last executing test programs: 15.642194042s ago: executing program 1 (id=6102): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b", 0x5b}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000940)=""/4117, 0x1015}, {&(0x7f00000039c0)=""/4083, 0xff3}, {&(0x7f0000001980)=""/212, 0xd4}, {&(0x7f0000001a80)=""/234, 0xea}], 0x4}, 0x22) recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0xffc3, 0x0}, 0x80) 14.686911087s ago: executing program 1 (id=6107): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x16, 0x2, 0x0, 0x0, 0x4, 0x8a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, @perf_config_ext={0x3, 0x6c99e481}, 0x100001, 0xca, 0x5, 0x5, 0xd12, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x2000000000000000}, 0x0, 0x3, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xe, &(0x7f0000002300)=ANY=[@ANYBLOB="b702000000001700bfa300000000000007030000f0ffffff720af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd844a954b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da487130d5f24bf901115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4b9535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024a0041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4fdc4b4861004eefbc17f54f82a804d4a69bf9bc5fa77ee2922bd165a5a68488e010030166565a097b103b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f940b6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c2d7f22b0d22772c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d366501753a7ac7fedb8d34f5bc381604fcd46105c457e7dd13cab6692422a47e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670100be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c160119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d300e4d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d0000002000000001c800000000000000000000000928ee53595a779d243a48cea769470424d28804c024ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d74bf0a305790c9d644735efbf3411718d6ee7aebf9ef40662d7836d252c566f5ee934c679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c031578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6155e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bcdb7c89739f5d81e750d50517a59a3ad09e8802e8f4f535447cc0facd5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5b473332f2011e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d3fcd116bce9c764c714c9402c21d181aae59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755367fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf00000048d2570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749e1338636555009edf66be445d6975d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab0043ebf7c79a953e023f74afad591821610b857e8717764b633b21cb32f09f4db033e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c1960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000000000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd5c17d5486b0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dff7aa46e820a74f9530bdcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fdca4e9eda0072f6df342f3e7071e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7194d1eb3de6a5f99f301f89c2ee627e949cdd22000026a9960503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640000cd9e7f2e236ef5f1e3a94b108eb9750b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a2050000c375c705c798e0e208e4a5259d0bda526b462af45a6e9a84aebe025c8a7f65819f397574db7ab01bd2b3e3cd28c5aec50f8edfe39a00bafd688a7eea04efdeed96f67012bc3f795edb68b5dec80ad31a858eb756c815e7695d00000000000000000000000000000000000000000000000000007ccf0ce549d97510f7f8765408bb702f0000006d4754d98b7064cf31a681421994e1f307f0ab4ff2e33d3c88fea5d218a276b77adfee7c8fb145783ee1f8cf632c2604eab3a62a28611da1cae5ce60003111ce5c96a1d6e45ee144ffa3dcca32a33f8f0ce2995b7b7aa0bce228cbf37412e1bdebae06edb51a134301b4627d4927287daf9dcae6720334862f3a18094f1edd9e3503379815dcfbbc8141f6e1bbb0901ae91357677fd9d2bb00d4f17fb441c2dfa2b424bf46ae299d68ac27792cdac2f09e99f4ab5546ba1e5ad6a329f24e73a9c38eec34bd4dcc1609f6150e2de72f6599a2310c3841f4bb7f39cabc82c9fdfff5587ed4fa84090635fa3445c4cc54478b2f98320944ac7cb1c4e414556f7b0b763a00a84327cec7e11b3470f0384b27bbfdd8b2472497e7fe8c5df7e0a00641872472efa21c9ad3979e642dcc85c17ca8e084aa9689b83426e2fdaa01f500000000000000000000f9fd84fa991466ff749afe900d02281b2bb60d458340c4f68ec34835760ceca945bf181a000000c000000000b4a76515564ae189de7c1765f0ff68a0388ca8dd2aa831d0e01f0d7ce74401a58cef60e63e97a50c18de54121ce66380224ab7b9c0d4710f2347bad2c9b3e41cc738c1092728687f33e5cdb077223dc82c2137b4e3ba6791a2cd764e654f904c9505b7c5e3b2897072e747534952dcda50cde3e4deb6ebf85a04c3e415112b01eed6515c845a8a20519cd21787d560e9d8283fa8ff0c17b63ba06577c26678ff45420a1f85df47dbfc44e534f71aae5693fb5df61c5096219091ce0cd8e1e2e79bf9d37779e52007c66a00e6ded1499ed3892ed1544d1577906b52e16c734d4aec07dd15faa768c97298be87dd34ce704ffe3da8b46708cf972de4f31c0705ac933db80bdcfcb35c0d4620d4ec270ff7c9ce1b78994dd2b28b9d1c5c469d4c1a61781dce2f1b54d6138bd3f7df9e9ca613bec407c1b8d1bd0c7cb9d76eebf2f17c"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x7, &(0x7f00000002c0)=@framed={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000010040)) perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xbb, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xc, 0xff}, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000b00)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6493790710000000000080000b2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249f21c6eee84309e7a23c19a394830f2539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bfb1c0e6b1244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbb888b0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f94479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b844139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323478a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151fcda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526894aa7fe5e68949a3b304723177d356c4604bca492ecec37e83efceefd78a2533659edc8bef9cb85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d350000000000000000e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e5a61561a9845e4ff29e2bd43b5b923b272341c5e093fd66a2946501559335781092cf8ce987c56cd31121624d7455f2a3666276c3c0e812b28e2f30d035cee5d0e77a3c72208ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f030b8d3ebcef5af469abe753314fae31a09c3a041a1e7b55c4e81dba1e12289ee34463aaf28345bde0c195bc9f022ca8ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262d0af3246eb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a0600adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa7000008000000000000117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cd50feeb7bfad9b7be3283b6450d34264e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5a71e0d7696caba172745c7dd919ffb631820420b75b6522c0e21c882c66f4f25ffb6d95e07e068000000000000eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff201000000000000002e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa66237e0dacc107f532348cc2116473381e961f3d9c8c21578fe3245097c280abe51427b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6f0100000000000000f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d174b0000000000000000000000fa08ad0731ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282b6caa2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae0533496b6d58da50ee80a6b9a7438978c5465113f668eb4484350048289d07dbef325d3221a7cb35f812f257941a9781e3214c2a3dcf89d99844b762a9cf17548c54fccad2c7ae8072b82e0880815daf966bd5343c1635e123f868a7167cfcff33320253af570f4ef9c0254afdd89ac3943562b530dd88da8a94013bbaf204bebc38055adc39f07f7c22711f4d1f6dcc928d1578a093c072e0b92babc76f47ee367e745a024a2278319d9a4d1378482b74c516647652bfb6e93002494a5cd74e2a9a4734487062437da23e1efa6ef7674108aaa3ffac859c3577c2637bb3bdc69bc365b1f20dba96b8acca62f3f80045318de0facf2ed44b814e842c2a520159bb6c320cec0910c0b8bd3d547bdfba2e09d24d117ed0388afd37affbad2f9c77c9c1314a16ffe64f5e3744a2fffd7039670f5706e589a4c3868db06fd892d68a547477f8ef686ff0dba7b8c18c94d5a89b0567a851750a35d9cc2217db890d89385fcaa00f0f2e524672e6f4c8bedfd5da5b157709b8265cf511dc5846ab1d85916c4a6b2d1b408575982e11230cbac0a9c6eaa03c945645581f678403c2a936c53ae72940aa92bcf22b82c6bc028e0acdddf9fef595f0f7a9f80c0e4c659ced769ec463d26a81e468846761a8e1efd6a031ab7adc8665e267be0065cc315aa23012423ec8b8492d9b50fa4d8c5891959b761eec6dc988532782fda13239c948e27853606e26225c796b79cc04f3d1a5a13000000001e301d82a27010d3ac6119d2b12caf282413672d20c852c50084d7b2d50754775ed63bc18023c31351af76e24788d96103455693b34e09a163a9f613a7e5530222cebd7fa0fbff32dc98088f9fab33648cc38e87dd2dd6ee157f5f018702696915661715c979b7796d4f101a257688af7c148e8615c938c4ca8a69f6fc585ec1dd1857a501f90b161eff23181a11a2b0da4c58d459cbf9db"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYRES8=r2], 0x9a) 14.481174362s ago: executing program 1 (id=6110): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0xd, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000000000000000000ffffffff851000000100000095000000000000001800000020646c2500000000002020207b1af8ff00000000bda100000000000007010000f8ffffffb702000008b19200b703000000000000850000002e00000095"], &(0x7f0000000a00)='syzkaller\x00', 0x6, 0x92, &(0x7f0000002700)=""/146}, 0x94) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000005d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x8806, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fdffffff00000000010000008507000000000000000000000000000029b1cb686cdbf1ad2a7945fc473873f968cf1969f23e7adbf17cb6d6073d3027318418ede7f7a03c51c981d6facc128fd289643c80f9931a785dccecaeaf835d2883f3d9253f1838773c5fb177ec808bd42822eedf10c6d62cadb538d9c81f056ab09dd7274fa1ef1a5749a625557e9a00eb5cec9e75795280f965430e9c6d1c892c9a547a98325cc68d3fb5ea1d907a3a"], &(0x7f00000000c0)='syzkaller\x00', 0x1}, 0x94) socket$kcm(0x10, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x18, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6c}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000f00)={0x6, 0x18, &(0x7f0000000a00)=@raw=[@generic={0x5, 0x7, 0x5, 0x40, 0x101}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, @tail_call, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfeaa}}, @map_fd={0x18, 0x1}, @alu={0x7, 0x1, 0x6, 0x9, 0x1, 0x50, 0xfffffffffffffff0}], &(0x7f0000000380)='syzkaller\x00', 0x1ff, 0x0, 0x0, 0x41000, 0x60}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0}, 0x4100, 0x0, 0x0, 0x9, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x11}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffe00}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0xc5}}]}, &(0x7f0000000300)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x301100, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_config_ext={0x0, 0x772}, 0x18000, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x5ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1, 0x10001, 0x7f, 0x4, 0xc1, 0xffffffffffffffff, 0x1000000}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000380), 0x3d, r3}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000840)={r3, &(0x7f0000000580), &(0x7f0000000940)=""/208}, 0x20) 11.160179479s ago: executing program 1 (id=6114): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x13, &(0x7f0000000340)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0xa, 0x6, 0x0) socket$kcm(0x11, 0x2, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000, 0x0, 0x0, 0x1, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x800, 0x0) socket$kcm(0x2, 0x922000000001, 0x84) socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000013006bcd9e3fe3dc6e48aa31086b876c0c0000007ea60264160af3653c001c000d0000008bc3a0e69ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4000894) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000061114c0000000000850000000300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0xa, 0x3, 0x73) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000002c0)=r3, 0x4) sendmsg$inet(r2, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0xffac, &(0x7f0000001080)=[{&(0x7f0000002440)="a72d11a15c048c0a7d78aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e02721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0xffa0}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f0000001940)=[@ip_tos_int={{0x50, 0x29, 0x32}}, @ip_pktinfo={{0x0, 0xe, 0x8, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @loopback}}}], 0x6d}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)="1400000017000b7dd25a80648c25949301a3c92b", 0x14}], 0x1}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="12000000040000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r5}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r1}, 0x20) syz_clone(0xc0126080, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r6, 0x0, 0x12, 0x0, 0x44) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x828, 0x0, 0x0, 0x8, 0x9, 0x800000, 0x4, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x6, 0xffffffffffffffff, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r5, &(0x7f0000000040)}, 0x20) 6.238757688s ago: executing program 2 (id=6132): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e08906200060000021000aac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) 5.904431536s ago: executing program 2 (id=6133): socket$kcm(0x2, 0x5, 0x84) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1206"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0x5}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000000)='n', 0xffb8}], 0x1}, 0x20000081) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) r2 = getpid() sendmsg$unix(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000004c0)="e60d", 0x2}], 0x1, &(0x7f0000000680)=[@cred={{0x1c, 0x1, 0x2, {r2, 0x0, 0xee00}}}], 0x20, 0x10}, 0x10044001) 5.901247726s ago: executing program 3 (id=6134): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x17, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x14}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@printk={@lu, {0x3, 0x3, 0x3, 0x4, 0x9}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffe}}], {{0x7, 0x1, 0x7, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x87}, @call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) r3 = gettid() r4 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000480)={r1, 0x0, 0x24, 0x0, &(0x7f0000000100)="f9a3ace87fe1ab6299c77c432852d197fa18f3d4269d34d9353810d852f9322d0903ea94", 0x0, 0x3, 0x0, 0xf3, 0x0, &(0x7f0000000380)="2de745535354dbb4431ba288d760c87c3309bd89e3e59670aec2b499d249ebcc127c18f66e9e28072d9b4a515a0698a0a5bb015d1da9491d84938f2fc492e0056d5a525de57bbd2a59bb5f47c16bd491204ba41926d7b08467b10978e96ece55e9b9d7dfaa1274a0d6e8f5155713b15e347f820eda8a0b71a7ffa905063f658c38202f2dd8830cea3f1b31f913c4eebdf214bf7084c4bbb7b9de14f8dd3bfc792893a31c37f91ad7989b00265910011605809b3a4fc23b83724be7029ccc712aea85cc86b455ee8466ea2cdf4a58fb8a1d7c649ec04c3e8e8bd5cf214d43544d1b9080de89771d7d492f03a1f2baac60beb812", 0x0, 0x2, 0x0, 0x5}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x17, 0x8, 0x4, 0xfe, 0x0, 0x4, 0x2080, 0x4, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x4, @perf_config_ext={0x10001, 0xcb}, 0x20, 0xe, 0x100, 0x5, 0x100000000, 0x8, 0x1, 0x0, 0x7405}, r3, 0x2, r4, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000880)="6dc029d186242d046f5ecf5bc9de", 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 5.38343985s ago: executing program 3 (id=6136): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0xd, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000000000000000000ffffffff851000000100000095000000000000001800000020646c2500000000002020207b1af8ff00000000bda100000000000007010000f8ffffffb702000008b19200b703000000000000850000002e00000095"], &(0x7f0000000a00)='syzkaller\x00', 0x6, 0x92, &(0x7f0000002700)=""/146}, 0x94) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000005d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x8806, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fdffffff00000000010000008507000000000000000000000000000029b1cb686cdbf1ad2a7945fc473873f968cf1969f23e7adbf17cb6d6073d3027318418ede7f7a03c51c981d6facc128fd289643c80f9931a785dccecaeaf835d2883f3d9253f1838773c5fb177ec808bd42822eedf10c6d62cadb538d9c81f056ab09dd7274fa1ef1a5749a625557e9a00eb5cec9e75795280f965430e9c6d1c892c9a547a98325cc68d3fb5ea1d907a3a"], &(0x7f00000000c0)='syzkaller\x00', 0x1}, 0x94) socket$kcm(0x10, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x18, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6c}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000f00)={0x6, 0x18, &(0x7f0000000a00)=@raw=[@generic={0x5, 0x7, 0x5, 0x40, 0x101}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, @tail_call, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfeaa}}, @map_fd={0x18, 0x1}, @alu={0x7, 0x1, 0x6, 0x9, 0x1, 0x50, 0xfffffffffffffff0}], &(0x7f0000000380)='syzkaller\x00', 0x1ff, 0x0, 0x0, 0x41000, 0x60}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0}, 0x4100, 0x0, 0x0, 0x9, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x11}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffe00}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0xc5}}]}, &(0x7f0000000300)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_config_ext={0x0, 0x772}, 0x18000, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x5ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1, 0x10001, 0x7f, 0x4, 0xc1, 0xffffffffffffffff, 0x1000000}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000380), 0x3d, r3}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000840)={r3, &(0x7f0000000580), &(0x7f0000000940)=""/208}, 0x20) 5.254628053s ago: executing program 0 (id=6137): bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xa, 0x3, 0x2, 0x3, 0x0, 0xffffffffffffffff, 0x3}, 0x50) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x40}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xb}, 0x94) 5.058616728s ago: executing program 0 (id=6138): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, 0x0, 0x22) recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0xffc3, 0x0}, 0x80) 4.395045365s ago: executing program 2 (id=6139): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000900)='T', 0x1}], 0x1}, 0x4048841) recvmsg(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001) sendmsg$inet(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="04", 0x1}], 0x1}, 0x1) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x61) (fail_nth: 1) 4.273711069s ago: executing program 0 (id=6140): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000900)='T', 0x1}], 0x1}, 0x4048841) recvmsg(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001) sendmsg$inet(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="04", 0x1}], 0x1}, 0x1) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x61) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x5, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2, 0x6ee9}}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x4, 0x5}}, @const={0x3, 0x0, 0x0, 0xa, 0x1}]}, {0x0, [0x61, 0x5f, 0x2e]}}, &(0x7f0000000200)=""/248, 0x59, 0xf8}, 0x28) 4.192278991s ago: executing program 3 (id=6141): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e08906200060000021000aac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) 3.808182711s ago: executing program 0 (id=6142): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0xd, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000000000000000000ffffffff851000000100000095000000000000001800000020646c2500000000002020207b1af8ff00000000bda100000000000007010000f8ffffffb702000008b19200b703000000000000850000002e00000095"], &(0x7f0000000a00)='syzkaller\x00', 0x6, 0x92, &(0x7f0000002700)=""/146}, 0x94) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000005d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x8806, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fdffffff00000000010000008507000000000000000000000000000029b1cb686cdbf1ad2a7945fc473873f968cf1969f23e7adbf17cb6d6073d3027318418ede7f7a03c51c981d6facc128fd289643c80f9931a785dccecaeaf835d2883f3d9253f1838773c5fb177ec808bd42822eedf10c6d62cadb538d9c81f056ab09dd7274fa1ef1a5749a625557e9a00eb5cec9e75795280f965430e9c6d1c892c9a547a98325cc68d3fb5ea1d907a3a"], &(0x7f00000000c0)='syzkaller\x00', 0x1}, 0x94) socket$kcm(0x10, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x18, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6c}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000f00)={0x6, 0x18, &(0x7f0000000a00)=@raw=[@generic={0x5, 0x7, 0x5, 0x40, 0x101}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, @tail_call, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfeaa}}, @map_fd={0x18, 0x1}, @alu={0x7, 0x1, 0x6, 0x9, 0x1, 0x50, 0xfffffffffffffff0}], &(0x7f0000000380)='syzkaller\x00', 0x1ff, 0x0, 0x0, 0x41000, 0x60}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0}, 0x4100, 0x0, 0x0, 0x9, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x11}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffe00}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0xc5}}]}, &(0x7f0000000300)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_config_ext={0x0, 0x772}, 0x18000, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x5ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1, 0x10001, 0x7f, 0x4, 0xc1, 0xffffffffffffffff, 0x1000000}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000380), 0x3d, r3}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000840)={r3, &(0x7f0000000580), &(0x7f0000000940)=""/208}, 0x20) 3.807961701s ago: executing program 3 (id=6143): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socket$kcm(0xa, 0x5, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8001, 0x1946}, 0x0, 0x0, 0xe, 0xd, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0xa, 0x2, 0x0) socket$kcm(0x21, 0x2, 0x2) socket$kcm(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000005"], 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x81000600, 0xe, 0x0, &(0x7f0000000740)="dc94eaaf4fcc07dbb0a7d11dcd21", 0x0, 0xadf0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.566106277s ago: executing program 2 (id=6144): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x4, @perf_config_ext={0x0, 0xffffffffffffff80}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x3, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0x94) r1 = socket$kcm(0x1e, 0x1, 0x0) sendmsg$kcm(r1, &(0x7f00000014c0)={&(0x7f0000001540)=@tipc=@id={0x1e, 0x3, 0x1, {0x4e21}}, 0x80, 0x0}, 0x0) perf_event_open(&(0x7f0000000040)={0x9, 0xd0, 0x3, 0x0, 0x0, 0xfc, 0x0, 0x100, 0x30144, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x7f, 0x1}, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x3, 0x0, 0x8001, 0x0, 0xa7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800e8b40000000000000000000000d456bef400000000019500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, @perf_config_ext={0x10000, 0x8}, 0x90208, 0x2, 0x310c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, r0, 0xa) unlink(&(0x7f0000000080)='./cgroup/cgroup.procs\x00') perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000080)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8917, &(0x7f0000000980)='lo:\x96o8\x14d\xa1\xba\xda\xd1\xa0J\x12t\x02\x006\xe3\xbd\\b\x00\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x01\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x02\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xeb\xe1\xde\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xfc\xfa 6(\x04\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x02\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x04.\x9aL\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc50xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x7, &(0x7f00000002c0)=@framed={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000010040)) perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xbb, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xc, 0xff}, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES8=r2], 0x9a) 791.81666ms ago: executing program 0 (id=6146): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x800000, 0x3fff8001}, 0x0, 0x32, 0x43e1bd74, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3efd7ab4c41335d9, @perf_config_ext={0x7, 0x4}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) sendmsg$inet(0xffffffffffffffff, 0x0, 0x10) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x5, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) socket$kcm(0x11, 0x200000000000002, 0x300) r2 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x2, 0x8}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x84, 0x64, &(0x7f0000000000)=r5, 0x10) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000100)={0x2, 0x10, @loopback}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000140)='{', 0x1}], 0x1}, 0x80d1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00'}, 0x90) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0xa000a, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x0, 0xbfffe277, 0x5, 0x0, 0x0, 0x0, 0x22}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0xa, 0x2, 0x73) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{r6, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000480)='%pi6 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r7}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x1f4, 0x0, 0x0, 0x0, 0x0, 0x304, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x8}, 0x50) socket$kcm(0xa, 0x2, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000020004008500000097000000b7080000000000007b8af8ff00000000b7080000ffffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0xe, 0x300, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 723.845632ms ago: executing program 3 (id=6147): socket$kcm(0x2, 0x5, 0x84) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1206"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0x5}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000000)='n', 0xffb8}], 0x1}, 0x20000081) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) r2 = getpid() sendmsg$unix(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000004c0)="e60d", 0x2}], 0x1, &(0x7f0000000680)=[@cred={{0x1c, 0x1, 0x2, {r2, 0x0, 0xee00}}}], 0x20, 0x10}, 0x10044001) 679.997793ms ago: executing program 2 (id=6148): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, 0x0, 0x22) recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0xffc3, 0x0}, 0x80) 180.271226ms ago: executing program 3 (id=6149): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0xd, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000000000000000000ffffffff851000000100000095000000000000001800000020646c2500000000002020207b1af8ff00000000bda100000000000007010000f8ffffffb702000008b19200b703000000000000850000002e00000095"], &(0x7f0000000a00)='syzkaller\x00', 0x6, 0x92, &(0x7f0000002700)=""/146}, 0x94) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000005d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x8806, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fdffffff00000000010000008507000000000000000000000000000029b1cb686cdbf1ad2a7945fc473873f968cf1969f23e7adbf17cb6d6073d3027318418ede7f7a03c51c981d6facc128fd289643c80f9931a785dccecaeaf835d2883f3d9253f1838773c5fb177ec808bd42822eedf10c6d62cadb538d9c81f056ab09dd7274fa1ef1a5749a625557e9a00eb5cec9e75795280f965430e9c6d1c892c9a547a98325cc68d3fb5ea1d907a3a"], &(0x7f00000000c0)='syzkaller\x00', 0x1}, 0x94) socket$kcm(0x10, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x18, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6c}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000f00)={0x6, 0x18, &(0x7f0000000a00)=@raw=[@generic={0x5, 0x7, 0x5, 0x40, 0x101}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, @tail_call, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfeaa}}, @map_fd={0x18, 0x1}, @alu={0x7, 0x1, 0x6, 0x9, 0x1, 0x50, 0xfffffffffffffff0}], &(0x7f0000000380)='syzkaller\x00', 0x1ff, 0x0, 0x0, 0x41000, 0x60}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0}, 0x4100, 0x0, 0x0, 0x9, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="02000000040000000800000001"], 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x11}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffe00}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {}, {0x85, 0x0, 0x0, 0xc5}}]}, &(0x7f0000000300)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_config_ext={0x0, 0x772}, 0x18000, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x5ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1, 0x10001, 0x7f, 0x4, 0xc1, 0xffffffffffffffff, 0x1000000}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000380), 0x3d, r3}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000840)={r3, &(0x7f0000000580), &(0x7f0000000940)=""/208}, 0x20) 112.535358ms ago: executing program 2 (id=6150): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, @perf_bp={0x0, 0x1}, 0x114105, 0x6, 0x9, 0x1, 0x0, 0x40000, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0xa) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="180000003f000b05d25a806c8c6394f90324fc6010000200", 0x18}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000180)=@tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x4}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000280)="af0e005016d4d12b13012faef37ccc71c7b25d7b26902d879d66fa351ebb8fc771c0edebe9f26002b1de55e8944ede0c0d6d2f6ee32734b7143d2cee6caf0e418eb4c46a04122465089821b5aeb29e552451f574e48f4ff0f9230bcb45a14153aeffe4a70a14b9b2ae06e1d7a38375fdcd365d4040f6de3354e59072ed522acfd477ae38af5e0e8b0988fb7e21d59d16577a228170dd471a274727ae837643a0be8fb52eaa29555d846a5bc69a2802aa16ff8042f19a929426ee7063f780305cf632ced12ab8a1", 0xc7}, {&(0x7f0000000380)="1195fa8432fb0f411755718ce0faaa0d1454e816d15e7b24e11bbc250ec5e25cb980c362fb8b09b066a731fc51d3e3add3ddb3550c16262bcc2dd909731f720d9e6088252ab7972d1d4e849971a32cef491238cd482a0fe4735e18c59894a68c62e115c457c65526c3eb84da97f57a3d4b06b3b77955cb599e77ca61293cb79347db68f5", 0x84}], 0x2}, 0x20000845) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) 62.752989ms ago: executing program 1 (id=6151): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x4e20, @dev}, 0x10, 0x0}, 0x400c080) 0s ago: executing program 0 (id=6152): r0 = socket$kcm(0x2b, 0x1, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb08, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x7f, 0x2}, 0x8c01, 0x0, 0x0, 0x1, 0x800}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x3) sendmsg$kcm(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0}, 0x24000000) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x2, 0x922000000001, 0x106) setsockopt$sock_attach_bpf(r2, 0x1, 0xf, &(0x7f00000002c0), 0x4) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@fallback, 0xffffffffffffffff, 0x2f, 0x8, 0xffffffffffffffff, @void, @value=0x0}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000002"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000001280)=ANY=[@ANYBLOB="620ac4ff00000000711051000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r3, &(0x7f0000000180)="abb49b774923a64f6840ce664447e6eca93a8fb868d18996a1d6ba9c243814b66ebf7b04f59a022dc7b6fa8e70ec668d9ca6c372685cba059198638fa9fe32cf6f61d5467a6061e1addb59c94ed401a592fd1706c6693835e5609af5364588537ade5594215257844758e96518e42f08758f45afc990c9ecabae2fbb9619d981f1b7950554a33fe61022e6d3784889730c3c7a41135c9ad268dcbeb0abbd492b99a57c13a4295e0e406d5b43a4f895636e01ac2a1c9f4f10506d64ce", &(0x7f0000000240)=""/135, 0x4}, 0x20) r4 = socket$kcm(0xf, 0x3, 0x2) recvmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="9feb01001800000000000000000006000000040000f4ff00000e0300000000000000000000000000000d0300000009000000000000010000000079005301000000006100"], 0x0, 0x4a}, 0x28) sendmsg$inet(r4, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="0212000902000000e4a17c45c8568660", 0x10}], 0x1}, 0x20040000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x6d1) write$cgroup_freezer_state(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) perf_event_open(&(0x7f0000000480)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0xfffffffffffffff8, 0x3}, 0x0, 0x0, 0x2, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r7 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r7, 0x6, 0x17, &(0x7f0000000200)=r7, 0x21) r8 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@bloom_filter={0x1e, 0x0, 0x24c, 0x6, 0x0, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, 0x50) socketpair$tipc(0x1e, 0x4, 0x0, 0x0) setsockopt$sock_attach_bpf(r8, 0x29, 0x23, 0x0, 0x0) kernel console output (not intermixed with test programs): yz.2.5663'. [ 1369.529624][T23991] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5663'. [ 1369.602673][T23995] netlink: 'syz.3.5665': attribute type 10 has an invalid length. [ 1369.624639][T23995] team0: Device hsr_slave_0 failed to register rx_handler [ 1370.011659][T24002] syzkaller0: entered promiscuous mode [ 1370.030047][T24002] syzkaller0: entered allmulticast mode [ 1374.904154][T24014] syzkaller0: entered promiscuous mode [ 1374.940613][T24014] syzkaller0: entered allmulticast mode [ 1375.033106][T24025] netlink: 'syz.2.5673': attribute type 10 has an invalid length. [ 1375.076910][T24025] team0: Device hsr_slave_0 failed to register rx_handler [ 1383.697147][T24039] syzkaller0: entered promiscuous mode [ 1383.714506][T24039] syzkaller0: entered allmulticast mode [ 1388.261840][ T5786] Bluetooth: hci1: unexpected subevent 0x0a length: 150 > 30 [ 1388.270695][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1388.280561][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1388.288253][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1388.298363][ T5786] Workqueue: hci1 hci_rx_work [ 1388.303141][ T5786] Call Trace: [ 1388.306467][ T5786] [ 1388.309461][ T5786] dump_stack_lvl+0x18c/0x250 [ 1388.314226][ T5786] ? show_regs_print_info+0x20/0x20 [ 1388.319496][ T5786] ? load_image+0x420/0x420 [ 1388.324096][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1388.329287][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1388.334409][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1388.339282][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1388.344547][ T5786] kobject_add_internal+0x617/0xc90 [ 1388.349813][ T5786] kobject_add+0x164/0x240 [ 1388.354416][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1388.359206][ T5786] ? get_device_parent+0x366/0x390 [ 1388.364368][ T5786] device_add+0x3fa/0xc40 [ 1388.368744][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1388.373737][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1388.379090][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1388.385405][ T5786] ? bt_info+0x180/0x180 [ 1388.389706][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1388.395575][ T5786] ? mutex_unlock+0x10/0x10 [ 1388.400151][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1388.404891][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1388.411564][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1388.418880][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1388.425360][ T5786] hci_event_packet+0x7b4/0x1280 [ 1388.430519][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1388.435608][ T5786] ? lock_chain_count+0x20/0x20 [ 1388.440523][ T5786] ? bis_list+0x290/0x290 [ 1388.445018][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1388.450770][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1388.456393][ T5786] hci_rx_work+0x43a/0xd60 [ 1388.460877][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1388.466656][ T5786] process_scheduled_works+0xa60/0x1600 [ 1388.472315][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1388.477928][ T5786] ? assign_work+0x3cc/0x5d0 [ 1388.482568][ T5786] worker_thread+0xa5e/0xfe0 [ 1388.487279][ T5786] kthread+0x2fa/0x390 [ 1388.491388][ T5786] ? pr_cont_work+0x550/0x550 [ 1388.496193][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1388.500825][ T5786] ret_from_fork+0x48/0x80 [ 1388.505286][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1388.509922][ T5786] ret_from_fork_asm+0x11/0x20 [ 1388.514745][ T5786] [ 1388.518583][ T5786] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1388.532840][ T5786] Bluetooth: hci1: failed to register connection device [ 1390.578249][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 1391.409408][T24069] FAULT_INJECTION: forcing a failure. [ 1391.409408][T24069] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 1391.429493][T24069] CPU: 1 PID: 24069 Comm: syz.2.5691 Not tainted syzkaller #0 [ 1391.437046][T24069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1391.447167][T24069] Call Trace: [ 1391.450589][T24069] [ 1391.453572][T24069] dump_stack_lvl+0x18c/0x250 [ 1391.458411][T24069] ? show_regs_print_info+0x20/0x20 [ 1391.463681][T24069] ? load_image+0x420/0x420 [ 1391.468269][T24069] ? __lock_acquire+0x7d80/0x7d80 [ 1391.473370][T24069] should_fail_ex+0x394/0x4c0 [ 1391.478345][T24069] prepare_alloc_pages+0x1e1/0x5b0 [ 1391.483558][T24069] __alloc_pages+0x134/0x460 [ 1391.488221][T24069] ? zone_statistics+0x170/0x170 [ 1391.493295][T24069] ? mt_find+0x169/0x640 [ 1391.497599][T24069] ? alloc_pages+0x4e1/0x740 [ 1391.502398][T24069] __pud_alloc+0x3a/0x200 [ 1391.506964][T24069] handle_mm_fault+0x346d/0x4a50 [ 1391.512048][T24069] ? handle_mm_fault+0xe6/0x4a50 [ 1391.517068][T24069] ? numa_migrate_prep+0x350/0x350 [ 1391.522255][T24069] ? lock_chain_count+0x20/0x20 [ 1391.527161][T24069] ? perf_trace_lock+0xfc/0x3b0 [ 1391.532166][T24069] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 1391.537513][T24069] do_user_addr_fault+0x736/0x12d0 [ 1391.542716][T24069] exc_page_fault+0x64/0x100 [ 1391.547410][T24069] asm_exc_page_fault+0x26/0x30 [ 1391.552420][T24069] RIP: 0010:__put_user_4+0x11/0x20 [ 1391.557677][T24069] Code: 01 ca c3 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 90 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb [ 1391.577571][T24069] RSP: 0018:ffffc900100cfe80 EFLAGS: 00050206 [ 1391.583790][T24069] RAX: 0000000000000004 RBX: 0000000000000000 RCX: 0000200000000000 [ 1391.591961][T24069] RDX: 0000000000000000 RSI: ffffffff8acadd60 RDI: ffffffff8b1d0ca0 [ 1391.600029][T24069] RBP: 0000000000000004 R08: ffffffff8e8c7aef R09: 1ffffffff1d18f5d [ 1391.608225][T24069] R10: dffffc0000000000 R11: fffffbfff1d18f5e R12: 0000000000000000 [ 1391.616408][T24069] R13: 0000200000000000 R14: 000000000000002c R15: 0000000000000003 [ 1391.624479][T24069] __sys_socketpair+0xb8/0x550 [ 1391.629482][T24069] __x64_sys_socketpair+0x9b/0xb0 [ 1391.634745][T24069] do_syscall_64+0x55/0xb0 [ 1391.639223][T24069] ? clear_bhb_loop+0x40/0x90 [ 1391.643954][T24069] ? clear_bhb_loop+0x40/0x90 [ 1391.648712][T24069] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1391.654762][T24069] RIP: 0033:0x7fe0d599e0d9 [ 1391.659333][T24069] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1391.679439][T24069] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 1391.688022][T24069] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1391.696154][T24069] RDX: 0000000000000006 RSI: 0000000000000003 RDI: 000000000000002c [ 1391.704381][T24069] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1391.712694][T24069] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1391.721178][T24069] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1391.730030][T24069] [ 1394.289064][T24079] netlink: 'syz.0.5695': attribute type 19 has an invalid length. [ 1394.297903][T24079] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5695'. [ 1397.879690][ T5786] Bluetooth: hci3: unexpected subevent 0x0a length: 150 > 30 [ 1398.319749][T24117] netlink: 128 bytes leftover after parsing attributes in process `syz.3.5709'. [ 1398.371313][T24117] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1398.554100][T24119] FAULT_INJECTION: forcing a failure. [ 1398.554100][T24119] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 1398.654251][T24119] CPU: 0 PID: 24119 Comm: syz.1.5710 Not tainted syzkaller #0 [ 1398.661830][T24119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1398.671951][T24119] Call Trace: [ 1398.675321][T24119] [ 1398.678310][T24119] dump_stack_lvl+0x18c/0x250 [ 1398.683048][T24119] ? show_regs_print_info+0x20/0x20 [ 1398.688400][T24119] ? load_image+0x420/0x420 [ 1398.692967][T24119] ? __might_fault+0xaa/0x120 [ 1398.697698][T24119] ? __lock_acquire+0x7d80/0x7d80 [ 1398.702790][T24119] should_fail_ex+0x394/0x4c0 [ 1398.707538][T24119] _copy_from_user+0x2f/0xe0 [ 1398.712207][T24119] ___sys_sendmsg+0x1c7/0x360 [ 1398.717084][T24119] ? get_pid_task+0x20/0x1e0 [ 1398.721737][T24119] ? __sys_sendmsg+0x2b0/0x2b0 [ 1398.726579][T24119] ? __lock_acquire+0x7d80/0x7d80 [ 1398.731682][T24119] __se_sys_sendmsg+0x1d0/0x2c0 [ 1398.736589][T24119] ? __x64_sys_sendmsg+0x80/0x80 [ 1398.741595][T24119] ? lockdep_hardirqs_on+0x98/0x150 [ 1398.746855][T24119] do_syscall_64+0x55/0xb0 [ 1398.751335][T24119] ? clear_bhb_loop+0x40/0x90 [ 1398.756077][T24119] ? clear_bhb_loop+0x40/0x90 [ 1398.760819][T24119] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1398.766769][T24119] RIP: 0033:0x7f5b09b9e0d9 [ 1398.771326][T24119] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1398.791185][T24119] RSP: 002b:00007f5b07df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1398.799660][T24119] RAX: ffffffffffffffda RBX: 00007f5b09e25fa0 RCX: 00007f5b09b9e0d9 [ 1398.807687][T24119] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000003 [ 1398.815713][T24119] RBP: 00007f5b07df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1398.823766][T24119] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1398.831796][T24119] R13: 00007f5b09e26038 R14: 00007f5b09e25fa0 R15: 00007fff6635d918 [ 1398.839843][T24119] [ 1399.938171][T23580] Bluetooth: hci3: command 0x0406 tx timeout [ 1404.688488][T23580] Bluetooth: hci2: unexpected subevent 0x0a length: 150 > 30 [ 1404.904336][T24152] netlink: 128 bytes leftover after parsing attributes in process `syz.2.5720'. [ 1404.948953][T24152] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1405.338786][T24156] FAULT_INJECTION: forcing a failure. [ 1405.338786][T24156] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1405.384338][T24156] CPU: 1 PID: 24156 Comm: syz.0.5723 Not tainted syzkaller #0 [ 1405.391925][T24156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1405.402124][T24156] Call Trace: [ 1405.405453][T24156] [ 1405.408455][T24156] dump_stack_lvl+0x18c/0x250 [ 1405.413183][T24156] ? show_regs_print_info+0x20/0x20 [ 1405.418429][T24156] ? load_image+0x420/0x420 [ 1405.422994][T24156] ? __might_fault+0xaa/0x120 [ 1405.427728][T24156] ? __lock_acquire+0x7d80/0x7d80 [ 1405.432821][T24156] should_fail_ex+0x394/0x4c0 [ 1405.437738][T24156] _copy_from_user+0x2f/0xe0 [ 1405.442385][T24156] __sys_bpf+0x23e/0x890 [ 1405.446690][T24156] ? bpf_link_show_fdinfo+0x390/0x390 [ 1405.452109][T24156] ? lock_chain_count+0x20/0x20 [ 1405.457001][T24156] __x64_sys_bpf+0x7c/0x90 [ 1405.461729][T24156] do_syscall_64+0x55/0xb0 [ 1405.466186][T24156] ? clear_bhb_loop+0x40/0x90 [ 1405.470897][T24156] ? clear_bhb_loop+0x40/0x90 [ 1405.475611][T24156] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1405.481533][T24156] RIP: 0033:0x7f35d379e0d9 [ 1405.485976][T24156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1405.505611][T24156] RSP: 002b:00007f35d463e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1405.514055][T24156] RAX: ffffffffffffffda RBX: 00007f35d3a25fa0 RCX: 00007f35d379e0d9 [ 1405.522051][T24156] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1405.530054][T24156] RBP: 00007f35d463e090 R08: 0000000000000000 R09: 0000000000000000 [ 1405.538046][T24156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1405.546043][T24156] R13: 00007f35d3a26038 R14: 00007f35d3a25fa0 R15: 00007ffd49c903e8 [ 1405.554142][T24156] [ 1406.738512][T23580] Bluetooth: hci2: command 0x0406 tx timeout [ 1409.389201][T24189] FAULT_INJECTION: forcing a failure. [ 1409.389201][T24189] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1409.421731][T24189] CPU: 1 PID: 24189 Comm: syz.2.5735 Not tainted syzkaller #0 [ 1409.429288][T24189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1409.439415][T24189] Call Trace: [ 1409.442745][T24189] [ 1409.445732][T24189] dump_stack_lvl+0x18c/0x250 [ 1409.450475][T24189] ? show_regs_print_info+0x20/0x20 [ 1409.455738][T24189] ? load_image+0x420/0x420 [ 1409.460314][T24189] ? __might_fault+0xaa/0x120 [ 1409.465050][T24189] ? __lock_acquire+0x7d80/0x7d80 [ 1409.470140][T24189] should_fail_ex+0x394/0x4c0 [ 1409.474876][T24189] _copy_from_user+0x2f/0xe0 [ 1409.479521][T24189] __sys_bpf+0x23e/0x890 [ 1409.483811][T24189] ? bpf_link_show_fdinfo+0x390/0x390 [ 1409.489230][T24189] ? lock_chain_count+0x20/0x20 [ 1409.494123][T24189] __x64_sys_bpf+0x7c/0x90 [ 1409.498574][T24189] do_syscall_64+0x55/0xb0 [ 1409.503022][T24189] ? clear_bhb_loop+0x40/0x90 [ 1409.507824][T24189] ? clear_bhb_loop+0x40/0x90 [ 1409.512538][T24189] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1409.518460][T24189] RIP: 0033:0x7fe0d599e0d9 [ 1409.522906][T24189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1409.542546][T24189] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1409.550990][T24189] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1409.559006][T24189] RDX: 0000000000000050 RSI: 0000200000000240 RDI: 000000000000000a [ 1409.567026][T24189] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1409.575046][T24189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1409.583179][T24189] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1409.591211][T24189] [ 1410.077763][T24200] netlink: 128 bytes leftover after parsing attributes in process `syz.3.5740'. [ 1410.093809][T24200] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1411.007511][T24211] FAULT_INJECTION: forcing a failure. [ 1411.007511][T24211] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1411.043040][T24211] CPU: 0 PID: 24211 Comm: syz.3.5746 Not tainted syzkaller #0 [ 1411.050597][T24211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1411.060704][T24211] Call Trace: [ 1411.064030][T24211] [ 1411.067004][T24211] dump_stack_lvl+0x18c/0x250 [ 1411.071795][T24211] ? show_regs_print_info+0x20/0x20 [ 1411.077053][T24211] ? load_image+0x420/0x420 [ 1411.081692][T24211] ? __might_fault+0xaa/0x120 [ 1411.086405][T24211] ? __lock_acquire+0x7d80/0x7d80 [ 1411.091467][T24211] should_fail_ex+0x394/0x4c0 [ 1411.096182][T24211] _copy_from_user+0x2f/0xe0 [ 1411.100805][T24211] ___sys_sendmsg+0x1c7/0x360 [ 1411.105522][T24211] ? get_pid_task+0x20/0x1e0 [ 1411.110151][T24211] ? __sys_sendmsg+0x2b0/0x2b0 [ 1411.115062][T24211] ? __lock_acquire+0x7d80/0x7d80 [ 1411.120145][T24211] __se_sys_sendmsg+0x1d0/0x2c0 [ 1411.125038][T24211] ? __x64_sys_sendmsg+0x80/0x80 [ 1411.130036][T24211] ? lockdep_hardirqs_on+0x98/0x150 [ 1411.135365][T24211] do_syscall_64+0x55/0xb0 [ 1411.139862][T24211] ? clear_bhb_loop+0x40/0x90 [ 1411.144582][T24211] ? clear_bhb_loop+0x40/0x90 [ 1411.149299][T24211] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1411.155235][T24211] RIP: 0033:0x7fe655d9e0d9 [ 1411.159678][T24211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1411.179498][T24211] RSP: 002b:00007fe656b7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1411.188124][T24211] RAX: ffffffffffffffda RBX: 00007fe656025fa0 RCX: 00007fe655d9e0d9 [ 1411.196126][T24211] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000003 [ 1411.204123][T24211] RBP: 00007fe656b7f090 R08: 0000000000000000 R09: 0000000000000000 [ 1411.212163][T24211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1411.220167][T24211] R13: 00007fe656026038 R14: 00007fe656025fa0 R15: 00007fff9e092f08 [ 1411.228192][T24211] [ 1411.784567][T24230] FAULT_INJECTION: forcing a failure. [ 1411.784567][T24230] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1411.815230][T24230] CPU: 0 PID: 24230 Comm: syz.3.5754 Not tainted syzkaller #0 [ 1411.822789][T24230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1411.832885][T24230] Call Trace: [ 1411.836180][T24230] [ 1411.839143][T24230] dump_stack_lvl+0x18c/0x250 [ 1411.843878][T24230] ? show_regs_print_info+0x20/0x20 [ 1411.849137][T24230] ? load_image+0x420/0x420 [ 1411.853714][T24230] ? __might_fault+0xaa/0x120 [ 1411.858455][T24230] ? __lock_acquire+0x7d80/0x7d80 [ 1411.863664][T24230] should_fail_ex+0x394/0x4c0 [ 1411.868463][T24230] _copy_from_user+0x2f/0xe0 [ 1411.873203][T24230] ___sys_sendmsg+0x1c7/0x360 [ 1411.878081][T24230] ? __sys_sendmsg+0x2b0/0x2b0 [ 1411.882924][T24230] ? __lock_acquire+0x7d80/0x7d80 [ 1411.888017][T24230] __se_sys_sendmsg+0x1d0/0x2c0 [ 1411.892907][T24230] ? __x64_sys_sendmsg+0x80/0x80 [ 1411.897914][T24230] ? lockdep_hardirqs_on+0x98/0x150 [ 1411.903440][T24230] do_syscall_64+0x55/0xb0 [ 1411.907911][T24230] ? clear_bhb_loop+0x40/0x90 [ 1411.912624][T24230] ? clear_bhb_loop+0x40/0x90 [ 1411.917353][T24230] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1411.923292][T24230] RIP: 0033:0x7fe655d9e0d9 [ 1411.927746][T24230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1411.947661][T24230] RSP: 002b:00007fe656b7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1411.956118][T24230] RAX: ffffffffffffffda RBX: 00007fe656025fa0 RCX: 00007fe655d9e0d9 [ 1411.964123][T24230] RDX: 0000000000000011 RSI: 0000200000001e80 RDI: 0000000000000003 [ 1411.972140][T24230] RBP: 00007fe656b7f090 R08: 0000000000000000 R09: 0000000000000000 [ 1411.980164][T24230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1411.988165][T24230] R13: 00007fe656026038 R14: 00007fe656025fa0 R15: 00007fff9e092f08 [ 1411.996188][T24230] [ 1412.702655][T24243] netlink: 128 bytes leftover after parsing attributes in process `syz.1.5757'. [ 1412.733956][T24243] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1413.606284][T23580] Bluetooth: hci0: unexpected subevent 0x0a length: 150 > 30 [ 1414.251214][T24278] FAULT_INJECTION: forcing a failure. [ 1414.251214][T24278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1414.286008][T24278] CPU: 1 PID: 24278 Comm: syz.1.5776 Not tainted syzkaller #0 [ 1414.294010][T24278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1414.304647][T24278] Call Trace: [ 1414.308218][T24278] [ 1414.311587][T24278] dump_stack_lvl+0x18c/0x250 [ 1414.316752][T24278] ? show_regs_print_info+0x20/0x20 [ 1414.322017][T24278] ? load_image+0x420/0x420 [ 1414.326585][T24278] ? __might_fault+0xaa/0x120 [ 1414.331976][T24278] ? __lock_acquire+0x7d80/0x7d80 [ 1414.337135][T24278] should_fail_ex+0x394/0x4c0 [ 1414.342878][T24278] _copy_from_user+0x2f/0xe0 [ 1414.347746][T24278] __sys_bpf+0x23e/0x890 [ 1414.353032][T24278] ? bpf_link_show_fdinfo+0x390/0x390 [ 1414.358997][T24278] ? lock_chain_count+0x20/0x20 [ 1414.363917][T24278] __x64_sys_bpf+0x7c/0x90 [ 1414.368413][T24278] do_syscall_64+0x55/0xb0 [ 1414.373491][T24278] ? clear_bhb_loop+0x40/0x90 [ 1414.378838][T24278] ? clear_bhb_loop+0x40/0x90 [ 1414.383852][T24278] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1414.390159][T24278] RIP: 0033:0x7f5b09b9e0d9 [ 1414.394877][T24278] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1414.416195][T24278] RSP: 002b:00007f5b07df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1414.424665][T24278] RAX: ffffffffffffffda RBX: 00007f5b09e25fa0 RCX: 00007f5b09b9e0d9 [ 1414.432866][T24278] RDX: 0000000000000048 RSI: 0000200000000500 RDI: 000000000000000a [ 1414.440905][T24278] RBP: 00007f5b07df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1414.449271][T24278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1414.457329][T24278] R13: 00007f5b09e26038 R14: 00007f5b09e25fa0 R15: 00007fff6635d918 [ 1414.465485][T24278] [ 1415.628897][T23580] Bluetooth: hci0: command 0x0406 tx timeout [ 1417.292773][T24292] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5777'. [ 1417.358890][T24292] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1418.178359][T24309] FAULT_INJECTION: forcing a failure. [ 1418.178359][T24309] name failslab, interval 1, probability 0, space 0, times 1 [ 1418.193944][T24309] CPU: 0 PID: 24309 Comm: syz.0.5787 Not tainted syzkaller #0 [ 1418.201479][T24309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1418.211757][T24309] Call Trace: [ 1418.215333][T24309] [ 1418.218328][T24309] dump_stack_lvl+0x18c/0x250 [ 1418.223085][T24309] ? show_regs_print_info+0x20/0x20 [ 1418.228446][T24309] ? load_image+0x420/0x420 [ 1418.233039][T24309] ? __might_sleep+0xe0/0xe0 [ 1418.237714][T24309] ? __lock_acquire+0x7d80/0x7d80 [ 1418.242781][T24309] should_fail_ex+0x394/0x4c0 [ 1418.247517][T24309] should_failslab+0x9/0x20 [ 1418.252117][T24309] slab_pre_alloc_hook+0x59/0x300 [ 1418.257209][T24309] ? kernfs_fop_write_iter+0x158/0x520 [ 1418.262723][T24309] ? kernfs_fop_write_iter+0x158/0x520 [ 1418.268236][T24309] __kmem_cache_alloc_node+0x53/0x250 [ 1418.273674][T24309] ? kernfs_fop_write_iter+0x158/0x520 [ 1418.279169][T24309] __kmalloc+0xa7/0x240 [ 1418.283363][T24309] kernfs_fop_write_iter+0x158/0x520 [ 1418.288690][T24309] vfs_write+0x474/0x9a0 [ 1418.292970][T24309] ? file_end_write+0x250/0x250 [ 1418.297855][T24309] ? __fget_files+0x3fc/0x460 [ 1418.302605][T24309] ? __fdget_pos+0x2a3/0x330 [ 1418.307247][T24309] ? ksys_write+0x74/0x260 [ 1418.311730][T24309] ksys_write+0x151/0x260 [ 1418.316120][T24309] ? __ia32_sys_read+0x90/0x90 [ 1418.320929][T24309] ? lockdep_hardirqs_on+0x98/0x150 [ 1418.326173][T24309] do_syscall_64+0x55/0xb0 [ 1418.330628][T24309] ? clear_bhb_loop+0x40/0x90 [ 1418.335354][T24309] ? clear_bhb_loop+0x40/0x90 [ 1418.340080][T24309] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1418.346013][T24309] RIP: 0033:0x7f35d379e0d9 [ 1418.350639][T24309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1418.370282][T24309] RSP: 002b:00007f35d463e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1418.378735][T24309] RAX: ffffffffffffffda RBX: 00007f35d3a25fa0 RCX: 00007f35d379e0d9 [ 1418.386736][T24309] RDX: 0000000000000012 RSI: 0000200000000200 RDI: 0000000000000004 [ 1418.394825][T24309] RBP: 00007f35d463e090 R08: 0000000000000000 R09: 0000000000000000 [ 1418.402827][T24309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1418.410848][T24309] R13: 00007f35d3a26038 R14: 00007f35d3a25fa0 R15: 00007ffd49c903e8 [ 1418.418873][T24309] [ 1419.113989][T24327] FAULT_INJECTION: forcing a failure. [ 1419.113989][T24327] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1419.131758][T24327] CPU: 0 PID: 24327 Comm: syz.2.5795 Not tainted syzkaller #0 [ 1419.139290][T24327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1419.149433][T24327] Call Trace: [ 1419.152757][T24327] [ 1419.155743][T24327] dump_stack_lvl+0x18c/0x250 [ 1419.160476][T24327] ? show_regs_print_info+0x20/0x20 [ 1419.165726][T24327] ? load_image+0x420/0x420 [ 1419.170289][T24327] ? __might_fault+0xaa/0x120 [ 1419.175034][T24327] ? __lock_acquire+0x7d80/0x7d80 [ 1419.180130][T24327] should_fail_ex+0x394/0x4c0 [ 1419.184876][T24327] _copy_from_user+0x2f/0xe0 [ 1419.189529][T24327] ___sys_sendmsg+0x1c7/0x360 [ 1419.194266][T24327] ? get_pid_task+0x20/0x1e0 [ 1419.199008][T24327] ? __sys_sendmsg+0x2b0/0x2b0 [ 1419.203850][T24327] ? __lock_acquire+0x7d80/0x7d80 [ 1419.208994][T24327] __se_sys_sendmsg+0x1d0/0x2c0 [ 1419.214115][T24327] ? __x64_sys_sendmsg+0x80/0x80 [ 1419.219142][T24327] ? lockdep_hardirqs_on+0x98/0x150 [ 1419.224445][T24327] do_syscall_64+0x55/0xb0 [ 1419.228923][T24327] ? clear_bhb_loop+0x40/0x90 [ 1419.233658][T24327] ? clear_bhb_loop+0x40/0x90 [ 1419.238387][T24327] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1419.244329][T24327] RIP: 0033:0x7fe0d599e0d9 [ 1419.248789][T24327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1419.268451][T24327] RSP: 002b:00007fe0d686b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1419.276924][T24327] RAX: ffffffffffffffda RBX: 00007fe0d5c26090 RCX: 00007fe0d599e0d9 [ 1419.284975][T24327] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1419.292992][T24327] RBP: 00007fe0d686b090 R08: 0000000000000000 R09: 0000000000000000 [ 1419.301099][T24327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1419.309132][T24327] R13: 00007fe0d5c26128 R14: 00007fe0d5c26090 R15: 00007ffee2bdfdc8 [ 1419.317170][T24327] [ 1419.488500][T24333] netlink: 'syz.1.5797': attribute type 1 has an invalid length. [ 1419.504883][T24333] netlink: 161700 bytes leftover after parsing attributes in process `syz.1.5797'. [ 1419.696122][T24336] FAULT_INJECTION: forcing a failure. [ 1419.696122][T24336] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1419.710549][T24336] CPU: 1 PID: 24336 Comm: syz.2.5801 Not tainted syzkaller #0 [ 1419.718108][T24336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1419.728218][T24336] Call Trace: [ 1419.731572][T24336] [ 1419.734581][T24336] dump_stack_lvl+0x18c/0x250 [ 1419.739771][T24336] ? show_regs_print_info+0x20/0x20 [ 1419.745030][T24336] ? load_image+0x420/0x420 [ 1419.749591][T24336] ? __might_fault+0xaa/0x120 [ 1419.754327][T24336] ? __lock_acquire+0x7d80/0x7d80 [ 1419.759413][T24336] should_fail_ex+0x394/0x4c0 [ 1419.764161][T24336] _copy_from_user+0x2f/0xe0 [ 1419.768813][T24336] __sys_bpf+0x23e/0x890 [ 1419.773114][T24336] ? bpf_link_show_fdinfo+0x390/0x390 [ 1419.778554][T24336] ? lock_chain_count+0x20/0x20 [ 1419.783478][T24336] __x64_sys_bpf+0x7c/0x90 [ 1419.787948][T24336] do_syscall_64+0x55/0xb0 [ 1419.792418][T24336] ? clear_bhb_loop+0x40/0x90 [ 1419.797142][T24336] ? clear_bhb_loop+0x40/0x90 [ 1419.801858][T24336] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1419.807797][T24336] RIP: 0033:0x7fe0d599e0d9 [ 1419.812252][T24336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1419.831940][T24336] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1419.840417][T24336] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1419.848458][T24336] RDX: 000000000000000c RSI: 0000200000000380 RDI: 000000000000000a [ 1419.856485][T24336] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1419.864595][T24336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1419.872614][T24336] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1419.880667][T24336] [ 1423.081609][T24411] netlink: 112 bytes leftover after parsing attributes in process `syz.2.5832'. [ 1423.310297][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.316985][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1425.725346][T24418] FAULT_INJECTION: forcing a failure. [ 1425.725346][T24418] name failslab, interval 1, probability 0, space 0, times 0 [ 1425.739076][T24419] FAULT_INJECTION: forcing a failure. [ 1425.739076][T24419] name failslab, interval 1, probability 0, space 0, times 0 [ 1425.747348][T24418] CPU: 0 PID: 24418 Comm: syz.1.5836 Not tainted syzkaller #0 [ 1425.759206][T24418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1425.769737][T24418] Call Trace: [ 1425.773084][T24418] [ 1425.776054][T24418] dump_stack_lvl+0x18c/0x250 [ 1425.780790][T24418] ? show_regs_print_info+0x20/0x20 [ 1425.786056][T24418] ? load_image+0x420/0x420 [ 1425.790720][T24418] ? __might_sleep+0xe0/0xe0 [ 1425.795357][T24418] ? __lock_acquire+0x7d80/0x7d80 [ 1425.800438][T24418] should_fail_ex+0x394/0x4c0 [ 1425.805177][T24418] should_failslab+0x9/0x20 [ 1425.809727][T24418] slab_pre_alloc_hook+0x59/0x300 [ 1425.814852][T24418] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1425.820675][T24418] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1425.826457][T24418] __kmem_cache_alloc_node+0x53/0x250 [ 1425.831893][T24418] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1425.837668][T24418] __kmalloc+0xa7/0x240 [ 1425.841882][T24418] tomoyo_realpath_from_path+0xe6/0x5c0 [ 1425.847512][T24418] ? tomoyo_domain+0xd6/0x120 [ 1425.852256][T24418] tomoyo_path_number_perm+0x248/0x5e0 [ 1425.857773][T24418] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1425.863555][T24418] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1425.869069][T24418] ? ksys_write+0x1d2/0x260 [ 1425.873654][T24418] ? __fget_files+0x28/0x460 [ 1425.878317][T24418] security_file_ioctl+0x70/0xa0 [ 1425.883370][T24418] __se_sys_ioctl+0x48/0x170 [ 1425.888023][T24418] do_syscall_64+0x55/0xb0 [ 1425.892488][T24418] ? clear_bhb_loop+0x40/0x90 [ 1425.897211][T24418] ? clear_bhb_loop+0x40/0x90 [ 1425.901953][T24418] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1425.907985][T24418] RIP: 0033:0x7f5b09b9e0d9 [ 1425.912447][T24418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1425.932808][T24418] RSP: 002b:00007f5b07df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1425.941368][T24418] RAX: ffffffffffffffda RBX: 00007f5b09e25fa0 RCX: 00007f5b09b9e0d9 [ 1425.949677][T24418] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000003 [ 1425.957691][T24418] RBP: 00007f5b07df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1425.965703][T24418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1425.973722][T24418] R13: 00007f5b09e26038 R14: 00007f5b09e25fa0 R15: 00007fff6635d918 [ 1425.981758][T24418] [ 1425.985669][T24419] CPU: 1 PID: 24419 Comm: syz.3.5834 Not tainted syzkaller #0 [ 1425.993192][T24419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1426.003276][T24419] Call Trace: [ 1426.006608][T24419] [ 1426.009571][T24419] dump_stack_lvl+0x18c/0x250 [ 1426.014293][T24419] ? show_regs_print_info+0x20/0x20 [ 1426.019517][T24419] ? load_image+0x420/0x420 [ 1426.024070][T24419] ? __might_sleep+0xe0/0xe0 [ 1426.028700][T24419] ? __lock_acquire+0x7d80/0x7d80 [ 1426.033763][T24419] should_fail_ex+0x394/0x4c0 [ 1426.038564][T24419] should_failslab+0x9/0x20 [ 1426.043102][T24419] slab_pre_alloc_hook+0x59/0x300 [ 1426.048171][T24419] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1426.054012][T24419] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1426.059781][T24419] __kmem_cache_alloc_node+0x53/0x250 [ 1426.065277][T24419] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1426.071033][T24419] __kmalloc+0xa7/0x240 [ 1426.075235][T24419] tomoyo_realpath_from_path+0xe6/0x5c0 [ 1426.080824][T24419] ? tomoyo_domain+0xd6/0x120 [ 1426.085556][T24419] tomoyo_path_number_perm+0x248/0x5e0 [ 1426.091057][T24419] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1426.096725][T24419] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1426.102215][T24419] ? ksys_write+0x1d2/0x260 [ 1426.106783][T24419] ? __fget_files+0x28/0x460 [ 1426.111416][T24419] security_file_ioctl+0x70/0xa0 [ 1426.116390][T24419] __se_sys_ioctl+0x48/0x170 [ 1426.121052][T24419] do_syscall_64+0x55/0xb0 [ 1426.125503][T24419] ? clear_bhb_loop+0x40/0x90 [ 1426.130237][T24419] ? clear_bhb_loop+0x40/0x90 [ 1426.134951][T24419] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1426.140901][T24419] RIP: 0033:0x7fe655d9e0d9 [ 1426.145365][T24419] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1426.165045][T24419] RSP: 002b:00007fe656b7f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1426.173597][T24419] RAX: ffffffffffffffda RBX: 00007fe656025fa0 RCX: 00007fe655d9e0d9 [ 1426.181610][T24419] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000003 [ 1426.189618][T24419] RBP: 00007fe656b7f090 R08: 0000000000000000 R09: 0000000000000000 [ 1426.197638][T24419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1426.205646][T24419] R13: 00007fe656026038 R14: 00007fe656025fa0 R15: 00007fff9e092f08 [ 1426.213759][T24419] [ 1426.233278][T24418] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1426.251879][T24419] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1427.498675][T23580] Bluetooth: hci2: unexpected subevent 0x0a length: 150 > 30 [ 1427.507801][T23580] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 1427.518359][T23580] CPU: 1 PID: 23580 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1427.526166][T23580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1427.536462][T23580] Workqueue: hci2 hci_rx_work [ 1427.541210][T23580] Call Trace: [ 1427.544530][T23580] [ 1427.547506][T23580] dump_stack_lvl+0x18c/0x250 [ 1427.552242][T23580] ? show_regs_print_info+0x20/0x20 [ 1427.557486][T23580] ? load_image+0x420/0x420 [ 1427.562049][T23580] sysfs_create_dir_ns+0x26e/0x2a0 [ 1427.567253][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1427.572328][T23580] ? sysfs_warn_dup+0xa0/0xa0 [ 1427.577176][T23580] ? do_raw_spin_unlock+0x121/0x230 [ 1427.582431][T23580] kobject_add_internal+0x617/0xc90 [ 1427.587695][T23580] kobject_add+0x164/0x240 [ 1427.592182][T23580] ? kobject_init+0x1d0/0x1d0 [ 1427.596920][T23580] ? get_device_parent+0x366/0x390 [ 1427.602539][T23580] device_add+0x3fa/0xc40 [ 1427.606910][T23580] hci_conn_add_sysfs+0xd5/0x1e0 [ 1427.611895][T23580] le_conn_complete_evt+0xe9f/0x1480 [ 1427.617226][T23580] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1427.623597][T23580] ? bt_info+0x180/0x180 [ 1427.627876][T23580] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1427.633572][T23580] ? mutex_unlock+0x10/0x10 [ 1427.638131][T23580] ? skb_pull_data+0xf0/0x1f0 [ 1427.642953][T23580] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1427.648904][T23580] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1427.655404][T23580] ? hci_remote_host_features_evt+0x150/0x150 [ 1427.661559][T23580] hci_event_packet+0x7b4/0x1280 [ 1427.666589][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1427.671706][T23580] ? lock_chain_count+0x20/0x20 [ 1427.676604][T23580] ? bis_list+0x290/0x290 [ 1427.680985][T23580] ? lockdep_hardirqs_on+0x98/0x150 [ 1427.686239][T23580] ? hci_send_to_monitor+0xd7/0x4f0 [ 1427.691490][T23580] hci_rx_work+0x43a/0xd60 [ 1427.695952][T23580] ? process_scheduled_works+0x975/0x1600 [ 1427.701974][T23580] process_scheduled_works+0xa60/0x1600 [ 1427.707702][T23580] ? worker_attach_to_pool+0x370/0x370 [ 1427.713298][T23580] ? assign_work+0x3cc/0x5d0 [ 1427.717969][T23580] worker_thread+0xa5e/0xfe0 [ 1427.722807][T23580] ? _raw_spin_unlock+0x40/0x40 [ 1427.727724][T23580] ? __kthread_parkme+0x71/0x1c0 [ 1427.732732][T23580] kthread+0x2fa/0x390 [ 1427.736960][T23580] ? pr_cont_work+0x550/0x550 [ 1427.741786][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1427.746453][T23580] ret_from_fork+0x48/0x80 [ 1427.750942][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1427.755603][T23580] ret_from_fork_asm+0x11/0x20 [ 1427.760569][T23580] [ 1427.803925][T23580] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1427.818143][T23580] Bluetooth: hci2: failed to register connection device [ 1429.859138][T23580] Bluetooth: hci2: command 0x0406 tx timeout [ 1430.000897][T24451] FAULT_INJECTION: forcing a failure. [ 1430.000897][T24451] name failslab, interval 1, probability 0, space 0, times 0 [ 1430.026092][T24451] CPU: 0 PID: 24451 Comm: syz.2.5848 Not tainted syzkaller #0 [ 1430.033660][T24451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1430.043795][T24451] Call Trace: [ 1430.047145][T24451] [ 1430.050149][T24451] dump_stack_lvl+0x18c/0x250 [ 1430.054947][T24451] ? show_regs_print_info+0x20/0x20 [ 1430.060223][T24451] ? load_image+0x420/0x420 [ 1430.064804][T24451] ? __might_sleep+0xe0/0xe0 [ 1430.069486][T24451] ? __lock_acquire+0x7d80/0x7d80 [ 1430.074585][T24451] should_fail_ex+0x394/0x4c0 [ 1430.079340][T24451] should_failslab+0x9/0x20 [ 1430.083901][T24451] slab_pre_alloc_hook+0x59/0x300 [ 1430.088999][T24451] ? trace_call_bpf+0x5e9/0x6c0 [ 1430.093933][T24451] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1430.099816][T24451] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1430.105602][T24451] __kmem_cache_alloc_node+0x53/0x250 [ 1430.111051][T24451] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1430.116824][T24451] __kmalloc+0xa7/0x240 [ 1430.121053][T24451] tomoyo_realpath_from_path+0xe6/0x5c0 [ 1430.126668][T24451] ? tomoyo_domain+0xd6/0x120 [ 1430.131518][T24451] tomoyo_path_number_perm+0x248/0x5e0 [ 1430.137122][T24451] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1430.142815][T24451] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1430.148342][T24451] ? ksys_write+0x1d2/0x260 [ 1430.153001][T24451] ? __fget_files+0x28/0x460 [ 1430.157682][T24451] security_file_ioctl+0x70/0xa0 [ 1430.162686][T24451] __se_sys_ioctl+0x48/0x170 [ 1430.167341][T24451] do_syscall_64+0x55/0xb0 [ 1430.171810][T24451] ? clear_bhb_loop+0x40/0x90 [ 1430.176538][T24451] ? clear_bhb_loop+0x40/0x90 [ 1430.181292][T24451] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1430.187229][T24451] RIP: 0033:0x7fe0d599e0d9 [ 1430.191695][T24451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1430.211698][T24451] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1430.220167][T24451] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1430.228195][T24451] RDX: 0000200000000040 RSI: 00000000400454dc RDI: 0000000000000005 [ 1430.236398][T24451] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1430.244414][T24451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1430.252428][T24451] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1430.260495][T24451] [ 1430.273061][T24451] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1430.544090][T24454] syzkaller0: entered promiscuous mode [ 1430.553949][T24454] syzkaller0: entered allmulticast mode [ 1431.456444][T23580] Bluetooth: hci3: unexpected subevent 0x0a length: 150 > 30 [ 1431.468550][T23580] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1431.486074][T23580] CPU: 1 PID: 23580 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1431.493779][T23580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1431.503884][T23580] Workqueue: hci3 hci_rx_work [ 1431.508627][T23580] Call Trace: [ 1431.511993][T23580] [ 1431.514960][T23580] dump_stack_lvl+0x18c/0x250 [ 1431.519697][T23580] ? show_regs_print_info+0x20/0x20 [ 1431.524950][T23580] ? load_image+0x420/0x420 [ 1431.529546][T23580] sysfs_create_dir_ns+0x26e/0x2a0 [ 1431.534716][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1431.539809][T23580] ? sysfs_warn_dup+0xa0/0xa0 [ 1431.544549][T23580] ? do_raw_spin_unlock+0x121/0x230 [ 1431.549811][T23580] kobject_add_internal+0x617/0xc90 [ 1431.555078][T23580] kobject_add+0x164/0x240 [ 1431.559565][T23580] ? kobject_init+0x1d0/0x1d0 [ 1431.564320][T23580] ? get_device_parent+0x366/0x390 [ 1431.569504][T23580] device_add+0x3fa/0xc40 [ 1431.573902][T23580] hci_conn_add_sysfs+0xd5/0x1e0 [ 1431.578907][T23580] le_conn_complete_evt+0xe9f/0x1480 [ 1431.584271][T23580] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1431.590576][T23580] ? bt_info+0x180/0x180 [ 1431.594877][T23580] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1431.600592][T23580] ? mutex_unlock+0x10/0x10 [ 1431.605152][T23580] ? skb_pull_data+0xf0/0x1f0 [ 1431.609888][T23580] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1431.615839][T23580] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1431.622301][T23580] ? hci_remote_host_features_evt+0x150/0x150 [ 1431.628437][T23580] hci_event_packet+0x7b4/0x1280 [ 1431.633430][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1431.638503][T23580] ? lock_chain_count+0x20/0x20 [ 1431.643393][T23580] ? bis_list+0x290/0x290 [ 1431.647759][T23580] ? lockdep_hardirqs_on+0x98/0x150 [ 1431.653000][T23580] ? hci_send_to_monitor+0xd7/0x4f0 [ 1431.658229][T23580] hci_rx_work+0x43a/0xd60 [ 1431.662690][T23580] ? process_scheduled_works+0x975/0x1600 [ 1431.668448][T23580] process_scheduled_works+0xa60/0x1600 [ 1431.674053][T23580] ? worker_attach_to_pool+0x370/0x370 [ 1431.679555][T23580] ? assign_work+0x3cc/0x5d0 [ 1431.684186][T23580] worker_thread+0xa5e/0xfe0 [ 1431.688829][T23580] ? _raw_spin_unlock+0x40/0x40 [ 1431.693715][T23580] ? __kthread_parkme+0x71/0x1c0 [ 1431.698783][T23580] kthread+0x2fa/0x390 [ 1431.702881][T23580] ? pr_cont_work+0x550/0x550 [ 1431.707592][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1431.712211][T23580] ret_from_fork+0x48/0x80 [ 1431.716675][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1431.721487][T23580] ret_from_fork_asm+0x11/0x20 [ 1431.726335][T23580] [ 1431.731337][T23580] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1431.746044][T23580] Bluetooth: hci3: failed to register connection device [ 1432.089604][T24473] FAULT_INJECTION: forcing a failure. [ 1432.089604][T24473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1432.107969][T24473] CPU: 0 PID: 24473 Comm: syz.2.5858 Not tainted syzkaller #0 [ 1432.115534][T24473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1432.125647][T24473] Call Trace: [ 1432.128972][T24473] [ 1432.131950][T24473] dump_stack_lvl+0x18c/0x250 [ 1432.136687][T24473] ? show_regs_print_info+0x20/0x20 [ 1432.141942][T24473] ? load_image+0x420/0x420 [ 1432.146511][T24473] ? __might_fault+0xaa/0x120 [ 1432.151516][T24473] ? __lock_acquire+0x7d80/0x7d80 [ 1432.156607][T24473] should_fail_ex+0x394/0x4c0 [ 1432.161349][T24473] _copy_from_user+0x2f/0xe0 [ 1432.166087][T24473] __sys_bpf+0x23e/0x890 [ 1432.170397][T24473] ? bpf_link_show_fdinfo+0x390/0x390 [ 1432.175844][T24473] ? lock_chain_count+0x20/0x20 [ 1432.180783][T24473] __x64_sys_bpf+0x7c/0x90 [ 1432.185269][T24473] do_syscall_64+0x55/0xb0 [ 1432.189742][T24473] ? clear_bhb_loop+0x40/0x90 [ 1432.194473][T24473] ? clear_bhb_loop+0x40/0x90 [ 1432.199208][T24473] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1432.205157][T24473] RIP: 0033:0x7fe0d599e0d9 [ 1432.209626][T24473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1432.229376][T24473] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1432.237843][T24473] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1432.245858][T24473] RDX: 0000000000000010 RSI: 0000200000000a80 RDI: 000000000000000a [ 1432.253876][T24473] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1432.261911][T24473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1432.269933][T24473] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1432.277974][T24473] [ 1433.778273][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 1436.012227][ T5786] Bluetooth: hci2: unexpected subevent 0x0a length: 150 > 30 [ 1436.021026][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 1436.030753][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1436.038375][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1436.048487][ T5786] Workqueue: hci2 hci_rx_work [ 1436.053230][ T5786] Call Trace: [ 1436.056559][ T5786] [ 1436.059617][ T5786] dump_stack_lvl+0x18c/0x250 [ 1436.064357][ T5786] ? show_regs_print_info+0x20/0x20 [ 1436.069606][ T5786] ? load_image+0x420/0x420 [ 1436.074158][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1436.079380][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1436.084431][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1436.089180][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1436.094447][ T5786] kobject_add_internal+0x617/0xc90 [ 1436.099719][ T5786] kobject_add+0x164/0x240 [ 1436.104208][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1436.108957][ T5786] ? get_device_parent+0x366/0x390 [ 1436.114121][ T5786] device_add+0x3fa/0xc40 [ 1436.118509][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1436.123522][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1436.128841][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1436.135105][ T5786] ? bt_info+0x180/0x180 [ 1436.139468][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1436.145297][ T5786] ? mutex_unlock+0x10/0x10 [ 1436.149867][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1436.154614][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1436.160575][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1436.167064][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1436.173202][ T5786] hci_event_packet+0x7b4/0x1280 [ 1436.178338][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1436.183432][ T5786] ? lock_chain_count+0x20/0x20 [ 1436.188346][ T5786] ? bis_list+0x290/0x290 [ 1436.192749][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1436.198047][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1436.203315][ T5786] hci_rx_work+0x43a/0xd60 [ 1436.207780][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1436.213548][ T5786] process_scheduled_works+0xa60/0x1600 [ 1436.219172][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1436.224672][ T5786] ? assign_work+0x3cc/0x5d0 [ 1436.229311][ T5786] worker_thread+0xa5e/0xfe0 [ 1436.233950][ T5786] kthread+0x2fa/0x390 [ 1436.238134][ T5786] ? pr_cont_work+0x550/0x550 [ 1436.242875][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1436.247530][ T5786] ret_from_fork+0x48/0x80 [ 1436.252001][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1436.256641][ T5786] ret_from_fork_asm+0x11/0x20 [ 1436.261467][ T5786] [ 1436.266147][ T5786] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1436.280127][ T5786] Bluetooth: hci2: failed to register connection device [ 1437.416563][T23580] Bluetooth: hci0: unexpected subevent 0x0a length: 150 > 30 [ 1437.426020][T23580] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 1437.436049][T23580] CPU: 0 PID: 23580 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1437.443861][T23580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1437.454152][T23580] Workqueue: hci0 hci_rx_work [ 1437.458889][T23580] Call Trace: [ 1437.462202][T23580] [ 1437.465166][T23580] dump_stack_lvl+0x18c/0x250 [ 1437.469895][T23580] ? show_regs_print_info+0x20/0x20 [ 1437.475133][T23580] ? load_image+0x420/0x420 [ 1437.479728][T23580] sysfs_create_dir_ns+0x26e/0x2a0 [ 1437.484906][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1437.490086][T23580] ? sysfs_warn_dup+0xa0/0xa0 [ 1437.494830][T23580] ? do_raw_spin_unlock+0x121/0x230 [ 1437.500289][T23580] kobject_add_internal+0x617/0xc90 [ 1437.505575][T23580] kobject_add+0x164/0x240 [ 1437.510228][T23580] ? kobject_init+0x1d0/0x1d0 [ 1437.515100][T23580] ? get_device_parent+0x366/0x390 [ 1437.520265][T23580] device_add+0x3fa/0xc40 [ 1437.524654][T23580] hci_conn_add_sysfs+0xd5/0x1e0 [ 1437.529673][T23580] le_conn_complete_evt+0xe9f/0x1480 [ 1437.535000][T23580] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1437.541278][T23580] ? bt_info+0x180/0x180 [ 1437.545560][T23580] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1437.551237][T23580] ? mutex_unlock+0x10/0x10 [ 1437.555801][T23580] ? skb_pull_data+0xf0/0x1f0 [ 1437.560616][T23580] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1437.566557][T23580] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1437.573459][T23580] ? hci_remote_host_features_evt+0x150/0x150 [ 1437.579574][T23580] hci_event_packet+0x7b4/0x1280 [ 1437.584554][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1437.589702][T23580] ? lock_chain_count+0x20/0x20 [ 1437.594590][T23580] ? bis_list+0x290/0x290 [ 1437.599045][T23580] ? lockdep_hardirqs_on+0x98/0x150 [ 1437.604410][T23580] ? hci_send_to_monitor+0xd7/0x4f0 [ 1437.609647][T23580] hci_rx_work+0x43a/0xd60 [ 1437.614211][T23580] ? process_scheduled_works+0x975/0x1600 [ 1437.619992][T23580] process_scheduled_works+0xa60/0x1600 [ 1437.625615][T23580] ? worker_attach_to_pool+0x370/0x370 [ 1437.631241][T23580] ? assign_work+0x3cc/0x5d0 [ 1437.635901][T23580] worker_thread+0xa5e/0xfe0 [ 1437.640545][T23580] ? _raw_spin_unlock+0x40/0x40 [ 1437.645439][T23580] ? __kthread_parkme+0x71/0x1c0 [ 1437.650735][T23580] kthread+0x2fa/0x390 [ 1437.654879][T23580] ? pr_cont_work+0x550/0x550 [ 1437.659606][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1437.664324][T23580] ret_from_fork+0x48/0x80 [ 1437.668796][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1437.673427][T23580] ret_from_fork_asm+0x11/0x20 [ 1437.678256][T23580] [ 1437.683193][T23580] kobject: kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1437.697628][T23580] Bluetooth: hci0: failed to register connection device [ 1438.139098][T24527] sit0: entered allmulticast mode [ 1438.237211][T24526] netlink: 'syz.0.5879': attribute type 2 has an invalid length. [ 1438.283190][T24526] netlink: 'syz.0.5879': attribute type 1 has an invalid length. [ 1438.338386][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 1438.390495][T24526] netlink: 9 bytes leftover after parsing attributes in process `syz.0.5879'. [ 1438.845572][T24535] sit0: entered allmulticast mode [ 1439.193763][T24551] netlink: 'syz.3.5883': attribute type 2 has an invalid length. [ 1439.248351][T24551] netlink: 'syz.3.5883': attribute type 1 has an invalid length. [ 1439.286798][T24551] netlink: 9 bytes leftover after parsing attributes in process `syz.3.5883'. [ 1439.366375][T24554] sit0: entered allmulticast mode [ 1439.699765][ T5786] Bluetooth: hci1: unexpected subevent 0x0a length: 150 > 30 [ 1439.707845][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1439.717508][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1439.725111][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1439.735205][ T5786] Workqueue: hci1 hci_rx_work [ 1439.739936][ T5786] Call Trace: [ 1439.743252][ T5786] [ 1439.746234][ T5786] dump_stack_lvl+0x18c/0x250 [ 1439.751101][ T5786] ? show_regs_print_info+0x20/0x20 [ 1439.756542][ T5786] ? load_image+0x420/0x420 [ 1439.761479][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1439.766644][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1439.771717][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1439.776449][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1439.781725][ T5786] kobject_add_internal+0x617/0xc90 [ 1439.786984][ T5786] kobject_add+0x164/0x240 [ 1439.791448][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1439.796201][ T5786] ? get_device_parent+0x366/0x390 [ 1439.801395][ T5786] device_add+0x3fa/0xc40 [ 1439.805780][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1439.810853][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1439.816195][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1439.822479][ T5786] ? bt_info+0x180/0x180 [ 1439.826765][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1439.832445][ T5786] ? mutex_unlock+0x10/0x10 [ 1439.837012][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1439.841733][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1439.847673][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1439.854240][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1439.860444][ T5786] hci_event_packet+0x7b4/0x1280 [ 1439.865425][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1439.870483][ T5786] ? lock_chain_count+0x20/0x20 [ 1439.875368][ T5786] ? bis_list+0x290/0x290 [ 1439.879739][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1439.884992][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1439.890243][ T5786] hci_rx_work+0x43a/0xd60 [ 1439.894884][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1439.900835][ T5786] process_scheduled_works+0xa60/0x1600 [ 1439.906633][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1439.912165][ T5786] ? assign_work+0x3cc/0x5d0 [ 1439.916812][ T5786] worker_thread+0xa5e/0xfe0 [ 1439.921510][ T5786] kthread+0x2fa/0x390 [ 1439.925647][ T5786] ? pr_cont_work+0x550/0x550 [ 1439.930364][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1439.934991][ T5786] ret_from_fork+0x48/0x80 [ 1439.939449][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1439.944072][ T5786] ret_from_fork_asm+0x11/0x20 [ 1439.948887][ T5786] [ 1439.958100][T23580] Bluetooth: hci0: command 0x0406 tx timeout [ 1440.014827][ T5786] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1440.029833][ T5786] Bluetooth: hci1: failed to register connection device [ 1440.184138][T24564] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.5889'. [ 1440.245256][T24564] netlink: 'syz.2.5889': attribute type 10 has an invalid length. [ 1440.264566][T24564] hsr0: entered promiscuous mode [ 1440.271024][T24569] netlink: 'syz.1.5890': attribute type 2 has an invalid length. [ 1440.271124][T24569] netlink: 'syz.1.5890': attribute type 1 has an invalid length. [ 1440.301699][T24569] netlink: 9 bytes leftover after parsing attributes in process `syz.1.5890'. [ 1440.350271][T24573] netlink: 'syz.3.5892': attribute type 2 has an invalid length. [ 1440.363743][T24573] netlink: 'syz.3.5892': attribute type 1 has an invalid length. [ 1440.387615][T24573] netlink: 9 bytes leftover after parsing attributes in process `syz.3.5892'. [ 1440.452163][T24564] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1440.482174][T24564] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 1440.507341][T24564] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1440.533884][T24564] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 1442.101194][T23580] Bluetooth: hci1: command 0x0406 tx timeout [ 1442.109470][T23580] Bluetooth: hci3: unexpected subevent 0x0a length: 150 > 30 [ 1442.118342][T23580] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1442.127814][T23580] CPU: 0 PID: 23580 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1442.135595][T23580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1442.145706][T23580] Workqueue: hci3 hci_rx_work [ 1442.150541][T23580] Call Trace: [ 1442.153868][T23580] [ 1442.156845][T23580] dump_stack_lvl+0x18c/0x250 [ 1442.161590][T23580] ? show_regs_print_info+0x20/0x20 [ 1442.167218][T23580] ? load_image+0x420/0x420 [ 1442.171805][T23580] sysfs_create_dir_ns+0x26e/0x2a0 [ 1442.177043][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1442.182132][T23580] ? sysfs_warn_dup+0xa0/0xa0 [ 1442.187202][T23580] ? do_raw_spin_unlock+0x121/0x230 [ 1442.192467][T23580] kobject_add_internal+0x617/0xc90 [ 1442.197723][T23580] kobject_add+0x164/0x240 [ 1442.202213][T23580] ? kobject_init+0x1d0/0x1d0 [ 1442.206958][T23580] ? get_device_parent+0x366/0x390 [ 1442.212826][T23580] device_add+0x3fa/0xc40 [ 1442.217217][T23580] hci_conn_add_sysfs+0xd5/0x1e0 [ 1442.222324][T23580] le_conn_complete_evt+0xe9f/0x1480 [ 1442.227679][T23580] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1442.233971][T23580] ? bt_info+0x180/0x180 [ 1442.238273][T23580] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1442.243982][T23580] ? mutex_unlock+0x10/0x10 [ 1442.248622][T23580] ? skb_pull_data+0xf0/0x1f0 [ 1442.253360][T23580] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1442.259601][T23580] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1442.266075][T23580] ? hci_remote_host_features_evt+0x150/0x150 [ 1442.272223][T23580] hci_event_packet+0x7b4/0x1280 [ 1442.277221][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1442.282326][T23580] ? lock_chain_count+0x20/0x20 [ 1442.287236][T23580] ? bis_list+0x290/0x290 [ 1442.291634][T23580] ? lockdep_hardirqs_on+0x98/0x150 [ 1442.296889][T23580] ? hci_send_to_monitor+0xd7/0x4f0 [ 1442.302133][T23580] hci_rx_work+0x43a/0xd60 [ 1442.306609][T23580] ? process_scheduled_works+0x975/0x1600 [ 1442.312378][T23580] process_scheduled_works+0xa60/0x1600 [ 1442.317998][T23580] ? worker_attach_to_pool+0x370/0x370 [ 1442.323521][T23580] ? assign_work+0x3cc/0x5d0 [ 1442.328173][T23580] worker_thread+0xa5e/0xfe0 [ 1442.332831][T23580] ? _raw_spin_unlock+0x40/0x40 [ 1442.337728][T23580] ? __kthread_parkme+0x71/0x1c0 [ 1442.342715][T23580] kthread+0x2fa/0x390 [ 1442.346827][T23580] ? pr_cont_work+0x550/0x550 [ 1442.351577][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1442.356206][T23580] ret_from_fork+0x48/0x80 [ 1442.360663][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1442.365294][T23580] ret_from_fork_asm+0x11/0x20 [ 1442.370118][T23580] [ 1442.374031][T23580] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1442.387996][T23580] Bluetooth: hci3: failed to register connection device [ 1442.514471][T24600] FAULT_INJECTION: forcing a failure. [ 1442.514471][T24600] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1442.589833][T24600] CPU: 1 PID: 24600 Comm: syz.3.5901 Not tainted syzkaller #0 [ 1442.598969][T24600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1442.610243][T24600] Call Trace: [ 1442.613702][T24600] [ 1442.616869][T24600] dump_stack_lvl+0x18c/0x250 [ 1442.621625][T24600] ? show_regs_print_info+0x20/0x20 [ 1442.626973][T24600] ? load_image+0x420/0x420 [ 1442.631540][T24600] ? __lock_acquire+0x7d80/0x7d80 [ 1442.637082][T24600] ? __lock_acquire+0x7d80/0x7d80 [ 1442.642174][T24600] should_fail_ex+0x394/0x4c0 [ 1442.646925][T24600] _copy_from_user+0x2f/0xe0 [ 1442.651581][T24600] perf_copy_attr+0x16a/0x820 [ 1442.656324][T24600] __se_sys_perf_event_open+0x11b/0x1c60 [ 1442.662027][T24600] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1442.668235][T24600] ? mutex_unlock+0x10/0x10 [ 1442.672978][T24600] ? __fget_files+0x3fc/0x460 [ 1442.677711][T24600] ? __x64_sys_perf_event_open+0xc0/0xc0 [ 1442.683402][T24600] ? lock_chain_count+0x20/0x20 [ 1442.688300][T24600] ? lockdep_hardirqs_on+0x98/0x150 [ 1442.693550][T24600] ? __x64_sys_perf_event_open+0x20/0xc0 [ 1442.699243][T24600] do_syscall_64+0x55/0xb0 [ 1442.703710][T24600] ? clear_bhb_loop+0x40/0x90 [ 1442.708432][T24600] ? clear_bhb_loop+0x40/0x90 [ 1442.713160][T24600] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1442.719100][T24600] RIP: 0033:0x7fe655d9e0d9 [ 1442.723560][T24600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1442.743653][T24600] RSP: 002b:00007fe656b7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1442.752218][T24600] RAX: ffffffffffffffda RBX: 00007fe656025fa0 RCX: 00007fe655d9e0d9 [ 1442.760227][T24600] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000500 [ 1442.768240][T24600] RBP: 00007fe656b7f090 R08: 0000000000000009 R09: 0000000000000000 [ 1442.776236][T24600] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1442.784231][T24600] R13: 00007fe656026038 R14: 00007fe656025fa0 R15: 00007fff9e092f08 [ 1442.792250][T24600] [ 1442.945175][T24600] sit0: entered promiscuous mode [ 1443.669752][T24626] netlink: 14 bytes leftover after parsing attributes in process `syz.3.5908'. [ 1443.912462][ T5786] Bluetooth: hci3: unexpected subevent 0x0a length: 150 > 30 [ 1443.921158][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1443.932288][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1443.939897][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1443.950076][ T5786] Workqueue: hci3 hci_rx_work [ 1443.954803][ T5786] Call Trace: [ 1443.958155][ T5786] [ 1443.961121][ T5786] dump_stack_lvl+0x18c/0x250 [ 1443.965860][ T5786] ? show_regs_print_info+0x20/0x20 [ 1443.971115][ T5786] ? load_image+0x420/0x420 [ 1443.975678][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1443.980842][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1443.985908][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1443.990625][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1443.995880][ T5786] kobject_add_internal+0x617/0xc90 [ 1444.001138][ T5786] kobject_add+0x164/0x240 [ 1444.005619][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1444.010432][ T5786] ? get_device_parent+0x366/0x390 [ 1444.015601][ T5786] device_add+0x3fa/0xc40 [ 1444.019979][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1444.024960][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1444.030501][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1444.036872][ T5786] ? bt_info+0x180/0x180 [ 1444.041150][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1444.046922][ T5786] ? mutex_unlock+0x10/0x10 [ 1444.051459][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1444.056179][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1444.062118][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1444.068571][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1444.074671][ T5786] hci_event_packet+0x7b4/0x1280 [ 1444.079650][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1444.084733][ T5786] ? lock_chain_count+0x20/0x20 [ 1444.089630][ T5786] ? bis_list+0x290/0x290 [ 1444.093999][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1444.099239][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1444.104478][ T5786] hci_rx_work+0x43a/0xd60 [ 1444.108935][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1444.114777][ T5786] process_scheduled_works+0xa60/0x1600 [ 1444.120391][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1444.125888][ T5786] ? assign_work+0x3cc/0x5d0 [ 1444.130523][ T5786] worker_thread+0xa5e/0xfe0 [ 1444.135177][ T5786] kthread+0x2fa/0x390 [ 1444.139275][ T5786] ? pr_cont_work+0x550/0x550 [ 1444.143991][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1444.148610][ T5786] ret_from_fork+0x48/0x80 [ 1444.153085][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1444.157706][ T5786] ret_from_fork_asm+0x11/0x20 [ 1444.162525][ T5786] [ 1444.175976][ T5786] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1444.190029][ T5786] Bluetooth: hci3: failed to register connection device [ 1444.419481][T23580] Bluetooth: hci3: command 0x0406 tx timeout [ 1444.450560][T24638] FAULT_INJECTION: forcing a failure. [ 1444.450560][T24638] name failslab, interval 1, probability 0, space 0, times 0 [ 1444.491454][T24638] CPU: 1 PID: 24638 Comm: syz.2.5913 Not tainted syzkaller #0 [ 1444.499005][T24638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1444.509109][T24638] Call Trace: [ 1444.512431][T24638] [ 1444.515411][T24638] dump_stack_lvl+0x18c/0x250 [ 1444.520168][T24638] ? show_regs_print_info+0x20/0x20 [ 1444.525411][T24638] ? load_image+0x420/0x420 [ 1444.529979][T24638] ? __might_sleep+0xe0/0xe0 [ 1444.534625][T24638] ? __lock_acquire+0x7d80/0x7d80 [ 1444.539715][T24638] should_fail_ex+0x394/0x4c0 [ 1444.544554][T24638] should_failslab+0x9/0x20 [ 1444.549121][T24638] slab_pre_alloc_hook+0x59/0x300 [ 1444.554211][T24638] ? kernfs_fop_write_iter+0x158/0x520 [ 1444.559741][T24638] ? kernfs_fop_write_iter+0x158/0x520 [ 1444.565276][T24638] __kmem_cache_alloc_node+0x53/0x250 [ 1444.570805][T24638] ? kernfs_fop_write_iter+0x158/0x520 [ 1444.576537][T24638] __kmalloc+0xa7/0x240 [ 1444.580828][T24638] kernfs_fop_write_iter+0x158/0x520 [ 1444.586233][T24638] vfs_write+0x474/0x9a0 [ 1444.590561][T24638] ? file_end_write+0x250/0x250 [ 1444.595488][T24638] ? __fget_files+0x3fc/0x460 [ 1444.600239][T24638] ? __fdget_pos+0x2a3/0x330 [ 1444.604891][T24638] ? ksys_write+0x74/0x260 [ 1444.609374][T24638] ksys_write+0x151/0x260 [ 1444.613766][T24638] ? __ia32_sys_read+0x90/0x90 [ 1444.618608][T24638] ? lockdep_hardirqs_on+0x98/0x150 [ 1444.623878][T24638] do_syscall_64+0x55/0xb0 [ 1444.628379][T24638] ? clear_bhb_loop+0x40/0x90 [ 1444.633109][T24638] ? clear_bhb_loop+0x40/0x90 [ 1444.637844][T24638] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1444.643787][T24638] RIP: 0033:0x7fe0d599e0d9 [ 1444.648254][T24638] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1444.667909][T24638] RSP: 002b:00007fe0d686b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1444.676379][T24638] RAX: ffffffffffffffda RBX: 00007fe0d5c26090 RCX: 00007fe0d599e0d9 [ 1444.684405][T24638] RDX: 000000000000000a RSI: 0000200000000200 RDI: 000000000000000e [ 1444.692422][T24638] RBP: 00007fe0d686b090 R08: 0000000000000000 R09: 0000000000000000 [ 1444.700436][T24638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1444.708448][T24638] R13: 00007fe0d5c26128 R14: 00007fe0d5c26090 R15: 00007ffee2bdfdc8 [ 1444.716492][T24638] [ 1444.834039][T24637] sit0: entered allmulticast mode [ 1444.904121][T24638] sit0: entered promiscuous mode [ 1445.274909][T24652] sit0: entered promiscuous mode [ 1446.057383][T24656] netlink: 'syz.0.5920': attribute type 1 has an invalid length. [ 1446.070234][T24657] netlink: 'syz.0.5920': attribute type 9 has an invalid length. [ 1446.084339][T24656] netlink: 'syz.0.5920': attribute type 3 has an invalid length. [ 1446.092344][T24657] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.5920'. [ 1446.106326][T24656] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5920'. [ 1446.333823][T23580] Bluetooth: hci1: unexpected subevent 0x0a length: 150 > 30 [ 1446.343309][T23580] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1446.353064][T23580] CPU: 0 PID: 23580 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1446.360758][T23580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1446.370952][T23580] Workqueue: hci1 hci_rx_work [ 1446.375881][T23580] Call Trace: [ 1446.379295][T23580] [ 1446.382268][T23580] dump_stack_lvl+0x18c/0x250 [ 1446.387016][T23580] ? show_regs_print_info+0x20/0x20 [ 1446.392270][T23580] ? load_image+0x420/0x420 [ 1446.396860][T23580] sysfs_create_dir_ns+0x26e/0x2a0 [ 1446.402024][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1446.407107][T23580] ? sysfs_warn_dup+0xa0/0xa0 [ 1446.411880][T23580] ? do_raw_spin_unlock+0x121/0x230 [ 1446.417148][T23580] kobject_add_internal+0x617/0xc90 [ 1446.422426][T23580] kobject_add+0x164/0x240 [ 1446.426893][T23580] ? kobject_init+0x1d0/0x1d0 [ 1446.431712][T23580] ? get_device_parent+0x366/0x390 [ 1446.436894][T23580] device_add+0x3fa/0xc40 [ 1446.441275][T23580] hci_conn_add_sysfs+0xd5/0x1e0 [ 1446.446282][T23580] le_conn_complete_evt+0xe9f/0x1480 [ 1446.451623][T23580] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1446.457975][T23580] ? bt_info+0x180/0x180 [ 1446.462263][T23580] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1446.467951][T23580] ? mutex_unlock+0x10/0x10 [ 1446.472521][T23580] ? skb_pull_data+0xf0/0x1f0 [ 1446.477245][T23580] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1446.483181][T23580] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1446.489665][T23580] ? hci_remote_host_features_evt+0x150/0x150 [ 1446.495781][T23580] hci_event_packet+0x7b4/0x1280 [ 1446.500933][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1446.506002][T23580] ? lock_chain_count+0x20/0x20 [ 1446.510890][T23580] ? bis_list+0x290/0x290 [ 1446.515258][T23580] ? lockdep_hardirqs_on+0x98/0x150 [ 1446.520497][T23580] ? hci_send_to_monitor+0xd7/0x4f0 [ 1446.525730][T23580] hci_rx_work+0x43a/0xd60 [ 1446.530180][T23580] ? process_scheduled_works+0x975/0x1600 [ 1446.535939][T23580] process_scheduled_works+0xa60/0x1600 [ 1446.541548][T23580] ? worker_attach_to_pool+0x370/0x370 [ 1446.547046][T23580] ? assign_work+0x3cc/0x5d0 [ 1446.551675][T23580] worker_thread+0xa5e/0xfe0 [ 1446.556424][T23580] ? _raw_spin_unlock+0x40/0x40 [ 1446.561312][T23580] ? __kthread_parkme+0x71/0x1c0 [ 1446.566319][T23580] kthread+0x2fa/0x390 [ 1446.570430][T23580] ? pr_cont_work+0x550/0x550 [ 1446.575157][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1446.579778][T23580] ret_from_fork+0x48/0x80 [ 1446.584233][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1446.588880][T23580] ret_from_fork_asm+0x11/0x20 [ 1446.593730][T23580] [ 1446.597891][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 1446.613692][T23580] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1446.632332][T23580] Bluetooth: hci1: failed to register connection device [ 1448.658528][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 1448.716089][T24682] sit0: left promiscuous mode [ 1449.089292][T24684] sit0: entered promiscuous mode [ 1449.140585][T24696] netlink: 'syz.0.5932': attribute type 3 has an invalid length. [ 1449.157443][T24696] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.5932'. [ 1449.278307][T24696] batadv0: entered promiscuous mode [ 1449.283611][T24696] batadv0: entered allmulticast mode [ 1452.886581][T24728] sit0: entered promiscuous mode [ 1453.284955][T24732] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.5944'. [ 1456.696313][T24743] sit0: left promiscuous mode [ 1457.072612][T24748] sit0: entered promiscuous mode [ 1457.874672][T24773] netlink: 'syz.0.5958': attribute type 10 has an invalid length. [ 1457.892962][T24773] netlink: 210880 bytes leftover after parsing attributes in process `syz.0.5958'. [ 1464.338091][T24794] sit0: left promiscuous mode [ 1464.498270][T24797] sit0: entered promiscuous mode [ 1464.914930][T24821] FAULT_INJECTION: forcing a failure. [ 1464.914930][T24821] name failslab, interval 1, probability 0, space 0, times 0 [ 1464.933624][T24821] CPU: 0 PID: 24821 Comm: syz.1.5972 Not tainted syzkaller #0 [ 1464.941241][T24821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1464.951341][T24821] Call Trace: [ 1464.954646][T24821] [ 1464.957604][T24821] dump_stack_lvl+0x18c/0x250 [ 1464.962409][T24821] ? show_regs_print_info+0x20/0x20 [ 1464.967652][T24821] ? load_image+0x420/0x420 [ 1464.972193][T24821] ? __might_sleep+0xe0/0xe0 [ 1464.976814][T24821] ? __lock_acquire+0x7d80/0x7d80 [ 1464.981877][T24821] should_fail_ex+0x394/0x4c0 [ 1464.986592][T24821] should_failslab+0x9/0x20 [ 1464.991131][T24821] slab_pre_alloc_hook+0x59/0x300 [ 1464.996224][T24821] ? kernfs_fop_write_iter+0x158/0x520 [ 1465.001942][T24821] ? kernfs_fop_write_iter+0x158/0x520 [ 1465.007569][T24821] __kmem_cache_alloc_node+0x53/0x250 [ 1465.013007][T24821] ? kernfs_fop_write_iter+0x158/0x520 [ 1465.018513][T24821] __kmalloc+0xa7/0x240 [ 1465.022722][T24821] kernfs_fop_write_iter+0x158/0x520 [ 1465.028074][T24821] vfs_write+0x474/0x9a0 [ 1465.032487][T24821] ? file_end_write+0x250/0x250 [ 1465.037377][T24821] ? __fget_files+0x3fc/0x460 [ 1465.042112][T24821] ? __fdget_pos+0x2a3/0x330 [ 1465.046743][T24821] ? ksys_write+0x74/0x260 [ 1465.051202][T24821] ksys_write+0x151/0x260 [ 1465.055661][T24821] ? __ia32_sys_read+0x90/0x90 [ 1465.060484][T24821] ? lockdep_hardirqs_on+0x98/0x150 [ 1465.066274][T24821] do_syscall_64+0x55/0xb0 [ 1465.071015][T24821] ? clear_bhb_loop+0x40/0x90 [ 1465.075783][T24821] ? clear_bhb_loop+0x40/0x90 [ 1465.080580][T24821] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1465.086684][T24821] RIP: 0033:0x7f5b09b9e0d9 [ 1465.091163][T24821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1465.110896][T24821] RSP: 002b:00007f5b07df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1465.119346][T24821] RAX: ffffffffffffffda RBX: 00007f5b09e25fa0 RCX: 00007f5b09b9e0d9 [ 1465.127354][T24821] RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000004 [ 1465.135360][T24821] RBP: 00007f5b07df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1465.143361][T24821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1465.151448][T24821] R13: 00007f5b09e26038 R14: 00007f5b09e25fa0 R15: 00007fff6635d918 [ 1465.159621][T24821] [ 1468.236161][T24837] sit0: left promiscuous mode [ 1468.382730][T24838] sit0: entered promiscuous mode [ 1471.831630][T24861] netlink: 'syz.0.5982': attribute type 3 has an invalid length. [ 1471.839754][T24861] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.5982'. [ 1471.876380][T24863] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5984'. [ 1471.923509][T24858] sit0: left promiscuous mode [ 1472.043529][T24862] sit0: entered promiscuous mode [ 1478.697874][ T5786] Bluetooth: hci2: unexpected subevent 0x0a length: 150 > 30 [ 1478.706092][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 1478.715983][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1478.723602][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1478.733714][ T5786] Workqueue: hci2 hci_rx_work [ 1478.738485][ T5786] Call Trace: [ 1478.741815][ T5786] [ 1478.744792][ T5786] dump_stack_lvl+0x18c/0x250 [ 1478.749520][ T5786] ? show_regs_print_info+0x20/0x20 [ 1478.754760][ T5786] ? load_image+0x420/0x420 [ 1478.759315][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1478.764644][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1478.769730][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1478.774445][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1478.779959][ T5786] kobject_add_internal+0x617/0xc90 [ 1478.785307][ T5786] kobject_add+0x164/0x240 [ 1478.789772][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1478.794496][ T5786] ? get_device_parent+0x366/0x390 [ 1478.799657][ T5786] device_add+0x3fa/0xc40 [ 1478.804030][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1478.809011][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1478.814337][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1478.820611][ T5786] ? bt_info+0x180/0x180 [ 1478.824893][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1478.830578][ T5786] ? mutex_unlock+0x10/0x10 [ 1478.835115][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1478.839829][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1478.845766][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1478.852224][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1478.858348][ T5786] hci_event_packet+0x7b4/0x1280 [ 1478.863325][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1478.868381][ T5786] ? lock_chain_count+0x20/0x20 [ 1478.873264][ T5786] ? bis_list+0x290/0x290 [ 1478.877656][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1478.882906][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1478.888236][ T5786] hci_rx_work+0x43a/0xd60 [ 1478.892723][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1478.898480][ T5786] process_scheduled_works+0xa60/0x1600 [ 1478.904119][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1478.909618][ T5786] ? assign_work+0x3cc/0x5d0 [ 1478.914245][ T5786] worker_thread+0xa5e/0xfe0 [ 1478.918893][ T5786] kthread+0x2fa/0x390 [ 1478.922991][ T5786] ? pr_cont_work+0x550/0x550 [ 1478.927716][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1478.932341][ T5786] ret_from_fork+0x48/0x80 [ 1478.936795][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1478.941416][ T5786] ret_from_fork_asm+0x11/0x20 [ 1478.946245][ T5786] [ 1478.951516][ T5786] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1478.968175][ T5786] Bluetooth: hci2: failed to register connection device [ 1479.063674][T24911] FAULT_INJECTION: forcing a failure. [ 1479.063674][T24911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1479.078522][T24911] CPU: 1 PID: 24911 Comm: syz.0.6000 Not tainted syzkaller #0 [ 1479.086055][T24911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1479.096152][T24911] Call Trace: [ 1479.099469][T24911] [ 1479.102439][T24911] dump_stack_lvl+0x18c/0x250 [ 1479.107172][T24911] ? show_regs_print_info+0x20/0x20 [ 1479.112425][T24911] ? load_image+0x420/0x420 [ 1479.117036][T24911] ? __might_fault+0xaa/0x120 [ 1479.121789][T24911] ? __lock_acquire+0x7d80/0x7d80 [ 1479.126891][T24911] should_fail_ex+0x394/0x4c0 [ 1479.131736][T24911] _copy_from_user+0x2f/0xe0 [ 1479.136395][T24911] ___sys_sendmsg+0x1c7/0x360 [ 1479.141138][T24911] ? get_pid_task+0x20/0x1e0 [ 1479.145822][T24911] ? __sys_sendmsg+0x2b0/0x2b0 [ 1479.150671][T24911] ? __lock_acquire+0x7d80/0x7d80 [ 1479.155776][T24911] __se_sys_sendmsg+0x1d0/0x2c0 [ 1479.160779][T24911] ? __x64_sys_sendmsg+0x80/0x80 [ 1479.165786][T24911] ? lockdep_hardirqs_on+0x98/0x150 [ 1479.171056][T24911] do_syscall_64+0x55/0xb0 [ 1479.175606][T24911] ? clear_bhb_loop+0x40/0x90 [ 1479.180338][T24911] ? clear_bhb_loop+0x40/0x90 [ 1479.185060][T24911] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1479.191031][T24911] RIP: 0033:0x7f35d379e0d9 [ 1479.195502][T24911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1479.215418][T24911] RSP: 002b:00007f35d463e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1479.223897][T24911] RAX: ffffffffffffffda RBX: 00007f35d3a25fa0 RCX: 00007f35d379e0d9 [ 1479.232049][T24911] RDX: 0000000020002800 RSI: 0000200000001640 RDI: 0000000000000003 [ 1479.240093][T24911] RBP: 00007f35d463e090 R08: 0000000000000000 R09: 0000000000000000 [ 1479.248403][T24911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1479.256434][T24911] R13: 00007f35d3a26038 R14: 00007f35d3a25fa0 R15: 00007ffd49c903e8 [ 1479.264499][T24911] [ 1480.185341][T24926] FAULT_INJECTION: forcing a failure. [ 1480.185341][T24926] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1480.199666][T24926] CPU: 0 PID: 24926 Comm: syz.3.6004 Not tainted syzkaller #0 [ 1480.207282][T24926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1480.217399][T24926] Call Trace: [ 1480.220747][T24926] [ 1480.223733][T24926] dump_stack_lvl+0x18c/0x250 [ 1480.228648][T24926] ? show_regs_print_info+0x20/0x20 [ 1480.233922][T24926] ? load_image+0x420/0x420 [ 1480.238512][T24926] ? __might_fault+0xaa/0x120 [ 1480.243266][T24926] ? __lock_acquire+0x7d80/0x7d80 [ 1480.248347][T24926] should_fail_ex+0x394/0x4c0 [ 1480.253195][T24926] _copy_from_user+0x2f/0xe0 [ 1480.257930][T24926] ___sys_sendmsg+0x1c7/0x360 [ 1480.262672][T24926] ? get_pid_task+0x20/0x1e0 [ 1480.267345][T24926] ? __sys_sendmsg+0x2b0/0x2b0 [ 1480.272291][T24926] ? __lock_acquire+0x7d80/0x7d80 [ 1480.277404][T24926] __se_sys_sendmsg+0x1d0/0x2c0 [ 1480.282400][T24926] ? __x64_sys_sendmsg+0x80/0x80 [ 1480.287685][T24926] ? lockdep_hardirqs_on+0x98/0x150 [ 1480.292942][T24926] do_syscall_64+0x55/0xb0 [ 1480.297401][T24926] ? clear_bhb_loop+0x40/0x90 [ 1480.302129][T24926] ? clear_bhb_loop+0x40/0x90 [ 1480.306992][T24926] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1480.312948][T24926] RIP: 0033:0x7fe655d9e0d9 [ 1480.317397][T24926] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1480.337051][T24926] RSP: 002b:00007fe656b7f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1480.345504][T24926] RAX: ffffffffffffffda RBX: 00007fe656025fa0 RCX: 00007fe655d9e0d9 [ 1480.353535][T24926] RDX: 0000000020002800 RSI: 0000200000001640 RDI: 0000000000000003 [ 1480.361677][T24926] RBP: 00007fe656b7f090 R08: 0000000000000000 R09: 0000000000000000 [ 1480.369709][T24926] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1480.377737][T24926] R13: 00007fe656026038 R14: 00007fe656025fa0 R15: 00007fff9e092f08 [ 1480.386031][T24926] [ 1480.978917][T23580] Bluetooth: hci2: command 0x0406 tx timeout [ 1481.263272][T23580] Bluetooth: hci3: unexpected subevent 0x0a length: 150 > 30 [ 1481.272149][T23580] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1481.281564][T23580] CPU: 1 PID: 23580 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1481.289257][T23580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1481.299381][T23580] Workqueue: hci3 hci_rx_work [ 1481.304128][T23580] Call Trace: [ 1481.307536][T23580] [ 1481.310556][T23580] dump_stack_lvl+0x18c/0x250 [ 1481.315285][T23580] ? show_regs_print_info+0x20/0x20 [ 1481.320524][T23580] ? load_image+0x420/0x420 [ 1481.325133][T23580] sysfs_create_dir_ns+0x26e/0x2a0 [ 1481.330646][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1481.335711][T23580] ? sysfs_warn_dup+0xa0/0xa0 [ 1481.340437][T23580] ? do_raw_spin_unlock+0x121/0x230 [ 1481.345685][T23580] kobject_add_internal+0x617/0xc90 [ 1481.350938][T23580] kobject_add+0x164/0x240 [ 1481.355403][T23580] ? kobject_init+0x1d0/0x1d0 [ 1481.360127][T23580] ? get_device_parent+0x366/0x390 [ 1481.365290][T23580] device_add+0x3fa/0xc40 [ 1481.369658][T23580] hci_conn_add_sysfs+0xd5/0x1e0 [ 1481.374665][T23580] le_conn_complete_evt+0xe9f/0x1480 [ 1481.380023][T23580] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1481.386406][T23580] ? bt_info+0x180/0x180 [ 1481.390693][T23580] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1481.396388][T23580] ? mutex_unlock+0x10/0x10 [ 1481.401014][T23580] ? skb_pull_data+0xf0/0x1f0 [ 1481.405766][T23580] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1481.411702][T23580] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1481.418448][T23580] ? hci_remote_host_features_evt+0x150/0x150 [ 1481.424632][T23580] hci_event_packet+0x7b4/0x1280 [ 1481.429922][T23580] ? __lock_acquire+0x7d80/0x7d80 [ 1481.435019][T23580] ? lock_chain_count+0x20/0x20 [ 1481.440101][T23580] ? bis_list+0x290/0x290 [ 1481.444521][T23580] ? lockdep_hardirqs_on+0x98/0x150 [ 1481.449850][T23580] ? hci_send_to_monitor+0xd7/0x4f0 [ 1481.455180][T23580] hci_rx_work+0x43a/0xd60 [ 1481.459664][T23580] ? process_scheduled_works+0x975/0x1600 [ 1481.465427][T23580] process_scheduled_works+0xa60/0x1600 [ 1481.471041][T23580] ? worker_attach_to_pool+0x370/0x370 [ 1481.476599][T23580] ? assign_work+0x3cc/0x5d0 [ 1481.481345][T23580] worker_thread+0xa5e/0xfe0 [ 1481.486004][T23580] ? _raw_spin_unlock+0x40/0x40 [ 1481.490935][T23580] ? __kthread_parkme+0x71/0x1c0 [ 1481.496122][T23580] kthread+0x2fa/0x390 [ 1481.500241][T23580] ? pr_cont_work+0x550/0x550 [ 1481.504965][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1481.509593][T23580] ret_from_fork+0x48/0x80 [ 1481.514051][T23580] ? kthread_blkcg+0xd0/0xd0 [ 1481.518676][T23580] ret_from_fork_asm+0x11/0x20 [ 1481.523505][T23580] [ 1481.542961][T23580] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1481.557733][T23580] Bluetooth: hci3: failed to register connection device [ 1483.621105][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 1484.038147][T24952] FAULT_INJECTION: forcing a failure. [ 1484.038147][T24952] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1484.080291][T24952] CPU: 1 PID: 24952 Comm: syz.2.6014 Not tainted syzkaller #0 [ 1484.087829][T24952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1484.097932][T24952] Call Trace: [ 1484.101257][T24952] [ 1484.104232][T24952] dump_stack_lvl+0x18c/0x250 [ 1484.108989][T24952] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1484.115211][T24952] ? show_regs_print_info+0x20/0x20 [ 1484.120483][T24952] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1484.126814][T24952] should_fail_ex+0x394/0x4c0 [ 1484.131561][T24952] _copy_from_user+0x2f/0xe0 [ 1484.136263][T24952] ___sys_recvmsg+0x174/0x590 [ 1484.141008][T24952] ? __sys_recvmsg+0x2a0/0x2a0 [ 1484.145846][T24952] ? ksys_write+0x1d2/0x260 [ 1484.150726][T24952] ? __fget_files+0x3fc/0x460 [ 1484.155511][T24952] __x64_sys_recvmsg+0x21e/0x2f0 [ 1484.160522][T24952] ? ___sys_recvmsg+0x590/0x590 [ 1484.165464][T24952] ? lockdep_hardirqs_on+0x98/0x150 [ 1484.170767][T24952] do_syscall_64+0x55/0xb0 [ 1484.175244][T24952] ? clear_bhb_loop+0x40/0x90 [ 1484.179981][T24952] ? clear_bhb_loop+0x40/0x90 [ 1484.184715][T24952] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1484.190665][T24952] RIP: 0033:0x7fe0d599e0d9 [ 1484.195240][T24952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1484.215027][T24952] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1484.223505][T24952] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1484.231568][T24952] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000003 [ 1484.239624][T24952] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1484.247658][T24952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1484.255870][T24952] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1484.263912][T24952] [ 1484.744066][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.750873][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.986815][T24976] netlink: 'syz.0.6021': attribute type 9 has an invalid length. [ 1485.002812][T24976] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.6021'. [ 1485.074793][T24970] netlink: 'syz.0.6021': attribute type 9 has an invalid length. [ 1485.085257][T24970] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.6021'. [ 1488.092070][T24988] FAULT_INJECTION: forcing a failure. [ 1488.092070][T24988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1488.154284][T24988] CPU: 1 PID: 24988 Comm: syz.0.6026 Not tainted syzkaller #0 [ 1488.161832][T24988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1488.171938][T24988] Call Trace: [ 1488.175266][T24988] [ 1488.178265][T24988] dump_stack_lvl+0x18c/0x250 [ 1488.183005][T24988] ? show_regs_print_info+0x20/0x20 [ 1488.188353][T24988] ? load_image+0x420/0x420 [ 1488.192923][T24988] ? __might_fault+0xaa/0x120 [ 1488.197762][T24988] ? __lock_acquire+0x7d80/0x7d80 [ 1488.202832][T24988] should_fail_ex+0x394/0x4c0 [ 1488.207551][T24988] _copy_from_user+0x2f/0xe0 [ 1488.212182][T24988] ___sys_sendmsg+0x1c7/0x360 [ 1488.216909][T24988] ? get_pid_task+0x20/0x1e0 [ 1488.221548][T24988] ? __sys_sendmsg+0x2b0/0x2b0 [ 1488.226380][T24988] ? __lock_acquire+0x7d80/0x7d80 [ 1488.231469][T24988] __se_sys_sendmsg+0x1d0/0x2c0 [ 1488.236362][T24988] ? __x64_sys_sendmsg+0x80/0x80 [ 1488.241351][T24988] ? lockdep_hardirqs_on+0x98/0x150 [ 1488.246665][T24988] do_syscall_64+0x55/0xb0 [ 1488.251139][T24988] ? clear_bhb_loop+0x40/0x90 [ 1488.255896][T24988] ? clear_bhb_loop+0x40/0x90 [ 1488.260669][T24988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1488.266621][T24988] RIP: 0033:0x7f35d379e0d9 [ 1488.271089][T24988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1488.290748][T24988] RSP: 002b:00007f35d463e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1488.299282][T24988] RAX: ffffffffffffffda RBX: 00007f35d3a25fa0 RCX: 00007f35d379e0d9 [ 1488.307302][T24988] RDX: 0000000000000854 RSI: 0000200000000000 RDI: 0000000000000003 [ 1488.315316][T24988] RBP: 00007f35d463e090 R08: 0000000000000000 R09: 0000000000000000 [ 1488.323322][T24988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1488.331411][T24988] R13: 00007f35d3a26038 R14: 00007f35d3a25fa0 R15: 00007ffd49c903e8 [ 1488.339433][T24988] [ 1489.355549][T24998] netlink: 'syz.2.6031': attribute type 3 has an invalid length. [ 1489.363556][T24998] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.6031'. [ 1491.007415][T24998] sit0: left promiscuous mode [ 1494.121212][T25018] FAULT_INJECTION: forcing a failure. [ 1494.121212][T25018] name failslab, interval 1, probability 0, space 0, times 0 [ 1494.158396][T25019] netlink: 'syz.1.6036': attribute type 9 has an invalid length. [ 1494.168174][T25018] CPU: 1 PID: 25018 Comm: syz.0.6037 Not tainted syzkaller #0 [ 1494.175902][T25018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1494.186002][T25018] Call Trace: [ 1494.189355][T25018] [ 1494.192326][T25018] dump_stack_lvl+0x18c/0x250 [ 1494.197056][T25018] ? show_regs_print_info+0x20/0x20 [ 1494.198572][T25019] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.6036'. [ 1494.202398][T25018] ? load_image+0x420/0x420 [ 1494.216249][T25018] ? __might_sleep+0xe0/0xe0 [ 1494.220919][T25018] ? __lock_acquire+0x7d80/0x7d80 [ 1494.225999][T25018] should_fail_ex+0x394/0x4c0 [ 1494.230759][T25018] should_failslab+0x9/0x20 [ 1494.235412][T25018] slab_pre_alloc_hook+0x59/0x300 [ 1494.240498][T25018] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1494.246280][T25018] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1494.252061][T25018] __kmem_cache_alloc_node+0x53/0x250 [ 1494.257677][T25018] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1494.263459][T25018] __kmalloc+0xa7/0x240 [ 1494.267683][T25018] tomoyo_realpath_from_path+0xe6/0x5c0 [ 1494.273271][T25018] ? tomoyo_domain+0xd6/0x120 [ 1494.278049][T25018] tomoyo_path_number_perm+0x248/0x5e0 [ 1494.283617][T25018] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1494.289309][T25018] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1494.294831][T25018] ? ksys_write+0x1d2/0x260 [ 1494.299427][T25018] ? __fget_files+0x28/0x460 [ 1494.304086][T25018] security_file_ioctl+0x70/0xa0 [ 1494.309103][T25018] __se_sys_ioctl+0x48/0x170 [ 1494.313796][T25018] do_syscall_64+0x55/0xb0 [ 1494.318321][T25018] ? clear_bhb_loop+0x40/0x90 [ 1494.323051][T25018] ? clear_bhb_loop+0x40/0x90 [ 1494.327795][T25018] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1494.333760][T25018] RIP: 0033:0x7f35d379e0d9 [ 1494.338224][T25018] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1494.357881][T25018] RSP: 002b:00007f35d463e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1494.366446][T25018] RAX: ffffffffffffffda RBX: 00007f35d3a25fa0 RCX: 00007f35d379e0d9 [ 1494.374655][T25018] RDX: 0000200000000080 RSI: 00000000000089f2 RDI: 0000000000000004 [ 1494.382951][T25018] RBP: 00007f35d463e090 R08: 0000000000000000 R09: 0000000000000000 [ 1494.390968][T25018] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1494.399074][T25018] R13: 00007f35d3a26038 R14: 00007f35d3a25fa0 R15: 00007ffd49c903e8 [ 1494.407100][T25018] [ 1494.435427][T25018] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1494.483807][T25028] FAULT_INJECTION: forcing a failure. [ 1494.483807][T25028] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1494.535998][T25028] CPU: 1 PID: 25028 Comm: syz.3.6039 Not tainted syzkaller #0 [ 1494.543559][T25028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1494.553675][T25028] Call Trace: [ 1494.557005][T25028] [ 1494.559977][T25028] dump_stack_lvl+0x18c/0x250 [ 1494.564710][T25028] ? show_regs_print_info+0x20/0x20 [ 1494.569964][T25028] ? load_image+0x420/0x420 [ 1494.574522][T25028] ? __might_fault+0xaa/0x120 [ 1494.579239][T25028] ? __lock_acquire+0x7d80/0x7d80 [ 1494.584351][T25028] should_fail_ex+0x394/0x4c0 [ 1494.589075][T25028] _copy_from_user+0x2f/0xe0 [ 1494.593703][T25028] ___sys_sendmsg+0x1c7/0x360 [ 1494.598415][T25028] ? get_pid_task+0x20/0x1e0 [ 1494.603049][T25028] ? __sys_sendmsg+0x2b0/0x2b0 [ 1494.608041][T25028] ? __lock_acquire+0x7d80/0x7d80 [ 1494.613129][T25028] __se_sys_sendmsg+0x1d0/0x2c0 [ 1494.618053][T25028] ? __x64_sys_sendmsg+0x80/0x80 [ 1494.623044][T25028] ? lockdep_hardirqs_on+0x98/0x150 [ 1494.628303][T25028] do_syscall_64+0x55/0xb0 [ 1494.632751][T25028] ? clear_bhb_loop+0x40/0x90 [ 1494.637501][T25028] ? clear_bhb_loop+0x40/0x90 [ 1494.642313][T25028] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1494.648264][T25028] RIP: 0033:0x7fe655d9e0d9 [ 1494.652755][T25028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1494.673034][T25028] RSP: 002b:00007fe653ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1494.681484][T25028] RAX: ffffffffffffffda RBX: 00007fe656026090 RCX: 00007fe655d9e0d9 [ 1494.689488][T25028] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 1494.697486][T25028] RBP: 00007fe653ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1494.705485][T25028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1494.713930][T25028] R13: 00007fe656026128 R14: 00007fe656026090 R15: 00007fff9e092f08 [ 1494.721952][T25028] [ 1494.732064][T25022] netlink: 'syz.1.6036': attribute type 9 has an invalid length. [ 1494.763648][T25022] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.6036'. [ 1494.948253][T25035] netlink: 'syz.3.6042': attribute type 3 has an invalid length. [ 1494.969265][T25035] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.6042'. [ 1495.023276][T25035] sit0: left promiscuous mode [ 1499.244170][T25061] FAULT_INJECTION: forcing a failure. [ 1499.244170][T25061] name failslab, interval 1, probability 0, space 0, times 0 [ 1499.262437][T25061] CPU: 1 PID: 25061 Comm: syz.0.6050 Not tainted syzkaller #0 [ 1499.269984][T25061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1499.280268][T25061] Call Trace: [ 1499.283594][T25061] [ 1499.286572][T25061] dump_stack_lvl+0x18c/0x250 [ 1499.291317][T25061] ? show_regs_print_info+0x20/0x20 [ 1499.296555][T25061] ? load_image+0x420/0x420 [ 1499.301117][T25061] ? __might_sleep+0xe0/0xe0 [ 1499.305756][T25061] ? __lock_acquire+0x7d80/0x7d80 [ 1499.310840][T25061] should_fail_ex+0x394/0x4c0 [ 1499.315563][T25061] should_failslab+0x9/0x20 [ 1499.320114][T25061] slab_pre_alloc_hook+0x59/0x300 [ 1499.325180][T25061] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1499.330940][T25061] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1499.336704][T25061] __kmem_cache_alloc_node+0x53/0x250 [ 1499.342118][T25061] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1499.347882][T25061] __kmalloc+0xa7/0x240 [ 1499.352165][T25061] tomoyo_realpath_from_path+0xe6/0x5c0 [ 1499.357938][T25061] ? tomoyo_domain+0xd6/0x120 [ 1499.362837][T25061] tomoyo_path_number_perm+0x248/0x5e0 [ 1499.368368][T25061] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1499.374165][T25061] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1499.379684][T25061] ? ksys_write+0x1d2/0x260 [ 1499.384301][T25061] ? __fget_files+0x28/0x460 [ 1499.388942][T25061] security_file_ioctl+0x70/0xa0 [ 1499.393925][T25061] __se_sys_ioctl+0x48/0x170 [ 1499.398554][T25061] do_syscall_64+0x55/0xb0 [ 1499.403013][T25061] ? clear_bhb_loop+0x40/0x90 [ 1499.407739][T25061] ? clear_bhb_loop+0x40/0x90 [ 1499.412884][T25061] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1499.418824][T25061] RIP: 0033:0x7f35d379e0d9 [ 1499.423358][T25061] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1499.443202][T25061] RSP: 002b:00007f35d463e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1499.451678][T25061] RAX: ffffffffffffffda RBX: 00007f35d3a25fa0 RCX: 00007f35d379e0d9 [ 1499.459788][T25061] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 000000000000002f [ 1499.467903][T25061] RBP: 00007f35d463e090 R08: 0000000000000000 R09: 0000000000000000 [ 1499.475924][T25061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1499.483949][T25061] R13: 00007f35d3a26038 R14: 00007f35d3a25fa0 R15: 00007ffd49c903e8 [ 1499.492075][T25061] [ 1499.509181][T25061] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1499.722100][T25070] netlink: 'syz.0.6055': attribute type 3 has an invalid length. [ 1499.758459][T25070] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6055'. [ 1502.780338][T25073] sit0: left promiscuous mode [ 1503.279656][T25085] FAULT_INJECTION: forcing a failure. [ 1503.279656][T25085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1503.310700][T25085] CPU: 0 PID: 25085 Comm: syz.2.6061 Not tainted syzkaller #0 [ 1503.318245][T25085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1503.328334][T25085] Call Trace: [ 1503.331638][T25085] [ 1503.334608][T25085] dump_stack_lvl+0x18c/0x250 [ 1503.339367][T25085] ? show_regs_print_info+0x20/0x20 [ 1503.344598][T25085] ? load_image+0x420/0x420 [ 1503.349292][T25085] ? __might_fault+0xaa/0x120 [ 1503.354010][T25085] ? __lock_acquire+0x7d80/0x7d80 [ 1503.359068][T25085] should_fail_ex+0x394/0x4c0 [ 1503.363784][T25085] _copy_from_user+0x2f/0xe0 [ 1503.368500][T25085] __sys_bpf+0x23e/0x890 [ 1503.372815][T25085] ? bpf_link_show_fdinfo+0x390/0x390 [ 1503.378262][T25085] ? lock_chain_count+0x20/0x20 [ 1503.383187][T25085] __x64_sys_bpf+0x7c/0x90 [ 1503.387676][T25085] do_syscall_64+0x55/0xb0 [ 1503.392146][T25085] ? clear_bhb_loop+0x40/0x90 [ 1503.396970][T25085] ? clear_bhb_loop+0x40/0x90 [ 1503.401704][T25085] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1503.407660][T25085] RIP: 0033:0x7fe0d599e0d9 [ 1503.412123][T25085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1503.431784][T25085] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1503.440362][T25085] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1503.448555][T25085] RDX: 0000000000000094 RSI: 00002000000005c0 RDI: 0000000000000005 [ 1503.456577][T25085] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1503.464592][T25085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1503.473151][T25085] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1503.481169][T25085] [ 1507.156183][T25106] netlink: 'syz.0.6069': attribute type 3 has an invalid length. [ 1507.164256][T25106] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6069'. [ 1509.774547][T25121] netlink: 'syz.2.6071': attribute type 9 has an invalid length. [ 1509.786930][T25121] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.6071'. [ 1509.906615][T25123] netlink: 'syz.2.6071': attribute type 9 has an invalid length. [ 1509.920341][T25123] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.6071'. [ 1512.855126][T25129] FAULT_INJECTION: forcing a failure. [ 1512.855126][T25129] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1512.870647][T25129] CPU: 0 PID: 25129 Comm: syz.3.6076 Not tainted syzkaller #0 [ 1512.878348][T25129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1512.888574][T25129] Call Trace: [ 1512.891913][T25129] [ 1512.894899][T25129] dump_stack_lvl+0x18c/0x250 [ 1512.899657][T25129] ? show_regs_print_info+0x20/0x20 [ 1512.904906][T25129] ? load_image+0x420/0x420 [ 1512.909481][T25129] ? __might_fault+0xaa/0x120 [ 1512.914223][T25129] ? __lock_acquire+0x7d80/0x7d80 [ 1512.919319][T25129] should_fail_ex+0x394/0x4c0 [ 1512.924064][T25129] _copy_from_user+0x2f/0xe0 [ 1512.928746][T25129] __sys_bpf+0x23e/0x890 [ 1512.933076][T25129] ? bpf_link_show_fdinfo+0x390/0x390 [ 1512.938546][T25129] ? lock_chain_count+0x20/0x20 [ 1512.943485][T25129] __x64_sys_bpf+0x7c/0x90 [ 1512.948075][T25129] do_syscall_64+0x55/0xb0 [ 1512.952924][T25129] ? clear_bhb_loop+0x40/0x90 [ 1512.957677][T25129] ? clear_bhb_loop+0x40/0x90 [ 1512.962416][T25129] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1512.968377][T25129] RIP: 0033:0x7fe655d9e0d9 [ 1512.972939][T25129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1512.992601][T25129] RSP: 002b:00007fe656b7f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1513.001054][T25129] RAX: ffffffffffffffda RBX: 00007fe656025fa0 RCX: 00007fe655d9e0d9 [ 1513.009069][T25129] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 0000000000000000 [ 1513.017073][T25129] RBP: 00007fe656b7f090 R08: 0000000000000000 R09: 0000000000000000 [ 1513.025070][T25129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1513.033094][T25129] R13: 00007fe656026038 R14: 00007fe656025fa0 R15: 00007fff9e092f08 [ 1513.041138][T25129] [ 1513.306529][T25138] netlink: 'syz.2.6080': attribute type 3 has an invalid length. [ 1513.322046][T25138] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.6080'. [ 1513.513770][T25140] batadv0: entered promiscuous mode [ 1513.524985][T25140] batadv0: entered allmulticast mode [ 1514.158411][T25144] netlink: 'syz.1.6082': attribute type 3 has an invalid length. [ 1514.166440][T25144] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.6082'. [ 1516.197777][T25146] sit0: left promiscuous mode [ 1516.340341][T25147] batadv0: entered promiscuous mode [ 1516.345797][T25147] batadv0: entered allmulticast mode [ 1516.626971][T25154] netlink: 'syz.0.6085': attribute type 28 has an invalid length. [ 1516.977350][T25160] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.6088'. [ 1520.056455][T25171] FAULT_INJECTION: forcing a failure. [ 1520.056455][T25171] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1520.085842][T25171] CPU: 1 PID: 25171 Comm: syz.3.6090 Not tainted syzkaller #0 [ 1520.093504][T25171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1520.103700][T25171] Call Trace: [ 1520.107109][T25171] [ 1520.110077][T25171] dump_stack_lvl+0x18c/0x250 [ 1520.114816][T25171] ? show_regs_print_info+0x20/0x20 [ 1520.120060][T25171] ? load_image+0x420/0x420 [ 1520.124730][T25171] ? __might_fault+0xaa/0x120 [ 1520.129450][T25171] ? __lock_acquire+0x7d80/0x7d80 [ 1520.134512][T25171] should_fail_ex+0x394/0x4c0 [ 1520.139234][T25171] _copy_from_user+0x2f/0xe0 [ 1520.143964][T25171] ___sys_recvmsg+0x174/0x590 [ 1520.148691][T25171] ? __sys_recvmsg+0x2a0/0x2a0 [ 1520.153500][T25171] ? ksys_write+0x1d2/0x260 [ 1520.158056][T25171] ? __fget_files+0x3fc/0x460 [ 1520.162887][T25171] __x64_sys_recvmsg+0x21e/0x2f0 [ 1520.167858][T25171] ? ___sys_recvmsg+0x590/0x590 [ 1520.172772][T25171] ? lockdep_hardirqs_on+0x98/0x150 [ 1520.178008][T25171] do_syscall_64+0x55/0xb0 [ 1520.182546][T25171] ? clear_bhb_loop+0x40/0x90 [ 1520.187256][T25171] ? clear_bhb_loop+0x40/0x90 [ 1520.191967][T25171] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1520.197919][T25171] RIP: 0033:0x7fe655d9e0d9 [ 1520.202390][T25171] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1520.222034][T25171] RSP: 002b:00007fe653ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1520.230484][T25171] RAX: ffffffffffffffda RBX: 00007fe656026090 RCX: 00007fe655d9e0d9 [ 1520.238489][T25171] RDX: 0000000040010002 RSI: 00002000000008c0 RDI: 0000000000000009 [ 1520.246488][T25171] RBP: 00007fe653ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1520.254593][T25171] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1520.262597][T25171] R13: 00007fe656026128 R14: 00007fe656026090 R15: 00007fff9e092f08 [ 1520.270633][T25171] [ 1520.438704][T25175] netlink: 'syz.3.6092': attribute type 3 has an invalid length. [ 1520.446555][T25175] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.6092'. [ 1520.732584][T25175] batadv0: entered promiscuous mode [ 1520.737970][T25175] batadv0: entered allmulticast mode [ 1521.774324][T25185] netlink: 'syz.3.6096': attribute type 3 has an invalid length. [ 1521.783449][T25185] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.6096'. [ 1525.527776][ T5786] Bluetooth: hci3: unexpected subevent 0x0a length: 150 > 30 [ 1525.537085][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1525.546927][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1525.554539][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1525.564640][ T5786] Workqueue: hci3 hci_rx_work [ 1525.569393][ T5786] Call Trace: [ 1525.572723][ T5786] [ 1525.575696][ T5786] dump_stack_lvl+0x18c/0x250 [ 1525.580436][ T5786] ? show_regs_print_info+0x20/0x20 [ 1525.585696][ T5786] ? load_image+0x420/0x420 [ 1525.590277][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1525.595449][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1525.600529][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1525.605448][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1525.610738][ T5786] kobject_add_internal+0x617/0xc90 [ 1525.616044][ T5786] kobject_add+0x164/0x240 [ 1525.620556][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1525.625330][ T5786] ? get_device_parent+0x366/0x390 [ 1525.630525][ T5786] device_add+0x3fa/0xc40 [ 1525.634935][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1525.639959][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1525.645333][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1525.651659][ T5786] ? bt_info+0x180/0x180 [ 1525.656067][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1525.661785][ T5786] ? mutex_unlock+0x10/0x10 [ 1525.666360][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1525.671119][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1525.677105][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1525.683608][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1525.689763][ T5786] hci_event_packet+0x7b4/0x1280 [ 1525.694791][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1525.699896][ T5786] ? lock_chain_count+0x20/0x20 [ 1525.704817][ T5786] ? bis_list+0x290/0x290 [ 1525.709231][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1525.714526][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1525.719976][ T5786] hci_rx_work+0x43a/0xd60 [ 1525.724469][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1525.730352][ T5786] process_scheduled_works+0xa60/0x1600 [ 1525.736002][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1525.741629][ T5786] ? assign_work+0x3cc/0x5d0 [ 1525.746304][ T5786] worker_thread+0xa5e/0xfe0 [ 1525.751027][ T5786] kthread+0x2fa/0x390 [ 1525.755152][ T5786] ? pr_cont_work+0x550/0x550 [ 1525.759896][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1525.764762][ T5786] ret_from_fork+0x48/0x80 [ 1525.769241][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1525.773890][ T5786] ret_from_fork_asm+0x11/0x20 [ 1525.778741][ T5786] [ 1525.785533][ T5786] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1525.800759][ T5786] Bluetooth: hci3: failed to register connection device [ 1526.019027][T25208] netlink: 'syz.0.6103': attribute type 3 has an invalid length. [ 1526.049303][T25208] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6103'. [ 1526.100250][T25209] FAULT_INJECTION: forcing a failure. [ 1526.100250][T25209] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1526.117064][T25209] CPU: 1 PID: 25209 Comm: syz.2.6104 Not tainted syzkaller #0 [ 1526.124630][T25209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1526.134729][T25209] Call Trace: [ 1526.138058][T25209] [ 1526.141130][T25209] dump_stack_lvl+0x18c/0x250 [ 1526.145876][T25209] ? show_regs_print_info+0x20/0x20 [ 1526.151235][T25209] ? load_image+0x420/0x420 [ 1526.155802][T25209] ? __might_fault+0xaa/0x120 [ 1526.160531][T25209] ? __lock_acquire+0x7d80/0x7d80 [ 1526.165626][T25209] should_fail_ex+0x394/0x4c0 [ 1526.170360][T25209] _copy_from_user+0x2f/0xe0 [ 1526.174998][T25209] ___sys_sendmsg+0x1c7/0x360 [ 1526.179722][T25209] ? __sys_sendmsg+0x2b0/0x2b0 [ 1526.184568][T25209] ? ktime_get+0x7f/0x280 [ 1526.188983][T25209] __se_sys_sendmsg+0x1d0/0x2c0 [ 1526.193870][T25209] ? perf_trace_preemptirq_template+0x269/0x330 [ 1526.200157][T25209] ? __x64_sys_sendmsg+0x80/0x80 [ 1526.205147][T25209] ? lockdep_hardirqs_on+0x98/0x150 [ 1526.210479][T25209] do_syscall_64+0x55/0xb0 [ 1526.214929][T25209] ? clear_bhb_loop+0x40/0x90 [ 1526.219640][T25209] ? clear_bhb_loop+0x40/0x90 [ 1526.224354][T25209] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1526.230283][T25209] RIP: 0033:0x7fe0d599e0d9 [ 1526.234732][T25209] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1526.254373][T25209] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1526.262826][T25209] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1526.270847][T25209] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1526.279068][T25209] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1526.287073][T25209] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1526.295076][T25209] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1526.303101][T25209] [ 1526.955006][ T5786] Bluetooth: hci1: unexpected subevent 0x0a length: 150 > 30 [ 1526.963072][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1526.973067][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1526.980703][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1526.990834][ T5786] Workqueue: hci1 hci_rx_work [ 1526.995689][ T5786] Call Trace: [ 1526.999041][ T5786] [ 1527.002041][ T5786] dump_stack_lvl+0x18c/0x250 [ 1527.006808][ T5786] ? show_regs_print_info+0x20/0x20 [ 1527.012077][ T5786] ? load_image+0x420/0x420 [ 1527.016662][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1527.021830][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1527.026920][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1527.031752][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1527.037107][ T5786] kobject_add_internal+0x617/0xc90 [ 1527.042366][ T5786] kobject_add+0x164/0x240 [ 1527.046832][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1527.051571][ T5786] ? get_device_parent+0x366/0x390 [ 1527.056747][ T5786] device_add+0x3fa/0xc40 [ 1527.061156][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1527.066207][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1527.071565][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1527.077890][ T5786] ? bt_info+0x180/0x180 [ 1527.082186][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1527.088093][ T5786] ? mutex_unlock+0x10/0x10 [ 1527.092851][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1527.097587][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1527.103559][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1527.110023][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1527.116227][ T5786] hci_event_packet+0x7b4/0x1280 [ 1527.121226][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1527.126295][ T5786] ? lock_chain_count+0x20/0x20 [ 1527.131178][ T5786] ? bis_list+0x290/0x290 [ 1527.135548][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1527.140791][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1527.146052][ T5786] hci_rx_work+0x43a/0xd60 [ 1527.150531][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1527.156295][ T5786] process_scheduled_works+0xa60/0x1600 [ 1527.161906][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1527.167410][ T5786] ? assign_work+0x3cc/0x5d0 [ 1527.172046][ T5786] worker_thread+0xa5e/0xfe0 [ 1527.176720][ T5786] kthread+0x2fa/0x390 [ 1527.181272][ T5786] ? pr_cont_work+0x550/0x550 [ 1527.186100][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1527.190761][ T5786] ret_from_fork+0x48/0x80 [ 1527.195304][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1527.200030][ T5786] ret_from_fork_asm+0x11/0x20 [ 1527.204846][ T5786] [ 1527.215056][ T5786] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1527.229474][ T5786] Bluetooth: hci1: failed to register connection device [ 1527.858252][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 1529.308318][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 1529.986233][T25234] netlink: 'syz.1.6114': attribute type 28 has an invalid length. [ 1531.267248][T25258] netlink: 'syz.2.6123': attribute type 3 has an invalid length. [ 1531.290832][T25258] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.6123'. [ 1531.597862][ T5786] Bluetooth: hci1: unexpected subevent 0x0a length: 150 > 30 [ 1531.607646][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1531.617945][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1531.625623][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1531.635918][ T5786] Workqueue: hci1 hci_rx_work [ 1531.640673][ T5786] Call Trace: [ 1531.644041][ T5786] [ 1531.647022][ T5786] dump_stack_lvl+0x18c/0x250 [ 1531.651771][ T5786] ? show_regs_print_info+0x20/0x20 [ 1531.657030][ T5786] ? load_image+0x420/0x420 [ 1531.661633][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1531.666807][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1531.671899][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1531.676642][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1531.681919][ T5786] kobject_add_internal+0x617/0xc90 [ 1531.687231][ T5786] kobject_add+0x164/0x240 [ 1531.691861][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1531.696635][ T5786] ? get_device_parent+0x366/0x390 [ 1531.701809][ T5786] device_add+0x3fa/0xc40 [ 1531.706187][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1531.711186][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1531.716528][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1531.722899][ T5786] ? bt_info+0x180/0x180 [ 1531.727213][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1531.732901][ T5786] ? mutex_unlock+0x10/0x10 [ 1531.737440][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1531.742167][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1531.748103][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1531.754574][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1531.760691][ T5786] hci_event_packet+0x7b4/0x1280 [ 1531.765664][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1531.770727][ T5786] ? lock_chain_count+0x20/0x20 [ 1531.775646][ T5786] ? bis_list+0x290/0x290 [ 1531.780076][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1531.785358][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1531.790627][ T5786] hci_rx_work+0x43a/0xd60 [ 1531.795105][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1531.800920][ T5786] process_scheduled_works+0xa60/0x1600 [ 1531.806552][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1531.812091][ T5786] ? assign_work+0x3cc/0x5d0 [ 1531.816744][ T5786] worker_thread+0xa5e/0xfe0 [ 1531.821612][ T5786] kthread+0x2fa/0x390 [ 1531.826043][ T5786] ? pr_cont_work+0x550/0x550 [ 1531.830925][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1531.835590][ T5786] ret_from_fork+0x48/0x80 [ 1531.840159][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1531.844920][ T5786] ret_from_fork_asm+0x11/0x20 [ 1531.849775][ T5786] [ 1531.862665][ T5786] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1531.877023][ T5786] Bluetooth: hci1: failed to register connection device [ 1533.938245][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 1534.833405][T25290] FAULT_INJECTION: forcing a failure. [ 1534.833405][T25290] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1534.865254][T25290] CPU: 1 PID: 25290 Comm: syz.0.6131 Not tainted syzkaller #0 [ 1534.873000][T25290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1534.883114][T25290] Call Trace: [ 1534.886599][T25290] [ 1534.889587][T25290] dump_stack_lvl+0x18c/0x250 [ 1534.894425][T25290] ? show_regs_print_info+0x20/0x20 [ 1534.899671][T25290] ? load_image+0x420/0x420 [ 1534.904222][T25290] ? __might_fault+0xaa/0x120 [ 1534.908940][T25290] ? __lock_acquire+0x7d80/0x7d80 [ 1534.914023][T25290] should_fail_ex+0x394/0x4c0 [ 1534.918754][T25290] _copy_from_user+0x2f/0xe0 [ 1534.923465][T25290] __sys_bpf+0x23e/0x890 [ 1534.927747][T25290] ? bpf_link_show_fdinfo+0x390/0x390 [ 1534.933263][T25290] ? lock_chain_count+0x20/0x20 [ 1534.938168][T25290] __x64_sys_bpf+0x7c/0x90 [ 1534.942642][T25290] do_syscall_64+0x55/0xb0 [ 1534.947296][T25290] ? clear_bhb_loop+0x40/0x90 [ 1534.952027][T25290] ? clear_bhb_loop+0x40/0x90 [ 1534.956748][T25290] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1534.962704][T25290] RIP: 0033:0x7f35d379e0d9 [ 1534.967152][T25290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1534.986975][T25290] RSP: 002b:00007f35d463e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1534.995420][T25290] RAX: ffffffffffffffda RBX: 00007f35d3a25fa0 RCX: 00007f35d379e0d9 [ 1535.003443][T25290] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 1535.011445][T25290] RBP: 00007f35d463e090 R08: 0000000000000000 R09: 0000000000000000 [ 1535.019441][T25290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1535.027469][T25290] R13: 00007f35d3a26038 R14: 00007f35d3a25fa0 R15: 00007ffd49c903e8 [ 1535.035589][T25290] [ 1535.316136][ T5786] Bluetooth: hci1: unexpected subevent 0x0a length: 150 > 30 [ 1535.325605][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1535.338377][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1535.346214][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1535.356577][ T5786] Workqueue: hci1 hci_rx_work [ 1535.361329][ T5786] Call Trace: [ 1535.364657][ T5786] [ 1535.367636][ T5786] dump_stack_lvl+0x18c/0x250 [ 1535.372378][ T5786] ? show_regs_print_info+0x20/0x20 [ 1535.377726][ T5786] ? load_image+0x420/0x420 [ 1535.382321][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1535.387496][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1535.392562][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1535.397517][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1535.402791][ T5786] kobject_add_internal+0x617/0xc90 [ 1535.408077][ T5786] kobject_add+0x164/0x240 [ 1535.412574][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1535.417327][ T5786] ? get_device_parent+0x366/0x390 [ 1535.422670][ T5786] device_add+0x3fa/0xc40 [ 1535.427092][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1535.432462][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1535.438004][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1535.444305][ T5786] ? bt_info+0x180/0x180 [ 1535.448592][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1535.454309][ T5786] ? mutex_unlock+0x10/0x10 [ 1535.458864][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1535.463588][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1535.469526][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1535.475990][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1535.482109][ T5786] hci_event_packet+0x7b4/0x1280 [ 1535.487100][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1535.492169][ T5786] ? lock_chain_count+0x20/0x20 [ 1535.497149][ T5786] ? bis_list+0x290/0x290 [ 1535.501524][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1535.506767][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1535.512005][ T5786] hci_rx_work+0x43a/0xd60 [ 1535.516481][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1535.522246][ T5786] process_scheduled_works+0xa60/0x1600 [ 1535.527898][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1535.533415][ T5786] ? assign_work+0x3cc/0x5d0 [ 1535.538063][ T5786] worker_thread+0xa5e/0xfe0 [ 1535.542782][ T5786] kthread+0x2fa/0x390 [ 1535.547171][ T5786] ? pr_cont_work+0x550/0x550 [ 1535.551917][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1535.556638][ T5786] ret_from_fork+0x48/0x80 [ 1535.561189][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1535.566001][ T5786] ret_from_fork_asm+0x11/0x20 [ 1535.570902][ T5786] [ 1535.574716][ T5786] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1535.588810][ T5786] Bluetooth: hci1: failed to register connection device [ 1535.973808][T25308] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6138'. [ 1536.582528][T25308] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6138'. [ 1536.597832][T25309] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6138'. [ 1536.913485][T25311] FAULT_INJECTION: forcing a failure. [ 1536.913485][T25311] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1536.972888][T25311] CPU: 0 PID: 25311 Comm: syz.2.6139 Not tainted syzkaller #0 [ 1536.980469][T25311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1536.990585][T25311] Call Trace: [ 1536.993915][T25311] [ 1536.996889][T25311] dump_stack_lvl+0x18c/0x250 [ 1537.001625][T25311] ? show_regs_print_info+0x20/0x20 [ 1537.006873][T25311] ? load_image+0x420/0x420 [ 1537.011446][T25311] ? __might_fault+0xaa/0x120 [ 1537.016177][T25311] ? __lock_acquire+0x7d80/0x7d80 [ 1537.021266][T25311] should_fail_ex+0x394/0x4c0 [ 1537.026003][T25311] _copy_from_user+0x2f/0xe0 [ 1537.030645][T25311] ___sys_recvmsg+0x174/0x590 [ 1537.035390][T25311] ? __sys_recvmsg+0x2a0/0x2a0 [ 1537.040220][T25311] ? ksys_write+0x1d2/0x260 [ 1537.044794][T25311] ? __fget_files+0x3fc/0x460 [ 1537.049545][T25311] __x64_sys_recvmsg+0x21e/0x2f0 [ 1537.054586][T25311] ? ___sys_recvmsg+0x590/0x590 [ 1537.059515][T25311] ? lockdep_hardirqs_on+0x98/0x150 [ 1537.064772][T25311] do_syscall_64+0x55/0xb0 [ 1537.069240][T25311] ? clear_bhb_loop+0x40/0x90 [ 1537.073962][T25311] ? clear_bhb_loop+0x40/0x90 [ 1537.078690][T25311] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1537.084637][T25311] RIP: 0033:0x7fe0d599e0d9 [ 1537.089142][T25311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1537.108813][T25311] RSP: 002b:00007fe0d688c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1537.117366][T25311] RAX: ffffffffffffffda RBX: 00007fe0d5c25fa0 RCX: 00007fe0d599e0d9 [ 1537.125389][T25311] RDX: 0000000000000061 RSI: 0000200000000100 RDI: 0000000000000003 [ 1537.133526][T25311] RBP: 00007fe0d688c090 R08: 0000000000000000 R09: 0000000000000000 [ 1537.142019][T25311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1537.150042][T25311] R13: 00007fe0d5c26038 R14: 00007fe0d5c25fa0 R15: 00007ffee2bdfdc8 [ 1537.158333][T25311] [ 1537.618323][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 1540.492160][T25334] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6148'. [ 1540.503225][ T5786] Bluetooth: hci2: unexpected subevent 0x0a length: 150 > 30 [ 1540.512773][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 1540.519589][T25334] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6148'. [ 1540.523177][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1540.538869][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1540.548982][ T5786] Workqueue: hci2 hci_rx_work [ 1540.554066][ T5786] Call Trace: [ 1540.557393][ T5786] [ 1540.560382][ T5786] dump_stack_lvl+0x18c/0x250 [ 1540.565113][ T5786] ? show_regs_print_info+0x20/0x20 [ 1540.570361][ T5786] ? load_image+0x420/0x420 [ 1540.574937][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 1540.580098][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1540.585193][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 1540.589940][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 1540.595208][ T5786] kobject_add_internal+0x617/0xc90 [ 1540.600487][ T5786] kobject_add+0x164/0x240 [ 1540.604978][ T5786] ? kobject_init+0x1d0/0x1d0 [ 1540.609720][ T5786] ? get_device_parent+0x366/0x390 [ 1540.614886][ T5786] device_add+0x3fa/0xc40 [ 1540.619277][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 1540.624291][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 1540.629648][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1540.636055][ T5786] ? bt_info+0x180/0x180 [ 1540.640345][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1540.646033][ T5786] ? mutex_unlock+0x10/0x10 [ 1540.650595][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 1540.655354][ T5786] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1540.661338][ T5786] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1540.667808][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 1540.673934][ T5786] hci_event_packet+0x7b4/0x1280 [ 1540.678932][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 1540.684013][ T5786] ? lock_chain_count+0x20/0x20 [ 1540.688911][ T5786] ? bis_list+0x290/0x290 [ 1540.693338][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 1540.698597][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 1540.703858][ T5786] hci_rx_work+0x43a/0xd60 [ 1540.708340][ T5786] ? process_scheduled_works+0x975/0x1600 [ 1540.714129][ T5786] process_scheduled_works+0xa60/0x1600 [ 1540.719771][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 1540.725378][ T5786] ? assign_work+0x3cc/0x5d0 [ 1540.730032][ T5786] worker_thread+0xa5e/0xfe0 [ 1540.734718][ T5786] kthread+0x2fa/0x390 [ 1540.738850][ T5786] ? pr_cont_work+0x550/0x550 [ 1540.743606][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1540.748257][ T5786] ret_from_fork+0x48/0x80 [ 1540.752743][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 1540.757392][ T5786] ret_from_fork_asm+0x11/0x20 [ 1540.762237][ T5786] [ 1540.767395][ T5786] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1540.782318][ T5786] Bluetooth: hci2: failed to register connection device [ 1540.799908][T25336] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6148'. [ 1541.018633][T25340] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6150'. [ 1541.124070][T25343] [ 1541.126525][T25343] ====================================================== [ 1541.133591][T25343] WARNING: possible circular locking dependency detected [ 1541.140835][T25343] syzkaller #0 Not tainted [ 1541.145292][T25343] ------------------------------------------------------ [ 1541.152345][T25343] syz.0.6152/25343 is trying to acquire lock: [ 1541.158446][T25343] ffff888073a37a38 (&trie->lock){....}-{2:2}, at: trie_delete_elem+0x94/0x630 [ 1541.167400][T25343] [ 1541.167400][T25343] but task is already holding lock: [ 1541.174799][T25343] ffff8880b8f37de8 (stock_lock){-.-.}-{2:2}, at: refill_stock+0xea/0x450 [ 1541.183348][T25343] [ 1541.183348][T25343] which lock already depends on the new lock. [ 1541.183348][T25343] [ 1541.193886][T25343] [ 1541.193886][T25343] the existing dependency chain (in reverse order) is: [ 1541.202955][T25343] [ 1541.202955][T25343] -> #1 (stock_lock){-.-.}-{2:2}: [ 1541.210227][T25343] try_charge_memcg+0x237/0x17c0 [ 1541.215750][T25343] __memcg_kmem_charge_page+0x224/0x380 [ 1541.221875][T25343] __alloc_pages+0x222/0x460 [ 1541.227040][T25343] __kmalloc_large_node+0x8c/0x1f0 [ 1541.232901][T25343] __kmalloc_node+0x112/0x240 [ 1541.238287][T25343] bpf_map_kmalloc_node+0xbc/0x1b0 [ 1541.243984][T25343] trie_update_elem+0x172/0xd60 [ 1541.249409][T25343] bpf_map_update_value+0x64b/0x710 [ 1541.255175][T25343] map_update_elem+0x586/0x710 [ 1541.260515][T25343] __sys_bpf+0x6b5/0x890 [ 1541.265421][T25343] __x64_sys_bpf+0x7c/0x90 [ 1541.270542][T25343] do_syscall_64+0x55/0xb0 [ 1541.275588][T25343] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1541.282108][T25343] [ 1541.282108][T25343] -> #0 (&trie->lock){....}-{2:2}: [ 1541.289464][T25343] __lock_acquire+0x37ef/0x7d80 [ 1541.294976][T25343] lock_acquire+0x19e/0x420 [ 1541.300057][T25343] _raw_spin_lock_irqsave+0xb4/0x100 [ 1541.305923][T25343] trie_delete_elem+0x94/0x630 [ 1541.311267][T25343] bpf_prog_2c29ac5cdc6b1842+0x42/0x46 [ 1541.317318][T25343] trace_call_bpf+0x333/0x6c0 [ 1541.322659][T25343] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 1541.329068][T25343] perf_trace_lock_acquire+0x342/0x400 [ 1541.335572][T25343] lock_acquire+0x3ef/0x420 [ 1541.340780][T25343] percpu_ref_put+0x35/0x180 [ 1541.346032][T25343] __refill_stock+0x12a/0x3d0 [ 1541.351291][T25343] refill_stock+0x19e/0x450 [ 1541.356383][T25343] try_charge_memcg+0x1281/0x17c0 [ 1541.361982][T25343] charge_memcg+0x11b/0x3b0 [ 1541.367058][T25343] __mem_cgroup_charge+0x25/0x80 [ 1541.372573][T25343] do_wp_page+0x1378/0x34d0 [ 1541.377654][T25343] handle_mm_fault+0x1306/0x4a50 [ 1541.383167][T25343] do_user_addr_fault+0xad2/0x12d0 [ 1541.388858][T25343] exc_page_fault+0x64/0x100 [ 1541.394035][T25343] asm_exc_page_fault+0x26/0x30 [ 1541.399490][T25343] [ 1541.399490][T25343] other info that might help us debug this: [ 1541.399490][T25343] [ 1541.409756][T25343] Possible unsafe locking scenario: [ 1541.409756][T25343] [ 1541.417253][T25343] CPU0 CPU1 [ 1541.422829][T25343] ---- ---- [ 1541.428228][T25343] lock(stock_lock); [ 1541.432262][T25343] lock(&trie->lock); [ 1541.438904][T25343] lock(stock_lock); [ 1541.445461][T25343] lock(&trie->lock); [ 1541.449582][T25343] [ 1541.449582][T25343] *** DEADLOCK *** [ 1541.449582][T25343] [ 1541.457764][T25343] 3 locks held by syz.0.6152/25343: [ 1541.463015][T25343] #0: ffff88805dee62f8 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x249/0x660 [ 1541.473543][T25343] #1: ffff8880b8f37de8 (stock_lock){-.-.}-{2:2}, at: refill_stock+0xea/0x450 [ 1541.482798][T25343] #2: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xc3/0x6c0 [ 1541.492207][T25343] [ 1541.492207][T25343] stack backtrace: [ 1541.498132][T25343] CPU: 1 PID: 25343 Comm: syz.0.6152 Not tainted syzkaller #0 [ 1541.505756][T25343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1541.515846][T25343] Call Trace: [ 1541.519236][T25343] [ 1541.522220][T25343] dump_stack_lvl+0x18c/0x250 [ 1541.526967][T25343] ? load_image+0x420/0x420 [ 1541.531505][T25343] ? show_regs_print_info+0x20/0x20 [ 1541.536851][T25343] ? print_circular_bug+0x12b/0x1a0 [ 1541.542070][T25343] check_noncircular+0x2fc/0x400 [ 1541.547029][T25343] ? print_deadlock_bug+0x5d0/0x5d0 [ 1541.552239][T25343] ? lockdep_lock+0xf5/0x230 [ 1541.556861][T25343] ? _find_first_zero_bit+0xd6/0x100 [ 1541.562171][T25343] __lock_acquire+0x37ef/0x7d80 [ 1541.567051][T25343] ? perf_trace_buf_alloc+0x131/0x290 [ 1541.572437][T25343] ? verify_lock_unused+0x140/0x140 [ 1541.577654][T25343] ? perf_trace_lock_acquire+0x1a7/0x400 [ 1541.583315][T25343] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1541.589935][T25343] lock_acquire+0x19e/0x420 [ 1541.594547][T25343] ? trie_delete_elem+0x94/0x630 [ 1541.599619][T25343] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1541.606343][T25343] ? read_lock_is_recursive+0x20/0x20 [ 1541.611745][T25343] _raw_spin_lock_irqsave+0xb4/0x100 [ 1541.617140][T25343] ? trie_delete_elem+0x94/0x630 [ 1541.622109][T25343] ? _raw_spin_lock+0x40/0x40 [ 1541.626866][T25343] trie_delete_elem+0x94/0x630 [ 1541.632013][T25343] bpf_prog_2c29ac5cdc6b1842+0x42/0x46 [ 1541.637499][T25343] trace_call_bpf+0x333/0x6c0 [ 1541.642188][T25343] ? trace_call_bpf+0xc3/0x6c0 [ 1541.646966][T25343] ? mark_lock+0x94/0x320 [ 1541.651340][T25343] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 1541.657420][T25343] ? __lock_acquire+0x1336/0x7d80 [ 1541.662460][T25343] ? trace_call_bpf+0xc3/0x6c0 [ 1541.667239][T25343] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 1541.672805][T25343] perf_trace_lock_acquire+0x342/0x400 [ 1541.678372][T25343] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1541.684981][T25343] ? perf_trace_lock_acquire+0x342/0x400 [ 1541.690825][T25343] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1541.697521][T25343] lock_acquire+0x3ef/0x420 [ 1541.702059][T25343] ? percpu_ref_put+0x19/0x180 [ 1541.706851][T25343] ? verify_lock_unused+0x140/0x140 [ 1541.712080][T25343] ? read_lock_is_recursive+0x20/0x20 [ 1541.717501][T25343] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1541.724157][T25343] ? percpu_ref_put+0x19/0x180 [ 1541.728970][T25343] percpu_ref_put+0x35/0x180 [ 1541.733980][T25343] ? percpu_ref_put+0x19/0x180 [ 1541.739036][T25343] __refill_stock+0x12a/0x3d0 [ 1541.743740][T25343] refill_stock+0x19e/0x450 [ 1541.748376][T25343] ? refill_stock+0xea/0x450 [ 1541.753020][T25343] ? mem_cgroup_uncharge_skmem+0x1b0/0x1b0 [ 1541.758853][T25343] ? page_counter_try_charge+0x293/0x2c0 [ 1541.764630][T25343] ? try_charge_memcg+0x3e1/0x17c0 [ 1541.769765][T25343] try_charge_memcg+0x1281/0x17c0 [ 1541.774809][T25343] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 1541.780634][T25343] ? try_charge_memcg+0x21a/0x17c0 [ 1541.785786][T25343] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1541.792398][T25343] ? folio_flags+0x120/0x120 [ 1541.797024][T25343] ? percpu_ref_tryget+0x15/0x180 [ 1541.802076][T25343] ? get_mem_cgroup_from_mm+0x38/0x290 [ 1541.807567][T25343] charge_memcg+0x11b/0x3b0 [ 1541.812082][T25343] ? __mem_cgroup_charge+0x80/0x80 [ 1541.817235][T25343] ? get_mem_cgroup_from_mm+0x38/0x290 [ 1541.822702][T25343] ? get_mem_cgroup_from_mm+0x38/0x290 [ 1541.828179][T25343] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 1541.833754][T25343] __mem_cgroup_charge+0x25/0x80 [ 1541.838731][T25343] do_wp_page+0x1378/0x34d0 [ 1541.843274][T25343] ? folio_put+0xd0/0xd0 [ 1541.847567][T25343] ? do_raw_spin_lock+0x11f/0x2b0 [ 1541.852710][T25343] ? __rwlock_init+0x150/0x150 [ 1541.857512][T25343] handle_mm_fault+0x1306/0x4a50 [ 1541.862514][T25343] ? handle_mm_fault+0xe6/0x4a50 [ 1541.867498][T25343] ? lock_vma_under_rcu+0x52c/0x660 [ 1541.872718][T25343] ? numa_migrate_prep+0x350/0x350 [ 1541.877840][T25343] ? lock_vma_under_rcu+0xe5/0x660 [ 1541.882993][T25343] ? do_user_addr_fault+0x1cb/0x12d0 [ 1541.888335][T25343] do_user_addr_fault+0xad2/0x12d0 [ 1541.893489][T25343] ? rcu_is_watching+0x15/0xb0 [ 1541.898299][T25343] exc_page_fault+0x64/0x100 [ 1541.902913][T25343] asm_exc_page_fault+0x26/0x30 [ 1541.907863][T25343] RIP: 0033:0x7f35d36517fc [ 1541.912292][T25343] Code: 23 83 c0 01 44 39 d0 75 dc 48 89 f0 25 ff 1f 00 00 49 89 34 c1 41 88 3c 00 31 c0 c3 66 90 41 38 3c 10 74 0b 41 88 3c 10 31 c0 <49> 89 34 d1 c3 b8 01 00 00 00 c3 66 0f 1f 84 00 00 00 00 00 48 83 [ 1541.931915][T25343] RSP: 002b:00007ffd49c90428 EFLAGS: 00010246 [ 1541.938038][T25343] RAX: 0000000000000000 RBX: ffffffff83f3eb6c RCX: 0000000000000000 [ 1541.946245][T25343] RDX: 0000000000000b6c RSI: ffffffff83f3eb6c RDI: 0000000000000000 [ 1541.954719][T25343] RBP: 0000000000000000 R08: 00007f35d3a10000 R09: 00007f35d3a12000 [ 1541.962849][T25343] R10: 0000000083f3eb70 R11: 0000000000000000 R12: 00007f35d3a26038 [ 1541.971466][T25343] R13: 000000000000000a R14: ffffffff83f3e468 R15: 00007f35d4555720 [ 1541.979476][T25343] ? begin_current_label_crit_section+0x98/0x1d0 [ 1541.985826][T25343] ? aa_sock_perm+0xac/0x100 [ 1541.990542][T25343] ? aa_sock_perm+0xac/0x100 [ 1541.995156][T25343] [ 1542.818501][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 1546.180827][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.187205][ T1294] ieee802154 phy1 wpan1: encryption failed: -22