pre_alloc_hook+0x59/0x300 [ 526.824772][T14117] ? __debug_object_init+0xec/0x450 [ 526.830017][T14117] kmem_cache_alloc+0x5a/0x2c0 [ 526.834832][T14117] ? slab_build_skb+0x28/0x3e0 [ 526.839649][T14117] slab_build_skb+0x28/0x3e0 [ 526.844267][T14117] bpf_prog_test_run_skb+0x38f/0x18f0 [ 526.849663][T14117] ? __fget_files+0x28/0x460 [ 526.854280][T14117] ? __fget_files+0x3fc/0x460 [ 526.858990][T14117] ? cpu_online+0x60/0x60 [ 526.863343][T14117] bpf_prog_test_run+0x31f/0x390 [ 526.868381][T14117] __sys_bpf+0x49d/0x890 [ 526.872657][T14117] ? bpf_link_show_fdinfo+0x390/0x390 [ 526.878081][T14117] ? lock_chain_count+0x20/0x20 [ 526.882958][T14117] __x64_sys_bpf+0x7c/0x90 [ 526.887398][T14117] do_syscall_64+0x55/0xb0 [ 526.891833][T14117] ? clear_bhb_loop+0x40/0x90 [ 526.896535][T14117] ? clear_bhb_loop+0x40/0x90 [ 526.901231][T14117] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 526.907147][T14117] RIP: 0033:0x7efca939e0d9 [ 526.911583][T14117] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.931214][T14117] RSP: 002b:00007efcaa2cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 526.939658][T14117] RAX: ffffffffffffffda RBX: 00007efca9625fa0 RCX: 00007efca939e0d9 [ 526.947654][T14117] RDX: 0000000000000050 RSI: 0000200000000380 RDI: 000000000000000a [ 526.955658][T14117] RBP: 00007efcaa2cf090 R08: 0000000000000000 R09: 0000000000000000 [ 526.963650][T14117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.971641][T14117] R13: 00007efca9626038 R14: 00007efca9625fa0 R15: 00007fff9ff939e8 [ 526.979649][T14117] [ 527.192378][T14122] sit0: entered allmulticast mode [ 527.284918][T14122] sit0: entered promiscuous mode [ 528.042551][T14149] openvswitch: netlink: Flow key attr not present in new flow. [ 528.280362][T14153] hsr_slave_1 (unregistering): left promiscuous mode [ 528.374416][T14156] validate_nla: 16 callbacks suppressed [ 528.374451][T14156] netlink: 'syz.3.2961': attribute type 27 has an invalid length. [ 528.727308][T14161] sit0: left promiscuous mode [ 528.859168][T14170] netlink: 'syz.3.2966': attribute type 3 has an invalid length. [ 528.873550][T14170] __nla_validate_parse: 15 callbacks suppressed [ 528.873568][T14170] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.2966'. [ 529.114186][T14167] sit0: entered promiscuous mode [ 529.580908][T14184] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.2968'. [ 529.652458][T14186] netlink: 'syz.0.2969': attribute type 3 has an invalid length. [ 529.660764][T14184] netlink: 'syz.1.2968': attribute type 10 has an invalid length. [ 529.661180][T14184] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2968'. [ 529.685099][T14186] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.2969'. [ 529.698538][T14184] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 529.754702][T14191] netlink: 'syz.3.2971': attribute type 27 has an invalid length. [ 529.976196][T14198] netlink: 'syz.0.2980': attribute type 27 has an invalid length. [ 530.058121][T14200] netlink: 'syz.1.2972': attribute type 10 has an invalid length. [ 530.291315][T14207] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2977'. [ 530.412364][T14207] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2977'. [ 530.434406][T14210] FAULT_INJECTION: forcing a failure. [ 530.434406][T14210] name failslab, interval 1, probability 0, space 0, times 0 [ 530.461815][T14210] CPU: 0 PID: 14210 Comm: syz.3.2978 Not tainted syzkaller #0 [ 530.469371][T14210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 530.479490][T14210] Call Trace: [ 530.482822][T14210] [ 530.485797][T14210] dump_stack_lvl+0x18c/0x250 [ 530.490539][T14210] ? show_regs_print_info+0x20/0x20 [ 530.495811][T14210] ? load_image+0x420/0x420 [ 530.500395][T14210] should_fail_ex+0x394/0x4c0 [ 530.505135][T14210] should_failslab+0x9/0x20 [ 530.509690][T14210] slab_pre_alloc_hook+0x59/0x300 [ 530.514794][T14210] ? find_exception+0x175/0xa30 [ 530.519858][T14210] kmem_cache_alloc+0x5a/0x2c0 [ 530.524693][T14210] ? dst_alloc+0x105/0x170 [ 530.529214][T14210] dst_alloc+0x105/0x170 [ 530.533532][T14210] ip_route_output_key_hash_rcu+0x14a2/0x2350 [ 530.539677][T14210] ? ip_route_output_key_hash+0x13d/0x330 [ 530.545469][T14210] ip_route_output_key_hash+0x1f3/0x330 [ 530.551093][T14210] ? ip_route_input_rcu+0x3120/0x3120 [ 530.556535][T14210] ? rcu_force_quiescent_state+0x220/0x220 [ 530.561171][T14211] netlink: 'syz.0.2977': attribute type 21 has an invalid length. [ 530.562384][T14210] ip_route_output_flow+0x2a/0x150 [ 530.575380][T14210] ? security_sk_classify_flow+0x7b/0x90 [ 530.581072][T14210] tcp_v4_connect+0x77a/0x18a0 [ 530.585945][T14210] ? tcp_twsk_unique+0x970/0x970 [ 530.590947][T14210] __inet_stream_connect+0x254/0xdf0 [ 530.596308][T14210] ? inet_dgram_connect+0x340/0x340 [ 530.601616][T14210] tcp_sendmsg_fastopen+0x3af/0x5f0 [ 530.606885][T14210] tcp_sendmsg_locked+0x44ee/0x4ab0 [ 530.612153][T14210] ? perf_trace_lock_acquire+0x105/0x400 [ 530.617855][T14210] ? perf_trace_lock+0xfc/0x3b0 [ 530.622784][T14210] ? mark_lock+0x94/0x320 [ 530.627193][T14210] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 530.633223][T14210] ? lock_chain_count+0x20/0x20 [ 530.638129][T14210] ? tcp_set_state+0x6c0/0x6c0 [ 530.642978][T14210] tcp_sendmsg+0x2f/0x50 [ 530.647264][T14210] ? inet_send_prepare+0x250/0x250 [ 530.652419][T14210] ____sys_sendmsg+0x61b/0x980 [ 530.657238][T14210] ? __asan_memset+0x22/0x40 [ 530.661883][T14210] ? __sys_sendmsg_sock+0x30/0x30 [ 530.666951][T14210] ? __import_iovec+0x3fa/0x850 [ 530.671864][T14210] ? import_iovec+0x73/0xa0 [ 530.676424][T14210] ___sys_sendmsg+0x2a6/0x360 [ 530.681175][T14210] ? __sys_sendmsg+0x2b0/0x2b0 [ 530.686016][T14210] ? __lock_acquire+0x7d80/0x7d80 [ 530.691162][T14210] __se_sys_sendmsg+0x1d0/0x2c0 [ 530.696072][T14210] ? __x64_sys_sendmsg+0x80/0x80 [ 530.701101][T14210] ? lockdep_hardirqs_on+0x98/0x150 [ 530.706360][T14210] do_syscall_64+0x55/0xb0 [ 530.710829][T14210] ? clear_bhb_loop+0x40/0x90 [ 530.715556][T14210] ? clear_bhb_loop+0x40/0x90 [ 530.720278][T14210] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 530.726227][T14210] RIP: 0033:0x7efca939e0d9 [ 530.730690][T14210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 530.750444][T14210] RSP: 002b:00007efcaa2cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 530.758924][T14210] RAX: ffffffffffffffda RBX: 00007efca9625fa0 RCX: 00007efca939e0d9 [ 530.766940][T14210] RDX: 000000003000c085 RSI: 0000200000000080 RDI: 0000000000000003 [ 530.774971][T14210] RBP: 00007efcaa2cf090 R08: 0000000000000000 R09: 0000000000000000 [ 530.783022][T14210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.791062][T14210] R13: 00007efca9626038 R14: 00007efca9625fa0 R15: 00007fff9ff939e8 [ 530.799116][T14210] [ 530.966655][T14220] FAULT_INJECTION: forcing a failure. [ 530.966655][T14220] name failslab, interval 1, probability 0, space 0, times 0 [ 530.993237][T14220] CPU: 1 PID: 14220 Comm: syz.1.2981 Not tainted syzkaller #0 [ 531.000787][T14220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 531.010894][T14220] Call Trace: [ 531.014219][T14220] [ 531.017180][T14220] dump_stack_lvl+0x18c/0x250 [ 531.021931][T14220] ? show_regs_print_info+0x20/0x20 [ 531.027206][T14220] ? load_image+0x420/0x420 [ 531.031758][T14220] ? fib_rules_unregister+0x330/0x330 [ 531.037272][T14220] should_fail_ex+0x394/0x4c0 [ 531.042028][T14220] should_failslab+0x9/0x20 [ 531.046560][T14220] slab_pre_alloc_hook+0x59/0x300 [ 531.051607][T14220] ? find_exception+0x175/0xa30 [ 531.056484][T14220] kmem_cache_alloc+0x5a/0x2c0 [ 531.061287][T14220] ? dst_alloc+0x105/0x170 [ 531.065759][T14220] dst_alloc+0x105/0x170 [ 531.070064][T14220] ip_route_output_key_hash_rcu+0x14a2/0x2350 [ 531.076251][T14220] ? ip_route_output_key_hash+0x13d/0x330 [ 531.082017][T14220] ip_route_output_key_hash+0x1f3/0x330 [ 531.087599][T14220] ? ip_route_input_rcu+0x3120/0x3120 [ 531.093008][T14220] ? rcu_force_quiescent_state+0x220/0x220 [ 531.098854][T14220] ip_route_output_flow+0x2a/0x150 [ 531.103993][T14220] ? security_sk_classify_flow+0x7b/0x90 [ 531.109669][T14220] tcp_v4_connect+0x77a/0x18a0 [ 531.114510][T14220] ? tcp_twsk_unique+0x970/0x970 [ 531.119505][T14220] __inet_stream_connect+0x254/0xdf0 [ 531.124842][T14220] ? inet_dgram_connect+0x340/0x340 [ 531.130092][T14220] tcp_sendmsg_fastopen+0x3af/0x5f0 [ 531.135338][T14220] tcp_sendmsg_locked+0x44ee/0x4ab0 [ 531.140575][T14220] ? verify_lock_unused+0x140/0x140 [ 531.145816][T14220] ? __might_sleep+0xe0/0xe0 [ 531.150446][T14220] ? mark_lock+0x94/0x320 [ 531.154813][T14220] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 531.160831][T14220] ? lock_chain_count+0x20/0x20 [ 531.165712][T14220] ? tcp_set_state+0x6c0/0x6c0 [ 531.170523][T14220] tcp_sendmsg+0x2f/0x50 [ 531.174795][T14220] ? inet_send_prepare+0x250/0x250 [ 531.179932][T14220] ____sys_sendmsg+0x61b/0x980 [ 531.184735][T14220] ? __asan_memset+0x22/0x40 [ 531.189350][T14220] ? __sys_sendmsg_sock+0x30/0x30 [ 531.194390][T14220] ? __import_iovec+0x3fa/0x850 [ 531.199268][T14220] ? import_iovec+0x73/0xa0 [ 531.203794][T14220] ___sys_sendmsg+0x2a6/0x360 [ 531.208511][T14220] ? get_pid_task+0x20/0x1e0 [ 531.213123][T14220] ? __sys_sendmsg+0x2b0/0x2b0 [ 531.217923][T14220] ? __lock_acquire+0x7d80/0x7d80 [ 531.222993][T14220] __se_sys_sendmsg+0x1d0/0x2c0 [ 531.227866][T14220] ? __x64_sys_sendmsg+0x80/0x80 [ 531.232837][T14220] ? lockdep_hardirqs_on+0x98/0x150 [ 531.238056][T14220] do_syscall_64+0x55/0xb0 [ 531.242492][T14220] ? clear_bhb_loop+0x40/0x90 [ 531.247187][T14220] ? clear_bhb_loop+0x40/0x90 [ 531.251894][T14220] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 531.257811][T14220] RIP: 0033:0x7fd71e59e0d9 [ 531.262240][T14220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 531.281888][T14220] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 531.290330][T14220] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 531.298336][T14220] RDX: 000000003000c085 RSI: 0000200000000080 RDI: 0000000000000003 [ 531.306332][T14220] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 531.314353][T14220] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 531.322360][T14220] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 531.330386][T14220] [ 531.988611][T14251] netlink: 'syz.1.2991': attribute type 2 has an invalid length. [ 532.105311][T14253] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 532.112590][T14253] IPv6: NLM_F_CREATE should be set when creating new route [ 532.119955][T14253] IPv6: NLM_F_CREATE should be set when creating new route [ 532.127257][T14253] IPv6: NLM_F_CREATE should be set when creating new route [ 532.282722][T14264] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3004'. [ 532.309965][T14264] netlink: 'syz.1.3004': attribute type 10 has an invalid length. [ 532.320360][T14264] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3004'. [ 532.342412][T14264] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 533.015565][T14281] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3005'. [ 533.159519][T14285] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3007'. [ 533.249893][T14285] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 533.903665][T14312] validate_nla: 2 callbacks suppressed [ 533.903683][T14312] netlink: 'syz.0.3017': attribute type 19 has an invalid length. [ 533.933090][T14312] __nla_validate_parse: 1 callbacks suppressed [ 533.933110][T14312] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3017'. [ 533.964961][T14312] FAULT_INJECTION: forcing a failure. [ 533.964961][T14312] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 533.979294][T14312] CPU: 1 PID: 14312 Comm: syz.0.3017 Not tainted syzkaller #0 [ 533.986825][T14312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 533.996948][T14312] Call Trace: [ 534.000279][T14312] [ 534.003259][T14312] dump_stack_lvl+0x18c/0x250 [ 534.007997][T14312] ? show_regs_print_info+0x20/0x20 [ 534.013244][T14312] ? load_image+0x420/0x420 [ 534.017815][T14312] ? __lock_acquire+0x7d80/0x7d80 [ 534.022895][T14312] ? snprintf+0xe9/0x140 [ 534.027199][T14312] should_fail_ex+0x394/0x4c0 [ 534.031935][T14312] _copy_to_user+0x2f/0xa0 [ 534.036400][T14312] simple_read_from_buffer+0xe7/0x150 [ 534.041824][T14312] proc_fail_nth_read+0x1e8/0x260 [ 534.046918][T14312] ? proc_fault_inject_write+0x360/0x360 [ 534.052630][T14312] ? fsnotify_perm+0x271/0x5e0 [ 534.057462][T14312] ? proc_fault_inject_write+0x360/0x360 [ 534.063189][T14312] vfs_read+0x298/0x990 [ 534.067417][T14312] ? kernel_read+0x1e0/0x1e0 [ 534.072061][T14312] ? __fget_files+0x28/0x460 [ 534.076721][T14312] ? __fget_files+0x3fc/0x460 [ 534.081463][T14312] ? __fdget_pos+0x2a3/0x330 [ 534.086098][T14312] ? ksys_read+0x74/0x260 [ 534.090479][T14312] ksys_read+0x151/0x260 [ 534.094784][T14312] ? vfs_write+0x9a0/0x9a0 [ 534.099269][T14312] ? lockdep_hardirqs_on+0x98/0x150 [ 534.104531][T14312] do_syscall_64+0x55/0xb0 [ 534.109025][T14312] ? clear_bhb_loop+0x40/0x90 [ 534.113752][T14312] ? clear_bhb_loop+0x40/0x90 [ 534.118498][T14312] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 534.124437][T14312] RIP: 0033:0x7fcbf7d5e90e [ 534.128895][T14312] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 534.148555][T14312] RSP: 002b:00007fcbf8d31fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 534.157023][T14312] RAX: ffffffffffffffda RBX: 00007fcbf8d326c0 RCX: 00007fcbf7d5e90e [ 534.165049][T14312] RDX: 000000000000000f RSI: 00007fcbf8d320a0 RDI: 0000000000000008 [ 534.173077][T14312] RBP: 00007fcbf8d32090 R08: 0000000000000000 R09: 0000000000000000 [ 534.181122][T14312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 534.189146][T14312] R13: 00007fcbf8026038 R14: 00007fcbf8025fa0 R15: 00007fffedb8ba78 [ 534.197186][T14312] [ 534.600518][T14323] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.3022'. [ 534.710623][T14323] netlink: 'syz.0.3022': attribute type 10 has an invalid length. [ 535.031915][T14323] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3022'. [ 535.068215][T14323] bridge0: port 4(ipvlan1) entered blocking state [ 535.077382][T14323] bridge0: port 4(ipvlan1) entered disabled state [ 535.164443][T14323] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 535.927727][T14355] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3036'. [ 535.984008][T14355] netlink: 'syz.1.3036': attribute type 10 has an invalid length. [ 535.996912][T14355] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3036'. [ 536.015564][T14355] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 536.346890][T14363] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 537.279008][T14380] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3047'. [ 537.345597][T14380] netlink: 'syz.1.3047': attribute type 10 has an invalid length. [ 537.371383][T14380] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3047'. [ 537.414609][T14380] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 537.590316][T14389] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3050'. [ 537.697793][T14389] team0: Port device team_slave_0 removed [ 537.746194][T14389] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 538.038735][T14400] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.3053'. [ 538.125261][T14400] netlink: 'syz.3.3053': attribute type 10 has an invalid length. [ 538.153364][T14400] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3053'. [ 538.180037][T14400] bridge0: port 3(ipvlan1) entered blocking state [ 538.192194][T14400] bridge0: port 3(ipvlan1) entered disabled state [ 538.272790][T14400] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 538.790369][T14420] netlink: 'syz.1.3060': attribute type 10 has an invalid length. [ 538.816637][T14420] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 538.900776][T14422] team0: Port device team_slave_0 removed [ 538.925209][T14422] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 539.341365][T14430] syzkaller0: entered promiscuous mode [ 539.357984][T14430] syzkaller0: entered allmulticast mode [ 539.516381][T14437] __nla_validate_parse: 3 callbacks suppressed [ 539.516399][T14437] netlink: 15487 bytes leftover after parsing attributes in process `syz.2.3068'. [ 539.974338][T14445] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 541.304435][T14437] netlink: 'syz.2.3068': attribute type 10 has an invalid length. [ 541.312664][T14437] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3068'. [ 541.321909][T14437] bridge0: port 2(ipvlan1) entered blocking state [ 541.328665][T14437] bridge0: port 2(ipvlan1) entered disabled state [ 541.337092][T14437] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 541.572173][T14453] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3073'. [ 541.635306][T14453] netlink: 'syz.1.3073': attribute type 10 has an invalid length. [ 541.644831][T14453] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3073'. [ 541.667301][T14453] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 542.011660][T14465] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3075'. [ 542.050057][T14465] team0: Port device team_slave_0 removed [ 542.065510][T14465] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 542.431741][T14475] netlink: 668 bytes leftover after parsing attributes in process `syz.1.3083'. [ 542.453433][T14475] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 542.478460][T14475] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 542.777421][T14473] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 543.291866][T14486] netlink: 'syz.1.3087': attribute type 10 has an invalid length. [ 543.303743][T14486] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3087'. [ 543.315533][T14486] team0: entered promiscuous mode [ 543.320654][T14486] team_slave_0: entered promiscuous mode [ 543.327937][T14486] team_slave_1: entered promiscuous mode [ 543.341032][T14486] team0: entered allmulticast mode [ 543.346743][T14486] team_slave_0: entered allmulticast mode [ 543.352597][T14486] team_slave_1: entered allmulticast mode [ 543.360767][T14486] 8021q: adding VLAN 0 to HW filter on device team0 [ 543.369769][T14486] bond0: (slave team0): Releasing backup interface [ 543.393749][T14486] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 543.430021][T14490] netlink: 'syz.2.3088': attribute type 10 has an invalid length. [ 543.461101][T14494] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.3089'. [ 543.478074][T14490] team0: Device bond0 is already an upper device of the team interface [ 543.522472][T14494] netlink: 'syz.0.3089': attribute type 10 has an invalid length. [ 543.542582][T14494] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3089'. [ 543.571780][T14494] bridge0: port 4(ipvlan1) entered blocking state [ 543.580894][T14494] bridge0: port 4(ipvlan1) entered disabled state [ 543.593566][T14494] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 543.776378][T14503] netlink: 'syz.3.3093': attribute type 21 has an invalid length. [ 543.961031][T14510] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3095'. [ 544.043004][T14510] team_slave_0: left promiscuous mode [ 544.048818][T14510] team_slave_0: left allmulticast mode [ 544.147733][T14510] team0: Port device team_slave_0 removed [ 544.179116][T14510] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 544.807064][T14522] FAULT_INJECTION: forcing a failure. [ 544.807064][T14522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 544.847844][T14522] CPU: 1 PID: 14522 Comm: syz.2.3099 Not tainted syzkaller #0 [ 544.855494][T14522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 544.858566][T14528] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3102'. [ 544.865585][T14522] Call Trace: [ 544.865629][T14522] [ 544.865639][T14522] dump_stack_lvl+0x18c/0x250 [ 544.865676][T14522] ? show_regs_print_info+0x20/0x20 [ 544.865713][T14522] ? load_image+0x420/0x420 [ 544.865748][T14522] ? __might_fault+0xaa/0x120 [ 544.865778][T14522] ? __lock_acquire+0x7d80/0x7d80 [ 544.865812][T14522] should_fail_ex+0x394/0x4c0 [ 544.865847][T14522] _copy_from_iter+0x1cd/0x1290 [ 544.865875][T14522] ? __virt_addr_valid+0x10c/0x380 [ 544.865904][T14522] ? __lock_acquire+0x7d80/0x7d80 [ 544.865933][T14522] ? copyout_mc+0x70/0x70 [ 544.929610][T14522] ? __virt_addr_valid+0x10c/0x380 [ 544.934765][T14522] ? __virt_addr_valid+0x10c/0x380 [ 544.939927][T14522] ? __virt_addr_valid+0x10c/0x380 [ 544.945079][T14522] ? __check_object_size+0x4fc/0xa40 [ 544.950394][T14522] kernfs_fop_write_iter+0x19e/0x520 [ 544.955722][T14522] vfs_write+0x474/0x9a0 [ 544.960010][T14522] ? file_end_write+0x250/0x250 [ 544.964901][T14522] ? __fget_files+0x3fc/0x460 [ 544.969621][T14522] ? __fdget_pos+0x2a3/0x330 [ 544.974242][T14522] ? ksys_write+0x74/0x260 [ 544.978725][T14522] ksys_write+0x151/0x260 [ 544.983129][T14522] ? __ia32_sys_read+0x90/0x90 [ 544.988001][T14522] ? syscall_enter_from_user_mode+0x2e/0x80 [ 544.993959][T14522] do_syscall_64+0x55/0xb0 [ 544.998408][T14522] ? clear_bhb_loop+0x40/0x90 [ 545.003129][T14522] ? clear_bhb_loop+0x40/0x90 [ 545.007827][T14522] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 545.013742][T14522] RIP: 0033:0x7ff21299e0d9 [ 545.018176][T14522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 545.037861][T14522] RSP: 002b:00007ff2137ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 545.046338][T14522] RAX: ffffffffffffffda RBX: 00007ff212c25fa0 RCX: 00007ff21299e0d9 [ 545.054334][T14522] RDX: 000000000000000c RSI: 0000200000000780 RDI: 0000000000000008 [ 545.062330][T14522] RBP: 00007ff2137ff090 R08: 0000000000000000 R09: 0000000000000000 [ 545.070320][T14522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 545.078314][T14522] R13: 00007ff212c26038 R14: 00007ff212c25fa0 R15: 00007ffdb52467e8 [ 545.086322][T14522] [ 545.105883][T14528] netlink: 'syz.1.3102': attribute type 10 has an invalid length. [ 545.133419][T14528] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3102'. [ 545.199814][T14528] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 545.221872][T14532] netlink: 'syz.3.3100': attribute type 10 has an invalid length. [ 545.243045][T14532] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3100'. [ 545.252490][T14532] team0: entered promiscuous mode [ 545.262640][T14532] team_slave_1: entered promiscuous mode [ 545.276692][T14532] geneve1: entered promiscuous mode [ 545.293159][T14532] bridge0: entered promiscuous mode [ 545.299152][T14532] team0: entered allmulticast mode [ 545.312909][T14532] team_slave_1: entered allmulticast mode [ 545.318744][T14532] geneve1: entered allmulticast mode [ 545.341553][T14532] bridge0: entered allmulticast mode [ 545.354233][T14532] bond0: (slave team0): Releasing backup interface [ 545.381920][T14532] bridge0: port 3(team0) entered blocking state [ 545.391948][T14532] bridge0: port 3(team0) entered disabled state [ 545.770485][T14546] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3109'. [ 546.045092][T14558] netlink: 'syz.0.3111': attribute type 3 has an invalid length. [ 546.053480][T14558] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.3111'. [ 546.665491][T14574] netlink: 'syz.0.3117': attribute type 10 has an invalid length. [ 546.678647][T14574] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3117'. [ 546.697740][T14574] team0: entered promiscuous mode [ 546.703509][T14574] team_slave_1: entered promiscuous mode [ 546.716140][T14574] team0: entered allmulticast mode [ 546.732957][T14574] team_slave_1: entered allmulticast mode [ 546.740562][T14574] 8021q: adding VLAN 0 to HW filter on device team0 [ 546.769053][T14574] bond0: (slave team0): Releasing backup interface [ 546.787677][T14574] bridge0: port 4(team0) entered blocking state [ 546.803112][T14574] bridge0: port 4(team0) entered disabled state [ 547.373597][T14590] netlink: 'syz.3.3126': attribute type 10 has an invalid length. [ 547.407018][T14590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 547.434836][T14590] bond0: entered promiscuous mode [ 547.439964][T14590] bond_slave_0: entered promiscuous mode [ 547.465991][T14590] bond_slave_1: entered promiscuous mode [ 547.493573][T14590] bond0: entered allmulticast mode [ 547.507127][T14590] bond_slave_0: entered allmulticast mode [ 547.514308][T14590] bond_slave_1: entered allmulticast mode [ 547.521102][T14590] team0: Port device bond0 added [ 547.536755][T14593] netlink: 'syz.0.3127': attribute type 10 has an invalid length. [ 547.564272][T14593] netlink: 'syz.0.3127': attribute type 4 has an invalid length. [ 547.572099][T14593] netlink: 116 bytes leftover after parsing attributes in process `syz.0.3127'. [ 547.585796][T14593] bridge0: port 4(team0) entered disabled state [ 547.624359][T14593] net_ratelimit: 1 callbacks suppressed [ 547.624377][T14593] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 547.677620][T14601] netlink: 'syz.1.3128': attribute type 10 has an invalid length. [ 547.688449][T14601] team0: left promiscuous mode [ 547.698660][T14601] team_slave_1: left promiscuous mode [ 547.717658][T14601] team0: left allmulticast mode [ 547.723027][T14601] team_slave_1: left allmulticast mode [ 547.731602][T14601] 8021q: adding VLAN 0 to HW filter on device team0 [ 547.746578][T14601] bond0: (slave team0): Enslaving as an active interface with an up link [ 548.667875][T14626] netlink: 'syz.2.3138': attribute type 21 has an invalid length. [ 549.078478][T14643] netlink: 'syz.3.3145': attribute type 10 has an invalid length. [ 549.086706][T14643] team0: left promiscuous mode [ 549.092217][T14643] team_slave_1: left promiscuous mode [ 549.098436][T14643] geneve1: left promiscuous mode [ 549.105302][T14643] bridge0: left promiscuous mode [ 549.110730][T14643] bond0: left promiscuous mode [ 549.116800][T14643] bond_slave_0: left promiscuous mode [ 549.122694][T14643] bond_slave_1: left promiscuous mode [ 549.130157][T14643] team0: left allmulticast mode [ 549.138234][T14643] team_slave_1: left allmulticast mode [ 549.144100][T14643] geneve1: left allmulticast mode [ 549.149433][T14643] bridge0: left allmulticast mode [ 549.155011][T14643] bond0: left allmulticast mode [ 549.160499][T14643] bond_slave_0: left allmulticast mode [ 549.169271][T14643] bond_slave_1: left allmulticast mode [ 549.178113][T14643] 8021q: adding VLAN 0 to HW filter on device team0 [ 549.615774][T14653] FAULT_INJECTION: forcing a failure. [ 549.615774][T14653] name failslab, interval 1, probability 0, space 0, times 0 [ 549.630799][T14653] CPU: 0 PID: 14653 Comm: syz.2.3149 Not tainted syzkaller #0 [ 549.638352][T14653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 549.648452][T14653] Call Trace: [ 549.651772][T14653] [ 549.654749][T14653] dump_stack_lvl+0x18c/0x250 [ 549.659490][T14653] ? show_regs_print_info+0x20/0x20 [ 549.664764][T14653] ? load_image+0x420/0x420 [ 549.669343][T14653] ? __might_sleep+0xe0/0xe0 [ 549.673979][T14653] ? __lock_acquire+0x7d80/0x7d80 [ 549.679075][T14653] ? __might_sleep+0xe0/0xe0 [ 549.683728][T14653] should_fail_ex+0x394/0x4c0 [ 549.688475][T14653] should_failslab+0x9/0x20 [ 549.693039][T14653] slab_pre_alloc_hook+0x59/0x300 [ 549.698155][T14653] kmem_cache_alloc_lru+0x4d/0x2b0 [ 549.703315][T14653] ? sock_alloc_inode+0x28/0xc0 [ 549.708233][T14653] sock_alloc_inode+0x28/0xc0 [ 549.712966][T14653] ? sockfs_init_fs_context+0xb0/0xb0 [ 549.718375][T14653] new_inode_pseudo+0x63/0x1d0 [ 549.723189][T14653] __sock_create+0x12d/0x940 [ 549.727828][T14653] ? __might_fault+0xaa/0x120 [ 549.732567][T14653] ? __might_fault+0xc6/0x120 [ 549.737295][T14653] __sys_socketpair+0x1c1/0x550 [ 549.742199][T14653] __x64_sys_socketpair+0x9b/0xb0 [ 549.747279][T14653] do_syscall_64+0x55/0xb0 [ 549.751732][T14653] ? clear_bhb_loop+0x40/0x90 [ 549.756448][T14653] ? clear_bhb_loop+0x40/0x90 [ 549.761192][T14653] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 549.767116][T14653] RIP: 0033:0x7ff21299e0d9 [ 549.771575][T14653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 549.791317][T14653] RSP: 002b:00007ff2137ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 549.799776][T14653] RAX: ffffffffffffffda RBX: 00007ff212c25fa0 RCX: 00007ff21299e0d9 [ 549.807783][T14653] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 000000000000001a [ 549.815799][T14653] RBP: 00007ff2137ff090 R08: 0000000000000000 R09: 0000000000000000 [ 549.823835][T14653] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000001 [ 549.831849][T14653] R13: 00007ff212c26038 R14: 00007ff212c25fa0 R15: 00007ffdb52467e8 [ 549.839936][T14653] [ 549.859439][T14653] socket: no more sockets [ 549.995213][T14606] Bluetooth: hci2: command 0x0406 tx timeout [ 550.238616][T14664] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.3154'. [ 550.347337][T14664] netlink: 'syz.0.3154': attribute type 10 has an invalid length. [ 550.359747][T14664] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3154'. [ 550.375392][T14664] bridge0: port 4(ipvlan1) entered blocking state [ 550.384330][T14664] bridge0: port 4(ipvlan1) entered disabled state [ 550.502389][T14664] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 550.810597][T14680] netlink: 'syz.1.3162': attribute type 6 has an invalid length. [ 550.823521][T14680] netlink: 164 bytes leftover after parsing attributes in process `syz.1.3162'. [ 550.999816][T14690] netlink: 'syz.3.3166': attribute type 10 has an invalid length. [ 551.008316][T14690] netlink: 116 bytes leftover after parsing attributes in process `syz.3.3166'. [ 551.026708][T14690] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 551.322029][T14696] netlink: 130984 bytes leftover after parsing attributes in process `syz.2.3165'. [ 551.770169][T14708] FAULT_INJECTION: forcing a failure. [ 551.770169][T14708] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 551.784420][T14708] CPU: 1 PID: 14708 Comm: syz.1.3172 Not tainted syzkaller #0 [ 551.791953][T14708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 551.802060][T14708] Call Trace: [ 551.805389][T14708] [ 551.808375][T14708] dump_stack_lvl+0x18c/0x250 [ 551.813147][T14708] ? show_regs_print_info+0x20/0x20 [ 551.818425][T14708] ? load_image+0x420/0x420 [ 551.823023][T14708] ? __might_fault+0xaa/0x120 [ 551.827787][T14708] ? __lock_acquire+0x7d80/0x7d80 [ 551.832908][T14708] should_fail_ex+0x394/0x4c0 [ 551.837684][T14708] _copy_from_user+0x2f/0xe0 [ 551.842352][T14708] ___sys_sendmsg+0x1c7/0x360 [ 551.847095][T14708] ? get_pid_task+0x20/0x1e0 [ 551.851773][T14708] ? __sys_sendmsg+0x2b0/0x2b0 [ 551.856661][T14708] ? __lock_acquire+0x7d80/0x7d80 [ 551.861827][T14708] __se_sys_sendmsg+0x1d0/0x2c0 [ 551.866745][T14708] ? __x64_sys_sendmsg+0x80/0x80 [ 551.871773][T14708] ? lockdep_hardirqs_on+0x98/0x150 [ 551.877045][T14708] do_syscall_64+0x55/0xb0 [ 551.881505][T14708] ? clear_bhb_loop+0x40/0x90 [ 551.886254][T14708] ? clear_bhb_loop+0x40/0x90 [ 551.890980][T14708] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 551.896910][T14708] RIP: 0033:0x7fd71e59e0d9 [ 551.901360][T14708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.921012][T14708] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 551.929511][T14708] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 551.937529][T14708] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 551.945543][T14708] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 551.953547][T14708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.961561][T14708] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 551.969613][T14708] [ 556.330037][T14724] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3177'. [ 556.375394][T14724] validate_nla: 2 callbacks suppressed [ 556.375415][T14724] netlink: 'syz.1.3177': attribute type 10 has an invalid length. [ 556.399544][T14724] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3177'. [ 556.419675][T14724] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 556.751737][T14736] netlink: 15487 bytes leftover after parsing attributes in process `syz.1.3183'. [ 556.785411][T14736] netlink: 'syz.1.3183': attribute type 10 has an invalid length. [ 556.800163][T14736] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3183'. [ 556.816650][T14736] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 556.890194][T14742] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3186'. [ 556.899598][T14742] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3186'. [ 556.927846][T14743] netlink: 'syz.2.3184': attribute type 10 has an invalid length. [ 556.956477][T14742] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3186'. [ 556.977129][T14742] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3186'. [ 557.111246][T14751] netlink: 'syz.1.3188': attribute type 10 has an invalid length. [ 557.122326][T14753] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.3190'. [ 557.166491][T14753] netlink: 'syz.0.3190': attribute type 10 has an invalid length. [ 557.176189][T14753] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3190'. [ 557.192288][T14753] bridge0: port 4(ipvlan1) entered blocking state [ 557.206885][T14753] bridge0: port 4(ipvlan1) entered disabled state [ 557.297829][T14753] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 557.851552][T14767] netlink: 'syz.3.3197': attribute type 10 has an invalid length. [ 557.895147][T14767] bridge0: port 3(ipvlan1) entered blocking state [ 557.949428][T14767] bridge0: port 3(ipvlan1) entered disabled state [ 558.070897][T14773] syz.2.3199: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 558.089819][T14773] CPU: 1 PID: 14773 Comm: syz.2.3199 Not tainted syzkaller #0 [ 558.097436][T14773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 558.107571][T14773] Call Trace: [ 558.110922][T14773] [ 558.111188][T14767] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 558.113899][T14773] dump_stack_lvl+0x18c/0x250 [ 558.114003][T14773] ? show_regs_print_info+0x20/0x20 [ 558.114050][T14773] ? load_image+0x420/0x420 [ 558.114108][T14773] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 558.114152][T14773] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 558.114200][T14773] warn_alloc+0x246/0x340 [ 558.114234][T14773] ? stack_trace_save+0xaa/0x100 [ 558.114282][T14773] ? zone_watermark_ok_safe+0x230/0x230 [ 558.114346][T14773] ? kasan_set_track+0x5f/0x70 [ 558.114375][T14773] ? kasan_set_track+0x4e/0x70 [ 558.114403][T14773] ? __kasan_kmalloc+0x8f/0xa0 [ 558.114435][T14773] ? xsk_init_queue+0xad/0x100 [ 558.114562][T14773] ? xsk_setsockopt+0x4c9/0x750 [ 558.114597][T14773] ? do_sock_setsockopt+0x175/0x1a0 [ 558.114626][T14773] ? __x64_sys_setsockopt+0x182/0x200 [ 558.114671][T14773] __vmalloc_node_range+0x129/0x1320 [ 558.114812][T14773] ? free_vm_area+0x50/0x50 [ 558.114892][T14773] vmalloc_user+0x74/0x80 [ 558.114932][T14773] ? xskq_create+0xbf/0x170 [ 558.114959][T14773] xskq_create+0xbf/0x170 [ 558.114999][T14773] xsk_init_queue+0xad/0x100 [ 558.115060][T14773] xsk_setsockopt+0x4c9/0x750 [ 558.115113][T14773] ? xsk_poll+0x670/0x670 [ 558.115169][T14773] ? __fget_files+0x28/0x460 [ 558.115209][T14773] ? aa_sock_opt_perm+0x74/0x100 [ 558.115262][T14773] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 558.115294][T14773] ? security_socket_setsockopt+0x7e/0xa0 [ 558.115319][T14773] ? xsk_poll+0x670/0x670 [ 558.115364][T14773] do_sock_setsockopt+0x175/0x1a0 [ 558.115393][T14773] ? __fdget+0x180/0x210 [ 558.115439][T14773] __x64_sys_setsockopt+0x182/0x200 [ 558.115489][T14773] do_syscall_64+0x55/0xb0 [ 558.115515][T14773] ? clear_bhb_loop+0x40/0x90 [ 558.115561][T14773] ? clear_bhb_loop+0x40/0x90 [ 558.115601][T14773] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 558.115630][T14773] RIP: 0033:0x7ff21299e0d9 [ 558.115663][T14773] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 558.115687][T14773] RSP: 002b:00007ff2137ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 558.115722][T14773] RAX: ffffffffffffffda RBX: 00007ff212c25fa0 RCX: 00007ff21299e0d9 [ 558.115744][T14773] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000010 [ 558.115763][T14773] RBP: 00007ff212a35024 R08: 0000000000004a00 R09: 0000000000000000 [ 558.115784][T14773] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 558.115804][T14773] R13: 00007ff212c26038 R14: 00007ff212c25fa0 R15: 00007ffdb52467e8 [ 558.115885][T14773] [ 558.158329][T14773] Mem-Info: [ 558.158411][T14773] active_anon:9988 inactive_anon:0 isolated_anon:0 [ 558.158411][T14773] active_file:21356 inactive_file:40139 isolated_file:0 [ 558.158411][T14773] unevictable:768 dirty:137 writeback:0 [ 558.158411][T14773] slab_reclaimable:10977 slab_unreclaimable:92480 [ 558.158411][T14773] mapped:25132 shmem:1363 pagetables:546 [ 558.158411][T14773] sec_pagetables:0 bounce:0 [ 558.158411][T14773] kernel_misc_reclaimable:0 [ 558.158411][T14773] free:1331404 free_pcp:10824 free_cma:0 [ 558.158544][T14773] Node 0 active_anon:39952kB inactive_anon:0kB active_file:85424kB inactive_file:160352kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100528kB dirty:548kB writeback:0kB shmem:3916kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10292kB pagetables:2184kB sec_pagetables:0kB all_unreclaimable? no [ 558.158677][T14773] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 558.158921][T14773] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 558.159128][T14773] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 558.159515][T14773] Node 0 DMA32 free:1411692kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:39912kB inactive_anon:0kB active_file:85424kB inactive_file:159532kB unevictable:1536kB writepending:548kB present:3129332kB managed:2586828kB mlocked:0kB bounce:0kB free_pcp:24916kB local_pcp:15600kB free_cma:0kB [ 558.159718][T14773] lowmem_reserve[]: 0 0 0 0 0 [ 558.160108][T14773] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:820kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 558.160307][T14773] lowmem_reserve[]: 0 0 0 0 0 [ 558.160693][T14773] Node 1 Normal free:3898564kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:18368kB local_pcp:5184kB free_cma:0kB [ 558.160893][T14773] lowmem_reserve[]: 0 0 0 0 0 [ 558.161359][T14773] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 558.189151][T14773] Node 0 DMA32: 875*4kB (UME) 686*8kB (UME) 859*16kB (UME) 1673*32kB (UME) 554*64kB (UME) 388*128kB (UME) 202*256kB (UME) 71*512kB (UM) 33*1024kB (UM) 7*2048kB (UME) 272*4096kB (UM) = 1411692kB [ 558.190838][T14773] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 558.191881][T14773] Node 1 Normal: 281*4kB (UM) 58*8kB (UME) 41*16kB (UME) 180*32kB (UME) 38*64kB (UE) 6*128kB (UME) 1*256kB (U) 2*512kB (ME) 1*1024kB (E) 1*2048kB (E) 948*4096kB (M) = 3898564kB [ 558.193640][T14773] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 558.193718][T14773] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 558.193796][T14773] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 558.193873][T14773] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 558.193951][T14773] 62858 total pagecache pages [ 558.194027][T14773] 0 pages in swap cache [ 558.194095][T14773] Free swap = 124996kB [ 558.194163][T14773] Total swap = 124996kB [ 558.194248][T14773] 2097051 pages RAM [ 558.194262][T14773] 0 pages HighMem/MovableOnly [ 558.194390][T14773] 416958 pages reserved [ 558.194461][T14773] 0 pages cma reserved [ 559.126109][T14780] netlink: 'syz.1.3203': attribute type 10 has an invalid length. [ 559.160036][T14780] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 560.114586][T14804] netlink: 'syz.0.3213': attribute type 10 has an invalid length. [ 560.133772][T14804] bridge0: port 4(ipvlan1) entered blocking state [ 560.143994][T14804] bridge0: port 4(ipvlan1) entered disabled state [ 560.218091][T14804] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 560.310164][T14809] netlink: 'syz.1.3216': attribute type 10 has an invalid length. [ 560.323212][T14606] Bluetooth: hci1: command 0x0406 tx timeout [ 560.337912][T14809] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 560.769584][T14823] netlink: 'syz.0.3222': attribute type 153 has an invalid length. [ 561.363478][T14840] __nla_validate_parse: 11 callbacks suppressed [ 561.363498][T14840] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.3229'. [ 561.424484][T14840] netlink: 'syz.3.3229': attribute type 10 has an invalid length. [ 561.432748][T14840] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3229'. [ 561.454001][T14840] bridge0: port 3(ipvlan1) entered blocking state [ 561.470588][T14840] bridge0: port 3(ipvlan1) entered disabled state [ 561.595258][T14840] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 562.050729][T14854] netlink: 206468 bytes leftover after parsing attributes in process `syz.2.3236'. [ 562.064596][T14854] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3236'. [ 562.199581][T14862] mac80211_hwsim hwsim50 wlan0: entered promiscuous mode [ 562.226489][T14864] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.3240'. [ 562.236734][T14862] mac80211_hwsim hwsim50 wlan0: entered allmulticast mode [ 562.271378][T14864] netlink: 'syz.0.3240': attribute type 10 has an invalid length. [ 562.282565][T14864] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3240'. [ 562.298561][T14864] bridge0: port 4(ipvlan1) entered blocking state [ 562.321485][T14864] bridge0: port 4(ipvlan1) entered disabled state [ 562.401558][T14864] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 562.850026][T14883] netlink: 'syz.0.3246': attribute type 10 has an invalid length. [ 562.858439][T14883] team0: left promiscuous mode [ 562.863970][T14883] team_slave_1: left promiscuous mode [ 562.869630][T14883] team0: left allmulticast mode [ 562.876413][T14883] team_slave_1: left allmulticast mode [ 562.887099][T14883] 8021q: adding VLAN 0 to HW filter on device team0 [ 562.917928][T14883] bond0: (slave team0): Enslaving as an active interface with an up link [ 563.297752][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.305677][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.465380][T14905] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 563.577011][T14910] netlink: 'syz.1.3260': attribute type 16 has an invalid length. [ 563.585363][T14910] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3260'. [ 563.595632][T14910] veth1_macvtap: entered allmulticast mode [ 563.858393][T14921] netlink: 'syz.3.3266': attribute type 21 has an invalid length. [ 563.867196][T14921] netlink: 'syz.3.3266': attribute type 6 has an invalid length. [ 563.899385][T14921] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3266'. [ 564.294426][T14939] netlink: 'syz.2.3272': attribute type 10 has an invalid length. [ 564.615559][T14947] FAULT_INJECTION: forcing a failure. [ 564.615559][T14947] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 564.635372][T14947] CPU: 1 PID: 14947 Comm: syz.3.3278 Not tainted syzkaller #0 [ 564.642919][T14947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 564.653021][T14947] Call Trace: [ 564.656329][T14947] [ 564.659290][T14947] dump_stack_lvl+0x18c/0x250 [ 564.664005][T14947] ? show_regs_print_info+0x20/0x20 [ 564.669227][T14947] ? load_image+0x420/0x420 [ 564.673760][T14947] ? __might_fault+0xaa/0x120 [ 564.678457][T14947] ? __lock_acquire+0x7d80/0x7d80 [ 564.683520][T14947] should_fail_ex+0x394/0x4c0 [ 564.688228][T14947] _copy_from_iter+0x1cd/0x1290 [ 564.693101][T14947] ? rcu_is_watching+0x15/0xb0 [ 564.697890][T14947] ? copyout_mc+0x70/0x70 [ 564.702258][T14947] ? __virt_addr_valid+0x10c/0x380 [ 564.707421][T14947] ? __virt_addr_valid+0x10c/0x380 [ 564.712558][T14947] ? __virt_addr_valid+0x10c/0x380 [ 564.717712][T14947] ? __check_object_size+0x4fc/0xa40 [ 564.723051][T14947] netlink_sendmsg+0x76b/0xbf0 [ 564.727849][T14947] ? netlink_getsockopt+0x590/0x590 [ 564.733089][T14947] ? apparmor_socket_sendmsg+0x8e/0x330 [ 564.738678][T14947] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 564.743995][T14947] ? security_socket_sendmsg+0x80/0xa0 [ 564.749473][T14947] ? netlink_getsockopt+0x590/0x590 [ 564.754706][T14947] ____sys_sendmsg+0x61b/0x980 [ 564.759506][T14947] ? __asan_memset+0x22/0x40 [ 564.764147][T14947] ? __sys_sendmsg_sock+0x30/0x30 [ 564.769216][T14947] ? __import_iovec+0x5f2/0x850 [ 564.774112][T14947] ? import_iovec+0x73/0xa0 [ 564.778644][T14947] ___sys_sendmsg+0x2a6/0x360 [ 564.783339][T14947] ? get_pid_task+0x20/0x1e0 [ 564.787954][T14947] ? __sys_sendmsg+0x2b0/0x2b0 [ 564.792788][T14947] ? __lock_acquire+0x7d80/0x7d80 [ 564.797874][T14947] __se_sys_sendmsg+0x1d0/0x2c0 [ 564.802757][T14947] ? __x64_sys_sendmsg+0x80/0x80 [ 564.807726][T14947] ? lockdep_hardirqs_on+0x98/0x150 [ 564.812952][T14947] do_syscall_64+0x55/0xb0 [ 564.817389][T14947] ? clear_bhb_loop+0x40/0x90 [ 564.822084][T14947] ? clear_bhb_loop+0x40/0x90 [ 564.826784][T14947] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 564.832726][T14947] RIP: 0033:0x7efca939e0d9 [ 564.837190][T14947] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 564.856816][T14947] RSP: 002b:00007efcaa2cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 564.865278][T14947] RAX: ffffffffffffffda RBX: 00007efca9625fa0 RCX: 00007efca939e0d9 [ 564.873289][T14947] RDX: 0000000000002080 RSI: 0000200000000040 RDI: 0000000000000003 [ 564.881288][T14947] RBP: 00007efcaa2cf090 R08: 0000000000000000 R09: 0000000000000000 [ 564.889277][T14947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 564.897270][T14947] R13: 00007efca9626038 R14: 00007efca9625fa0 R15: 00007fff9ff939e8 [ 564.905410][T14947] [ 565.096759][T14945] netlink: 'syz.0.3277': attribute type 10 has an invalid length. [ 565.112583][T14945] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3277'. [ 565.136374][T14945] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 565.352067][T14958] FAULT_INJECTION: forcing a failure. [ 565.352067][T14958] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 565.412717][T14958] CPU: 0 PID: 14958 Comm: syz.3.3281 Not tainted syzkaller #0 [ 565.420278][T14958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 565.430390][T14958] Call Trace: [ 565.433713][T14958] [ 565.436719][T14958] dump_stack_lvl+0x18c/0x250 [ 565.441454][T14958] ? show_regs_print_info+0x20/0x20 [ 565.446788][T14958] ? load_image+0x420/0x420 [ 565.451359][T14958] ? __lock_acquire+0x7d80/0x7d80 [ 565.456438][T14958] should_fail_ex+0x394/0x4c0 [ 565.461192][T14958] _copy_from_user+0x2f/0xe0 [ 565.465839][T14958] bpf_prog_test_run_skb+0x267/0x18f0 [ 565.471267][T14958] ? __fget_files+0x28/0x460 [ 565.475925][T14958] ? __fget_files+0x3fc/0x460 [ 565.480671][T14958] ? cpu_online+0x60/0x60 [ 565.485057][T14958] bpf_prog_test_run+0x31f/0x390 [ 565.490045][T14958] __sys_bpf+0x49d/0x890 [ 565.494349][T14958] ? bpf_link_show_fdinfo+0x390/0x390 [ 565.499785][T14958] ? lock_chain_count+0x20/0x20 [ 565.504679][T14958] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 565.510727][T14958] __x64_sys_bpf+0x7c/0x90 [ 565.515207][T14958] do_syscall_64+0x55/0xb0 [ 565.519680][T14958] ? clear_bhb_loop+0x40/0x90 [ 565.524412][T14958] ? clear_bhb_loop+0x40/0x90 [ 565.529132][T14958] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 565.535058][T14958] RIP: 0033:0x7efca939e0d9 [ 565.539506][T14958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.559163][T14958] RSP: 002b:00007efcaa2cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 565.567632][T14958] RAX: ffffffffffffffda RBX: 00007efca9625fa0 RCX: 00007efca939e0d9 [ 565.575630][T14958] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 565.583626][T14958] RBP: 00007efcaa2cf090 R08: 0000000000000000 R09: 0000000000000000 [ 565.591614][T14958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 565.599605][T14958] R13: 00007efca9626038 R14: 00007efca9625fa0 R15: 00007fff9ff939e8 [ 565.607618][T14958] [ 566.191083][T14983] netlink: 'syz.2.3290': attribute type 10 has an invalid length. [ 566.415931][T14992] netlink: 'syz.0.3295': attribute type 16 has an invalid length. [ 566.424077][T14992] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3295'. [ 566.433272][T14992] veth1_macvtap: entered allmulticast mode [ 567.144539][T15009] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 567.462577][T15022] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.3317'. [ 567.556252][T15022] netlink: 'syz.0.3317': attribute type 10 has an invalid length. [ 567.565399][T15022] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3317'. [ 567.579039][T15022] bridge0: port 4(ipvlan1) entered blocking state [ 567.588181][T15022] bridge0: port 4(ipvlan1) entered disabled state [ 567.661747][T15022] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 568.013461][T15039] netlink: 'syz.3.3313': attribute type 10 has an invalid length. [ 568.044041][T15039] 8021q: adding VLAN 0 to HW filter on device team0 [ 569.083862][T15065] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.3327'. [ 569.356404][T15074] netlink: 'syz.2.3331': attribute type 4 has an invalid length. [ 569.364943][T15074] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3331'. [ 569.738051][T15086] netlink: 'syz.2.3334': attribute type 10 has an invalid length. [ 570.333727][T15100] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.3341'. [ 570.485123][T14606] Bluetooth: hci3: command 0x0406 tx timeout [ 570.649835][T15098] netlink: 'syz.1.3340': attribute type 10 has an invalid length. [ 570.674973][T15098] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3340'. [ 570.761336][T15098] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 571.529201][T15133] netlink: 15487 bytes leftover after parsing attributes in process `syz.2.3351'. [ 571.602457][T15133] netlink: 'syz.2.3351': attribute type 10 has an invalid length. [ 571.627738][T15133] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3351'. [ 571.651662][T15133] bridge0: port 2(ipvlan1) entered blocking state [ 571.670739][T15133] bridge0: port 2(ipvlan1) entered disabled state [ 571.735445][T15133] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 571.820011][T15138] netlink: 'syz.3.3353': attribute type 10 has an invalid length. [ 571.837972][T15138] 8021q: adding VLAN 0 to HW filter on device team0 [ 574.880730][T15145] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.3356'. [ 575.530529][T15151] netlink: 'syz.3.3357': attribute type 10 has an invalid length. [ 575.544663][T15151] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3357'. [ 575.572067][T15151] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 576.203036][T15186] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.3373'. [ 576.644685][T15201] netlink: 'syz.1.3378': attribute type 21 has an invalid length. [ 576.652708][T15201] netlink: 'syz.1.3378': attribute type 6 has an invalid length. [ 576.672849][T15201] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3378'. [ 577.301135][T15216] IPv6: Can't replace route, no match found [ 577.569829][T15233] FAULT_INJECTION: forcing a failure. [ 577.569829][T15233] name failslab, interval 1, probability 0, space 0, times 0 [ 577.583450][T15233] CPU: 0 PID: 15233 Comm: syz.1.3395 Not tainted syzkaller #0 [ 577.590968][T15233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 577.601081][T15233] Call Trace: [ 577.604389][T15233] [ 577.607354][T15233] dump_stack_lvl+0x18c/0x250 [ 577.612082][T15233] ? show_regs_print_info+0x20/0x20 [ 577.617329][T15233] ? load_image+0x420/0x420 [ 577.621907][T15233] ? __might_sleep+0xe0/0xe0 [ 577.626554][T15233] ? __lock_acquire+0x7d80/0x7d80 [ 577.631625][T15233] should_fail_ex+0x394/0x4c0 [ 577.636364][T15233] should_failslab+0x9/0x20 [ 577.640908][T15233] slab_pre_alloc_hook+0x59/0x300 [ 577.645977][T15233] ? sctp_add_bind_addr+0x8c/0x360 [ 577.651216][T15233] __kmem_cache_alloc_node+0x53/0x250 [ 577.656615][T15233] ? sctp_add_bind_addr+0x8c/0x360 [ 577.661754][T15233] kmalloc_trace+0x2a/0xe0 [ 577.666210][T15233] sctp_add_bind_addr+0x8c/0x360 [ 577.671177][T15233] sctp_bind_addr_copy+0xb3/0x3c0 [ 577.676228][T15233] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 577.682650][T15233] sctp_connect_new_asoc+0x2f9/0x6a0 [ 577.687965][T15233] ? __sctp_connect+0xd80/0xd80 [ 577.692848][T15233] ? __local_bh_enable_ip+0x13a/0x1c0 [ 577.698250][T15233] ? _local_bh_enable+0xa0/0xa0 [ 577.703123][T15233] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 577.708953][T15233] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 577.714798][T15233] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 577.720375][T15233] ? security_sctp_bind_connect+0x89/0xb0 [ 577.726143][T15233] sctp_sendmsg+0x1519/0x27b0 [ 577.730854][T15233] ? sctp_getsockopt+0xb60/0xb60 [ 577.735828][T15233] ? aa_af_perm+0x330/0x330 [ 577.740365][T15233] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 577.746815][T15233] ? sock_rps_record_flow+0x19/0x3f0 [ 577.752142][T15233] ? inet_sendmsg+0x7e/0x2a0 [ 577.756762][T15233] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 577.762077][T15233] ? inet_send_prepare+0x250/0x250 [ 577.767225][T15233] ____sys_sendmsg+0x61b/0x980 [ 577.772029][T15233] ? __asan_memset+0x22/0x40 [ 577.776645][T15233] ? __sys_sendmsg_sock+0x30/0x30 [ 577.781687][T15233] ? __import_iovec+0x5f2/0x850 [ 577.786571][T15233] ? import_iovec+0x73/0xa0 [ 577.791107][T15233] ___sys_sendmsg+0x2a6/0x360 [ 577.795832][T15233] ? __sys_sendmsg+0x2b0/0x2b0 [ 577.800645][T15233] ? trace_call_bpf+0xc3/0x6c0 [ 577.805457][T15233] __se_sys_sendmsg+0x1d0/0x2c0 [ 577.810327][T15233] ? perf_trace_preemptirq_template+0x269/0x330 [ 577.816597][T15233] ? __x64_sys_sendmsg+0x80/0x80 [ 577.821576][T15233] ? lockdep_hardirqs_on+0x98/0x150 [ 577.826814][T15233] do_syscall_64+0x55/0xb0 [ 577.831253][T15233] ? clear_bhb_loop+0x40/0x90 [ 577.835950][T15233] ? clear_bhb_loop+0x40/0x90 [ 577.840664][T15233] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 577.846609][T15233] RIP: 0033:0x7fd71e59e0d9 [ 577.851055][T15233] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.870698][T15233] RSP: 002b:00007fd71f43c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 577.879139][T15233] RAX: ffffffffffffffda RBX: 00007fd71e825fa0 RCX: 00007fd71e59e0d9 [ 577.887140][T15233] RDX: 00000000000080d1 RSI: 0000200000000140 RDI: 0000000000000003 [ 577.895134][T15233] RBP: 00007fd71f43c090 R08: 0000000000000000 R09: 0000000000000000 [ 577.903122][T15233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 577.911125][T15233] R13: 00007fd71e826038 R14: 00007fd71e825fa0 R15: 00007ffce5e940d8 [ 577.919126][T15233] [ 578.149825][T15241] netlink: 'syz.1.3398': attribute type 21 has an invalid length. [ 578.158942][T15241] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3398'. [ 578.327265][T15245] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3402'. [ 578.357656][T15245] netlink: 'syz.3.3402': attribute type 30 has an invalid length. [ 578.654577][T15257] sock: sock_set_timeout: `syz.2.3403' (pid 15257) tries to set negative timeout [ 581.904524][ C1] [ 581.904534][ C1] ================================ [ 581.904541][ C1] WARNING: inconsistent lock state [ 581.904563][ C1] syzkaller #0 Not tainted [ 581.904573][ C1] -------------------------------- [ 581.904579][ C1] inconsistent {INITIAL USE} -> {IN-NMI} usage. [ 581.904587][ C1] syz.3.3410/15277 [HC1[1]:SC0[0]:HE0:SE1] takes: [ 581.904607][ C1] ffff888066d53ba0 (&htab->lockdep_key){....}-{2:2}, at: htab_lock_bucket+0x17d/0x300 [ 581.904660][ C1] {INITIAL USE} state was registered at: [ 581.904667][ C1] lock_acquire+0x19e/0x420 [ 581.904688][ C1] _raw_spin_lock+0x2e/0x40 [ 581.904713][ C1] htab_lock_bucket+0x17d/0x300 [ 581.904732][ C1] htab_lru_map_delete_elem+0x19f/0x640 [ 581.904751][ C1] bpf_prog_69bf374aa003a95d+0x46/0x4a [ 581.904770][ C1] bpf_overflow_handler+0x1fc/0x510 [ 581.904795][ C1] __perf_event_overflow+0x461/0x660 [ 581.904814][ C1] perf_swevent_event+0x319/0x570 [ 581.904833][ C1] perf_bp_event+0x319/0x430 [ 581.904852][ C1] hw_breakpoint_exceptions_notify+0x23e/0x670 [ 581.904874][ C1] notifier_call_chain+0x18f/0x380 [ 581.904896][ C1] atomic_notifier_call_chain+0xda/0x180 [ 581.904918][ C1] notify_die+0x145/0x1a0 [ 581.904937][ C1] notify_debug+0x2e/0x50 [ 581.904983][ C1] noist_exc_debug+0x77/0x120 [ 581.905002][ C1] asm_exc_debug+0x33/0x40 [ 581.905024][ C1] irq event stamp: 1424 [ 581.905030][ C1] hardirqs last enabled at (1423): [] _raw_spin_unlock_irq+0x23/0x50 [ 581.905063][ C1] hardirqs last disabled at (1424): [] exc_debug+0x73/0x140 [ 581.905087][ C1] softirqs last enabled at (1042): [] bpf_prog_load+0x1204/0x1610 [ 581.905111][ C1] softirqs last disabled at (1040): [] bpf_ksym_add+0x2c/0x330 [ 581.905136][ C1] [ 581.905136][ C1] other info that might help us debug this: [ 581.905142][ C1] Possible unsafe locking scenario: [ 581.905142][ C1] [ 581.905147][ C1] CPU0 [ 581.905150][ C1] ---- [ 581.905153][ C1] lock(&htab->lockdep_key); [ 581.905166][ C1] [ 581.905170][ C1] lock(&htab->lockdep_key); [ 581.905181][ C1] [ 581.905181][ C1] *** DEADLOCK *** [ 581.905181][ C1] [ 581.905185][ C1] 3 locks held by syz.3.3410/15277: [ 581.905196][ C1] #0: ffff88802fb12fc8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 581.905245][ C1] #1: ffff88802c456418 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 581.905296][ C1] #2: ffff88807cda89c0 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at: shmem_file_write_iter+0x82/0x120 [ 581.905351][ C1] [ 581.905351][ C1] stack backtrace: [ 581.905357][ C1] CPU: 1 PID: 15277 Comm: syz.3.3410 Not tainted syzkaller #0 [ 581.905375][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 581.905387][ C1] Call Trace: [ 581.905395][ C1] <#DB> [ 581.905403][ C1] dump_stack_lvl+0x18c/0x250 [ 581.905431][ C1] ? show_regs_print_info+0x20/0x20 [ 581.905463][ C1] ? print_usage_bug+0x43d/0x6a0 [ 581.905488][ C1] ? verify_lock_unused+0x15/0x140 [ 581.905516][ C1] lock_acquire+0x2c2/0x420 [ 581.905545][ C1] ? htab_lock_bucket+0x17d/0x300 [ 581.905570][ C1] ? read_lock_is_recursive+0x20/0x20 [ 581.905613][ C1] _raw_spin_lock+0x2e/0x40 [ 581.905640][ C1] ? htab_lock_bucket+0x17d/0x300 [ 581.905661][ C1] htab_lock_bucket+0x17d/0x300 [ 581.905688][ C1] ? htab_lru_map_delete_node+0x770/0x770 [ 581.905711][ C1] ? look_up_lock_class+0x75/0x140 [ 581.905740][ C1] ? verify_lock_unused+0x15/0x140 [ 581.905764][ C1] ? jhash+0x34e/0x740 [ 581.905790][ C1] htab_lru_map_delete_elem+0x19f/0x640 [ 581.905822][ C1] ? htab_lru_map_update_elem+0x990/0x990 [ 581.905844][ C1] ? perf_callchain+0x220/0x220 [ 581.905878][ C1] bpf_prog_69bf374aa003a95d+0x46/0x4a [ 581.905901][ C1] bpf_overflow_handler+0x1fc/0x510 [ 581.905935][ C1] ? bpf_overflow_handler+0xde/0x510 [ 581.905962][ C1] ? tp_perf_event_destroy+0x20/0x20 [ 581.906001][ C1] ? __perf_event_account_interrupt+0x187/0x280 [ 581.906040][ C1] __perf_event_overflow+0x461/0x660 [ 581.906072][ C1] perf_swevent_event+0x319/0x570 [ 581.906099][ C1] ? perf_tp_event+0x1550/0x1550 [ 581.906121][ C1] ? perf_trace_buf_alloc+0x290/0x290 [ 581.906159][ C1] perf_bp_event+0x319/0x430 [ 581.906189][ C1] ? perf_event_free_bpf_prog+0x120/0x120 [ 581.906255][ C1] ? lock_acquire+0x2c2/0x420 [ 581.906287][ C1] hw_breakpoint_exceptions_notify+0x23e/0x670 [ 581.906324][ C1] notifier_call_chain+0x18f/0x380 [ 581.906351][ C1] ? atomic_notifier_call_chain+0x26/0x180 [ 581.906378][ C1] atomic_notifier_call_chain+0xda/0x180 [ 581.906405][ C1] notify_die+0x145/0x1a0 [ 581.906448][ C1] ? srcu_init_notifier_head+0x90/0x90 [ 581.906485][ C1] ? rcu_is_watching+0x15/0xb0 [ 581.906516][ C1] notify_debug+0x2e/0x50 [ 581.906534][ C1] exc_debug+0xde/0x140 [ 581.906578][ C1] asm_exc_debug+0x1e/0x40 [ 581.906598][ C1] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 581.906623][ C1] Code: 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 29 f8 48 01 [ 581.906640][ C1] RSP: 0018:ffffc9000c1779b8 EFLAGS: 00050206 [ 581.906655][ C1] RAX: ffffffff8431d001 RBX: dffffc0000000000 RCX: 0000000000000e40 [ 581.906670][ C1] RDX: 0000000000000001 RSI: 0000200000000340 RDI: ffff88804f76e1c0 [ 581.906684][ C1] RBP: ffffc9000c177b50 R08: ffff88804f76efff R09: 1ffff11009eeddff [ 581.906698][ C1] R10: dffffc0000000000 R11: ffffed1009eede00 R12: 1ffff9200182efb7 [ 581.906713][ C1] R13: 0000000000001000 R14: 0000200000000180 R15: ffff88804f76e000 [ 581.906740][ C1] ? copy_page_from_iter_atomic+0x2b1/0x13d0 [ 581.906779][ C1] [ 581.906785][ C1] [ 581.906791][ C1] copy_page_from_iter_atomic+0x2db/0x13d0 [ 581.906819][ C1] ? shmem_get_folio_gfp+0x2780/0x2b40 [ 581.906869][ C1] ? iov_iter_zero+0x1160/0x1160 [ 581.906910][ C1] ? shmem_write_begin+0x1cf/0x430 [ 581.906942][ C1] generic_perform_write+0x353/0x5c0 [ 581.906991][ C1] ? generic_file_direct_write+0x3e0/0x3e0 [ 581.907014][ C1] ? down_write+0x16e/0x200 [ 581.907054][ C1] ? file_update_time+0x98/0x1a0 [ 581.907083][ C1] shmem_file_write_iter+0xfb/0x120 [ 581.907114][ C1] vfs_write+0x474/0x9a0 [ 581.907152][ C1] ? file_end_write+0x250/0x250 [ 581.907188][ C1] ? __fget_files+0x3fc/0x460 [ 581.907230][ C1] ? __fdget_pos+0x2a3/0x330 [ 581.907255][ C1] ? ksys_write+0x74/0x260 [ 581.907288][ C1] ksys_write+0x151/0x260 [ 581.907328][ C1] ? __ia32_sys_read+0x90/0x90 [ 581.907363][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 581.907397][ C1] do_syscall_64+0x55/0xb0 [ 581.907418][ C1] ? clear_bhb_loop+0x40/0x90 [ 581.907438][ C1] ? clear_bhb_loop+0x40/0x90 [ 581.907464][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 581.907486][ C1] RIP: 0033:0x7efca939e0d9 [ 581.907504][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 581.907521][ C1] RSP: 002b:00007efcaa2cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 581.907540][ C1] RAX: ffffffffffffffda RBX: 00007efca9625fa0 RCX: 00007efca939e0d9 [ 581.907553][ C1] RDX: 00000000fffffe51 RSI: 0000200000000180 RDI: 000000000000000b [ 581.907566][ C1] RBP: 00007efca9435024 R08: 0000000000000000 R09: 0000000000000000 [ 581.907579][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 581.907591][ C1] R13: 00007efca9626038 R14: 00007efca9625fa0 R15: 00007fff9ff939e8 [ 581.907631][ C1] [ 585.832871][T14606] Bluetooth: hci0: command 0x0406 tx timeout