last executing test programs: 8.098799824s ago: executing program 0 (id=1696): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000240)={0x4, 0x80, 0x2, 0x80, 0x4, 0xe, 0x0, 0x8, 0x20000, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0xf67, 0x80000001}, 0x100000, 0x2, 0x9, 0x5, 0x800, 0x2, 0x400, 0x0, 0x8, 0x0, 0x9}, 0xffffffffffffffff, 0x2, r0, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703025701f328000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000003c21880b", 0xfdef}], 0x1}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800a411bbaa1282150100000000000071122c00000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf8000000, 0x4}, 0x0, 0x200000, 0xffffffffffffffff, 0xb) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) socket$kcm(0xa, 0x6, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r4, 0x29, 0x11, &(0x7f0000000000)=r3, 0x4) 8.025695496s ago: executing program 1 (id=1701): r0 = socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x400, 0x4556, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x3, 0x3}, 0x18, 0x0, 0xfffffffe, 0x1, 0x5, 0x3, 0x103, 0x0, 0x2, 0x0, 0x80000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d0e, 0x80218, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x7}, 0x2005, 0x0, 0x51, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="07000000040000000001000004000000200000", @ANYRES32=0x1, @ANYBLOB, @ANYRES32=0x0], 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffffffffffffef, &(0x7f0000000040)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d0048007ea60864160af36504001a0038001d00", 0x28}, {&(0x7f00000000c0)="83d2ff5f00000080d2898a0cc6d6703b87eb28f77b09bc7e64f918fa3be4664d327d90424d5503002800"/52, 0x34}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030020000b12d25a80648c2594f90124fc60100c074002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000001280), 0x4) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x5) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000010008188040f80ec59acbc0413a181003100000006010000000000000e000a000f000000018002002d1f", 0x2e}], 0x1}, 0x40) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x890b, &(0x7f0000000000)) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000001340)={0x2, 0x6, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @multicast1}}}], 0x20}, 0x8000) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x4}, 0x2400a880) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f2, &(0x7f0000000080)) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) 7.529055348s ago: executing program 2 (id=1704): r0 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000480)="d80000001c0081064e81f782db44b9040a1d08041000000000000aa1180015000600142603600e1208000f0000811701a80016002000014003fc000007391bd06b", 0x41}, {&(0x7f0000000240)="5c4875c6cad162c8a030dbf75c3199af9d2530b2a0903b3e130a77de8bd885166fc0c25d69226ae9915eccf9551f804eae36cf2327896a0400000000000000deed88adf4ca13a5a0c36a7496d22b9adf2c0fa13e5d0100000001000000d69c546e17a7118272ace242bc6025d0b60a12b3788fa6a7649045e4af16ba69df4bd43527a3d09bb308ac7073e1b8cc3b1f2337c492560dcaf2e27137dce9e63f963516e023ab35ee5efe28002000175bd1e2caddb4f0af8a7d68a120570669c0e034f537ff73126118a1b1d690c6c4c58b8a11b9da223749ab47e30974245e0380b04b6ac4516fc825d8018b1516193eed3201977c2d8bd421f8bb219051360d66644f9f64adda50578061dfe77650b3690000000300000000000000e9ffffff0000000000000000000000349b888a87d8cc29b633007d9dc6451348cd6fe4211910438611cd7244dc83010aded92d8775b722a0bfb77c3b716f5126dd19b1a7510157b4520b505a84e189b00166e950ca2e264c56df7f8c2edbb4ce88c8bdb0c2968a3582072a89f5b4e99dc1413b29e18e74fd9a6e0b", 0x195}], 0x2, 0x0, 0x0, 0x7400}, 0x20004041) 7.315694874s ago: executing program 0 (id=1705): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) socket$kcm(0xa, 0x5, 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000240)={0x4, 0x80, 0x2, 0x80, 0x4, 0xe, 0x0, 0x8, 0x20000, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0xf67, 0x80000001}, 0x100000, 0x2, 0x9, 0x5, 0x800, 0x2, 0x400, 0x0, 0x8, 0x0, 0x9}, 0xffffffffffffffff, 0x2, r0, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703025701f328000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000003c21880b", 0xfdef}], 0x1}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800a411bbaa1282150100000000000071122c00000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf8000000, 0x4}, 0x0, 0x200000, 0xffffffffffffffff, 0xb) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) socket$kcm(0xa, 0x6, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r4, 0x29, 0x11, &(0x7f0000000000)=r3, 0x4) 7.315268534s ago: executing program 2 (id=1706): socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$kcm(0x2, 0x3, 0x106) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0xec, 0x0, 0x0, 0x1, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, @perf_bp={&(0x7f00000004c0), 0x2}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x8, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)="d80000001e0081054e81f782db4cb9040a1d080006007c095dd2086518000a800d00000003600e1208000f0000000406a80016c0080009", 0x37}], 0x1, 0x0, 0xffffffffffffff3c}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001240)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000aecd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad94ed406f21caf5adcf920569c00cc1199684fa75814709fea019af247c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c1faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6fab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b79db2e3d5986c82b5aa94e539b204d58f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c7160ec83070000020000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72b0000000000001cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2cc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78ac02ca3cdf6a662db1c9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad943e392955f4f979ea13201bafedcd2063d11dd665647223c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd89346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca2533659edc8be05cc85451c6a14507434eb54b6f43caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffca9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a294351c5356c1d06c92cf8ce3c7c56cd31121624d74517fd3666277f670e812b28e2f30d035cee5d0e77a3c7220000000000000005a474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f034b8d3ebce68663ef5af469abe75b314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041e12282ce24463aaf28345bd168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f09000000000000004fc4bda3453602004535a976eacd3adaa4d2ee6fe0d072ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d401adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb40f7f02f750d6c977a191852c9ae031db044b2353199546609f9f69a6cfefdf879d447df53f3b9b70d10355b00300000000000000553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f58fab987baab97a9bfbd8f185b5631820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe527340935aa3c0b4f3f45b418a18217747ae442e31560e5b741445ea2a1acee2a81425ff000000d2a0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51423b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f88735fce5115dc83ed73d8ee4a91322608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf5000000000000fa08ad0631c4b839688b22c4da2a6bc4cf45854d221a2d5f96bc64647f15daa2ba79cd0f4254ed55217912ef84bd2927df82fc061aef2920c49b2a90886da75561173fa186cb7ee86dd4285c4721eb428c953296bb2f5d825da54dbef07c1b349b4901e093d13e6b9a0000009b5b22e887bc061d40bcaf0aa18623fd9b7179ccc692ba74b531b65c4decf9d080a8ac7e82d4cde1267aa64b2a94fd87a009e6742c2ddc3a9d7eccbb1831b1fa218277c2814a91cab7cb59c697166d6f1bb1a360470000000000000000000000000000000000000000000000000000f9f9b4ce7e871f507084c8c88e0652decbe579b03ed84ea94597dd1059620a050f69ea03b99b4e19d35f4a3b54e96ae2172effecec80f6baa4bf69a6ebf5392882df78b0983e662dc0cb64b77f3f006b6b25443197ae93f0be6de5a703d003f00720943c0e4b33af00000000000000000021a688b2d7007fcc4b59f719afb0b3b7e0aee306ca70fe42bf4984a68f40e1fc043a03a17e4744359b87dc27c82d51cbeb64e52a28daeb6a78d6fe06181ecc840000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x200040c4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000000080)={0x0, 0xffffffffffffff20, 0x0, 0x0, 0xffffffffffffffff, 0x100}, 0x2040) socket$kcm(0x2, 0x1000000000000002, 0x0) r3 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r3, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) close(0xffffffffffffffff) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000880)={&(0x7f00000005c0)="bd25a9fb9e0651f8b3936947481ae61daedbe33148e2cddb792459445298a565aa7e211da5c3b8458f2243278afe35a8f4d0352c2ac07a45fa6c272babb04b04a6762083981bbc3ccb9ce4901e077998f0da587efb54710e35a0c4b49ed4ad4eecf6634b8e854b790bbced664bd21f7a95663bf451f5d86b8c3393609dc78a4ab6fda11ec3945b87a6d330691b6169ca39f101ebb127ef353a197655", &(0x7f0000000680)=""/213, &(0x7f0000000940)="06dea47cd18aeaffded834821b68030d27fb8eed95637bceda17c62b148ddee2869428c1008e00bbe3ac44f0ca66df217872c98b52ffd5aa0ac96e4831ed85081aea715796288f4ea52a4e4ca7cf73b44757dd5dc6f9b0d0ee67dc3079ca56764ec50644792fb44efebd421869240487876b652a33c8d24a85b7db08a27c1125c067547a7307da2f50695fc05c26683bbeb4d5402a50547ee676e5", &(0x7f0000000800)="bada5ab0387d0c3380ae7b33c8043c78326ea3289feb352896513a7bee473f88aadbc74d3fd832978352a93e1b56dfa2125adc789526190ca5b46e5dabbdba6171e4136914419bbb17720bbac4d69e5a53b86e98c2e605d777943cb84eb186c95af730cbb0ca3ea2f0717ee8b63f99891a90036d4bf24ba1b879f6bff5", 0x7f, r0}, 0x38) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) close(r3) 7.300846116s ago: executing program 3 (id=1707): close(0xffffffffffffffff) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000b80)={0xffffffffffffffff, 0x58, &(0x7f0000000a80)}, 0xfffffffffffffcf2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffbfffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3f00}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0x7, 0x9, 0x0, 0x0, 0x5c}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {}, {}, {0x4, 0x0, 0x7}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x6, 0x1, 0x6, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.154532641s ago: executing program 1 (id=1708): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x2, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r2) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)="822225b1fef33b", 0x0, 0xa}, 0x38) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) perf_event_open(&(0x7f0000000380)={0x3, 0x80, 0x93, 0x0, 0xf3, 0xa, 0x0, 0x0, 0xd006e1258c4875cc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0xc20, 0xc8, 0x7, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000000000000f37538e486dd630080fc5c082c00db5bffffffffff000000060300000023000000000000000000000000ac1414aa2b200007"], 0xfdef) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r6, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000200)={0x0, 0x0}, 0x8) r8 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r7, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000500)={r8, r6, 0x4, r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x31}}, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x90) write$cgroup_int(r1, &(0x7f0000000080)=0x80000002, 0x12) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'ip6gre0\x00', 0x1}) r9 = socket$kcm(0x2a, 0x2, 0x0) recvmsg(r9, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x40002182) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x541b, 0x0) 6.612934941s ago: executing program 2 (id=1709): r0 = socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$kcm(0x10, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000003c0), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x3a, 0x0, 0xfd, 0x0, 0x5c35, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x0, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$TOKEN_CREATE(0x24, &(0x7f0000001600)={0x0, r0}, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000015c0)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x4, [@enum64={0x7, 0x4, 0x0, 0x13, 0x0, 0x1, [{0x5, 0x8da0, 0x3}, {0x3, 0x361c3271, 0xffff0001}, {0xa, 0x5, 0xb473}, {0x7, 0xb, 0x4}]}]}, {0x0, [0x5f, 0x30]}}, &(0x7f00000005c0)=""/4096, 0x58, 0x1000, 0x0, 0x6, 0x10000, @value=r1}, 0x28) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd63f580fc02082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa"], 0xfdef) write$cgroup_subtree(r3, &(0x7f00000004c0)=ANY=[], 0xfdef) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000040), &(0x7f0000000080)='%pB \x00'}, 0x20) r4 = socket$kcm(0x23, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x400c84c) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1e00000000040000080000c8212b18c41b25136d", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r5, 0x0, 0x0}, 0x20) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89ed, 0x0) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x39c}, 0x0) r7 = socket$kcm(0xa, 0x1, 0x0) setsockopt$sock_attach_bpf(r7, 0x29, 0x10, 0x0, 0x1300) sendmsg$kcm(r7, &(0x7f0000000000)={&(0x7f0000000240)=@in6={0xa, 0x4e21, 0x3000000c, @loopback, 0x7}, 0x80, 0x0}, 0x20004800) socketpair(0x9, 0x800, 0xff, &(0x7f0000000200)) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, 0x0, 0x0) gettid() bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000240)={0x800, 0x0}, 0x8) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000002c0)={r8, 0xc92d, 0x10}, 0xc) syz_clone(0x410a4400, 0x0, 0xfffffffffffffd56, 0x0, 0x0, 0xffffffffffffffff) 6.607492422s ago: executing program 1 (id=1710): perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x8, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x0, 0x46fa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r0 = perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x3, r0, 0xb) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x131600, 0x0) ioctl$TUNSETVNETLE(r1, 0x400454dc, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x80800, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$TUNSETQUEUE(r2, 0x400454d9, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x69, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r3, 0x0, 0x40012100) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x2000002, 0x3a, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000440)={0xffffffffffffffff, r4}) recvmsg(r3, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x10002) r5 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000010008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}], 0x1}, 0x0) 6.530480775s ago: executing program 3 (id=1711): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) socket$kcm(0xa, 0x5, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) perf_event_open$cgroup(&(0x7f0000000240)={0x4, 0x80, 0x2, 0x80, 0x4, 0xe, 0x0, 0x8, 0x20000, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0xf67, 0x80000001}, 0x100000, 0x2, 0x9, 0x5, 0x800, 0x2, 0x400, 0x0, 0x8, 0x0, 0x9}, r0, 0x2, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x541b, &(0x7f00000013c0)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000cabe9cb37abbe40a00864eab7749efbc3330ec3a"], 0x48) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703025701f328000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000003c21880b", 0xfdef}], 0x1}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800a411bbaa1282150100000000000071122c00000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf8000000, 0x4}, 0x0, 0x200000, 0xffffffffffffffff, 0xb) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) r3 = socket$kcm(0xa, 0x6, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r5 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r5, 0x29, 0x11, &(0x7f0000000000)=r4, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x5411, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)) 6.490746051s ago: executing program 4 (id=1712): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2d0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_config_ext, 0x10c002, 0xac5d, 0x10000200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x11, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000100000000000000000000008500000087000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547e9f17dbe9abc89b6e0704", 0x0, 0x3696, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 6.408115675s ago: executing program 0 (id=1713): r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x8081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x3, 0x0, 0x9, 0x0, 0x0, 0x3fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x3}, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x20}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a000000800000000642"], 0xfdef) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000300)={r2}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYRES16, @ANYRESDEC=r1, @ANYBLOB="0000000b000000a400"/20, @ANYRES64=r2, @ANYRES32, @ANYRES16=r0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000400000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10f002, 0x0, 0x4, 0xd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f00000002c0)}, 0x20) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1ff, 0x0, 0xa8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, 0x0, &(0x7f0000000240)}, 0x20) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000100)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x210}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000340)=@o_path={&(0x7f0000000280)='./file0\x00', r2}, 0x18) 6.146183498s ago: executing program 4 (id=1714): socket$kcm(0x21, 0x2, 0x2) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac59}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x8, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x48, 0x1, 0x5, 0x0, 0x0, 0x0, 0x202, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000100), 0xe}, 0x7851, 0x0, 0xfffffffc, 0x8, 0x7fff, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400, 0x8}, 0x9, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x300, 0xe, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0xa, 0x2, 0x0) r4 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r4, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000140)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x44, 0x2}]}}}], 0x18}, 0x20002880) socket$kcm(0x21, 0x2, 0x2) socket$kcm(0x11, 0x2, 0x300) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200003, 0x0) socket$kcm(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x4, 0x7fffffffffffffff}, 0x0, 0x0, 0xc2ba, 0x0, 0x8, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001580)="d80000001a0081044e81f782db4cb9040a1d08007b490d4f1e9ff8d815000100ff05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f990071342e875fab7cb6cec6cf6efb80004cd2000000000000b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40db5e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x4048140) 5.308528308s ago: executing program 1 (id=1715): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="6d8500"/21, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r0}, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x2d1, 0xfffffffffffffd85, &(0x7f00000000c0)="b9ff0303000d698cb89e40f086dd6000000e00ff8900630677", 0x0, 0x100, 0x2000000, 0x0, 0x0, &(0x7f0000000440)}, 0x28) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x8001, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000780)="d80000001a0081044e81f782db4cb9040a1d0800fe007c05e8fe55a115001c000200142603600e12080005007a010401a800160020001d400d000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92", 0xcb}, {&(0x7f0000000400)="ec487517fecd894af18ce18fbf", 0xd}], 0x2}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, &(0x7f0000005c00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546000677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5467a932b77674e802a0d42bc6099ad238af770b5ed8925161729298700000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3ac3209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b135ab6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809b5b9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed3957f813567f7a95435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac559eaf39027ceb379a902d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385beef3282830689da6b53b263339863297771429d120000003341bf4abacac94500fca0493cf29b33dcc9ffffffffffffffd39f6ce0c6ff01589646efd1cf870cd7bb2366fdf870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1293b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd000c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301fb997316dbf17866fb84d4173731efe895ff2e1c55ef08235a0126e01254c44060926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a861887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc74aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7ad333545794f37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea139376f24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8e3070000001e48418046c216c1f895778cb25122a2a998de0842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec84ac3571f02f647b3385b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba2f58ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df986741517abf11389b751f4e109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750890ae71555b3228b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288d139bd3da230ed05a8fe64680b0a3f9f2dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b9100000000a55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c776f4b4ce07e1c6fa66fcfc7a228805f76785efc0ceb1c8e5729c66418d169fc03aa18854693ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7e478950aa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab848753203b458b97ec1afb079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7db3c4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6c30ebc660309e1e245b0fdf9743af932cd6db49a47613808bad959719c0000000000378ac2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6ca0400966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e3030108000000000000c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bffef97dcecc467ace456597685c5870d25f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5000000000006065d6735eb7a00e127c0000000000000000000000bfb0bba79344643b1d8daa9f38e4b62c1e2af68c6f5054b078acd74b4a9c944e4505da485a3a4154387a0a88372091cd397b09c5888a06431df3f68abf0b366c4d5f8bea7b29c257ed756dff7a21c6b661cbdd43de65afd7f661d5c84f915c90e3d6ea012b68b787eb01d8320000000000000060176dacba0ec503a37fae6b472ec369c79ee6a420c0fd8d8d82fe136d5af6c30bfeb0a7275babfdb96a127aa9386e0671c6454245a18c1c8c49552cff5d27b547cdc34c0858c77a47a9ff86ee9fbd9ceda428716a4218821176d8067997527230fa67d26950d3e4f2750fa7c872874ad3a2d11f9f6eb08e6d7b6fa257b04d8ce36360f524e3dfd2211641f3d2637d86b80681eca50ce0eecafdd22d41fa515c15591e70ded4b70efac3cb42fb352d82e8f7573e8ed8248da356fa91a252976d3a4d8c1843a8d5bb7f5f1028453a0562a3ea93117076dd4940b7df50d78289fe66197525f6095f8662d232970bef61b03fa83027963a1a2e07cfee30c0d0b4c5877f93b3637ca21eab5afcf5d4638dfe8f9202aaad51c979049dd76d65368cbd4187d9f74257c7c4a23ac4a34eec5aa17e78c5167216f5e72138d20f8325dd5f8f96c32189c904eaef580987f1ce601a7cdc35461db9981ac42f9e24b0699bbe4e3d986e38952b0b7938eefd9e7a292bbb66367ad77045fdc18855c81c031dedd185c723238373fc698d676791d04f1ff5f0825a6619e844882f31ed190233d58ecee949e310bf2b1a51b8a33ae65a06d2b6ad386bf8dc49dd328bcd75d1843a13d68560175a18af7efc3c0f20e32f84f6aaaf000000000000000000000013a6c66bce74a8fb9092023df695da2714a7933d699d42de2bc4a85e0a0e22228290a7a7553ab93a16e42453ed86869a02df2f47d4088fac1772d3cd955c81cbf91c2ca7942942f61723b558079b82547844f92df2499c4b2c2ef2539e5daa8d8727baaa6b5755e6f83bbfca00000000000000000000007925d0f1256330b9e2aa9a18cea8e009116f63c6c7d8f7f95bf0f6731e5eb1dcdc534f357b9f08e7a9a3aebeca145d695053b5bef004ca24e6c57ed10f01488d38b8b0b68d93e3cf630837915d518fde2115e66615786fe7b9216de958119cf762cac77ac829a02f48e72c0d2841880b2c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff7e}, 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x1}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000091030000090000000100000008000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000008c00"/28], 0x50) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r3}, 0xc) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[], 0x50) r4 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="f4000900062b2c05fe80000000000000dc8b850f693c66ccfe808100000000000000613a2eb0094401e0728f1d", 0x2d}], 0x1}, 0x20000884) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="000000000000000000000000ec9c0c0500000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x10, &(0x7f0000000880)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007000000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000800000085000000c500000095c448c996c3082d2efb14a94c89d95a3bb7c6113f90062a2a73206a0fe22a5c8ea9f9fe86bcfe2da6e1312f92fb7e44c5f50b4527d4aa71d39680e77c6f9d011939a203ee3d1985aa0892198631ceefa01aa7696c49d625ce47408f47f288e48406b5a78d9f5033f9ddd34df69f4df211d3d2bbed04fc35f2fed38c5ffcad8625c016bc18efceee3ef584cbe3534f3f7d1c40804fec6a7c7c4560969d53698d70da08cfff0765be6be5db43d0a76413a04a48d9a3f44933a82ae2648144aa07cb8ca3c17972f08035"], &(0x7f0000000640)='syzkaller\x00', 0x1, 0x94, &(0x7f0000000580)=""/148}, 0x94) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x1f00, &(0x7f0000001840)=[{&(0x7f0000000580)="6700000011008188040f56ecdb4cb9cca7480ef436000000e3bd6efb440009000e000a0010000000ba80010000005a8c3774fa0af3dc59a933c1e7a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f09cdc2649f", 0x67}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) 2.963581748s ago: executing program 0 (id=1716): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x40}, 0x200, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x1, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xe3, 0x6, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x100000000, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21bef5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f94306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a835701bea8240399c56ce8f58df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b262341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f9ac2f7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db000000000000e6ed75ca8fcda7ef3ee336189fef3b3ffb9f38fefc5ff39c4e69e3fa1f8b10ee97123e99b61eba065b1ad67530e7c4f11f9da7ae000002000000610101ad7f79cb9bbf64a0fc109f49fe8799fe266e2ccac80fefe750151f5ddfe51833ec65ece70e07ce8ab5d97db47da8f80000664dc0b86ae2b3ff9d4e220752a6b2f3ea9f793612386496dca5af7b8952aafa796ea7b156d19612297c63bb20e1e0469f7615f67a9218cbace38f5236821314f76302b98afa93044b83989339ca10e6ae30e70e17a82f03e915b8425e8e7a91614306d2ae0bc3550d856f2d7293672b5673d264fc886b0c8bdf436a0fcd21bf9da7bdca98e34cd6e59b0a7ce4ba1b466561aaa35448dff47bb1d7df23d467689a6669e4300d5acf12e4d0b35abf91569f605b2f6df0d861"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_clone(0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0xc5bf) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0xb, 0x5, &(0x7f0000000a80)=ANY=[], &(0x7f0000000a80)='GPL\x00', 0x20, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) sendmsg$kcm(r0, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000041) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg(r0, &(0x7f00000008c0)={0x0, 0x241, &(0x7f0000000580)=[{&(0x7f0000000440)="a6", 0xffffff58}], 0x1}, 0x40001) sendmsg$inet(r0, &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000e80)}, 0x40) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x4000000, 0x3ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00fea0"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x790f}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x4, 0xd}, {0x10000002, 0x0, 0xf, 0x6}], 0x10, 0x4000000}, 0xfe33) r4 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r4, 0x84, 0x6e, &(0x7f0000000000)=r7, 0x10) r8 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r10) recvmsg$unix(r9, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r8, 0x84, 0x77, &(0x7f0000000000)=r11, 0x8) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) socket$kcm(0xf, 0x3, 0x2) 2.94712549s ago: executing program 3 (id=1717): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000240)={0x4, 0x80, 0x2, 0x80, 0x4, 0xe, 0x0, 0x8, 0x20000, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0xf67, 0x80000001}, 0x100000, 0x2, 0x9, 0x5, 0x800, 0x2, 0x400, 0x0, 0x8, 0x0, 0x9}, 0xffffffffffffffff, 0x2, r0, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703025701f328000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000003c21880b", 0xfdef}], 0x1}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800a411bbaa1282150100000000000071122c00000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf8000000, 0x4}, 0x0, 0x200000, 0xffffffffffffffff, 0xb) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) socket$kcm(0xa, 0x6, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r4, 0x29, 0x11, &(0x7f0000000000)=r3, 0x4) 2.653325249s ago: executing program 4 (id=1718): r0 = socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x400, 0x4556, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x3, 0x3}, 0x18, 0x0, 0xfffffffe, 0x1, 0x5, 0x3, 0x103, 0x0, 0x2, 0x0, 0x80000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d0e, 0x80218, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x7}, 0x2005, 0x0, 0x51, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="07000000040000000001000004000000200000", @ANYRES32=0x1, @ANYBLOB, @ANYRES32=0x0], 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffffffffffffef, &(0x7f0000000040)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d0048007ea60864160af36504001a0038001d00", 0x28}, {&(0x7f00000000c0)="83d2ff5f00000080d2898a0cc6d6703b87eb28f77b09bc7e64f918fa3be4664d327d90424d5503002800"/52, 0x34}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030020000b12d25a80648c2594f90124fc60100c074002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000001280), 0x4) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x5) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000010008188040f80ec59acbc0413a181003100000006010000000000000e000a000f000000018002002d1f", 0x2e}], 0x1}, 0x40) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x890b, &(0x7f0000000000)) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000001340)={0x2, 0x6, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @multicast1}}}], 0x20}, 0x8000) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x4}, 0x2400a880) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f2, &(0x7f0000000080)) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) 1.733870752s ago: executing program 1 (id=1719): perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x8, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x0, 0x46fa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r0 = perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x3, r0, 0xb) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x131600, 0x0) ioctl$TUNSETVNETLE(r1, 0x400454dc, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x80800, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$TUNSETQUEUE(r2, 0x400454d9, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x69, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r3, 0x0, 0x40012100) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x2000002, 0x3a, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000440)={0xffffffffffffffff, r4}) recvmsg(r3, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x10002) r5 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000010008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}], 0x1}, 0x0) (fail_nth: 2) 1.733339002s ago: executing program 3 (id=1720): socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$kcm(0x2, 0x3, 0x106) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0xec, 0x0, 0x0, 0x1, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, @perf_bp={&(0x7f00000004c0), 0x2}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x8, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)="d80000001e0081054e81f782db4cb9040a1d080006007c095dd2086518000a800d00000003600e1208000f0000000406a80016c0080009", 0x37}], 0x1, 0x0, 0xffffffffffffff3c}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001240)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000aecd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad94ed406f21caf5adcf920569c00cc1199684fa75814709fea019af247c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c1faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6fab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b79db2e3d5986c82b5aa94e539b204d58f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c7160ec83070000020000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72b0000000000001cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2cc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78ac02ca3cdf6a662db1c9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad943e392955f4f979ea13201bafedcd2063d11dd665647223c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd89346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca2533659edc8be05cc85451c6a14507434eb54b6f43caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffca9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a294351c5356c1d06c92cf8ce3c7c56cd31121624d74517fd3666277f670e812b28e2f30d035cee5d0e77a3c7220000000000000005a474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f034b8d3ebce68663ef5af469abe75b314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041e12282ce24463aaf28345bd168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f09000000000000004fc4bda3453602004535a976eacd3adaa4d2ee6fe0d072ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d401adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb40f7f02f750d6c977a191852c9ae031db044b2353199546609f9f69a6cfefdf879d447df53f3b9b70d10355b00300000000000000553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f58fab987baab97a9bfbd8f185b5631820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe527340935aa3c0b4f3f45b418a18217747ae442e31560e5b741445ea2a1acee2a81425ff000000d2a0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51423b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f88735fce5115dc83ed73d8ee4a91322608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf5000000000000fa08ad0631c4b839688b22c4da2a6bc4cf45854d221a2d5f96bc64647f15daa2ba79cd0f4254ed55217912ef84bd2927df82fc061aef2920c49b2a90886da75561173fa186cb7ee86dd4285c4721eb428c953296bb2f5d825da54dbef07c1b349b4901e093d13e6b9a0000009b5b22e887bc061d40bcaf0aa18623fd9b7179ccc692ba74b531b65c4decf9d080a8ac7e82d4cde1267aa64b2a94fd87a009e6742c2ddc3a9d7eccbb1831b1fa218277c2814a91cab7cb59c697166d6f1bb1a360470000000000000000000000000000000000000000000000000000f9f9b4ce7e871f507084c8c88e0652decbe579b03ed84ea94597dd1059620a050f69ea03b99b4e19d35f4a3b54e96ae2172effecec80f6baa4bf69a6ebf5392882df78b0983e662dc0cb64b77f3f006b6b25443197ae93f0be6de5a703d003f00720943c0e4b33af00000000000000000021a688b2d7007fcc4b59f719afb0b3b7e0aee306ca70fe42bf4984a68f40e1fc043a03a17e4744359b87dc27c82d51cbeb64e52a28daeb6a78d6fe06181ecc840000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x200040c4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000000080)={0x0, 0xffffffffffffff20, 0x0, 0x0, 0xffffffffffffffff, 0x100}, 0x2040) socket$kcm(0x2, 0x1000000000000002, 0x0) r3 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r3, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) close(0xffffffffffffffff) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000880)={&(0x7f00000005c0)="bd25a9fb9e0651f8b3936947481ae61daedbe33148e2cddb792459445298a565aa7e211da5c3b8458f2243278afe35a8f4d0352c2ac07a45fa6c272babb04b04a6762083981bbc3ccb9ce4901e077998f0da587efb54710e35a0c4b49ed4ad4eecf6634b8e854b790bbced664bd21f7a95663bf451f5d86b8c3393609dc78a4ab6fda11ec3945b87a6d330691b6169ca39f101ebb127ef353a197655", &(0x7f0000000680)=""/213, &(0x7f0000000940)="06dea47cd18aeaffded834821b68030d27fb8eed95637bceda17c62b148ddee2869428c1008e00bbe3ac44f0ca66df217872c98b52ffd5aa0ac96e4831ed85081aea715796288f4ea52a4e4ca7cf73b44757dd5dc6f9b0d0ee67dc3079ca56764ec50644792fb44efebd421869240487876b652a33c8d24a85b7db08a27c1125c067547a7307da2f50695fc05c26683bbeb4d5402a50547ee676e538", 0x0, 0x7f, r0}, 0x38) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) close(r3) 1.665491954s ago: executing program 4 (id=1721): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100080, 0x0, 0x0, 0x1}, 0x0, 0xfffffffdffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="08000000040000000400"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r1}, &(0x7f0000000200), &(0x7f0000000240)=r0}, 0x20) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r2, 0x0, 0x3004c041) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0xff8d, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) 1.652854966s ago: executing program 2 (id=1722): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='memory.high\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x5, 0x2, 0x4}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r6 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x0, 0x3}, {0x10040002, 0x0, 0x7, 0x5}], 0x10, 0x80}, 0x94) close(r8) recvmsg$unix(r7, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0x12, &(0x7f00000008c0)=r9, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmsg$kcm(r6, &(0x7f0000001980)={0x0, 0x0, 0x0}, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) close(0x3) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0900000006000000080000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r11}, &(0x7f0000000000), &(0x7f0000000880)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x18, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000001bc6500850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0xfffffe4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r12, 0x1, 0x32, &(0x7f00000000c0)=r14, 0x4) sendmsg$unix(r13, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) write$cgroup_subtree(r3, &(0x7f0000000200)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce8112032c00fc08000000000200875a65969ff57b00fc"], 0xfdef) recvmsg$kcm(r3, &(0x7f00000035c0)={&(0x7f0000000100)=@ethernet={0x0, @multicast}, 0x80, &(0x7f0000003480)=[{&(0x7f0000000180)=""/216, 0xd8}, {&(0x7f0000000280)=""/47, 0x2f}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/4096, 0x1000}, {&(0x7f00000022c0)=""/85, 0x55}, {&(0x7f0000002340)=""/4096, 0x1000}, {&(0x7f0000003340)=""/68, 0x44}, {&(0x7f00000033c0)=""/175, 0xaf}], 0x8, &(0x7f0000003500)=""/155, 0x9b}, 0x21) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="382d17"], 0x6a) 1.44649264s ago: executing program 0 (id=1723): close(0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)) r2 = socket$kcm(0x2b, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000029600009500000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)="a17abd7c18cf849b288a9ccf2f6cd01576a60e6a75d6095b906da81195ee210632ff5cdbe4df675c43a84cd27a40c1d374c2dd354d30bcd60c2a2b860f008238d717d6cf0b4e0ac29adfbbbc393abeb74c65354f62d57392aa528e867c9db4d77bb7f63d2527382860a9ec32c53b2899227748bff0ecff1146f532d9590edacac7b29ce6365c856765", &(0x7f0000000240), 0x800, r3}, 0x38) bpf$MAP_UPDATE_BATCH(0x1b, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x24, r3}, 0x38) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x8905, &(0x7f0000000100)) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012", @ANYBLOB], 0x48) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x8) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="c9e20e3b4db63ddf686121f4000000000000000e53c484"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x80) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r5, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, &(0x7f0000000e00)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000e80)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xe1, &(0x7f0000000440)=[{}], 0x8, 0x10, &(0x7f00000004c0), &(0x7f0000000e40), 0x8, 0x10068, 0x8, 0x8, &(0x7f0000000580)}}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="180200000300000000000000000000008500000013000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000170000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x81) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="1000000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="fcffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="e6ffffffffffffff00000000000000000000000000000000000000009a4b8b3090b2e1ca74382d89b79cbfe9a3350a8922ca8d37735745bfbe5d8702066ac8459946ab285cf311b502444df357bb69471b0ced6216e47fbcbd95e80f704dbfcd7a71c9e3464e7db5265b4c5d96cc79a4a2b7c0220b55e45ddbb464"], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x15, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x86}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r10, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000340)="196a348fbba6e75ce3e37fd3d3fc", 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r11 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000700)=0xffffffffffffffff, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a80)={r5, 0xe0, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x286, &(0x7f0000000780)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x9, 0x3, &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000840)=[0x0, 0x0, 0x0], 0x0, 0xa2, &(0x7f0000000880)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f00000008c0), &(0x7f0000000900), 0x8, 0x3f, 0x8, 0x8, &(0x7f0000000940)}}, 0x10) r13 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000ac0)={0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x1, 0x3, &(0x7f0000000080)=@raw=[@btf_id={0x18, 0x4, 0x3, 0x0, 0x2}, @generic={0x3, 0x0, 0x9, 0x6}], &(0x7f0000000280)='GPL\x00', 0x5, 0x7, &(0x7f00000002c0)=""/7, 0x41000, 0x5, '\x00', r6, @fallback=0x3c, r11, 0x8, &(0x7f0000000740)={0x7, 0x2}, 0x8, 0x10, 0x0, 0x0, r12, r13, 0x3, &(0x7f0000000b00)=[r4], &(0x7f0000000b40)=[{0x1, 0x5, 0xe, 0x2}, {0x0, 0x1, 0x3, 0xb}, {0x1, 0x3, 0x5}], 0x10, 0x3}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r14, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES8], 0x9a) 429.162859ms ago: executing program 3 (id=1724): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2d0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_config_ext, 0x10c002, 0xac5d, 0x10000200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x11, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000100000000000000000000008500000087000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547e9f17dbe9abc89b6e0704", 0x0, 0x3696, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 334.631715ms ago: executing program 2 (id=1725): perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x3, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x4044}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = getpid() perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000001, 0x1004000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x7, 0x2}, 0x8386, 0x0, 0x0, 0x0, 0x0, 0x4}, r0, 0x1, 0xffffffffffffffff, 0x3) 269.294145ms ago: executing program 4 (id=1726): r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xc2ba, 0x0, 0x200000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="d80000001e0081054e81f782db020000001d080006007c09e8fe08a104000e000a00142603600e1208000fc01e000406a80016c008000e400400027c035c0461c1967f6f94007134cff6d26efb8000a0ffa290457f01895416277ce06bba0000031fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d25ccca95c9757c01deeb12c0e440f57d6cf23b1900360db7e5167fda40fad956d809d5e12a9ecbee5de6ccd40dd6e4edef3d93452a92950b0000000000000023f9a941000000000000000000007d59ef7e1359485303f720a1ed469c778f", 0xd8}], 0x1}, 0x804) 251.858729ms ago: executing program 1 (id=1727): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) socket$kcm(0xa, 0x5, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) perf_event_open$cgroup(&(0x7f0000000240)={0x4, 0x80, 0x2, 0x80, 0x4, 0xe, 0x0, 0x8, 0x20000, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0xf67, 0x80000001}, 0x100000, 0x2, 0x9, 0x5, 0x800, 0x2, 0x400, 0x0, 0x8, 0x0, 0x9}, r0, 0x2, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x541b, &(0x7f00000013c0)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000cabe9cb37abbe40a00864eab7749efbc3330ec3a"], 0x48) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703025701f328000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000003c21880b", 0xfdef}], 0x1}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800a411bbaa1282150100000000000071122c00000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf8000000, 0x4}, 0x0, 0x200000, 0xffffffffffffffff, 0xb) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) r3 = socket$kcm(0xa, 0x6, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r5 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r5, 0x29, 0x11, &(0x7f0000000000)=r4, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x5411, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)) 174.388491ms ago: executing program 2 (id=1728): r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x8081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x3, 0x0, 0x9, 0x0, 0x0, 0x3fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x3}, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x20}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a000000800000000642"], 0xfdef) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000300)={r2}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYRES16, @ANYRESDEC=r1, @ANYBLOB="0000000b000000a400"/20, @ANYRES64=r2, @ANYRES32, @ANYRES16=r0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000400000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f00000002c0)}, 0x20) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1ff, 0x0, 0xa8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, 0x0, &(0x7f0000000240)}, 0x20) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000100)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x210}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000340)=@o_path={&(0x7f0000000280)='./file0\x00', r2}, 0x18) 68.741359ms ago: executing program 3 (id=1729): socket$kcm(0x21, 0x2, 0x2) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac59}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x8, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x48, 0x1, 0x5, 0x0, 0x0, 0x0, 0x202, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000100), 0xe}, 0x7851, 0x0, 0xfffffffc, 0x8, 0x7fff, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400, 0x8}, 0x9, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x300, 0xe, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0xa, 0x2, 0x0) r4 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r4, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000140)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x44, 0x2}]}}}], 0x18}, 0x20002880) socket$kcm(0x21, 0x2, 0x2) socket$kcm(0x11, 0x2, 0x300) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200003, 0x0) socket$kcm(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x4, 0x7fffffffffffffff}, 0x0, 0x0, 0xc2ba, 0x0, 0x8, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001580)="d80000001a0081044e81f782db4cb9040a1d08007b490d4f1e9ff8d815000100ff05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f990071342e875fab7cb6cec6cf6efb80004cd2000000000000b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40db5e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x4048140) 1.21987ms ago: executing program 0 (id=1730): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000240)={0x4, 0x80, 0x2, 0x80, 0x4, 0xe, 0x0, 0x8, 0x20000, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0xf67, 0x80000001}, 0x100000, 0x2, 0x9, 0x5, 0x800, 0x2, 0x400, 0x0, 0x8, 0x0, 0x9}, 0xffffffffffffffff, 0x2, r0, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="2703025701f328000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000003c21880b", 0xfdef}], 0x1}, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800a411bbaa1282150100000000000071122c00000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf8000000, 0x4}, 0x0, 0x200000, 0xffffffffffffffff, 0xb) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) socket$kcm(0xa, 0x6, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r4, 0x29, 0x11, &(0x7f0000000000)=r3, 0x4) 0s ago: executing program 4 (id=1731): r0 = socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x400, 0x4556, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x3, 0x3}, 0x18, 0x0, 0xfffffffe, 0x1, 0x5, 0x3, 0x103, 0x0, 0x2, 0x0, 0x80000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d0e, 0x80218, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x7}, 0x2005, 0x0, 0x51, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000000)={0x0, 0xffffffffffffffef, &(0x7f0000000040)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d0048007ea60864160af36504001a0038001d00", 0x28}, {&(0x7f00000000c0)="83d2ff5f00000080d2898a0cc6d6703b87eb28f77b09bc7e64f918fa3be4664d327d90424d5503002800"/52, 0x34}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x0) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030020000b12d25a80648c2594f90124fc60100c074002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000001280), 0x4) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x5) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000010008188040f80ec59acbc0413a181003100000006010000000000000e000a000f000000018002002d1f", 0x2e}], 0x1}, 0x40) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x890b, &(0x7f0000000000)) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000001340)={0x2, 0x6, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @multicast1}}}], 0x20}, 0x8000) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x4}, 0x2400a880) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89f2, &(0x7f0000000080)) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): tch found [ 223.831387][ T6595] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 223.853236][ T46] wlan1: Trigger new scan to find an IBSS to join [ 224.119563][ T6605] FAULT_INJECTION: forcing a failure. [ 224.119563][ T6605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 224.140299][ T6605] CPU: 1 PID: 6605 Comm: syz.1.694 Not tainted syzkaller #0 [ 224.147768][ T6605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 224.157912][ T6605] Call Trace: [ 224.161226][ T6605] [ 224.164183][ T6605] dump_stack_lvl+0x188/0x24e [ 224.168910][ T6605] ? show_regs_print_info+0x12/0x12 [ 224.174149][ T6605] ? load_image+0x400/0x400 [ 224.178689][ T6605] ? ___ratelimit+0x4f0/0x5f0 [ 224.183402][ T6605] should_fail_ex+0x399/0x4d0 [ 224.188196][ T6605] _copy_from_user+0x2c/0x170 [ 224.192919][ T6605] __sys_bpf+0x2ea/0x780 [ 224.197213][ T6605] ? bpf_link_show_fdinfo+0x380/0x380 [ 224.202735][ T6605] ? lock_chain_count+0x20/0x20 [ 224.207630][ T6605] __x64_sys_bpf+0x78/0x90 [ 224.212079][ T6605] do_syscall_64+0x4c/0xa0 [ 224.216575][ T6605] ? clear_bhb_loop+0x60/0xb0 [ 224.221278][ T6605] ? clear_bhb_loop+0x60/0xb0 [ 224.226004][ T6605] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 224.231932][ T6605] RIP: 0033:0x7f6ef959c819 [ 224.236374][ T6605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 224.256122][ T6605] RSP: 002b:00007f6efa3bd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 224.264571][ T6605] RAX: ffffffffffffffda RBX: 00007f6ef9815fa0 RCX: 00007f6ef959c819 [ 224.272574][ T6605] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 224.280577][ T6605] RBP: 00007f6efa3bd090 R08: 0000000000000000 R09: 0000000000000000 [ 224.288569][ T6605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 224.296703][ T6605] R13: 00007f6ef9816038 R14: 00007f6ef9815fa0 R15: 00007fffb4cdc148 [ 224.304730][ T6605] [ 224.907467][ T6614] IPv6: Can't replace route, no match found [ 224.998440][ T6612] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 225.303555][ T6613] IPv6: Can't replace route, no match found [ 225.354876][ T6613] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 225.492118][ T6628] netlink: 'syz.1.702': attribute type 2 has an invalid length. [ 225.675831][ T6631] device syzkaller0 entered promiscuous mode [ 225.680974][ T6634] FAULT_INJECTION: forcing a failure. [ 225.680974][ T6634] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 225.798872][ T6638] __nla_validate_parse: 1 callbacks suppressed [ 225.798914][ T6638] netlink: 763 bytes leftover after parsing attributes in process `syz.4.705'. [ 225.821667][ T6634] CPU: 0 PID: 6634 Comm: syz.0.704 Not tainted syzkaller #0 [ 225.829033][ T6634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 225.839142][ T6634] Call Trace: [ 225.842462][ T6634] [ 225.845431][ T6634] dump_stack_lvl+0x188/0x24e [ 225.850185][ T6634] ? show_regs_print_info+0x12/0x12 [ 225.855452][ T6634] ? load_image+0x400/0x400 [ 225.860035][ T6634] ? __lock_acquire+0x7d10/0x7d10 [ 225.865128][ T6634] should_fail_ex+0x399/0x4d0 [ 225.869861][ T6634] _copy_from_user+0x2c/0x170 [ 225.874605][ T6634] sk_setsockopt+0x2f1/0x28a0 [ 225.879334][ T6634] ? __fget_files+0x28/0x4b0 [ 225.883983][ T6634] ? sockopt_capable+0x60/0x60 [ 225.888801][ T6634] ? aa_sk_perm+0x81f/0x950 [ 225.893399][ T6634] ? aa_af_perm+0x340/0x340 [ 225.898049][ T6634] ? __fget_files+0x43d/0x4b0 [ 225.902874][ T6634] ? aa_sock_opt_perm+0x74/0x100 [ 225.907858][ T6634] ? bpf_lsm_socket_setsockopt+0x5/0x10 [ 225.913457][ T6634] ? security_socket_setsockopt+0x7a/0xa0 [ 225.919226][ T6634] __sys_setsockopt+0x2f6/0x3d0 [ 225.924141][ T6634] __x64_sys_setsockopt+0xb1/0xc0 [ 225.929250][ T6634] do_syscall_64+0x4c/0xa0 [ 225.933713][ T6634] ? clear_bhb_loop+0x60/0xb0 [ 225.938422][ T6634] ? clear_bhb_loop+0x60/0xb0 [ 225.943160][ T6634] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 225.949093][ T6634] RIP: 0033:0x7f4af8b9c819 [ 225.953547][ T6634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.973181][ T6634] RSP: 002b:00007f4af9a4d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 225.981627][ T6634] RAX: ffffffffffffffda RBX: 00007f4af8e15fa0 RCX: 00007f4af8b9c819 [ 225.989624][ T6634] RDX: 000000000000002f RSI: 0000000000000001 RDI: 0000000000000003 [ 225.997619][ T6634] RBP: 00007f4af9a4d090 R08: 0000000000000004 R09: 0000000000000000 [ 226.005618][ T6634] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 226.013614][ T6634] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 226.021631][ T6634] [ 226.893831][ T6667] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.712'. [ 227.855847][ T46] wlan1: Trigger new scan to find an IBSS to join [ 227.862617][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 227.862756][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 228.356883][ T6643] IPv6: Can't replace route, no match found [ 228.364355][ T6645] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 228.384287][ T6661] IPv6: Can't replace route, no match found [ 228.396447][ T6665] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 228.426013][ T6671] netlink: 36 bytes leftover after parsing attributes in process `syz.4.712'. [ 228.765533][ T6677] netlink: 'syz.3.716': attribute type 2 has an invalid length. [ 229.099294][ T6691] netlink: 763 bytes leftover after parsing attributes in process `syz.2.721'. [ 229.225442][ T6682] IPv6: Can't replace route, no match found [ 229.329148][ T6682] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 229.388144][ T30] tipc: Subscription rejected, illegal request [ 229.497096][ T46] tipc: Subscription rejected, illegal request [ 229.898879][ T6704] device syzkaller0 entered promiscuous mode [ 230.223266][ T6705] IPv6: Can't replace route, no match found [ 230.250910][ T6719] FAULT_INJECTION: forcing a failure. [ 230.250910][ T6719] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.282059][ T6705] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 230.307754][ T6719] CPU: 1 PID: 6719 Comm: syz.3.731 Not tainted syzkaller #0 [ 230.315128][ T6719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 230.325228][ T6719] Call Trace: [ 230.328550][ T6719] [ 230.331522][ T6719] dump_stack_lvl+0x188/0x24e [ 230.336277][ T6719] ? show_regs_print_info+0x12/0x12 [ 230.341544][ T6719] ? load_image+0x400/0x400 [ 230.346107][ T6719] ? __lock_acquire+0x7d10/0x7d10 [ 230.351185][ T6719] ? perf_trace_run_bpf_submit+0x1c0/0x1c0 [ 230.357030][ T6719] should_fail_ex+0x399/0x4d0 [ 230.361768][ T6719] _copy_from_user+0x2c/0x170 [ 230.366505][ T6719] ___sys_sendmsg+0x1c3/0x360 [ 230.371247][ T6719] ? __sys_sendmsg+0x290/0x290 [ 230.376117][ T6719] __se_sys_sendmsg+0x1bb/0x2a0 [ 230.381032][ T6719] ? __x64_sys_sendmsg+0x80/0x80 [ 230.386056][ T6719] ? syscall_enter_from_user_mode+0x2a/0x80 [ 230.392013][ T6719] do_syscall_64+0x4c/0xa0 [ 230.396490][ T6719] ? clear_bhb_loop+0x60/0xb0 [ 230.401222][ T6719] ? clear_bhb_loop+0x60/0xb0 [ 230.406051][ T6719] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 230.412027][ T6719] RIP: 0033:0x7f3c3559c819 [ 230.416475][ T6719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.436114][ T6719] RSP: 002b:00007f3c363ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 230.444563][ T6719] RAX: ffffffffffffffda RBX: 00007f3c35815fa0 RCX: 00007f3c3559c819 [ 230.452569][ T6719] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000006 [ 230.460571][ T6719] RBP: 00007f3c363ff090 R08: 0000000000000000 R09: 0000000000000000 [ 230.468594][ T6719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 230.476609][ T6719] R13: 00007f3c35816038 R14: 00007f3c35815fa0 R15: 00007ffdf43a3fc8 [ 230.484643][ T6719] [ 230.678400][ T6730] netlink: 'syz.0.733': attribute type 3 has an invalid length. [ 230.688989][ T6707] IPv6: Can't replace route, no match found [ 230.698258][ T6730] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.733'. [ 230.709833][ T6720] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 230.812310][ T46] wlan1: Trigger new scan to find an IBSS to join [ 232.804436][ T6733] netlink: 'syz.2.734': attribute type 2 has an invalid length. [ 232.812830][ T6742] netlink: 763 bytes leftover after parsing attributes in process `syz.0.738'. [ 232.827256][ T6744] IPv6: Can't replace route, no match found [ 232.835026][ T6748] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 232.903301][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 232.904168][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 232.910411][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 233.031750][ T6751] FAULT_INJECTION: forcing a failure. [ 233.031750][ T6751] name failslab, interval 1, probability 0, space 0, times 0 [ 233.117362][ T6757] FAULT_INJECTION: forcing a failure. [ 233.117362][ T6757] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.142804][ T6751] CPU: 1 PID: 6751 Comm: syz.2.740 Not tainted syzkaller #0 [ 233.150290][ T6751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 233.160434][ T6751] Call Trace: [ 233.163781][ T6751] [ 233.166805][ T6751] dump_stack_lvl+0x188/0x24e [ 233.171594][ T6751] ? show_regs_print_info+0x12/0x12 [ 233.176888][ T6751] ? load_image+0x400/0x400 [ 233.181481][ T6751] ? __might_sleep+0xd0/0xd0 [ 233.186155][ T6751] ? __lock_acquire+0x7d10/0x7d10 [ 233.191278][ T6751] should_fail_ex+0x399/0x4d0 [ 233.196048][ T6751] should_failslab+0x5/0x20 [ 233.200625][ T6751] slab_pre_alloc_hook+0x59/0x310 [ 233.205748][ T6751] kmem_cache_alloc_node+0x5a/0x320 [ 233.211019][ T6751] ? __alloc_skb+0xfc/0x7e0 [ 233.215633][ T6751] __alloc_skb+0xfc/0x7e0 [ 233.220043][ T6751] ? netlink_autobind+0xda/0x300 [ 233.225076][ T6751] netlink_sendmsg+0x654/0xbd0 [ 233.229967][ T6751] ? netlink_getsockopt+0x550/0x550 [ 233.235269][ T6751] ? aa_sock_msg_perm+0x94/0x150 [ 233.240289][ T6751] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 233.245649][ T6751] ? security_socket_sendmsg+0x7c/0xa0 [ 233.251198][ T6751] ? netlink_getsockopt+0x550/0x550 [ 233.256486][ T6751] ____sys_sendmsg+0x5be/0x970 [ 233.261366][ T6751] ? __sys_sendmsg_sock+0x30/0x30 [ 233.266555][ T6751] ? __import_iovec+0x315/0x500 [ 233.271530][ T6751] ? import_iovec+0x6f/0xa0 [ 233.276130][ T6751] ___sys_sendmsg+0x2a2/0x360 [ 233.280912][ T6751] ? __sys_sendmsg+0x290/0x290 [ 233.285844][ T6751] ? __lock_acquire+0x7d10/0x7d10 [ 233.291036][ T6751] __se_sys_sendmsg+0x1bb/0x2a0 [ 233.295981][ T6751] ? __x64_sys_sendmsg+0x80/0x80 [ 233.301070][ T6751] ? lockdep_hardirqs_on+0x94/0x140 [ 233.306365][ T6751] do_syscall_64+0x4c/0xa0 [ 233.310864][ T6751] ? clear_bhb_loop+0x60/0xb0 [ 233.315694][ T6751] ? clear_bhb_loop+0x60/0xb0 [ 233.320457][ T6751] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 233.326411][ T6751] RIP: 0033:0x7f430819c819 [ 233.330898][ T6751] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 233.350585][ T6751] RSP: 002b:00007f430912f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 233.359083][ T6751] RAX: ffffffffffffffda RBX: 00007f4308415fa0 RCX: 00007f430819c819 [ 233.367135][ T6751] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000003 [ 233.375175][ T6751] RBP: 00007f430912f090 R08: 0000000000000000 R09: 0000000000000000 [ 233.383215][ T6751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 233.391254][ T6751] R13: 00007f4308416038 R14: 00007f4308415fa0 R15: 00007ffe71f96dc8 [ 233.399358][ T6751] [ 233.407943][ T6757] CPU: 0 PID: 6757 Comm: syz.4.743 Not tainted syzkaller #0 [ 233.415302][ T6757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 233.425416][ T6757] Call Trace: [ 233.428724][ T6757] [ 233.431687][ T6757] dump_stack_lvl+0x188/0x24e [ 233.436409][ T6757] ? show_regs_print_info+0x12/0x12 [ 233.441656][ T6757] ? load_image+0x400/0x400 [ 233.446202][ T6757] ? __lock_acquire+0x7d10/0x7d10 [ 233.451271][ T6757] should_fail_ex+0x399/0x4d0 [ 233.455990][ T6757] _copy_from_user+0x2c/0x170 [ 233.460743][ T6757] __sys_bpf+0x2ea/0x780 [ 233.465040][ T6757] ? bpf_link_show_fdinfo+0x380/0x380 [ 233.470465][ T6757] ? lock_chain_count+0x20/0x20 [ 233.475366][ T6757] __x64_sys_bpf+0x78/0x90 [ 233.479820][ T6757] do_syscall_64+0x4c/0xa0 [ 233.484283][ T6757] ? clear_bhb_loop+0x60/0xb0 [ 233.489024][ T6757] ? clear_bhb_loop+0x60/0xb0 [ 233.493755][ T6757] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 233.499690][ T6757] RIP: 0033:0x7f3f83d9c819 [ 233.504247][ T6757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 233.523910][ T6757] RSP: 002b:00007f3f84bcb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 233.532374][ T6757] RAX: ffffffffffffffda RBX: 00007f3f84015fa0 RCX: 00007f3f83d9c819 [ 233.540399][ T6757] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 233.548421][ T6757] RBP: 00007f3f84bcb090 R08: 0000000000000000 R09: 0000000000000000 [ 233.556435][ T6757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 233.564438][ T6757] R13: 00007f3f84016038 R14: 00007f3f84015fa0 R15: 00007ffda18123f8 [ 233.572462][ T6757] [ 233.836962][ T6760] IPv6: Can't replace route, no match found [ 233.852483][ T46] wlan1: Trigger new scan to find an IBSS to join [ 233.866093][ T6760] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 234.319858][ T6779] -: renamed from syzkaller0 [ 234.466054][ T6770] netlink: 'syz.4.747': attribute type 3 has an invalid length. [ 234.475108][ T6770] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.747'. [ 234.794055][ T4320] wlan1: Creating new IBSS network, BSSID 02:36:27:42:5a:58 [ 234.794067][ T11] wlan1: Creating new IBSS network, BSSID 3e:78:ee:c2:2a:f7 [ 234.840574][ T6781] netlink: 'syz.3.750': attribute type 2 has an invalid length. [ 234.865322][ T6783] netlink: 152 bytes leftover after parsing attributes in process `syz.1.751'. [ 234.902816][ T11] wlan1: Trigger new scan to find an IBSS to join [ 235.207741][ T6790] netlink: 763 bytes leftover after parsing attributes in process `syz.0.754'. [ 235.368951][ T6792] device syzkaller0 entered promiscuous mode [ 235.578964][ T6788] IPv6: Can't replace route, no match found [ 235.696802][ T6788] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 235.995760][ T6806] netlink: 'syz.4.758': attribute type 11 has an invalid length. [ 236.024251][ T6813] FAULT_INJECTION: forcing a failure. [ 236.024251][ T6813] name failslab, interval 1, probability 0, space 0, times 0 [ 236.037947][ T6813] CPU: 0 PID: 6813 Comm: syz.0.759 Not tainted syzkaller #0 [ 236.045348][ T6813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 236.055479][ T6813] Call Trace: [ 236.058844][ T6813] [ 236.061851][ T6813] dump_stack_lvl+0x188/0x24e [ 236.066737][ T6813] ? show_regs_print_info+0x12/0x12 [ 236.072135][ T6813] ? load_image+0x400/0x400 [ 236.076750][ T6813] ? __might_sleep+0xd0/0xd0 [ 236.081427][ T6813] ? __lock_acquire+0x7d10/0x7d10 [ 236.086660][ T6813] should_fail_ex+0x399/0x4d0 [ 236.091441][ T6813] should_failslab+0x5/0x20 [ 236.096017][ T6813] slab_pre_alloc_hook+0x59/0x310 [ 236.101112][ T6813] ? tomoyo_realpath_from_path+0xdf/0x5d0 [ 236.106992][ T6813] __kmem_cache_alloc_node+0x4f/0x260 [ 236.112551][ T6813] ? tomoyo_realpath_from_path+0xdf/0x5d0 [ 236.118358][ T6813] __kmalloc+0xa0/0x240 [ 236.122696][ T6813] tomoyo_realpath_from_path+0xdf/0x5d0 [ 236.128368][ T6813] tomoyo_check_open_permission+0x212/0x440 [ 236.134330][ T6813] ? tomoyo_check_open_permission+0x1bf/0x440 [ 236.140478][ T6813] ? tomoyo_check_path_number_acl+0x280/0x280 [ 236.146742][ T6813] ? __lock_acquire+0x7d10/0x7d10 [ 236.151853][ T6813] ? __rwlock_init+0x140/0x140 [ 236.156671][ T6813] ? do_raw_spin_lock+0x128/0x2f0 [ 236.161763][ T6813] ? tomoyo_file_open+0xe9/0x170 [ 236.166790][ T6813] security_file_open+0x5e/0xa0 [ 236.171716][ T6813] do_dentry_open+0x305/0x10d0 [ 236.176609][ T6813] path_openat+0x2635/0x2ee0 [ 236.181262][ T6813] ? trace_call_bpf+0xbf/0x6b0 [ 236.186155][ T6813] ? do_filp_open+0x430/0x430 [ 236.190885][ T6813] ? perf_trace_lock+0x301/0x390 [ 236.195896][ T6813] ? trace_event_raw_event_lock+0x250/0x250 [ 236.201870][ T6813] do_filp_open+0x1f1/0x430 [ 236.206440][ T6813] ? vfs_tmpfile+0x480/0x480 [ 236.211150][ T6813] ? _raw_spin_unlock+0x24/0x40 [ 236.216062][ T6813] ? alloc_fd+0x58f/0x630 [ 236.220496][ T6813] do_sys_openat2+0x150/0x4b0 [ 236.225237][ T6813] ? ct_nmi_exit+0x145/0x1c0 [ 236.229885][ T6813] ? ct_irq_exit_irqson+0x113/0x170 [ 236.235170][ T6813] ? do_sys_open+0xe0/0xe0 [ 236.239765][ T6813] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 236.245919][ T6813] ? lock_chain_count+0x20/0x20 [ 236.250845][ T6813] __x64_sys_openat+0x135/0x160 [ 236.255782][ T6813] do_syscall_64+0x4c/0xa0 [ 236.260270][ T6813] ? clear_bhb_loop+0x60/0xb0 [ 236.265011][ T6813] ? clear_bhb_loop+0x60/0xb0 [ 236.269761][ T6813] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 236.275712][ T6813] RIP: 0033:0x7f4af8b5d04e [ 236.280183][ T6813] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 236.299850][ T6813] RSP: 002b:00007f4af9a4cec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 236.308674][ T6813] RAX: ffffffffffffffda RBX: 00007f4af9a4d6c0 RCX: 00007f4af8b5d04e [ 236.316969][ T6813] RDX: 0000000000000000 RSI: 00007f4af9a4cf90 RDI: ffffffffffffff9c [ 236.324994][ T6813] RBP: 00007f4af9a4d090 R08: 0000000000000000 R09: 0000000000000000 [ 236.333011][ T6813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 236.341036][ T6813] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 236.349098][ T6813] [ 236.422637][ T6813] ERROR: Out of memory at tomoyo_realpath_from_path. [ 236.904089][ T9] wlan1: Trigger new scan to find an IBSS to join [ 236.910744][ T9] wlan1: Trigger new scan to find an IBSS to join [ 237.164890][ T6825] netlink: 10 bytes leftover after parsing attributes in process `syz.0.764'. [ 237.699308][ T6833] netlink: 'syz.2.766': attribute type 29 has an invalid length. [ 237.936677][ T9] wlan1: Creating new IBSS network, BSSID f6:2e:09:34:1d:df [ 238.865937][ T6824] netlink: 'syz.3.763': attribute type 2 has an invalid length. [ 238.879316][ T6833] netlink: 'syz.2.766': attribute type 29 has an invalid length. [ 239.275503][ T6845] netlink: 156 bytes leftover after parsing attributes in process `syz.4.771'. [ 239.339942][ T6844] delete_channel: no stack [ 239.583829][ T6843] IPv6: Can't replace route, no match found [ 239.609177][ T6841] IPv6: Can't replace route, no match found [ 239.638952][ T6841] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 239.671334][ T6843] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 239.752099][ T6847] IPv6: Can't replace route, no match found [ 239.852801][ T9] wlan1: Trigger new scan to find an IBSS to join [ 239.865574][ T6854] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 240.237654][ T6870] netlink: 10 bytes leftover after parsing attributes in process `syz.1.780'. [ 240.345144][ T6873] netlink: 'syz.0.778': attribute type 2 has an invalid length. [ 240.762546][ T6878] netlink: 'syz.4.781': attribute type 10 has an invalid length. [ 240.845247][ T6875] device syzkaller0 entered promiscuous mode [ 241.852625][ T9] wlan1: Trigger new scan to find an IBSS to join [ 241.859397][ T30] wlan1: Trigger new scan to find an IBSS to join [ 242.812934][ T11] wlan1: Trigger new scan to find an IBSS to join [ 243.703177][ T4320] wlan1: Creating new IBSS network, BSSID 6a:55:3b:c7:30:37 [ 243.779120][ T6887] netlink: 763 bytes leftover after parsing attributes in process `syz.0.785'. [ 243.798350][ T6885] IPv6: Can't replace route, no match found [ 243.805915][ T6894] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 243.817109][ T6889] IPv6: Can't replace route, no match found [ 243.824761][ T6899] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 243.852590][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 244.110126][ T6916] netlink: 'syz.0.792': attribute type 2 has an invalid length. [ 245.187593][ T6942] netlink: 763 bytes leftover after parsing attributes in process `syz.2.803'. [ 245.239464][ T6948] netlink: 'syz.4.804': attribute type 3 has an invalid length. [ 245.261204][ T6948] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.804'. [ 245.336899][ T6946] FAULT_INJECTION: forcing a failure. [ 245.336899][ T6946] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 245.412606][ T6946] CPU: 0 PID: 6946 Comm: syz.0.805 Not tainted syzkaller #0 [ 245.420170][ T6946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 245.430416][ T6946] Call Trace: [ 245.433831][ T6946] [ 245.436812][ T6946] dump_stack_lvl+0x188/0x24e [ 245.441640][ T6946] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 245.447959][ T6946] ? show_regs_print_info+0x12/0x12 [ 245.453229][ T6946] ? load_image+0x400/0x400 [ 245.457832][ T6946] should_fail_ex+0x399/0x4d0 [ 245.462572][ T6946] _copy_from_user+0x2c/0x170 [ 245.467337][ T6946] __sys_bpf+0x2ea/0x780 [ 245.471650][ T6946] ? bpf_link_show_fdinfo+0x380/0x380 [ 245.477118][ T6946] ? lock_chain_count+0x20/0x20 [ 245.482020][ T6946] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 245.488068][ T6946] __x64_sys_bpf+0x78/0x90 [ 245.492598][ T6946] do_syscall_64+0x4c/0xa0 [ 245.497189][ T6946] ? clear_bhb_loop+0x60/0xb0 [ 245.501941][ T6946] ? clear_bhb_loop+0x60/0xb0 [ 245.506682][ T6946] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 245.512627][ T6946] RIP: 0033:0x7f4af8b9c819 [ 245.517073][ T6946] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 245.536721][ T6946] RSP: 002b:00007f4af9a4d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 245.545214][ T6946] RAX: ffffffffffffffda RBX: 00007f4af8e15fa0 RCX: 00007f4af8b9c819 [ 245.553246][ T6946] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 245.561254][ T6946] RBP: 00007f4af9a4d090 R08: 0000000000000000 R09: 0000000000000000 [ 245.569277][ T6946] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 245.577373][ T6946] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 245.585481][ T6946] [ 245.855685][ T9] wlan1: Trigger new scan to find an IBSS to join [ 245.863162][ T11] wlan1: Trigger new scan to find an IBSS to join [ 245.928309][ T6957] netlink: 'syz.3.808': attribute type 2 has an invalid length. [ 246.123642][ T4274] Bluetooth: hci3: unexpected event 0x08 length: 15 > 4 [ 246.462412][ T6960] IPv6: Can't replace route, no match found [ 246.596668][ T6969] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 246.925774][ T6986] netlink: 'syz.2.819': attribute type 29 has an invalid length. [ 246.955103][ T6986] netlink: 'syz.2.819': attribute type 29 has an invalid length. [ 247.004696][ T6989] netlink: 763 bytes leftover after parsing attributes in process `syz.1.820'. [ 247.023730][ T6990] netlink: 'syz.2.819': attribute type 29 has an invalid length. [ 247.044648][ T6986] netlink: 'syz.2.819': attribute type 29 has an invalid length. [ 247.088005][ T6986] netlink: 'syz.2.819': attribute type 29 has an invalid length. [ 247.401638][ T6994] netlink: 14 bytes leftover after parsing attributes in process `syz.4.821'. [ 247.475610][ T6994] openvswitch: netlink: Flow key attr not present in new flow. [ 248.258785][ T6987] IPv6: Can't replace route, no match found [ 248.346171][ T6987] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 248.455433][ T7004] netlink: 'syz.4.823': attribute type 2 has an invalid length. [ 248.906650][ T9] wlan1: Trigger new scan to find an IBSS to join [ 248.906848][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 248.919963][ T46] wlan1: Trigger new scan to find an IBSS to join [ 249.104821][ T7020] netlink: 126288 bytes leftover after parsing attributes in process `syz.1.830'. [ 249.439231][ T7012] IPv6: Can't replace route, no match found [ 249.470519][ T7012] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 249.534507][ T7014] IPv6: Can't replace route, no match found [ 249.639418][ T7014] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 250.080808][ T7047] netlink: 10 bytes leftover after parsing attributes in process `syz.1.840'. [ 250.566560][ T7055] netlink: 'syz.0.844': attribute type 2 has an invalid length. [ 251.133114][ T7078] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.850'. [ 251.212968][ T7079] netlink: 'syz.0.849': attribute type 2 has an invalid length. [ 251.246510][ T7078] netlink: 'syz.3.850': attribute type 2 has an invalid length. [ 251.270043][ T7079] netlink: 132 bytes leftover after parsing attributes in process `syz.0.849'. [ 251.300117][ T7078] netlink: 199848 bytes leftover after parsing attributes in process `syz.3.850'. [ 251.855991][ T11] wlan1: Trigger new scan to find an IBSS to join [ 251.858481][ T4934] wlan1: Creating new IBSS network, BSSID a6:18:c3:5b:92:f1 [ 252.044009][ T7083] netlink: 'syz.2.851': attribute type 5 has an invalid length. [ 252.076287][ T7083] netlink: 'syz.2.851': attribute type 5 has an invalid length. [ 252.087467][ T7083] netlink: 144 bytes leftover after parsing attributes in process `syz.2.851'. [ 252.236308][ T7091] netlink: 763 bytes leftover after parsing attributes in process `syz.0.855'. [ 252.413606][ T7100] netlink: 10 bytes leftover after parsing attributes in process `syz.2.859'. [ 253.670700][ T7113] device syzkaller0 entered promiscuous mode [ 253.855494][ T30] wlan1: Trigger new scan to find an IBSS to join [ 253.874119][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 254.788217][ T9] wlan1: Creating new IBSS network, BSSID 66:2d:be:10:f1:cd [ 255.699111][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.706097][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.432714][ T7137] netlink: 132 bytes leftover after parsing attributes in process `syz.3.871'. [ 256.700002][ T7144] netlink: 763 bytes leftover after parsing attributes in process `syz.0.874'. [ 256.719634][ T7141] netlink: 'syz.3.872': attribute type 3 has an invalid length. [ 256.805955][ T7141] netlink: 'syz.3.872': attribute type 1 has an invalid length. [ 256.814230][ T11] wlan1: Trigger new scan to find an IBSS to join [ 256.842930][ T7141] netlink: 132 bytes leftover after parsing attributes in process `syz.3.872'. [ 256.893037][ T30] wlan1: Trigger new scan to find an IBSS to join [ 256.986379][ T7156] FAULT_INJECTION: forcing a failure. [ 256.986379][ T7156] name failslab, interval 1, probability 0, space 0, times 0 [ 257.070149][ T7156] CPU: 1 PID: 7156 Comm: syz.1.876 Not tainted syzkaller #0 [ 257.078082][ T7156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 257.088514][ T7156] Call Trace: [ 257.092563][ T7156] [ 257.095565][ T7156] dump_stack_lvl+0x188/0x24e [ 257.101296][ T7156] ? show_regs_print_info+0x12/0x12 [ 257.106852][ T7156] ? load_image+0x400/0x400 [ 257.111620][ T7156] should_fail_ex+0x399/0x4d0 [ 257.116375][ T7156] should_failslab+0x5/0x20 [ 257.120963][ T7156] slab_pre_alloc_hook+0x59/0x310 [ 257.126334][ T7156] kmem_cache_alloc+0x56/0x2f0 [ 257.131387][ T7156] ? skb_clone+0x1e7/0x370 [ 257.135907][ T7156] skb_clone+0x1e7/0x370 [ 257.140259][ T7156] bpf_clone_redirect+0x163/0x4a0 [ 257.145402][ T7156] bpf_prog_1bdca61151ad2842+0x19/0x1d [ 257.151116][ T7156] bpf_test_run+0x2b6/0x830 [ 257.155810][ T7156] ? convert___skb_to_skb+0x580/0x580 [ 257.161298][ T7156] ? eth_get_headlen+0x200/0x200 [ 257.166371][ T7156] ? __build_skb+0x257/0x3c0 [ 257.171029][ T7156] ? convert___skb_to_skb+0x3d/0x580 [ 257.176600][ T7156] bpf_prog_test_run_skb+0xaa6/0x12a0 [ 257.182599][ T7156] ? cpu_online+0xa0/0xa0 [ 257.187470][ T7156] bpf_prog_test_run+0x31e/0x390 [ 257.192685][ T7156] __sys_bpf+0x62b/0x780 [ 257.197630][ T7156] ? bpf_link_show_fdinfo+0x380/0x380 [ 257.203279][ T7156] ? lock_chain_count+0x20/0x20 [ 257.208308][ T7156] __x64_sys_bpf+0x78/0x90 [ 257.212977][ T7156] do_syscall_64+0x4c/0xa0 [ 257.217491][ T7156] ? clear_bhb_loop+0x60/0xb0 [ 257.222729][ T7156] ? clear_bhb_loop+0x60/0xb0 [ 257.227573][ T7156] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 257.234292][ T7156] RIP: 0033:0x7f6ef959c819 [ 257.238804][ T7156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.259011][ T7156] RSP: 002b:00007f6efa39c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 257.267713][ T7156] RAX: ffffffffffffffda RBX: 00007f6ef9816090 RCX: 00007f6ef959c819 [ 257.275854][ T7156] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 257.283955][ T7156] RBP: 00007f6efa39c090 R08: 0000000000000000 R09: 0000000000000000 [ 257.292265][ T7156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 257.301322][ T7156] R13: 00007f6ef9816128 R14: 00007f6ef9816090 R15: 00007fffb4cdc148 [ 257.309922][ T7156] [ 258.103778][ T4325] wlan1: Creating new IBSS network, BSSID 62:b3:a5:b2:6b:e5 [ 258.111821][ T30] wlan1: Creating new IBSS network, BSSID f6:11:b3:e1:03:0d [ 258.391868][ T7161] netlink: 10 bytes leftover after parsing attributes in process `syz.3.877'. [ 258.533644][ T7171] netlink: 36 bytes leftover after parsing attributes in process `syz.0.881'. [ 260.597094][ T7200] netlink: 'syz.0.888': attribute type 29 has an invalid length. [ 260.642101][ T7200] netlink: 'syz.0.888': attribute type 29 has an invalid length. [ 260.705758][ T7195] netlink: 'syz.0.888': attribute type 29 has an invalid length. [ 260.750780][ T7200] netlink: 'syz.0.888': attribute type 2 has an invalid length. [ 260.772055][ T7200] netlink: 132 bytes leftover after parsing attributes in process `syz.0.888'. [ 260.866825][ T7203] netlink: 763 bytes leftover after parsing attributes in process `syz.2.891'. [ 261.928598][ T7229] netlink: 10 bytes leftover after parsing attributes in process `syz.0.897'. [ 263.710028][ T7216] netlink: 'syz.1.893': attribute type 2 has an invalid length. [ 263.729636][ T7225] netlink: 36 bytes leftover after parsing attributes in process `syz.3.896'. [ 264.048132][ T7238] FAULT_INJECTION: forcing a failure. [ 264.048132][ T7238] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 264.261956][ T7238] CPU: 1 PID: 7238 Comm: syz.3.899 Not tainted syzkaller #0 [ 264.269502][ T7238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 264.279891][ T7238] Call Trace: [ 264.283236][ T7238] [ 264.286244][ T7238] dump_stack_lvl+0x188/0x24e [ 264.291017][ T7238] ? show_regs_print_info+0x12/0x12 [ 264.296292][ T7238] ? load_image+0x400/0x400 [ 264.301002][ T7238] ? __lock_acquire+0x7d10/0x7d10 [ 264.306105][ T7238] should_fail_ex+0x399/0x4d0 [ 264.310857][ T7238] _copy_from_user+0x2c/0x170 [ 264.315614][ T7238] __sys_bpf+0x2ea/0x780 [ 264.320096][ T7238] ? bpf_link_show_fdinfo+0x380/0x380 [ 264.325550][ T7238] ? lock_chain_count+0x20/0x20 [ 264.330493][ T7238] __x64_sys_bpf+0x78/0x90 [ 264.335187][ T7238] do_syscall_64+0x4c/0xa0 [ 264.339795][ T7238] ? clear_bhb_loop+0x60/0xb0 [ 264.344620][ T7238] ? clear_bhb_loop+0x60/0xb0 [ 264.349436][ T7238] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 264.355517][ T7238] RIP: 0033:0x7f3c3559c819 [ 264.360676][ T7238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 264.380744][ T7238] RSP: 002b:00007f3c363de028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 264.389397][ T7238] RAX: ffffffffffffffda RBX: 00007f3c35816090 RCX: 00007f3c3559c819 [ 264.398477][ T7238] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 264.406528][ T7238] RBP: 00007f3c363de090 R08: 0000000000000000 R09: 0000000000000000 [ 264.414882][ T7238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 264.423192][ T7238] R13: 00007f3c35816128 R14: 00007f3c35816090 R15: 00007ffdf43a3fc8 [ 264.431285][ T7238] [ 264.755089][ T7235] IPv6: Can't replace route, no match found [ 264.849482][ T4934] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 265.473104][ T7243] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 265.770884][ T7262] netlink: 'syz.0.909': attribute type 2 has an invalid length. [ 265.921047][ T7268] netlink: 36 bytes leftover after parsing attributes in process `syz.2.911'. [ 266.123332][ T7274] netlink: 763 bytes leftover after parsing attributes in process `syz.3.912'. [ 266.181664][ T7260] IPv6: Can't replace route, no match found [ 267.722604][ T7271] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 269.019522][ T7286] netlink: 'syz.2.914': attribute type 29 has an invalid length. [ 269.037905][ T7286] netlink: 'syz.2.914': attribute type 29 has an invalid length. [ 269.058537][ T7286] netlink: 'syz.2.914': attribute type 29 has an invalid length. [ 269.075774][ T7286] netlink: 'syz.2.914': attribute type 2 has an invalid length. [ 269.086136][ T7286] netlink: 132 bytes leftover after parsing attributes in process `syz.2.914'. [ 269.264143][ T7285] netlink: 'syz.2.914': attribute type 2 has an invalid length. [ 269.444813][ T7285] device 0 entered promiscuous mode [ 269.866051][ T30] wlan1: Trigger new scan to find an IBSS to join [ 269.948880][ T7301] IPv6: Can't replace route, no match found [ 270.759110][ T7301] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 270.776685][ T7309] IPv6: Can't replace route, no match found [ 270.852358][ T7322] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 271.070830][ T7324] netlink: 132 bytes leftover after parsing attributes in process `syz.0.926'. [ 271.517375][ T7329] IPv6: Can't replace route, no match found [ 274.031523][ T7329] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 274.865301][ T7364] device syzkaller0 entered promiscuous mode [ 274.904041][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 274.942155][ T7359] IPv6: Can't replace route, no match found [ 274.974655][ T7359] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 277.852406][ T11] wlan1: Trigger new scan to find an IBSS to join [ 277.867709][ T11] wlan1: Trigger new scan to find an IBSS to join [ 278.792826][ T4325] wlan1: Creating new IBSS network, BSSID 26:01:f4:a1:9e:f9 [ 278.815250][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 279.891721][ T4325] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 280.070203][ T7377] IPv6: Can't replace route, no match found [ 280.083179][ T7393] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 280.112754][ T7397] IPv6: Can't replace route, no match found [ 280.119337][ T7403] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 280.338492][ T7414] netlink: 10 bytes leftover after parsing attributes in process `syz.3.952'. [ 280.513665][ T7419] netlink: 'syz.2.955': attribute type 2 has an invalid length. [ 280.812184][ T7416] IPv6: Can't replace route, no match found [ 280.845448][ T7416] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 280.945914][ T7431] netlink: 'syz.3.960': attribute type 1 has an invalid length. [ 281.578312][ T7434] IPv6: Can't replace route, no match found [ 281.847699][ T7445] netlink: 60 bytes leftover after parsing attributes in process `syz.4.964'. [ 282.011253][ T7444] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 282.032059][ T7446] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 282.044431][ T7445] netlink: 60 bytes leftover after parsing attributes in process `syz.4.964'. [ 282.109134][ T7448] netlink: 60 bytes leftover after parsing attributes in process `syz.4.964'. [ 282.491547][ T7457] netlink: 'syz.2.968': attribute type 2 has an invalid length. [ 282.634125][ T7459] netlink: 10 bytes leftover after parsing attributes in process `syz.1.969'. [ 282.812660][ T30] wlan1: Trigger new scan to find an IBSS to join [ 282.852188][ T7453] IPv6: Can't replace route, no match found [ 282.867198][ T7453] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 282.892467][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 282.957595][ T7470] netlink: 'syz.3.973': attribute type 29 has an invalid length. [ 282.986566][ T7470] netlink: 'syz.3.973': attribute type 29 has an invalid length. [ 283.047094][ T7473] netlink: 'syz.2.972': attribute type 29 has an invalid length. [ 283.070280][ T7473] netlink: 'syz.2.972': attribute type 29 has an invalid length. [ 283.091381][ T7470] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.973'. [ 283.140938][ T7468] netlink: 'syz.2.972': attribute type 29 has an invalid length. [ 283.244991][ T7470] netlink: 'syz.3.973': attribute type 10 has an invalid length. [ 283.319572][ T7470] device hsr0 entered promiscuous mode [ 283.477916][ T7470] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 283.508206][ T7470] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 283.576998][ T7470] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 283.595329][ T7470] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 283.604025][ T7476] netlink: 'syz.2.972': attribute type 29 has an invalid length. [ 283.980636][ T7472] IPv6: Can't replace route, no match found [ 283.988993][ T7482] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 284.146938][ T7487] FAULT_INJECTION: forcing a failure. [ 284.146938][ T7487] name failslab, interval 1, probability 0, space 0, times 0 [ 284.231629][ T7487] CPU: 1 PID: 7487 Comm: syz.2.977 Not tainted syzkaller #0 [ 284.239032][ T7487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 284.249854][ T7487] Call Trace: [ 284.253200][ T7487] [ 284.256277][ T7487] dump_stack_lvl+0x188/0x24e [ 284.261188][ T7487] ? show_regs_print_info+0x12/0x12 [ 284.266688][ T7487] ? load_image+0x400/0x400 [ 284.271266][ T7487] ? verify_lock_unused+0x140/0x140 [ 284.276549][ T7487] should_fail_ex+0x399/0x4d0 [ 284.281310][ T7487] should_failslab+0x5/0x20 [ 284.285868][ T7487] slab_pre_alloc_hook+0x59/0x310 [ 284.290975][ T7487] kmem_cache_alloc+0x56/0x2f0 [ 284.295806][ T7487] ? skb_clone+0x1e7/0x370 [ 284.300343][ T7487] skb_clone+0x1e7/0x370 [ 284.304767][ T7487] __netlink_deliver_tap+0x3ed/0x800 [ 284.310151][ T7487] ? netlink_deliver_tap+0x2e/0x1b0 [ 284.315547][ T7487] netlink_deliver_tap+0x19c/0x1b0 [ 284.320746][ T7487] netlink_unicast+0x728/0x8d0 [ 284.325610][ T7487] netlink_sendmsg+0x8ad/0xbd0 [ 284.331157][ T7487] ? netlink_getsockopt+0x550/0x550 [ 284.336449][ T7487] ? aa_sock_msg_perm+0x94/0x150 [ 284.341807][ T7487] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 284.347168][ T7487] ? security_socket_sendmsg+0x7c/0xa0 [ 284.352814][ T7487] ? netlink_getsockopt+0x550/0x550 [ 284.358178][ T7487] ____sys_sendmsg+0x5be/0x970 [ 284.363162][ T7487] ? __sys_sendmsg_sock+0x30/0x30 [ 284.368284][ T7487] ? __import_iovec+0x315/0x500 [ 284.373221][ T7487] ? import_iovec+0x6f/0xa0 [ 284.377894][ T7487] ___sys_sendmsg+0x2a2/0x360 [ 284.382659][ T7487] ? __sys_sendmsg+0x290/0x290 [ 284.387523][ T7487] ? __lock_acquire+0x7d10/0x7d10 [ 284.392734][ T7487] __se_sys_sendmsg+0x1bb/0x2a0 [ 284.397839][ T7487] ? __x64_sys_sendmsg+0x80/0x80 [ 284.403213][ T7487] ? lockdep_hardirqs_on+0x94/0x140 [ 284.408914][ T7487] do_syscall_64+0x4c/0xa0 [ 284.413409][ T7487] ? clear_bhb_loop+0x60/0xb0 [ 284.418153][ T7487] ? clear_bhb_loop+0x60/0xb0 [ 284.422901][ T7487] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.428866][ T7487] RIP: 0033:0x7f430819c819 [ 284.433343][ T7487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.453020][ T7487] RSP: 002b:00007f430912f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 284.461609][ T7487] RAX: ffffffffffffffda RBX: 00007f4308415fa0 RCX: 00007f430819c819 [ 284.469749][ T7487] RDX: 0000000000000054 RSI: 0000200000000000 RDI: 0000000000000003 [ 284.477786][ T7487] RBP: 00007f430912f090 R08: 0000000000000000 R09: 0000000000000000 [ 284.485995][ T7487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 284.494026][ T7487] R13: 00007f4308416038 R14: 00007f4308415fa0 R15: 00007ffe71f96dc8 [ 284.502081][ T7487] [ 284.813604][ T11] wlan1: Trigger new scan to find an IBSS to join [ 284.892424][ T11] wlan1: Trigger new scan to find an IBSS to join [ 284.946349][ T7493] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 285.478412][ T7512] syz.0.988[7512] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 285.479037][ T7512] syz.0.988[7512] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 285.852469][ T9] wlan1: Trigger new scan to find an IBSS to join [ 285.859177][ T9] wlan1: Trigger new scan to find an IBSS to join [ 285.998141][ T7524] netlink: 10 bytes leftover after parsing attributes in process `syz.3.992'. [ 286.492666][ T7529] IPv6: Can't replace route, no match found [ 286.543564][ T7521] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 286.970803][ T46] wlan1: Trigger new scan to find an IBSS to join [ 287.564840][ T7543] validate_nla: 1 callbacks suppressed [ 287.564861][ T7543] netlink: 'syz.1.997': attribute type 11 has an invalid length. [ 287.852623][ T11] wlan1: Trigger new scan to find an IBSS to join [ 288.061774][ T9] wlan1: Creating new IBSS network, BSSID d6:bc:62:9a:47:0d [ 288.316005][ T7545] netlink: 'syz.2.998': attribute type 2 has an invalid length. [ 288.900551][ T7569] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1006'. [ 289.852297][ T9] wlan1: Trigger new scan to find an IBSS to join [ 290.754764][ T30] wlan1: Creating new IBSS network, BSSID b6:57:b1:c6:4f:da [ 290.812397][ T30] wlan1: Trigger new scan to find an IBSS to join [ 290.819128][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 291.769389][ T46] wlan1: Creating new IBSS network, BSSID aa:6c:8c:74:ff:10 [ 292.031039][ T7587] netlink: 763 bytes leftover after parsing attributes in process `syz.4.1011'. [ 292.061230][ T7585] netlink: 122896 bytes leftover after parsing attributes in process `syz.0.1010'. [ 292.646615][ T7599] netlink: 'syz.3.1014': attribute type 2 has an invalid length. [ 293.454544][ T7615] FAULT_INJECTION: forcing a failure. [ 293.454544][ T7615] name failslab, interval 1, probability 0, space 0, times 0 [ 293.589031][ T7615] CPU: 0 PID: 7615 Comm: syz.0.1021 Not tainted syzkaller #0 [ 293.596538][ T7615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 293.606678][ T7615] Call Trace: [ 293.610201][ T7615] [ 293.613295][ T7615] dump_stack_lvl+0x188/0x24e [ 293.618169][ T7615] ? trace_event_raw_event_lock+0x250/0x250 [ 293.624173][ T7615] ? show_regs_print_info+0x12/0x12 [ 293.629657][ T7615] ? load_image+0x400/0x400 [ 293.634250][ T7615] ? fib_rules_lookup+0x98/0xb40 [ 293.639323][ T7615] should_fail_ex+0x399/0x4d0 [ 293.644380][ T7615] should_failslab+0x5/0x20 [ 293.649423][ T7615] slab_pre_alloc_hook+0x59/0x310 [ 293.654768][ T7615] kmem_cache_alloc+0x56/0x2f0 [ 293.659886][ T7615] ? dst_alloc+0x101/0x160 [ 293.664552][ T7615] dst_alloc+0x101/0x160 [ 293.668915][ T7615] ip_route_output_key_hash_rcu+0x14a4/0x23f0 [ 293.675293][ T7615] ? ip_route_output_key_hash+0x139/0x330 [ 293.681116][ T7615] ip_route_output_key_hash+0x1ef/0x330 [ 293.686755][ T7615] ? kfree+0x30/0x190 [ 293.691120][ T7615] ? ip_route_input_rcu+0x3160/0x3160 [ 293.696966][ T7615] ? ip_cmsg_send+0x9a5/0xa50 [ 293.701786][ T7615] ip_route_output_flow+0x26/0x150 [ 293.707808][ T7615] ? security_sk_classify_flow+0x77/0x90 [ 293.713543][ T7615] raw_sendmsg+0x116d/0x1b20 [ 293.718247][ T7615] ? compat_raw_ioctl+0x60/0x60 [ 293.723253][ T7615] ? __might_fault+0xa6/0x120 [ 293.728112][ T7615] ? tomoyo_socket_sendmsg_permission+0x212/0x2f0 [ 293.734746][ T7615] ? sock_rps_record_flow+0x19/0x3f0 [ 293.740209][ T7615] ? inet_sendmsg+0x78/0x2f0 [ 293.744954][ T7615] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 293.750686][ T7615] ? security_socket_sendmsg+0x7c/0xa0 [ 293.756557][ T7615] ? inet_send_prepare+0x260/0x260 [ 293.762085][ T7615] ____sys_sendmsg+0x5be/0x970 [ 293.767562][ T7615] ? __sys_sendmsg_sock+0x30/0x30 [ 293.772690][ T7615] ? __import_iovec+0x315/0x500 [ 293.778778][ T7615] ? import_iovec+0x6f/0xa0 [ 293.783409][ T7615] ___sys_sendmsg+0x2a2/0x360 [ 293.788818][ T7615] ? __sys_sendmsg+0x290/0x290 [ 293.793853][ T7615] ? __lock_acquire+0x7d10/0x7d10 [ 293.799072][ T7615] __se_sys_sendmsg+0x1bb/0x2a0 [ 293.804023][ T7615] ? __x64_sys_sendmsg+0x80/0x80 [ 293.809252][ T7615] ? lockdep_hardirqs_on+0x94/0x140 [ 293.814557][ T7615] do_syscall_64+0x4c/0xa0 [ 293.819095][ T7615] ? clear_bhb_loop+0x60/0xb0 [ 293.823937][ T7615] ? clear_bhb_loop+0x60/0xb0 [ 293.828698][ T7615] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 293.834839][ T7615] RIP: 0033:0x7f4af8b9c819 [ 293.839400][ T7615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.859273][ T7615] RSP: 002b:00007f4af9a4d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 293.867934][ T7615] RAX: ffffffffffffffda RBX: 00007f4af8e15fa0 RCX: 00007f4af8b9c819 [ 293.875972][ T7615] RDX: 0000000004040950 RSI: 0000200000000700 RDI: 0000000000000004 [ 293.884543][ T7615] RBP: 00007f4af9a4d090 R08: 0000000000000000 R09: 0000000000000000 [ 293.893297][ T7615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 293.901332][ T7615] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 293.909418][ T7615] [ 293.915906][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 293.916736][ T46] wlan1: Trigger new scan to find an IBSS to join [ 294.343059][ T7618] device syzkaller0 entered promiscuous mode [ 294.409221][ T7612] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1019'. [ 295.090860][ T4325] wlan1: Creating new IBSS network, BSSID 16:dd:29:d8:d2:e3 [ 295.090956][ T9] wlan1: Creating new IBSS network, BSSID 0e:cd:da:4d:e5:17 [ 297.843829][ T7629] netlink: 'syz.4.1023': attribute type 21 has an invalid length. [ 297.852647][ T7629] netlink: 164 bytes leftover after parsing attributes in process `syz.4.1023'. [ 297.862823][ T7609] IPv6: Can't replace route, no match found [ 297.869641][ T7625] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 297.887658][ T7645] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 298.337390][ T7657] netlink: 763 bytes leftover after parsing attributes in process `syz.0.1033'. [ 298.559926][ T7662] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1034'. [ 298.980546][ T7667] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1035'. [ 299.081297][ T7651] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 299.768700][ T7691] netlink: 'syz.0.1041': attribute type 17 has an invalid length. [ 299.839484][ T7691] netlink: 'syz.0.1041': attribute type 41 has an invalid length. [ 299.882846][ T11] wlan1: Trigger new scan to find an IBSS to join [ 299.987096][ T7691] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1041'. [ 300.384006][ T7690] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 300.396402][ T7691] netlink: 'syz.0.1041': attribute type 1 has an invalid length. [ 300.415291][ T7683] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 301.340384][ T7716] device syzkaller0 entered promiscuous mode [ 301.878543][ T11] wlan1: Trigger new scan to find an IBSS to join [ 302.347333][ T7719] netlink: 'syz.0.1048': attribute type 2 has an invalid length. [ 302.530483][ T7736] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1051'. [ 302.894520][ T11] wlan1: Trigger new scan to find an IBSS to join [ 302.901395][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 302.901407][ T11] wlan1: Trigger new scan to find an IBSS to join [ 304.813911][ T7722] device syzkaller0 entered promiscuous mode [ 304.821506][ T7730] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 305.226980][ T7756] netlink: 'syz.0.1059': attribute type 29 has an invalid length. [ 305.856330][ T9] wlan1: Trigger new scan to find an IBSS to join [ 306.758094][ T30] wlan1: Creating new IBSS network, BSSID 52:e3:cb:f8:a1:ff [ 306.910105][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 306.910692][ T30] wlan1: Trigger new scan to find an IBSS to join [ 307.827578][ T11] wlan1: Creating new IBSS network, BSSID 16:4a:8a:1e:c4:d5 [ 307.853471][ T9] wlan1: Trigger new scan to find an IBSS to join [ 308.280329][ T7756] netlink: 'syz.0.1059': attribute type 29 has an invalid length. [ 308.294519][ T7752] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 308.323507][ T7773] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 308.595357][ T7788] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.1076'. [ 308.796043][ T7791] netlink: 'syz.4.1076': attribute type 10 has an invalid length. [ 310.034255][ T7791] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.042204][ T7791] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.070918][ T7791] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.078296][ T7791] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.086212][ T7791] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.093558][ T7791] bridge0: port 1(bridge_slave_0) entered forwarding state [ 310.114955][ T7791] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 310.180641][ T7801] device aaaaaaaaaaaaaaa entered promiscuous mode [ 310.429325][ T7811] netlink: 763 bytes leftover after parsing attributes in process `syz.4.1071'. [ 310.506182][ T7813] netlink: 'syz.0.1072': attribute type 2 has an invalid length. [ 310.691711][ T7822] netlink: 'syz.1.1075': attribute type 29 has an invalid length. [ 310.857979][ T7822] netlink: 'syz.1.1075': attribute type 29 has an invalid length. [ 310.905459][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 311.543369][ T7816] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 311.969856][ T7825] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 312.130064][ T7843] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1084'. [ 312.997353][ T7843] device aaaaaaaaaaaaaaa entered promiscuous mode [ 313.389493][ T7862] netlink: 'syz.3.1087': attribute type 2 has an invalid length. [ 313.440794][ T7859] netlink: 'syz.1.1088': attribute type 10 has an invalid length. [ 313.472912][ T7859] netlink: 65015 bytes leftover after parsing attributes in process `syz.1.1088'. [ 313.496710][ T7863] netlink: 763 bytes leftover after parsing attributes in process `syz.4.1089'. [ 313.852933][ T30] wlan1: Trigger new scan to find an IBSS to join [ 313.859680][ T30] wlan1: Trigger new scan to find an IBSS to join [ 313.900518][ T7867] device syzkaller0 entered promiscuous mode [ 315.852683][ T9] wlan1: Trigger new scan to find an IBSS to join [ 315.860996][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 316.754143][ T11] wlan1: Creating new IBSS network, BSSID a2:7b:61:59:c0:7d [ 316.813103][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 316.818395][ T11] wlan1: Trigger new scan to find an IBSS to join [ 317.030711][ T7871] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 317.041150][ T7891] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1096'. [ 317.058366][ T7892] device aaaaaaaaaaaaaaa entered promiscuous mode [ 317.077169][ T7898] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 317.143359][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.149736][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.385546][ T7922] netlink: 'syz.4.1106': attribute type 29 has an invalid length. [ 318.406861][ T7922] netlink: 'syz.4.1106': attribute type 29 has an invalid length. [ 318.470846][ T7922] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1106'. [ 318.561725][ T7922] netlink: 'syz.4.1106': attribute type 10 has an invalid length. [ 318.661529][ T30] wlan1: Creating new IBSS network, BSSID 7e:24:e4:d3:77:44 [ 318.672926][ T7922] device hsr0 entered promiscuous mode [ 318.740672][ T7922] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 318.765153][ T7922] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 318.784320][ T7922] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 318.811127][ T7922] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 318.896648][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 319.856896][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 319.892465][ T7933] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 319.909871][ T7937] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 320.154342][ T7946] netlink: 'syz.2.1114': attribute type 29 has an invalid length. [ 320.214530][ T7951] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1114'. [ 320.217724][ T7946] netlink: 'syz.2.1114': attribute type 29 has an invalid length. [ 320.235835][ T7949] delete_channel: no stack [ 320.259879][ T7949] delete_channel: no stack [ 320.370312][ T7958] netlink: 196 bytes leftover after parsing attributes in process `syz.4.1115'. [ 320.380882][ T7946] netlink: 'syz.2.1114': attribute type 10 has an invalid length. [ 320.407818][ T7946] device hsr0 entered promiscuous mode [ 320.434299][ T7958] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 320.757199][ T7961] netlink: 'syz.0.1119': attribute type 29 has an invalid length. [ 320.788446][ T7961] netlink: 'syz.0.1119': attribute type 29 has an invalid length. [ 320.813442][ T11] wlan1: Trigger new scan to find an IBSS to join [ 320.822617][ T7953] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 321.291053][ T7980] netlink: 'syz.1.1124': attribute type 29 has an invalid length. [ 321.351626][ T7980] netlink: 'syz.1.1124': attribute type 29 has an invalid length. [ 321.359651][ T7983] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1124'. [ 321.948737][ T7983] device hsr0 entered promiscuous mode [ 322.000232][ T7983] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 322.042422][ T7983] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 322.060229][ T7983] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 322.089773][ T7983] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 322.136665][ T7986] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 322.197361][ T7997] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1129'. [ 322.294729][ T4274] Bluetooth: hci4: unexpected subevent 0x01 length: 150 > 18 [ 322.302390][ T4274] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 322.798758][ T8015] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1135'. [ 322.855951][ T8015] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 322.892479][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 322.895862][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 323.403302][ T8034] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1141'. [ 323.445819][ T8035] validate_nla: 5 callbacks suppressed [ 323.445840][ T8035] netlink: 'syz.1.1141': attribute type 10 has an invalid length. [ 323.554343][ T8035] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 323.655373][ T8035] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 323.693593][ T8035] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 323.760762][ T8035] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 323.853003][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 324.287174][ T8046] netlink: 'syz.0.1143': attribute type 29 has an invalid length. [ 324.296353][ T8030] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 324.323078][ T8046] netlink: 'syz.0.1143': attribute type 29 has an invalid length. [ 324.355777][ T8051] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1143'. [ 324.376313][ T8048] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1144'. [ 324.452021][ T8053] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1146'. [ 324.505062][ T8053] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1146'. [ 324.553258][ T8046] netlink: 'syz.0.1143': attribute type 10 has an invalid length. [ 324.629628][ T8046] device hsr0 entered promiscuous mode [ 324.903408][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 326.171558][ T8081] device syzkaller0 entered promiscuous mode [ 326.893343][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 326.900379][ T30] wlan1: Trigger new scan to find an IBSS to join [ 327.810376][ T4325] wlan1: Creating new IBSS network, BSSID 6e:8f:91:82:fb:2a [ 327.871238][ T8105] netlink: 'syz.2.1157': attribute type 2 has an invalid length. [ 327.897970][ T8105] netlink: 199848 bytes leftover after parsing attributes in process `syz.2.1157'. [ 328.813620][ T11] wlan1: Trigger new scan to find an IBSS to join [ 328.898233][ T11] wlan1: Trigger new scan to find an IBSS to join [ 329.680608][ T8088] netlink: 'syz.3.1158': attribute type 16 has an invalid length. [ 329.688760][ T8088] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1158'. [ 329.707716][ T8099] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 329.723555][ T4934] wlan1: Creating new IBSS network, BSSID d2:42:3a:72:97:37 [ 329.723580][ T8104] pimreg0: tun_chr_ioctl cmd 35111 [ 329.834534][ T8109] netlink: 'syz.3.1160': attribute type 21 has an invalid length. [ 329.853166][ T30] wlan1: Trigger new scan to find an IBSS to join [ 329.877009][ T8109] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1160'. [ 329.921170][ T8110] netlink: 198580 bytes leftover after parsing attributes in process `syz.3.1160'. [ 329.963791][ T8109] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1160'. [ 330.136621][ T8117] netlink: 763 bytes leftover after parsing attributes in process `syz.0.1163'. [ 330.835958][ T8129] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1166'. [ 331.852327][ T30] wlan1: Trigger new scan to find an IBSS to join [ 332.163962][ T8162] netlink: 'syz.4.1176': attribute type 29 has an invalid length. [ 332.218518][ T8168] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1176'. [ 332.652887][ T8162] netlink: 'syz.4.1176': attribute type 29 has an invalid length. [ 332.698870][ T8168] netlink: 'syz.4.1176': attribute type 10 has an invalid length. [ 332.737433][ T8168] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 332.786332][ T8168] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 332.853870][ T8168] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 332.942225][ T8168] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 332.954021][ T9] wlan1: Trigger new scan to find an IBSS to join [ 333.349251][ T8163] device syzkaller0 entered promiscuous mode [ 333.463060][ T8185] netlink: 'syz.0.1178': attribute type 3 has an invalid length. [ 333.470891][ T8185] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1178'. [ 333.966552][ T8197] netlink: 'syz.1.1181': attribute type 29 has an invalid length. [ 334.021602][ T8199] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1181'. [ 334.290091][ T8205] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1182'. [ 334.375081][ T4935] wlan1: Creating new IBSS network, BSSID 92:3f:73:b4:6c:87 [ 334.897563][ T11] wlan1: Trigger new scan to find an IBSS to join [ 336.320997][ T8188] netlink: 763 bytes leftover after parsing attributes in process `syz.3.1179'. [ 336.345973][ T8197] netlink: 'syz.1.1181': attribute type 29 has an invalid length. [ 336.354362][ T8199] netlink: 'syz.1.1181': attribute type 10 has an invalid length. [ 336.363822][ T8199] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 336.377719][ T8199] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 336.389053][ T8199] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 336.402270][ T8199] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 336.753361][ T8214] netlink: 'syz.4.1186': attribute type 10 has an invalid length. [ 337.853393][ T11] wlan1: Trigger new scan to find an IBSS to join [ 337.977900][ T8245] netlink: 'syz.3.1193': attribute type 10 has an invalid length. [ 338.064386][ T8246] netlink: 'syz.2.1192': attribute type 3 has an invalid length. [ 338.088683][ T8246] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1192'. [ 338.593372][ T8245] device veth0_macvtap left promiscuous mode [ 338.795387][ T7577] wlan1: Creating new IBSS network, BSSID 5e:52:d6:64:0e:4a [ 338.930307][ T8255] device syzkaller0 entered promiscuous mode [ 339.081886][ T8260] netlink: 'syz.2.1197': attribute type 29 has an invalid length. [ 339.143843][ T8260] netlink: 'syz.2.1197': attribute type 29 has an invalid length. [ 339.170417][ T8262] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1197'. [ 339.276891][ T8262] netlink: 'syz.2.1197': attribute type 10 has an invalid length. [ 339.486348][ T8270] netlink: 'syz.3.1200': attribute type 29 has an invalid length. [ 339.515785][ T8270] netlink: 'syz.3.1200': attribute type 29 has an invalid length. [ 339.601587][ T8270] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1200'. [ 339.920208][ T8270] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 339.944374][ T8270] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 339.974293][ T8270] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 340.021097][ T8270] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 343.280857][ T8279] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 343.288293][ T8279] IPv6: NLM_F_CREATE should be set when creating new route [ 343.295681][ T8279] IPv6: NLM_F_CREATE should be set when creating new route [ 343.303009][ T8279] IPv6: NLM_F_CREATE should be set when creating new route [ 343.312765][ T8289] netlink: 763 bytes leftover after parsing attributes in process `syz.3.1204'. [ 343.695011][ T8300] validate_nla: 1 callbacks suppressed [ 343.695050][ T8300] netlink: 'syz.2.1207': attribute type 29 has an invalid length. [ 343.749465][ T8306] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1207'. [ 343.818288][ T8305] netlink: 'syz.3.1208': attribute type 29 has an invalid length. [ 343.983149][ T8308] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1208'. [ 344.556530][ T8300] netlink: 'syz.2.1207': attribute type 29 has an invalid length. [ 344.572722][ T8305] netlink: 'syz.3.1208': attribute type 29 has an invalid length. [ 344.587511][ T8308] netlink: 'syz.3.1208': attribute type 10 has an invalid length. [ 344.602792][ T8308] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 344.632870][ T8308] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 344.650671][ T8308] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 344.712279][ T8308] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 344.787986][ T8314] FAULT_INJECTION: forcing a failure. [ 344.787986][ T8314] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 344.827058][ T8314] CPU: 0 PID: 8314 Comm: syz.0.1209 Not tainted syzkaller #0 [ 344.834530][ T8314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 344.845190][ T8314] Call Trace: [ 344.848516][ T8314] [ 344.851501][ T8314] dump_stack_lvl+0x188/0x24e [ 344.856264][ T8314] ? show_regs_print_info+0x12/0x12 [ 344.861532][ T8314] ? load_image+0x400/0x400 [ 344.866099][ T8314] ? __lock_acquire+0x7d10/0x7d10 [ 344.871195][ T8314] should_fail_ex+0x399/0x4d0 [ 344.875943][ T8314] _copy_from_user+0x2c/0x170 [ 344.880687][ T8314] iovec_from_user+0x143/0x360 [ 344.885523][ T8314] __import_iovec+0x6d/0x500 [ 344.890186][ T8314] import_iovec+0x6f/0xa0 [ 344.894676][ T8314] ___sys_sendmsg+0x252/0x360 [ 344.899424][ T8314] ? __sys_sendmsg+0x290/0x290 [ 344.904278][ T8314] ? __lock_acquire+0x7d10/0x7d10 [ 344.909390][ T8314] __se_sys_sendmsg+0x1bb/0x2a0 [ 344.914443][ T8314] ? __x64_sys_sendmsg+0x80/0x80 [ 344.920008][ T8314] ? lockdep_hardirqs_on+0x94/0x140 [ 344.925374][ T8314] do_syscall_64+0x4c/0xa0 [ 344.930036][ T8314] ? clear_bhb_loop+0x60/0xb0 [ 344.934784][ T8314] ? clear_bhb_loop+0x60/0xb0 [ 344.939536][ T8314] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 344.945496][ T8314] RIP: 0033:0x7f4af8b9c819 [ 344.949975][ T8314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 344.969825][ T8314] RSP: 002b:00007f4af9a4d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 344.978387][ T8314] RAX: ffffffffffffffda RBX: 00007f4af8e15fa0 RCX: 00007f4af8b9c819 [ 344.986420][ T8314] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 344.994447][ T8314] RBP: 00007f4af9a4d090 R08: 0000000000000000 R09: 0000000000000000 [ 345.002461][ T8314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 345.010478][ T8314] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 345.018503][ T8314] [ 345.906713][ T8330] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 346.124349][ T8331] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 346.198191][ T8350] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1219'. [ 346.703775][ T8355] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 346.771221][ T8358] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 346.919812][ T8364] netlink: 'syz.3.1222': attribute type 29 has an invalid length. [ 346.960644][ T8364] netlink: 'syz.3.1222': attribute type 29 has an invalid length. [ 347.050031][ T8364] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1222'. [ 347.091456][ T8370] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1223'. [ 347.126850][ T8364] netlink: 'syz.3.1222': attribute type 10 has an invalid length. [ 347.173227][ T8374] netlink: 'syz.4.1225': attribute type 29 has an invalid length. [ 347.180096][ T8364] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 347.226608][ T8379] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1225'. [ 347.250273][ T8364] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 347.383860][ T8364] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 347.494256][ T8364] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 347.536720][ T8374] netlink: 'syz.4.1225': attribute type 29 has an invalid length. [ 347.554357][ T8379] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 347.619004][ T8379] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 347.699971][ T8379] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 347.762262][ T8379] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 348.245076][ T8400] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1232'. [ 348.824748][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 348.893688][ T9] wlan1: Trigger new scan to find an IBSS to join [ 349.511434][ T8404] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 349.541896][ T8397] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 349.893969][ T8420] validate_nla: 1 callbacks suppressed [ 349.894015][ T8420] netlink: 'syz.2.1238': attribute type 29 has an invalid length. [ 350.015804][ T8420] netlink: 'syz.2.1238': attribute type 29 has an invalid length. [ 350.106634][ T8421] netlink: 'syz.2.1238': attribute type 10 has an invalid length. [ 350.503165][ T8416] device bridge_slave_1 left promiscuous mode [ 350.578939][ T8416] bridge0: port 2(bridge_slave_1) entered disabled state [ 351.068830][ T8416] device bridge_slave_0 left promiscuous mode [ 351.198817][ T8416] bridge0: port 1(bridge_slave_0) entered disabled state [ 351.583372][ T8416] bond0: (slave bridge0): Releasing backup interface [ 351.678567][ T8412] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 351.704783][ T8434] netlink: 763 bytes leftover after parsing attributes in process `syz.0.1240'. [ 351.852474][ T9] wlan1: Trigger new scan to find an IBSS to join [ 351.873976][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 351.897402][ T8445] netlink: 'syz.1.1243': attribute type 29 has an invalid length. [ 351.951049][ T8448] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1243'. [ 352.032878][ T8445] netlink: 'syz.1.1243': attribute type 29 has an invalid length. [ 352.041785][ T8449] netlink: 763 bytes leftover after parsing attributes in process `syz.3.1244'. [ 352.159718][ T8445] netlink: 'syz.1.1243': attribute type 10 has an invalid length. [ 352.196160][ T8445] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 352.232396][ T8445] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 352.259032][ T8445] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 352.301825][ T8445] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 352.364045][ T8454] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 352.937051][ T8466] netlink: 'syz.4.1249': attribute type 29 has an invalid length. [ 353.088063][ T8468] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1249'. [ 353.863889][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 354.086677][ T8465] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 354.096798][ T9] wlan1: Creating new IBSS network, BSSID 32:0e:d3:41:69:5d [ 354.109407][ T8466] netlink: 'syz.4.1249': attribute type 29 has an invalid length. [ 354.139758][ T8461] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 354.181546][ T8473] netlink: 'syz.4.1249': attribute type 10 has an invalid length. [ 354.242229][ T8473] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 354.362029][ T8473] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 354.422661][ T8473] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 354.521447][ T8473] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 354.558101][ T8457] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 354.607892][ T8480] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 354.836881][ T8489] netlink: 763 bytes leftover after parsing attributes in process `syz.2.1256'. [ 355.545304][ T8485] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 355.688407][ T8486] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 356.014206][ T8508] netlink: 763 bytes leftover after parsing attributes in process `syz.0.1259'. [ 356.209420][ T8511] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 356.894483][ T8528] netlink: 'syz.0.1267': attribute type 29 has an invalid length. [ 356.919982][ T30] wlan1: Trigger new scan to find an IBSS to join [ 356.963797][ T8528] netlink: 'syz.0.1267': attribute type 29 has an invalid length. [ 357.006323][ T8529] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1267'. [ 357.105017][ T8528] netlink: 'syz.0.1267': attribute type 10 has an invalid length. [ 357.852532][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 358.016331][ T8519] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 358.072621][ T8538] netlink: 763 bytes leftover after parsing attributes in process `syz.3.1269'. [ 358.480668][ T8548] netlink: 'syz.0.1281': attribute type 29 has an invalid length. [ 358.521556][ T8548] netlink: 'syz.0.1281': attribute type 29 has an invalid length. [ 358.606076][ T8548] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1281'. [ 358.645119][ T8557] netlink: 'syz.0.1281': attribute type 10 has an invalid length. [ 358.812551][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 358.819330][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 359.756200][ T8550] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 360.122920][ T8569] netlink: 763 bytes leftover after parsing attributes in process `syz.2.1276'. [ 360.303295][ T8567] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 360.754198][ T8586] netlink: 'syz.1.1283': attribute type 2 has an invalid length. [ 360.841747][ T8587] netlink: 763 bytes leftover after parsing attributes in process `syz.2.1285'. [ 361.083639][ T8581] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 361.169467][ T8598] netlink: 'syz.1.1288': attribute type 2 has an invalid length. [ 361.201561][ T8598] netlink: 'syz.1.1288': attribute type 8 has an invalid length. [ 361.238847][ T8598] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1288'. [ 361.271055][ T8599] netlink: 146340 bytes leftover after parsing attributes in process `syz.1.1288'. [ 361.342680][ T8599] openvswitch: netlink: Key type 386 is out of range max 32 [ 361.853987][ T4935] wlan1: Creating new IBSS network, BSSID 4a:18:1a:b7:c3:09 [ 361.861768][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 362.760904][ T8611] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 362.908811][ T30] wlan1: Trigger new scan to find an IBSS to join [ 363.067301][ T8629] netlink: 'syz.0.1298': attribute type 29 has an invalid length. [ 363.118434][ T8629] netlink: 'syz.0.1298': attribute type 29 has an invalid length. [ 363.856610][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 364.607316][ T30] wlan1: Creating new IBSS network, BSSID 96:40:58:35:42:3b [ 364.619892][ T8637] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 364.915187][ T8645] netlink: 'syz.4.1305': attribute type 29 has an invalid length. [ 364.949179][ T8645] netlink: 'syz.4.1305': attribute type 29 has an invalid length. [ 365.037770][ T8645] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1305'. [ 365.094381][ T8648] netlink: 'syz.4.1305': attribute type 10 has an invalid length. [ 365.142953][ T8648] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 365.164350][ T8648] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 365.272630][ T8648] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 365.382394][ T8648] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 365.438290][ T8657] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1309'. [ 365.473789][ T8658] netlink: 'syz.3.1308': attribute type 29 has an invalid length. [ 365.569621][ T8662] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1308'. [ 365.582657][ T8658] netlink: 'syz.3.1308': attribute type 29 has an invalid length. [ 365.616745][ T8652] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 365.730627][ T8658] netlink: 'syz.3.1308': attribute type 10 has an invalid length. [ 365.818251][ T8658] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 365.900032][ T8658] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 365.979252][ T8658] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 366.348395][ T8658] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 366.434449][ T8667] netlink: 'syz.4.1311': attribute type 2 has an invalid length. [ 366.812630][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 366.892647][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 366.899491][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 367.179719][ T8674] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 367.455820][ T8693] netlink: 763 bytes leftover after parsing attributes in process `syz.0.1319'. [ 367.481791][ T8696] netlink: 'syz.2.1321': attribute type 29 has an invalid length. [ 367.497885][ T8696] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1321'. [ 367.788630][ T8704] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1323'. [ 367.810282][ T8705] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1324'. [ 367.818103][ T8704] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1323'. [ 367.843213][ T30] wlan1: Creating new IBSS network, BSSID 32:91:49:bb:67:6b [ 367.916958][ T8704] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1323'. [ 367.939151][ T8713] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1326'. [ 368.748083][ T8713] validate_nla: 3 callbacks suppressed [ 368.748102][ T8713] netlink: 'syz.3.1326': attribute type 27 has an invalid length. [ 368.769316][ T8706] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 368.790201][ T8719] netlink: 'syz.4.1328': attribute type 2 has an invalid length. [ 369.854118][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 369.860976][ T30] wlan1: Trigger new scan to find an IBSS to join [ 370.343529][ T8729] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 370.823455][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 371.092029][ T8750] tap0: tun_chr_ioctl cmd 1074025677 [ 371.098031][ T8750] tap0: linktype set to 270 [ 371.179743][ T8744] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 371.341896][ T8761] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 371.370522][ T8767] __nla_validate_parse: 2 callbacks suppressed [ 371.370563][ T8767] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1342'. [ 371.963214][ T8769] netlink: 'syz.1.1343': attribute type 2 has an invalid length. [ 373.852484][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 373.852562][ T30] wlan1: Trigger new scan to find an IBSS to join [ 373.868015][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 373.868641][ T11] wlan1: Trigger new scan to find an IBSS to join [ 374.460697][ T8777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1355'. [ 374.476552][ T8777] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1355'. [ 374.512020][ T8792] netlink: 763 bytes leftover after parsing attributes in process `syz.1.1348'. [ 374.753472][ T8800] netlink: 'syz.0.1351': attribute type 21 has an invalid length. [ 374.784523][ T46] wlan1: Creating new IBSS network, BSSID 42:c0:8d:90:99:5d [ 374.792429][ T9] wlan1: Creating new IBSS network, BSSID 3e:92:2d:b0:c2:53 [ 374.889726][ T8799] netlink: 'syz.3.1352': attribute type 3 has an invalid length. [ 374.912326][ T8806] netlink: 'syz.0.1351': attribute type 2 has an invalid length. [ 374.920738][ T8806] netlink: 'syz.0.1351': attribute type 1 has an invalid length. [ 374.935279][ T8799] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1352'. [ 375.596330][ T8817] netlink: 'syz.3.1352': attribute type 10 has an invalid length. [ 375.611113][ T8817] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1352'. [ 375.621520][ T8817] device veth0_vlan left promiscuous mode [ 375.636135][ T8817] device veth0_vlan entered promiscuous mode [ 375.720195][ T8817] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 375.799321][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 375.827732][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 375.841490][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 376.560506][ T8823] netlink: 'syz.3.1359': attribute type 2 has an invalid length. [ 376.879120][ T9] wlan1: Trigger new scan to find an IBSS to join [ 376.897512][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 376.917919][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 376.934303][ T8825] FAULT_INJECTION: forcing a failure. [ 376.934303][ T8825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.098309][ T8825] CPU: 0 PID: 8825 Comm: syz.0.1360 Not tainted syzkaller #0 [ 377.105794][ T8825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 377.116083][ T8825] Call Trace: [ 377.119414][ T8825] [ 377.122393][ T8825] dump_stack_lvl+0x188/0x24e [ 377.127145][ T8825] ? show_regs_print_info+0x12/0x12 [ 377.132544][ T8825] ? load_image+0x400/0x400 [ 377.137123][ T8825] ? __lock_acquire+0x7d10/0x7d10 [ 377.142215][ T8825] should_fail_ex+0x399/0x4d0 [ 377.147040][ T8825] _copy_from_iter+0x1c0/0x1130 [ 377.151948][ T8825] ? copyout_mc+0x110/0x110 [ 377.156501][ T8825] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 377.162566][ T8825] ? lock_chain_count+0x20/0x20 [ 377.167474][ T8825] ? _raw_spin_lock_irq+0xb7/0xf0 [ 377.172598][ T8825] ? _raw_spin_lock_irqsave+0x100/0x100 [ 377.178278][ T8825] ? page_copy_sane+0x4e/0x390 [ 377.183091][ T8825] copy_page_from_iter+0x77/0x100 [ 377.188178][ T8825] pipe_write+0x87f/0x1b20 [ 377.192682][ T8825] ? pipe_read+0x1260/0x1260 [ 377.197349][ T8825] ? end_current_label_crit_section+0x14b/0x170 [ 377.203678][ T8825] ? common_file_perm+0x171/0x1c0 [ 377.208869][ T8825] vfs_write+0x4b1/0xa30 [ 377.213192][ T8825] ? file_end_write+0x250/0x250 [ 377.218117][ T8825] ? __fget_files+0x43d/0x4b0 [ 377.222864][ T8825] ? __fdget_pos+0x1d4/0x360 [ 377.227588][ T8825] ? ksys_write+0x71/0x250 [ 377.232064][ T8825] ksys_write+0x14c/0x250 [ 377.236490][ T8825] ? __ia32_sys_read+0x80/0x80 [ 377.241351][ T8825] ? lockdep_hardirqs_on+0x94/0x140 [ 377.246619][ T8825] do_syscall_64+0x4c/0xa0 [ 377.251097][ T8825] ? clear_bhb_loop+0x60/0xb0 [ 377.255880][ T8825] ? clear_bhb_loop+0x60/0xb0 [ 377.260624][ T8825] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 377.266605][ T8825] RIP: 0033:0x7f4af8b9c819 [ 377.271085][ T8825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.290867][ T8825] RSP: 002b:00007f4af9a4d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 377.299435][ T8825] RAX: ffffffffffffffda RBX: 00007f4af8e15fa0 RCX: 00007f4af8b9c819 [ 377.307548][ T8825] RDX: 00000000fffffdef RSI: 00002000000001c0 RDI: 0000000000000000 [ 377.315583][ T8825] RBP: 00007f4af9a4d090 R08: 0000000000000000 R09: 0000000000000000 [ 377.323679][ T8825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 377.332056][ T8825] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 377.340287][ T8825] [ 377.563967][ T8833] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1362'. [ 378.282534][ T8819] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 378.313331][ T11] wlan1: Creating new IBSS network, BSSID d6:a7:93:87:0f:65 [ 378.550445][ T8843] netlink: 763 bytes leftover after parsing attributes in process `syz.2.1364'. [ 378.613280][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.619861][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.789966][ T8857] netlink: 'syz.4.1371': attribute type 2 has an invalid length. [ 379.871363][ T8862] netlink: 'syz.1.1372': attribute type 29 has an invalid length. [ 379.905529][ T8862] netlink: 'syz.1.1372': attribute type 29 has an invalid length. [ 380.078472][ T8862] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1372'. [ 380.180956][ T8870] netlink: 'syz.1.1372': attribute type 10 has an invalid length. [ 380.437476][ T8870] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 380.541413][ T8870] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 380.637966][ T8874] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1377'. [ 380.723752][ T8870] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 380.885708][ T8870] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 380.925098][ T9] wlan1: Trigger new scan to find an IBSS to join [ 381.578508][ T8869] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 381.917820][ T8890] netlink: 763 bytes leftover after parsing attributes in process `syz.1.1379'. [ 383.152314][ T4325] wlan1: Creating new IBSS network, BSSID 52:ea:c1:bc:37:c4 [ 383.174163][ T8907] netlink: 'syz.1.1386': attribute type 2 has an invalid length. [ 383.853617][ T30] wlan1: Trigger new scan to find an IBSS to join [ 385.268620][ T8911] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 385.638535][ T8919] netlink: 'syz.3.1390': attribute type 29 has an invalid length. [ 385.684467][ T8919] netlink: 'syz.3.1390': attribute type 29 has an invalid length. [ 385.761823][ T8922] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1390'. [ 386.028869][ T8926] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1392'. [ 387.577321][ T8953] netlink: 'syz.0.1398': attribute type 10 has an invalid length. [ 387.852391][ T46] wlan1: Trigger new scan to find an IBSS to join [ 387.943405][ T46] wlan1: Trigger new scan to find an IBSS to join [ 388.274789][ T8953] device geneve0 entered promiscuous mode [ 389.771028][ T8963] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 389.792614][ T11] wlan1: Creating new IBSS network, BSSID b6:cf:c4:1b:da:16 [ 389.803482][ T8967] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 389.836415][ T8982] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 390.011555][ T8986] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1407'. [ 390.203144][ T8994] netlink: 'syz.3.1410': attribute type 2 has an invalid length. [ 390.799829][ T9008] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1412'. [ 391.129733][ T9012] netlink: 'syz.0.1426': attribute type 29 has an invalid length. [ 391.193758][ T9017] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1426'. [ 391.228224][ T9012] netlink: 'syz.0.1426': attribute type 29 has an invalid length. [ 391.298571][ T9016] netlink: 'syz.1.1415': attribute type 10 has an invalid length. [ 391.476867][ T9016] device geneve0 entered promiscuous mode [ 391.791386][ T9016] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 391.852865][ T46] wlan1: Trigger new scan to find an IBSS to join [ 391.859527][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 391.867771][ T46] wlan1: Trigger new scan to find an IBSS to join [ 392.850995][ T9025] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 392.878137][ T9034] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 392.897267][ T9036] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 393.244773][ T9051] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1425'. [ 393.694838][ T9050] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 394.060590][ T9069] netlink: 'syz.1.1428': attribute type 7 has an invalid length. [ 394.892678][ T9] wlan1: Trigger new scan to find an IBSS to join [ 394.909692][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 395.432937][ T9090] netlink: 'syz.4.1435': attribute type 10 has an invalid length. [ 395.523937][ T9090] device geneve0 entered promiscuous mode [ 395.841988][ T9090] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 395.862728][ T46] wlan1: Trigger new scan to find an IBSS to join [ 396.065719][ T9092] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 396.903640][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 397.028764][ T9102] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 397.150304][ T9109] netlink: 'syz.4.1442': attribute type 22 has an invalid length. [ 397.161994][ T9109] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1442'. [ 397.472873][ T9122] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1447'. [ 397.587502][ T9126] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1449'. [ 397.930960][ T9124] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 398.478518][ T9148] netlink: 'syz.3.1454': attribute type 10 has an invalid length. [ 398.527081][ T9148] device geneve0 entered promiscuous mode [ 398.841676][ T9148] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 398.866722][ T9146] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 398.892594][ T9] wlan1: Trigger new scan to find an IBSS to join [ 399.174273][ T9165] netlink: 'syz.1.1459': attribute type 29 has an invalid length. [ 399.267574][ T9165] netlink: 'syz.1.1459': attribute type 29 has an invalid length. [ 399.304409][ T9168] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1459'. [ 399.328521][ T9163] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 399.406522][ T9172] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1461'. [ 399.737351][ T9177] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1463'. [ 399.864770][ T9] wlan1: Trigger new scan to find an IBSS to join [ 400.260545][ T9182] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 400.817188][ T7577] wlan1: Creating new IBSS network, BSSID 66:df:e2:05:13:e7 [ 400.903086][ T11] wlan1: Trigger new scan to find an IBSS to join [ 400.909960][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 401.605627][ T9224] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1479'. [ 401.628809][ T9226] netlink: 196 bytes leftover after parsing attributes in process `syz.0.1480'. [ 402.895514][ T46] wlan1: Trigger new scan to find an IBSS to join [ 403.489077][ T9272] netlink: 'syz.4.1494': attribute type 10 has an invalid length. [ 403.853945][ T4325] wlan1: Trigger new scan to find an IBSS to join [ 403.889947][ T9284] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1498'. [ 404.437846][ T9302] netlink: 'syz.0.1504': attribute type 21 has an invalid length. [ 404.460249][ T9300] netlink: 'syz.4.1505': attribute type 29 has an invalid length. [ 404.482925][ T9300] netlink: 'syz.4.1505': attribute type 29 has an invalid length. [ 404.522001][ T9292] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 404.535542][ T9303] netlink: 'syz.4.1505': attribute type 29 has an invalid length. [ 405.684365][ T4325] wlan1: Creating new IBSS network, BSSID ca:53:f7:4b:73:a8 [ 405.852487][ T46] wlan1: Trigger new scan to find an IBSS to join [ 405.952871][ T9325] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1513'. [ 406.008556][ T9325] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1513'. [ 406.146435][ T9327] sctp: [Deprecated]: syz.0.1513 (pid 9327) Use of int in maxseg socket option. [ 406.146435][ T9327] Use struct sctp_assoc_value instead [ 406.195334][ T9331] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1516'. [ 406.335700][ T9333] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1515'. [ 406.618550][ T9345] netlink: 192432 bytes leftover after parsing attributes in process `syz.1.1518'. [ 406.632388][ T9345] netlink: get zone limit has 4 unknown bytes [ 406.840321][ T4325] wlan1: Creating new IBSS network, BSSID 46:42:bf:87:94:bf [ 406.893323][ T46] wlan1: Trigger new scan to find an IBSS to join [ 407.027544][ T9353] netlink: 'syz.3.1520': attribute type 7 has an invalid length. [ 407.157301][ T9347] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 407.853526][ T46] wlan1: Trigger new scan to find an IBSS to join [ 407.889389][ T9376] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1531'. [ 408.254798][ T9382] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1532'. [ 408.376306][ T9386] netlink: 'syz.4.1534': attribute type 20 has an invalid length. [ 409.237498][ T9] wlan1: Creating new IBSS network, BSSID 4a:2f:ae:45:78:db [ 409.249401][ T9399] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 409.588279][ T9412] netlink: 'syz.1.1541': attribute type 10 has an invalid length. [ 409.854300][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 409.855173][ T11] wlan1: Trigger new scan to find an IBSS to join [ 410.124655][ T4274] Bluetooth: Frame is too long (len 13, expected len 4) [ 410.489419][ T9425] netlink: 'syz.1.1547': attribute type 5 has an invalid length. [ 410.512245][ T9425] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1547'. [ 411.229680][ T9444] netlink: 'syz.3.1555': attribute type 29 has an invalid length. [ 411.279099][ T9444] netlink: 'syz.3.1555': attribute type 29 has an invalid length. [ 411.353845][ T9446] netlink: 'syz.3.1555': attribute type 10 has an invalid length. [ 411.399241][ T9446] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 411.463629][ T9446] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 411.488771][ T9446] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 411.554554][ T9446] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 411.686261][ T9437] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 411.858351][ T9] wlan1: Trigger new scan to find an IBSS to join [ 412.576636][ T9454] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 412.813262][ T46] wlan1: Creating new IBSS network, BSSID 7a:ca:20:94:2f:67 [ 412.847618][ T9458] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 413.263827][ T9481] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1568'. [ 413.853938][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 414.899999][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 416.330047][ T9511] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1587'. [ 416.566934][ T9489] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 416.893679][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 416.974841][ T9523] netlink: 'syz.4.1580': attribute type 29 has an invalid length. [ 417.019401][ T9523] netlink: 'syz.4.1580': attribute type 29 has an invalid length. [ 417.116406][ T9523] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1580'. [ 417.133601][ T9524] netlink: 'syz.4.1580': attribute type 10 has an invalid length. [ 417.141538][ T9524] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 417.226315][ T9524] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 417.343973][ T9524] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 417.377614][ T9524] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 417.387187][ T9526] netlink: 'syz.2.1581': attribute type 10 has an invalid length. [ 417.408871][ T9513] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 417.436855][ T9531] netlink: 'syz.1.1582': attribute type 8 has an invalid length. [ 417.462416][ T9531] netlink: 128124 bytes leftover after parsing attributes in process `syz.1.1582'. [ 417.637820][ T9519] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 418.133321][ T9541] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 418.179776][ T9547] netlink: 'syz.1.1586': attribute type 2 has an invalid length. [ 418.818773][ T30] wlan1: Trigger new scan to find an IBSS to join [ 418.836173][ T9566] netlink: 'syz.2.1593': attribute type 29 has an invalid length. [ 419.116540][ T9571] netlink: 'syz.3.1596': attribute type 29 has an invalid length. [ 419.193842][ T9576] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1596'. [ 419.737259][ T9566] netlink: 'syz.2.1593': attribute type 29 has an invalid length. [ 419.749014][ T9568] netlink: 'syz.2.1593': attribute type 10 has an invalid length. [ 419.797212][ T9576] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 419.851651][ T9576] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 419.862580][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 419.869468][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 419.878232][ T9] wlan1: Trigger new scan to find an IBSS to join [ 419.905869][ T9576] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 419.952235][ T9576] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 420.810446][ T30] wlan1: Creating new IBSS network, BSSID aa:7f:07:36:54:44 [ 420.903769][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 421.094472][ T9598] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 422.359295][ T9627] validate_nla: 6 callbacks suppressed [ 422.359335][ T9627] netlink: 'syz.2.1611': attribute type 29 has an invalid length. [ 422.399207][ T9627] netlink: 'syz.2.1611': attribute type 29 has an invalid length. [ 422.470435][ T9627] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1611'. [ 422.496834][ T9634] netlink: 'syz.2.1611': attribute type 10 has an invalid length. [ 422.753326][ T9641] netlink: 'syz.3.1617': attribute type 2 has an invalid length. [ 423.258116][ T9639] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 423.276549][ T9654] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 423.298171][ T9656] -1: renamed from syzkaller0 [ 423.510848][ T9661] netlink: 'syz.3.1624': attribute type 29 has an invalid length. [ 423.783320][ T9671] netlink: 'syz.1.1627': attribute type 29 has an invalid length. [ 423.813430][ T9673] FAULT_INJECTION: forcing a failure. [ 423.813430][ T9673] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 423.827603][ T9673] CPU: 1 PID: 9673 Comm: syz.0.1628 Not tainted syzkaller #0 [ 423.835195][ T9673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 423.845348][ T9673] Call Trace: [ 423.848700][ T9673] [ 423.851770][ T9673] dump_stack_lvl+0x188/0x24e [ 423.856627][ T9673] ? show_regs_print_info+0x12/0x12 [ 423.861925][ T9673] ? load_image+0x400/0x400 [ 423.866516][ T9673] ? __lock_acquire+0x7d10/0x7d10 [ 423.871691][ T9673] should_fail_ex+0x399/0x4d0 [ 423.876462][ T9673] _copy_from_user+0x2c/0x170 [ 423.881236][ T9673] iovec_from_user+0x143/0x360 [ 423.886112][ T9673] __import_iovec+0x6d/0x500 [ 423.890799][ T9673] import_iovec+0x6f/0xa0 [ 423.895223][ T9673] ___sys_sendmsg+0x252/0x360 [ 423.900004][ T9673] ? __sys_sendmsg+0x290/0x290 [ 423.904893][ T9673] ? __lock_acquire+0x7d10/0x7d10 [ 423.910063][ T9673] __se_sys_sendmsg+0x1bb/0x2a0 [ 423.915009][ T9673] ? __x64_sys_sendmsg+0x80/0x80 [ 423.920070][ T9673] ? lockdep_hardirqs_on+0x94/0x140 [ 423.925342][ T9673] do_syscall_64+0x4c/0xa0 [ 423.929850][ T9673] ? clear_bhb_loop+0x60/0xb0 [ 423.934610][ T9673] ? clear_bhb_loop+0x60/0xb0 [ 423.939387][ T9673] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 423.945355][ T9673] RIP: 0033:0x7f4af8b9c819 [ 423.949830][ T9673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 423.969509][ T9673] RSP: 002b:00007f4af9a4d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 423.978002][ T9673] RAX: ffffffffffffffda RBX: 00007f4af8e15fa0 RCX: 00007f4af8b9c819 [ 423.986041][ T9673] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 423.994167][ T9673] RBP: 00007f4af9a4d090 R08: 0000000000000000 R09: 0000000000000000 [ 424.002392][ T9673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.010743][ T9673] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 424.019189][ T9673] [ 424.812342][ T30] wlan1: Trigger new scan to find an IBSS to join [ 424.821580][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 424.841759][ T9661] netlink: 'syz.3.1624': attribute type 29 has an invalid length. [ 424.853224][ T9666] netlink: 'syz.3.1624': attribute type 10 has an invalid length. [ 424.861221][ T9666] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 424.875318][ T9666] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 424.885904][ T9666] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 424.898560][ T30] wlan1: Trigger new scan to find an IBSS to join [ 424.926179][ T9666] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 424.949255][ T9671] netlink: 'syz.1.1627': attribute type 29 has an invalid length. [ 425.400606][ T9698] netlink: 'syz.2.1634': attribute type 2 has an invalid length. [ 425.853034][ T11] wlan1: Trigger new scan to find an IBSS to join [ 425.859642][ T30] wlan1: Trigger new scan to find an IBSS to join [ 425.906892][ T4935] wlan1: Creating new IBSS network, BSSID a2:46:2c:f6:2f:7b [ 425.920162][ T7577] wlan1: Creating new IBSS network, BSSID 72:c5:17:e7:d6:57 [ 425.963215][ T7577] wlan1: Creating new IBSS network, BSSID 66:59:ef:17:d9:48 [ 426.140705][ T9710] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1640'. [ 426.617977][ T9703] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 426.816414][ T9708] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 427.201692][ T9732] FAULT_INJECTION: forcing a failure. [ 427.201692][ T9732] name failslab, interval 1, probability 0, space 0, times 0 [ 427.309566][ T9732] CPU: 1 PID: 9732 Comm: syz.0.1645 Not tainted syzkaller #0 [ 427.317051][ T9732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 427.327294][ T9732] Call Trace: [ 427.330621][ T9732] [ 427.333598][ T9732] dump_stack_lvl+0x188/0x24e [ 427.338466][ T9732] ? show_regs_print_info+0x12/0x12 [ 427.344002][ T9732] ? load_image+0x400/0x400 [ 427.348576][ T9732] ? __might_sleep+0xd0/0xd0 [ 427.354259][ T9732] ? __lock_acquire+0x7d10/0x7d10 [ 427.359598][ T9732] should_fail_ex+0x399/0x4d0 [ 427.364376][ T9732] should_failslab+0x5/0x20 [ 427.368944][ T9732] slab_pre_alloc_hook+0x59/0x310 [ 427.374041][ T9732] ? bpf_prog_test_run_skb+0x234/0x12a0 [ 427.379826][ T9732] __kmem_cache_alloc_node+0x4f/0x260 [ 427.385717][ T9732] ? bpf_prog_test_run_skb+0x234/0x12a0 [ 427.391377][ T9732] __kmalloc+0xa0/0x240 [ 427.395618][ T9732] bpf_prog_test_run_skb+0x234/0x12a0 [ 427.401218][ T9732] ? __fget_files+0x28/0x4b0 [ 427.405967][ T9732] ? __fget_files+0x28/0x4b0 [ 427.410648][ T9732] ? __fget_files+0x43d/0x4b0 [ 427.415454][ T9732] ? cpu_online+0xa0/0xa0 [ 427.419960][ T9732] bpf_prog_test_run+0x31e/0x390 [ 427.425071][ T9732] __sys_bpf+0x62b/0x780 [ 427.429429][ T9732] ? bpf_link_show_fdinfo+0x380/0x380 [ 427.434917][ T9732] ? lock_chain_count+0x20/0x20 [ 427.439851][ T9732] __x64_sys_bpf+0x78/0x90 [ 427.444420][ T9732] do_syscall_64+0x4c/0xa0 [ 427.448903][ T9732] ? clear_bhb_loop+0x60/0xb0 [ 427.453724][ T9732] ? clear_bhb_loop+0x60/0xb0 [ 427.458464][ T9732] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 427.464426][ T9732] RIP: 0033:0x7f4af8b9c819 [ 427.468987][ T9732] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 427.489265][ T9732] RSP: 002b:00007f4af9a4d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 427.498022][ T9732] RAX: ffffffffffffffda RBX: 00007f4af8e15fa0 RCX: 00007f4af8b9c819 [ 427.506291][ T9732] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 427.514384][ T9732] RBP: 00007f4af9a4d090 R08: 0000000000000000 R09: 0000000000000000 [ 427.522496][ T9732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 427.530699][ T9732] R13: 00007f4af8e16038 R14: 00007f4af8e15fa0 R15: 00007ffc86d8a778 [ 427.538760][ T9732] [ 428.491223][ T9727] validate_nla: 3 callbacks suppressed [ 428.491246][ T9727] netlink: 'syz.3.1644': attribute type 10 has an invalid length. [ 428.511524][ T9727] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 428.529649][ T9727] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 428.545669][ T9727] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 428.558936][ T9727] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 428.566300][ T9733] netlink: 'syz.2.1646': attribute type 29 has an invalid length. [ 428.585830][ T9736] netlink: 'syz.2.1646': attribute type 10 has an invalid length. [ 428.890191][ T9756] FAULT_INJECTION: forcing a failure. [ 428.890191][ T9756] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 428.912624][ T11] wlan1: Trigger new scan to find an IBSS to join [ 428.919447][ T30] wlan1: Trigger new scan to find an IBSS to join [ 429.006965][ T9756] CPU: 0 PID: 9756 Comm: syz.4.1651 Not tainted syzkaller #0 [ 429.014451][ T9756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 429.024567][ T9756] Call Trace: [ 429.027908][ T9756] [ 429.030900][ T9756] dump_stack_lvl+0x188/0x24e [ 429.036191][ T9756] ? show_regs_print_info+0x12/0x12 [ 429.041576][ T9756] ? load_image+0x400/0x400 [ 429.046433][ T9756] ? __lock_acquire+0x7d10/0x7d10 [ 429.051583][ T9756] ? snprintf+0xe5/0x140 [ 429.055939][ T9756] should_fail_ex+0x399/0x4d0 [ 429.060683][ T9756] _copy_to_user+0x2c/0x130 [ 429.065263][ T9756] simple_read_from_buffer+0xe3/0x150 [ 429.070702][ T9756] proc_fail_nth_read+0x1a6/0x220 [ 429.075790][ T9756] ? proc_fault_inject_write+0x310/0x310 [ 429.081489][ T9756] ? fsnotify_perm+0x248/0x550 [ 429.086320][ T9756] ? proc_fault_inject_write+0x310/0x310 [ 429.092017][ T9756] vfs_read+0x2de/0xa00 [ 429.096253][ T9756] ? kernel_read+0x1e0/0x1e0 [ 429.100918][ T9756] ? __fget_files+0x28/0x4b0 [ 429.105585][ T9756] ? __fget_files+0x28/0x4b0 [ 429.110426][ T9756] ? __fget_files+0x43d/0x4b0 [ 429.115202][ T9756] ? __fdget_pos+0x2ae/0x360 [ 429.119877][ T9756] ? ksys_read+0x71/0x250 [ 429.124286][ T9756] ksys_read+0x14c/0x250 [ 429.128609][ T9756] ? vfs_write+0xa30/0xa30 [ 429.133113][ T9756] ? lockdep_hardirqs_on+0x94/0x140 [ 429.138561][ T9756] do_syscall_64+0x4c/0xa0 [ 429.143134][ T9756] ? clear_bhb_loop+0x60/0xb0 [ 429.147881][ T9756] ? clear_bhb_loop+0x60/0xb0 [ 429.152636][ T9756] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 429.158600][ T9756] RIP: 0033:0x7f3f83d5d04e [ 429.163111][ T9756] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 429.183152][ T9756] RSP: 002b:00007f3f84bcafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 429.191871][ T9756] RAX: ffffffffffffffda RBX: 00007f3f84bcb6c0 RCX: 00007f3f83d5d04e [ 429.199911][ T9756] RDX: 000000000000000f RSI: 00007f3f84bcb0a0 RDI: 0000000000000004 [ 429.208155][ T9756] RBP: 00007f3f84bcb090 R08: 0000000000000000 R09: 0000000000000000 [ 429.216281][ T9756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 429.224314][ T9756] R13: 00007f3f84016038 R14: 00007f3f84015fa0 R15: 00007ffda18123f8 [ 429.232400][ T9756] [ 429.284747][ T9755] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 429.315699][ T9763] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1654'. [ 429.581866][ T9769] netlink: 'syz.2.1656': attribute type 29 has an invalid length. [ 430.429355][ T9779] netlink: 'syz.3.1658': attribute type 29 has an invalid length. [ 430.458044][ T9765] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 430.479841][ T9778] netlink: 'syz.3.1658': attribute type 10 has an invalid length. [ 430.505114][ T9778] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 430.552226][ T9778] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 430.569363][ T9778] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 430.605524][ T9778] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 430.642525][ T9779] netlink: 'syz.3.1658': attribute type 29 has an invalid length. [ 430.748005][ T9785] netlink: 'syz.1.1659': attribute type 29 has an invalid length. [ 430.793570][ T9785] netlink: 'syz.1.1659': attribute type 29 has an invalid length. [ 430.857916][ T9785] netlink: 'syz.1.1659': attribute type 10 has an invalid length. [ 430.892532][ T9785] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 430.912257][ T4935] wlan1: Trigger new scan to find an IBSS to join [ 430.973755][ T9785] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 431.024410][ T9785] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 431.065989][ T9785] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 431.819389][ T9783] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 431.830898][ T4935] wlan1: Creating new IBSS network, BSSID 56:25:20:d0:68:d3 [ 431.845526][ T9805] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 431.882408][ T9805] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 431.902917][ T9805] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 431.919633][ T9805] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 431.956215][ T9804] mac80211_hwsim hwsim4 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 432.381605][ T4320] tipc: Subscription rejected, illegal request [ 432.523462][ T9830] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1673'. [ 432.892453][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 433.852654][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 435.418184][ T9822] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 435.432677][ T9840] bridge0: port 3(batadv0) entered blocking state [ 435.442962][ T9840] bridge0: port 3(batadv0) entered disabled state [ 435.459178][ T9840] device batadv0 entered promiscuous mode [ 435.761842][ T9852] FAULT_INJECTION: forcing a failure. [ 435.761842][ T9852] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 435.784577][ T4935] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 435.794425][ T4935] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 435.861246][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 435.893641][ T9852] CPU: 0 PID: 9852 Comm: syz.2.1679 Not tainted syzkaller #0 [ 435.902070][ T9852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 435.912410][ T9852] Call Trace: [ 435.915853][ T9852] [ 435.918919][ T9852] dump_stack_lvl+0x188/0x24e [ 435.923862][ T9852] ? show_regs_print_info+0x12/0x12 [ 435.929149][ T9852] ? load_image+0x400/0x400 [ 435.933752][ T9852] ? __lock_acquire+0x7d10/0x7d10 [ 435.938873][ T9852] ? lockdep_hardirqs_on+0x94/0x140 [ 435.944132][ T9852] should_fail_ex+0x399/0x4d0 [ 435.948872][ T9852] _copy_from_user+0x2c/0x170 [ 435.953705][ T9852] __copy_msghdr+0x3b7/0x580 [ 435.958531][ T9852] ___sys_sendmsg+0x210/0x360 [ 435.963320][ T9852] ? __sys_sendmsg+0x290/0x290 [ 435.968192][ T9852] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 435.974137][ T9852] __se_sys_sendmsg+0x1bb/0x2a0 [ 435.979277][ T9852] ? __x64_sys_sendmsg+0x80/0x80 [ 435.984391][ T9852] ? lockdep_hardirqs_on+0x94/0x140 [ 435.989942][ T9852] ? __x64_sys_sendmsg+0x30/0x80 [ 435.994957][ T9852] do_syscall_64+0x4c/0xa0 [ 435.999545][ T9852] ? clear_bhb_loop+0x60/0xb0 [ 436.004278][ T9852] ? clear_bhb_loop+0x60/0xb0 [ 436.009120][ T9852] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 436.015100][ T9852] RIP: 0033:0x7f430819c819 [ 436.019852][ T9852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 436.039974][ T9852] RSP: 002b:00007f430912f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 436.048552][ T9852] RAX: ffffffffffffffda RBX: 00007f4308415fa0 RCX: 00007f430819c819 [ 436.056599][ T9852] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000006 [ 436.064635][ T9852] RBP: 00007f430912f090 R08: 0000000000000000 R09: 0000000000000000 [ 436.072668][ T9852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 436.080712][ T9852] R13: 00007f4308416038 R14: 00007f4308415fa0 R15: 00007ffe71f96dc8 [ 436.088768][ T9852] [ 436.748694][ T9871] validate_nla: 5 callbacks suppressed [ 436.748740][ T9871] netlink: 'syz.3.1682': attribute type 29 has an invalid length. [ 436.982757][ T9846] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 437.003531][ T9868] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 437.056039][ T9871] netlink: 'syz.3.1682': attribute type 29 has an invalid length. [ 437.090037][ T9872] netlink: 'syz.3.1682': attribute type 10 has an invalid length. [ 437.099721][ T9872] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 437.141538][ T9872] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 437.195145][ T9872] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 437.257698][ T9872] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 437.380659][ T9883] netlink: 'syz.1.1685': attribute type 2 has an invalid length. [ 437.768068][ T9892] netlink: 'syz.2.1697': attribute type 10 has an invalid length. [ 438.017206][ T9889] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 438.300643][ T9899] netlink: 'syz.2.1690': attribute type 10 has an invalid length. [ 438.391604][ T9899] netlink: 55 bytes leftover after parsing attributes in process `syz.2.1690'. [ 438.820431][ T9920] netlink: 'syz.0.1694': attribute type 3 has an invalid length. [ 438.895881][ T9920] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1694'. [ 440.073674][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.080065][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.389411][ T9910] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 440.425095][ T9924] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 440.745787][ T9937] netlink: 'syz.2.1698': attribute type 21 has an invalid length. [ 440.805488][ T9934] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1701'. [ 440.845155][ T9938] netlink: 'syz.1.1701': attribute type 10 has an invalid length. [ 440.882361][ T9938] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 440.905127][ T4320] wlan1: Trigger new scan to find an IBSS to join [ 440.932233][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 441.010941][ T9938] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 441.082475][ T9938] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 441.113323][ T9938] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 441.158777][ T9928] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 441.853433][ T9] wlan1: Trigger new scan to find an IBSS to join [ 441.861031][ T4935] wlan1: Creating new IBSS network, BSSID 56:d3:f8:bb:2d:41 [ 441.958166][ T9958] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 442.151303][ T9969] netlink: 'syz.1.1710': attribute type 29 has an invalid length. [ 442.179429][ T9969] netlink: 'syz.1.1710': attribute type 29 has an invalid length. [ 442.229261][ T9969] netlink: 'syz.1.1710': attribute type 29 has an invalid length. [ 442.327472][ T9972] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 442.901610][ T11] wlan1: Trigger new scan to find an IBSS to join [ 442.908707][ T9] wlan1: Trigger new scan to find an IBSS to join [ 442.944991][ T9986] netlink: 'syz.4.1714': attribute type 3 has an invalid length. [ 442.987407][ T9986] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1714'. [ 443.414877][ T9989] netlink: 'syz.1.1715': attribute type 28 has an invalid length. [ 443.425453][ T9989] netlink: 'syz.1.1715': attribute type 29 has an invalid length. [ 443.434953][ T9989] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1715'. [ 445.522009][ T9967] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 445.608416][ T9990] netlink: 'syz.1.1715': attribute type 10 has an invalid length. [ 445.620098][ T9990] netlink: 55 bytes leftover after parsing attributes in process `syz.1.1715'. [ 445.858990][ T11] wlan1: Trigger new scan to find an IBSS to join [ 446.181499][ T9997] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1718'. [ 446.539274][ T9998] netlink: 'syz.4.1718': attribute type 10 has an invalid length. [ 446.554077][ T9998] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 446.571913][ T9998] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 446.589844][ T9998] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 446.611676][ T9998] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 446.651308][ T9994] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 447.003899][T10008] netlink: 'syz.1.1719': attribute type 29 has an invalid length. [ 447.058792][T10008] netlink: 'syz.1.1719': attribute type 29 has an invalid length. [ 447.100414][T10012] FAULT_INJECTION: forcing a failure. [ 447.100414][T10012] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 447.172676][T10012] CPU: 0 PID: 10012 Comm: syz.1.1719 Not tainted syzkaller #0 [ 447.180328][T10012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 447.190465][T10012] Call Trace: [ 447.193794][T10012] [ 447.196785][T10012] dump_stack_lvl+0x188/0x24e [ 447.201547][T10012] ? show_regs_print_info+0x12/0x12 [ 447.206833][T10012] ? load_image+0x400/0x400 [ 447.211500][T10012] ? __lock_acquire+0x7d10/0x7d10 [ 447.216697][T10012] should_fail_ex+0x399/0x4d0 [ 447.221450][T10012] _copy_from_user+0x2c/0x170 [ 447.226233][T10012] iovec_from_user+0x143/0x360 [ 447.231067][T10012] __import_iovec+0x6d/0x500 [ 447.235712][T10012] import_iovec+0x6f/0xa0 [ 447.240112][T10012] ___sys_sendmsg+0x252/0x360 [ 447.244854][T10012] ? __sys_sendmsg+0x290/0x290 [ 447.249691][T10012] ? __lock_acquire+0x7d10/0x7d10 [ 447.254791][T10012] __se_sys_sendmsg+0x1bb/0x2a0 [ 447.259688][T10012] ? ct_nmi_exit+0x145/0x1c0 [ 447.264320][T10012] ? __x64_sys_sendmsg+0x80/0x80 [ 447.269349][T10012] ? lockdep_hardirqs_on+0x94/0x140 [ 447.274636][T10012] do_syscall_64+0x4c/0xa0 [ 447.279275][T10012] ? clear_bhb_loop+0x60/0xb0 [ 447.283998][T10012] ? clear_bhb_loop+0x60/0xb0 [ 447.288808][T10012] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 447.294755][T10012] RIP: 0033:0x7f6ef959c819 [ 447.299313][T10012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.319302][T10012] RSP: 002b:00007f6efa39c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 447.327952][T10012] RAX: ffffffffffffffda RBX: 00007f6ef9816090 RCX: 00007f6ef959c819 [ 447.336096][T10012] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000007 [ 447.344194][T10012] RBP: 00007f6efa39c090 R08: 0000000000000000 R09: 0000000000000000 [ 447.352225][T10012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 447.360242][T10012] R13: 00007f6ef9816128 R14: 00007f6ef9816090 R15: 00007fffb4cdc148 [ 447.368360][T10012] [ 447.852297][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 447.852495][ T9] wlan1: Trigger new scan to find an IBSS to join [ 448.737599][T10038] validate_nla: 1 callbacks suppressed [ 448.737639][T10038] netlink: 'syz.4.1731': attribute type 29 has an invalid length. [ 448.807798][T10043] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1731'. [ 448.817727][ T7577] wlan1: Trigger new scan to find an IBSS to join [ 448.846974][T10044] netlink: 'syz.3.1729': attribute type 3 has an invalid length. [ 448.922564][T10044] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1729'. [ 450.812465][ T4934] wlan1: Trigger new scan to find an IBSS to join [ 451.655759][ T4935] wlan1: Creating new IBSS network, BSSID f6:07:c1:c3:00:28 [ 451.668872][ T9] wlan1: Creating new IBSS network, BSSID d2:08:9a:c0:7a:6c [ 451.688170][T10031] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 451.698300][T10038] netlink: 'syz.4.1731': attribute type 29 has an invalid length. [ 451.705171][ T9] ------------[ cut here ]------------ [ 451.712000][ T9] WARNING: CPU: 0 PID: 9 at net/wireless/ibss.c:37 __cfg80211_ibss_joined+0x428/0x4b0 [ 451.712892][T10045] netlink: 'syz.4.1731': attribute type 10 has an invalid length. [ 451.722377][ T9] Modules linked in: [ 451.734253][ T9] CPU: 0 PID: 9 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 451.741613][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 451.747546][T10045] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 451.751764][ T9] Workqueue: cfg80211 cfg80211_event_work [ 451.769818][ T9] RIP: 0010:__cfg80211_ibss_joined+0x428/0x4b0 [ 451.776105][ T9] Code: 00 00 00 48 3b 84 24 80 00 00 00 75 57 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 f1 6c ed f7 0f 0b eb bb e8 e8 6c ed f7 <0f> 0b eb b2 e8 df 6c ed f7 0f 0b e9 77 fd ff ff e8 d3 6c ed f7 0f [ 451.796017][ T9] RSP: 0018:ffffc900000e7aa0 EFLAGS: 00010293 [ 451.802193][ T9] RAX: ffffffff89950868 RBX: dffffc0000000000 RCX: ffff88813fe70000 [ 451.810229][ T9] RDX: 0000000000000000 RSI: ffffffff8a8c10a0 RDI: ffffffff8adf11a0 [ 451.818396][ T9] RBP: ffffc900000e7b70 R08: ffffffff90af92a7 R09: 1ffffffff215f254 [ 451.826477][ T9] R10: dffffc0000000000 R11: fffffbfff215f255 R12: ffff888053e6b5b8 [ 451.834580][ T9] R13: 1ffff9200001cf5c R14: 000000000000001f R15: ffff888076454c90 [ 451.842670][ T9] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 451.851671][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 451.858362][ T9] CR2: 00007f4af9a4d990 CR3: 0000000023c29000 CR4: 00000000003506f0 [ 451.866479][ T9] DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 [ 451.869324][T10045] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 451.874528][ T9] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 451.874551][ T9] Call Trace: [ 451.874573][ T9] [ 451.874587][ T9] ? mutex_lock_nested+0x10/0x10 [ 451.874631][ T9] ? trace_rdev_return_void+0x240/0x240 [ 451.874670][ T9] cfg80211_process_wdev_events+0x3ad/0x550 [ 451.874710][ T9] cfg80211_process_rdev_events+0x9d/0x110 [ 451.921817][ T9] ? process_one_work+0x7b0/0x1160 [ 451.927067][ T9] cfg80211_event_work+0x2b/0x40 [ 451.932219][ T9] process_one_work+0x8a2/0x1160 [ 451.937256][ T9] ? worker_detach_from_pool+0x240/0x240 [ 451.942997][ T9] ? _raw_spin_lock_irq+0x86/0xf0 [ 451.946965][T10045] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 451.948077][ T9] ? _raw_spin_lock_irq+0xb7/0xf0 [ 451.948112][ T9] ? _raw_spin_lock_irqsave+0x100/0x100 [ 451.971237][ T9] ? kthread_data+0x4b/0xc0 [ 451.976040][ T9] worker_thread+0xaa2/0x1270 [ 451.980821][ T9] kthread+0x29d/0x330 [ 451.984985][ T9] ? worker_clr_flags+0x1a0/0x1a0 [ 451.990089][ T9] ? kthread_blkcg+0xd0/0xd0 [ 451.994795][ T9] ret_from_fork+0x1f/0x30 [ 451.999315][ T9] [ 452.002423][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 452.009760][ T9] CPU: 0 PID: 9 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 452.017088][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 452.027194][ T9] Workqueue: cfg80211 cfg80211_event_work [ 452.032995][ T9] Call Trace: [ 452.036316][ T9] [ 452.039292][ T9] dump_stack_lvl+0x188/0x24e [ 452.042637][T10045] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 452.050755][ T9] ? memcpy+0x3c/0x60 [ 452.054803][ T9] ? show_regs_print_info+0x12/0x12 [ 452.060091][ T9] ? load_image+0x400/0x400 [ 452.064664][ T9] panic+0x2e5/0x730 [ 452.068611][ T9] ? bpf_jit_dump+0xd0/0xd0 [ 452.073199][ T9] ? ret_from_fork+0x1f/0x30 [ 452.077854][ T9] __warn+0x2f8/0x4f0 [ 452.081885][ T9] ? __cfg80211_ibss_joined+0x428/0x4b0 [ 452.087574][ T9] ? __cfg80211_ibss_joined+0x428/0x4b0 [ 452.093173][ T9] report_bug+0x2ba/0x4f0 [ 452.097602][ T9] ? __cfg80211_ibss_joined+0x428/0x4b0 [ 452.103216][ T9] handle_bug+0x3a/0x70 [ 452.107431][ T9] exc_invalid_op+0x16/0x40 [ 452.111987][ T9] asm_exc_invalid_op+0x16/0x20 [ 452.116883][ T9] RIP: 0010:__cfg80211_ibss_joined+0x428/0x4b0 [ 452.123075][ T9] Code: 00 00 00 48 3b 84 24 80 00 00 00 75 57 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 f1 6c ed f7 0f 0b eb bb e8 e8 6c ed f7 <0f> 0b eb b2 e8 df 6c ed f7 0f 0b e9 77 fd ff ff e8 d3 6c ed f7 0f [ 452.142819][ T9] RSP: 0018:ffffc900000e7aa0 EFLAGS: 00010293 [ 452.149001][ T9] RAX: ffffffff89950868 RBX: dffffc0000000000 RCX: ffff88813fe70000 [ 452.157225][ T9] RDX: 0000000000000000 RSI: ffffffff8a8c10a0 RDI: ffffffff8adf11a0 [ 452.165249][ T9] RBP: ffffc900000e7b70 R08: ffffffff90af92a7 R09: 1ffffffff215f254 [ 452.173323][ T9] R10: dffffc0000000000 R11: fffffbfff215f255 R12: ffff888053e6b5b8 [ 452.181348][ T9] R13: 1ffff9200001cf5c R14: 000000000000001f R15: ffff888076454c90 [ 452.189468][ T9] ? __cfg80211_ibss_joined+0x428/0x4b0 [ 452.195246][ T9] ? mutex_lock_nested+0x10/0x10 [ 452.200354][ T9] ? trace_rdev_return_void+0x240/0x240 [ 452.205943][ T9] cfg80211_process_wdev_events+0x3ad/0x550 [ 452.211892][ T9] cfg80211_process_rdev_events+0x9d/0x110 [ 452.217778][ T9] ? process_one_work+0x7b0/0x1160 [ 452.222931][ T9] cfg80211_event_work+0x2b/0x40 [ 452.227912][ T9] process_one_work+0x8a2/0x1160 [ 452.232896][ T9] ? worker_detach_from_pool+0x240/0x240 [ 452.239012][ T9] ? _raw_spin_lock_irq+0x86/0xf0 [ 452.244085][ T9] ? _raw_spin_lock_irq+0xb7/0xf0 [ 452.249149][ T9] ? _raw_spin_lock_irqsave+0x100/0x100 [ 452.254995][ T9] ? kthread_data+0x4b/0xc0 [ 452.259554][ T9] worker_thread+0xaa2/0x1270 [ 452.264300][ T9] kthread+0x29d/0x330 [ 452.268398][ T9] ? worker_clr_flags+0x1a0/0x1a0 [ 452.273667][ T9] ? kthread_blkcg+0xd0/0xd0 [ 452.278314][ T9] ret_from_fork+0x1f/0x30 [ 452.282886][ T9] [ 452.286693][ T9] Kernel Offset: disabled [ 452.291312][ T9] Rebooting in 86400 seconds..