last executing test programs: 2.166440925s ago: executing program 0 (id=2747): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000180)="5c00000014006b15c84e21008bf32c19020000f80200000044000200edb556a705251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b780000ffffff0000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (fail_nth: 1) 2.090511167s ago: executing program 3 (id=2750): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000002000000000000000100000d0200000000000000000000000000210000000004"], 0x0, 0x3a, 0x0, 0x1}, 0x28) 1.794035715s ago: executing program 2 (id=2751): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000180)="5c00000014006b15c84e21008bf32c19020000f80200000044000200edb556a705251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000001100", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 1.750394245s ago: executing program 0 (id=2752): r0 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=0xffffffffffffffff, 0x4) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x9, &(0x7f0000000040)=@raw=[@map_val={0x18, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xe9a}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @jmp={0x5, 0x1, 0xa, 0x2, 0x6, 0xfffffffffffffffc, 0x10}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}, @map_fd], &(0x7f00000000c0)='syzkaller\x00', 0xfc9c, 0x42, &(0x7f0000000100)=""/66, 0x41100, 0x14, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0xa, 0x5}, 0x8, 0x10, &(0x7f00000001c0)={0x4, 0xc, 0xffff2fd7, 0x7ff}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000200)=[0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0xf703}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000300)={r0, r1, 0x4}, 0x10) close(r0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x3}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1d, 0x10, 0x6, 0x10, 0x144, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x4}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000900)={r1, 0xe0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x5, &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x5c, &(0x7f0000000700)=[{}], 0x8, 0x10, &(0x7f0000000740), &(0x7f0000000780), 0x8, 0x9c, 0x8, 0x8, &(0x7f00000007c0)}}, 0x10) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000000940)={r0}, 0x8) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000a00)={0x0, 0x4, 0x10}, 0xc) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x1a, &(0x7f0000000480)=@raw=[@map_val={0x18, 0x6, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x3}, @exit, @map_val={0x18, 0x0, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xd}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3209}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}], &(0x7f0000000580)='syzkaller\x00', 0x7, 0x0, &(0x7f00000005c0), 0x40f00, 0x0, '\x00', r5, 0x0, r7, 0x8, &(0x7f0000000980)={0x4, 0x3}, 0x8, 0x10, &(0x7f00000009c0)={0x0, 0x0, 0x4f48, 0x81}, 0x10, 0x0, 0x0, 0xa, &(0x7f0000000a40)=[r8, 0xffffffffffffffff], &(0x7f0000000a80)=[{0x0, 0x3, 0x6, 0x1}, {0x4, 0x5, 0xc, 0x7}, {0x0, 0x5, 0xf, 0x5}, {0x5, 0x3, 0xf, 0x5}, {0x2, 0x5, 0xc, 0x7}, {0x1, 0x5, 0xf, 0x1}, {0x0, 0x1, 0x7, 0x9}, {0x1, 0x1, 0xe}, {0x0, 0x3, 0xc, 0x1}, {0x3, 0x4, 0x1, 0x4}], 0x10, 0x1f}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000d80)={r2, 0x58, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r11 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000dc0)=r6, 0x4) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000ec0)={0xa, 0x4, &(0x7f0000000c00)=@raw=[@btf_id={0x18, 0x9, 0x3, 0x0, 0x5}, @jmp={0x5, 0x0, 0x3, 0x9, 0xf, 0x18, 0x10}, @call={0x85, 0x0, 0x0, 0x61}], &(0x7f0000000c40)='syzkaller\x00', 0x81, 0x4c, &(0x7f0000000c80)=""/76, 0x40f00, 0x6c, '\x00', r10, @fallback, r11, 0x8, &(0x7f0000000e00)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000e40)={0x2, 0xc, 0x6, 0x800}, 0x10, r6, r1, 0x0, &(0x7f0000000e80)=[0xffffffffffffffff], 0x0, 0x10, 0x5}, 0x94) r13 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001080)={&(0x7f0000000f80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x64, 0x64, 0x5, [@restrict={0x5, 0x0, 0x0, 0xb, 0x4}, @fwd={0x8}, @fwd={0x5}, @decl_tag={0xb, 0x0, 0x0, 0x11, 0x3}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x7, 0x5}]}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x2, 0x1}, {0x6, 0x2}]}]}, {0x0, [0x30, 0x2e, 0x61]}}, &(0x7f0000001040)=""/56, 0x81, 0x38, 0x1, 0x40}, 0x28) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000010c0)='./cgroup/syz1\x00', 0x200002, 0x0) r14 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001380)={0x6, 0x9, &(0x7f0000001100)=@raw=[@btf_id={0x18, 0xa, 0x3, 0x0, 0x1}, @jmp={0x5, 0x0, 0xc, 0x9, 0xb, 0x6, 0x10}, @map_val={0x18, 0x9}, @jmp={0x5, 0x0, 0xc, 0x1, 0x0, 0x10, 0x1}, @ldst={0x2, 0x1, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffff0}, @map_val={0x18, 0x5, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x1c000000}], &(0x7f0000001180)='GPL\x00', 0x1, 0xd9, &(0x7f00000011c0)=""/217, 0x40f00, 0x20, '\x00', 0x0, 0x25, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f00000012c0)={0x3, 0x7, 0xc, 0x3}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000001300)=[r4, r3, r2, r3, r2], &(0x7f0000001340)=[{0x5, 0x4, 0x8}, {0x4, 0x4, 0x5, 0xb}, {0x0, 0x5, 0x2}, {0x1, 0x2, 0x4, 0x8}], 0x10, 0xfff}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001540)={@fallback=r11, 0x22, 0x0, 0x3, &(0x7f0000001440)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000001480)=[0x0, 0x0], &(0x7f00000014c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000001500)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000001580)={@ifindex=r5, r1, 0x5, 0x18, r14, @void, @value=r12, @void, @void, r16}, 0x20) r17 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001740)={&(0x7f00000015c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x15c, 0x15c, 0x9, [@struct={0x3, 0x9, 0x0, 0x4, 0x0, 0x793, [{0x8, 0x3, 0xfffffffd}, {0xf, 0x1, 0x1}, {0x5, 0x5, 0x6}, {0x0, 0x0, 0x8}, {0x1, 0x0, 0x89}, {0x1, 0x0, 0xffffffff}, {0x6, 0x1, 0x4}, {0x6, 0x2, 0x5}, {0x10, 0x1}]}, @ptr={0xc, 0x0, 0x0, 0x2, 0x3}, @union={0x3, 0x1, 0x0, 0x5, 0x1, 0x10001, [{0x6, 0x5, 0x7b}]}, @restrict={0x10, 0x0, 0x0, 0xb, 0x3}, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x1}, {0xe, 0x1}, {0x10, 0x4}, {0x8, 0x2}]}, @ptr={0xb}, @union={0x4, 0x8, 0x0, 0x5, 0x1, 0x2, [{0x8, 0x1, 0x10000}, {0xb, 0x3, 0x400}, {0x10, 0x5, 0x2}, {0x3, 0x4, 0xffffffff}, {0xb, 0x1, 0x4}, {0xa, 0x0, 0x100}, {0x10, 0x5, 0xfffffffd}, {0x6, 0x3, 0x3}]}, @int={0x1, 0x0, 0x0, 0x1, 0x0, 0x7d, 0x0, 0x12, 0x5}]}, {0x0, [0x30, 0x0, 0x0, 0x0, 0x0, 0x2e, 0x2e]}}, 0xffffffffffffffff, 0x17d, 0x0, 0x0, 0xfffffff3}, 0x28) openat$tun(0xffffffffffffff9c, &(0x7f0000001780), 0x40, 0x0) r18 = bpf$MAP_CREATE(0x0, &(0x7f00000017c0)=@base={0x11, 0x9, 0xefcb, 0x400, 0x90, r2, 0x9, '\x00', r10, r13, 0x3, 0x4, 0x4}, 0x50) r19 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001840)={0x1b, 0x0, 0x0, 0x0, 0x0, r3, 0x101, '\x00', r10, r15, 0x2, 0x3, 0x1}, 0x50) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001b00)={0x10001, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000001b80)={0x1, 0x2d, &(0x7f00000018c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401}, {{0x18, 0x1, 0x1, 0x0, r18}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @map_fd={0x18, 0x8, 0x1, 0x0, r19}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xe4b}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xe}, @call={0x85, 0x0, 0x0, 0x27}, @call={0x85, 0x0, 0x0, 0xac}, @call={0x85, 0x0, 0x0, 0xd}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001a40)='syzkaller\x00', 0xffff, 0x0, 0x0, 0x41000, 0x56, '\x00', r10, @fallback=0x33, r11, 0x8, &(0x7f0000001a80)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000001ac0)={0x1, 0xf, 0x81, 0x4}, 0x10, r20, r9, 0x3, 0x0, &(0x7f0000001b40)=[{0x3, 0x3, 0xa, 0x1}, {0x5, 0x2, 0x9, 0xc}, {0x4, 0x1, 0xd, 0x6}]}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001d80)={0x7ff, 0x0}, 0x8) r22 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e40)=@bpf_lsm={0x1d, 0xf, &(0x7f0000001c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001cc0)='GPL\x00', 0x1ff, 0x0, 0x0, 0x41100, 0x49, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000001d00)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000001d40)={0x4, 0x6, 0x2, 0xd}, 0x10, r21, 0x0, 0x1, &(0x7f0000001dc0)=[r3], &(0x7f0000001e00)=[{0x1, 0x1, 0xb, 0xa}], 0x10, 0x4}, 0x94) r23 = bpf$PROG_LOAD(0x5, &(0x7f0000002180)={0x1e, 0x10, &(0x7f0000001f00)=@raw=[@alu={0x7, 0x0, 0x0, 0x1, 0x4, 0x2}, @ldst={0x0, 0x1, 0x2, 0x9, 0x4, 0x50, 0xfffffffffffffff0}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r18}}, @jmp={0x5, 0x0, 0x4, 0x3, 0x8, 0x0, 0x8}], &(0x7f0000001f80)='GPL\x00', 0x3, 0x23, &(0x7f0000001fc0)=""/35, 0x40f00, 0x5022e303065b78de, '\x00', r5, @sk_lookup, r17, 0x8, &(0x7f0000002000)={0x1, 0x3}, 0x8, 0x10, &(0x7f0000002040)={0x2, 0x0, 0x8, 0x81}, 0x10, r6, r14, 0x9, &(0x7f0000002080)=[r8, r19], &(0x7f00000020c0)=[{0x5, 0x4, 0x10, 0x4}, {0x3, 0x4, 0x5}, {0x4, 0x1, 0x1, 0xa}, {0x2, 0x5, 0xf, 0x1}, {0x4, 0x3, 0xf, 0xb}, {0x1, 0x5, 0x5, 0x5ac7edc307293ad8}, {0x3, 0x3, 0xa, 0xc}, {0x0, 0x4, 0xb, 0x8}, {0x5, 0x2, 0x4}], 0x10, 0x1, @value=r7}, 0x94) ioctl$TUNGETVNETHDRSZ(r15, 0x800454d7, &(0x7f0000002240)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000002280)={@map=r18, r23, 0x29, 0xa, r22, @void, @value=r9, @void, @void, r16}, 0x20) 1.750286265s ago: executing program 1 (id=2753): r0 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b8825fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b400", 0x28}], 0x1}, 0xf00000000000000) 1.695544637s ago: executing program 3 (id=2754): socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0xb, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xd, 0x590f}, 0x2920, 0x0, 0x6, 0x8, 0x80000000, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0e000000040000000400000003"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0x5, 0x0}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x4, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb0ff, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, 0x0) 1.659569258s ago: executing program 2 (id=2755): socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002f000000620a00ff000000007500000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="00000000000000000504000000a48774000000f7"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000900)={r0, 0xe0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x93, &(0x7f0000000300)=[{}], 0x8, 0x10, &(0x7f0000000340), &(0x7f0000000780), 0x8, 0xb6, 0x8, 0x8, &(0x7f00000007c0)}}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x25, r0}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000080), &(0x7f0000000200)='%pi6 \x00'}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x58, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x8, [@datasec={0x5, 0x4, 0x0, 0xf, 0x1, [{0x4, 0x1, 0x3590}, {0x3, 0x6, 0x4}, {0x4, 0x7, 0xcb}, {0x4, 0x1c38a4c0, 0x6}], "f6"}]}, {0x0, [0x61, 0x2e, 0x2e, 0x2e, 0x61, 0x0]}}, &(0x7f0000000440)=""/213, 0x60, 0xd5, 0x0, 0x3, 0x10000}, 0x28) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x9, 0x0, r3, 0x7, '\x00', r4, r5, 0x2, 0x4}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.546671781s ago: executing program 0 (id=2756): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0xc8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="8fedcb791f6f9875f37538e486dd6317ce81e6978800fe08000e40000200875a65969ff57b00ff02000000000000000000e697000001"], 0xfdef) 1.545132851s ago: executing program 1 (id=2757): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xc, 0xc, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2ffff}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0, 0x0, 0x0, 0x0, 0x2000000}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}]}, &(0x7f0000000180)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x7, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.544824981s ago: executing program 3 (id=2758): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0xffffffffffffffff, 0xffffffffffffffff}, 0x0, 0x0}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x4, 0x5, &(0x7f00000007c0)=ANY=[@ANYBLOB="180200000200000000000000000000008500000028000000850000002a00000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x7, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000dc0)={0x1b, 0x0, 0x0, 0x5, 0x0, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001640)={r0, 0x58, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001800)={&(0x7f0000001680)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xab, 0xab, 0x9, [@typedef={0x2, 0x0, 0x0, 0x8, 0x3}, @float={0x9, 0x0, 0x0, 0x10, 0x4}, @enum64={0xe, 0x8, 0x0, 0x13, 0x1, 0x6, [{0x1, 0x2, 0xc003b44}, {0xe, 0x5, 0x4}, {0x6, 0x3, 0x5}, {0x7, 0x1, 0xbe}, {0x7, 0x1c, 0x8}, {0xa, 0x4}, {0xd, 0x2, 0x1}, {0x4, 0x2, 0xf}]}, @datasec={0xa, 0x2, 0x0, 0xf, 0x3, [{0x5, 0x5, 0xd1}, {0x3, 0x4, 0xfffffffb}], "66a8de"}]}, {0x0, [0x2e, 0x2e, 0x2e, 0x61, 0x61, 0x30, 0x2e]}}, &(0x7f0000001780)=""/108, 0xcd, 0x6c, 0x0, 0x40}, 0x28) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001940)={{0x1, 0xffffffffffffffff}, &(0x7f00000018c0), &(0x7f0000001900)='%+9llu \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000019c0)={0x18, 0x18, &(0x7f00000013c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xf}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@generic={0x4, 0x9, 0x5, 0x6fd8, 0xff}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @ldst={0x3, 0x0, 0x50a48b1f21fbfdac, 0xb, 0x4, 0xffffffffffffffc0}, @initr0={0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x2}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001480)='syzkaller\x00', 0x9, 0xc7, &(0x7f00000014c0)=""/199, 0x40f00, 0x0, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000001840)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001880)={0x4, 0xf, 0x1, 0x40}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000001980)=[r0, r0, r0, r5, r0, r0], 0x0, 0x10, 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xe, 0x0, &(0x7f0000000040)="00001b0031000000000000000000", 0x0, 0x20007539, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.procs\x00', 0x2, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0x6, [@var={0x3, 0x0, 0x0, 0xe, 0x1}, @fwd={0x10}, @fwd={0x2}, @var={0xa, 0x0, 0x0, 0xe, 0x1, 0x1}, @enum={0xa, 0x2, 0x0, 0x6, 0x4, [{0x1, 0x1ff}, {0xf, 0x8}]}, @func={0xf, 0x0, 0x0, 0xc, 0x4}]}, {0x0, [0x2e, 0x0, 0x30, 0x5f]}}, &(0x7f0000000180)=""/63, 0x7e, 0x3f, 0x0, 0x9}, 0x28) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="18020000feffffff0000000003000000850000004100000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f805ffffb702000008000006b703000003000000850000001700000095"], &(0x7f0000000e40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0xe, 0x0, &(0x7f0000000240)="f529340da29de991a0b256ed5010", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000a80)={0x0, r6}, 0x8) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x1d, 0x5, &(0x7f0000000180)=ANY=[@ANYRES8=r0], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001100)={r8, 0xe0, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000100), &(0x7f0000001380)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x42, &(0x7f0000000200)=[{}, {}, {}, {}], 0x20, 0x0, 0x0, &(0x7f0000000f80), 0x8, 0x12, 0x8, 0x8, &(0x7f0000000fc0)}}, 0x10) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001200)={&(0x7f0000001140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x5}, {0x0, [0x5f, 0x30, 0x2e]}}, 0x0, 0x1d, 0x0, 0x1, 0x0, 0x10000}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x18, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3}, [@exit]}, &(0x7f0000000080)='GPL\x00', 0x179, 0x0, 0x0, 0x41000, 0x48, '\x00', r9, 0x0, r10, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001280)=[{0x1, 0x2, 0x1, 0x9}], 0x10, 0x8}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001a80)=@bpf_lsm={0x1d, 0xd, &(0x7f0000000ac0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}}, @call={0x85, 0x0, 0x0, 0x21}]}, &(0x7f0000000b40)='syzkaller\x00', 0x6, 0x21, &(0x7f0000000c40)=""/33, 0x41000, 0x0, '\x00', r9, 0x1b, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000c80)={0x1, 0x2, 0x6}, 0x10, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000cc0)=[r0], 0x0, 0x10, 0x3800000}, 0x94) r11 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000d00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x0, 0x3}, {0x7, 0x3}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x44}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e80)={0x11, 0xd, &(0x7f0000001180)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}}], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r9, 0x0, r11, 0x8, &(0x7f0000000240)={0x0, 0x5}, 0x8}, 0x94) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0x2, 0xe6, 0x7, 0x4000a, 0xffffffffffffffff, 0x4, '\x00', r9, r11, 0x2, 0x2, 0x3, 0x5}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{r0, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f00000004c0)=r1}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000880)={r12, 0x58, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r15 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000900)={0xffffffffffffffff, 0x6, 0x8}, 0xc) r16 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r16], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x28}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x11, 0x13, &(0x7f0000000540)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r13}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x400}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r12}}, @call={0x85, 0x0, 0x0, 0x36}], &(0x7f0000000680)='GPL\x00', 0xc2e7, 0xf4, &(0x7f00000006c0)=""/244, 0x40f00, 0x44, '\x00', r14, 0x0, r6, 0x8, &(0x7f00000008c0)={0x0, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000940)=[r0, r0, r15, r16], &(0x7f0000000980)=[{0x0, 0x4, 0x8, 0x2}, {0x1, 0x2, 0x5, 0xb}, {0x5, 0x2, 0x9}], 0x10, 0xb}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r12}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r12, &(0x7f0000000180), 0x0}, 0x20) socket$kcm(0x10, 0x0, 0x10) 1.417639944s ago: executing program 1 (id=2759): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x40, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x15, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b7020000380d0000bfa30000000000000703000000feffff720af0fff8ffff1989a4f0ff00000000b7060000080000001e640000000000004504040001000000170400000c000a00b7040000ff0100006a0af2fe00000000850000001a000000b70000003f00000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb937b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c4608800000000000000005cbb5a2600"], &(0x7f0000000040)='syzkaller\x00', 0x2000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffe49}, 0x42) 1.396234915s ago: executing program 0 (id=2760): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0xc8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(0x3) close(r1) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="8fedcb791f6f9875f37538e486dd6317ce81e6978800fe08000e40000200875a65969ff57b00ff020000000000030000000000000001e2607e15004dab"], 0xfdef) 1.19442301s ago: executing program 2 (id=2761): ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x7c, 0x0, 0x6}]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x80000, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000180)=ANY=[@ANYBLOB="0100050001aaaaaabbbbbbbbbbbb000000000000ffffffffffff0000000000000000"]) (async) r1 = socket$kcm(0xa, 0x1, 0x106) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x2, 0x300}, {0x6e, 0x0, 0xd}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9, 0x0, 0x0, 0x20000f19}, {0x3, 0x0, 0x6, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @dev, 0xfffff001}, 0x80, 0x0}, 0xe07e872420dfefca) (async) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="62202a3a340977770a89"], 0xa) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000640), 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x50) r4 = socket$kcm(0xf, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000080000700000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x1c, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$inet(r4, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x600) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000026000000240000000200000000000000000000040000000300000000000000060400000000000000007a000d020000000000"], 0xffffffffffffffff, 0x3e, 0xb1, 0x2}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6tnl0\x00', 0x210}) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r6 = perf_event_open(&(0x7f00000002c0)={0x4, 0x80, 0xdc, 0xc, 0x10, 0x6b, 0x0, 0x9a, 0x2008, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x401, 0xffffffffffffffff}, 0xab0, 0xc3d, 0x4bd6, 0x5, 0x33df, 0x40, 0xfe, 0x0, 0x9c6, 0x0, 0x9}, 0x0, 0xd, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, @perf_config_ext, 0x800, 0x0, 0x20, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2ff}, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0x0) (async) ioctl$PERF_EVENT_IOC_ID(r6, 0x80082407, &(0x7f0000000400)) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89f1, &(0x7f0000000080)) 1.15988814s ago: executing program 1 (id=2762): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xc, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000e9ff0000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008000000bc0900000000020845080100002000009500000000000000b7020000000000007b9af8ff00000000b5090000000000007baaf0ff00000000bf2700000000000007080000fffdffffbfa400000000000007040000f0ffffffc40200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608efff76000000bf9800000000000056090000000000008500000000004000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.135126141s ago: executing program 0 (id=2763): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x120a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0xc2b8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0xa, 0x6, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x2a040, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}, 0x10022) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000030feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7303f01e5cdb5682ddf73d65c3de1d88dd7496d6345d5b9de0223988056a53e19a8b96b9640bc6c09d3c2ff894d626b57c776ed53f94d5e22ff148061b37f72bd92924cb1d0a725e19b264346b7cae0251a850de78316503f3c3d395c7e3f04fc8d52583327cd2341ce4b2d092815376299686f41353b2823814563011a2223b9dd00000000000000000000003a131374a3371cb3e2a9bb4d798b91cefa444501f40b7c9589e8c0bb6c82123d2b45ce905d0903b32ecf30e828c71a07a83f3275f3d661d1af0ffbd5d7f0"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbde8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d944e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7303f01e5cdb5682ddf73d65c3de1d88dd7496d6345d5b9de0223988056a53e19a8b96b9640bc6c09d3c2ff894d626b57c776ed53f94d5e22ff148061b37f72bd92924cb1d0a725e19b264346b7cae0251a850de78316503f3c3d395c7e3f04fc8d52583327cd2341ce4b2d092815376299686f41353b2823814563011a2223b9dd00000000000000000000003a131374a3371cb3e2a9bb4d798b91cefa444501f40b7c9589e8c0bb6c82123d2b45ce905d0903b32ecf30e828c71a07a83f3275f3d661d1af0ffbd5d7f0"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e21, @multicast1}, 0x10, 0x0}, 0x0) 983.101025ms ago: executing program 1 (id=2764): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)) (async) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)) r0 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r0, 0x84, 0x11, &(0x7f0000000000), 0x8) (async) setsockopt$sock_attach_bpf(r0, 0x84, 0x11, &(0x7f0000000000), 0x8) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) (async) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x502b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x2, @perf_config_ext={0x1000000000000, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x4, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf13a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf13a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x5, 0xffffffff}, 0x8000, 0x5, 0x43a1bd76, 0x3, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x30004001) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x24, &(0x7f0000000000), 0x4) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d8150001e0e000000103600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x4000000) (async) sendmsg$kcm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d8150001e0e000000103600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x4000000) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x10, 0x400000002, 0x0) (async) socket$kcm(0x10, 0x400000002, 0x0) socket$kcm(0xa, 0x5, 0x0) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x4, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.swap.events\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.swap.events\x00', 0x275a, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) socket$kcm(0x10, 0x2, 0x0) recvmsg$kcm(r0, &(0x7f0000002540)={&(0x7f0000000200)=@caif=@util, 0x80, &(0x7f0000000580)=[{&(0x7f0000000340)=""/229, 0xe5}, {&(0x7f0000000440)=""/16, 0x10}], 0x2, &(0x7f0000001540)=""/4096, 0x1000}, 0x40000000) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0xe3451, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x4001, 0x35, 0x43a1bd76, 0x3, 0x9, 0x80000001, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x5, 0xffffffffffffffff, 0x9) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) 967.633205ms ago: executing program 2 (id=2765): r0 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r0, &(0x7f0000000c00)={0x0, 0x0, 0x0}, 0xc0) sendmsg$kcm(r0, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty, 0xc4ffffff}, 0x80, 0x0}, 0x20000001) 837.019279ms ago: executing program 2 (id=2766): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x64099, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b81, 0x2, @perf_config_ext={0xfffffffffffffffd, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x9, 0x9, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000080040000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000000f000000bf09000000000000550901000074f6967d00000000000006180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 746.460221ms ago: executing program 1 (id=2767): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="07000000040000001800000003"], 0x50) r1 = socket$kcm(0x23, 0x2, 0x0) recvmsg$kcm(r1, &(0x7f0000001800)={0x0, 0x0, 0x0}, 0x40010160) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000070000850000001b"], 0x0, 0xfffffffe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r2 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0x66137, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x7, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETTXFILTER(r4, 0x400454d1, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x9, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r5) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x1c, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7020000000000008500000008000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b8000005000000a0", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) syz_clone(0x8009400, 0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0) 717.542242ms ago: executing program 0 (id=2768): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x3, 0x3fff8004}, 0x1000, 0x32, 0x43a1bd76, 0x5, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$kcm(0x11, 0x3, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'pim6reg0\x00', 0x2}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4509c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a900d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a3c0db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848022e8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0000000000000000000000000001545f0ec539c3b58facd2f62dc3307a6c91d6b"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000c40)={@cgroup=r1, r1, 0x2f, 0x2c, 0x4}, 0x20) (fail_nth: 8) 660.707903ms ago: executing program 2 (id=2769): openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f00000000c0)=ANY=[@ANYBLOB="0844724c4ecca1aa81ba5f46d69e7bdfd33784ba50356e446affddbeac4688f027d75eaf7adc24340152e6c021760418b8014d8c25ac0f444cd1975586e0404ca486", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000085000000230000009500000000000000"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001800599c6d0eab070004000523"], 0xfe33) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000300)=@o_path={&(0x7f0000000000)='./file0\x00', r1, 0x4000, r2}, 0x18) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, &(0x7f0000002280)={'veth1_vlan\x00', @random="001000"}) 502.593107ms ago: executing program 3 (id=2770): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000008b0000000000000000000000850000001300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000008ea00007b8af8ff000f0000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 128.775896ms ago: executing program 3 (id=2771): r0 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r0, &(0x7f00000007c0)={&(0x7f0000000040)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000080)="92", 0x1}], 0x1, &(0x7f0000000640)=ANY=[@ANYBLOB="2400000000000000000000000700000044140823e000000200000002e00000010000100000000000dc00000000000000840000000700000094040000863900000001000cb2ffb69602013567ffcb060f19367d2b99bdc0f59e428bc33a050a3660f2bb77c7045b050a31efe0215e235d56060495ae0144243471ac14142700000006ac1414bb00000001ac1414bb0000ffff0a01010200000009009404010000866000000000000c253d78b48f9458beb62d0102000d3bf9f2dbdddfea00b260f00503db010436b20603c70109e35e3ab5244a640709675e60e1799f870512e123b12c8654130f6a1f80f526064d12061127d9c9821b1bfe4b42fcb33e2e2d2594040000000000001400000000000000000000000200000022a20000000000001400000000000000000000000200000005000000000000001c"], 0x158}, 0x40) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d000a847ea622fb564500004e23e3f58e76110165f450e71b0075e3002500028d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e786a6d0bdd700"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 0s ago: executing program 3 (id=2772): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x5}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000838500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f375ffff86dd6317ce62070000000000000000431ccaf57b00000000000000000104"], 0xfe1b) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'tunl0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="851000000000000018100000", @ANYRES32, @ANYBLOB="0000000000000000950000000000000045000000000088"], 0x0}, 0x94) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a80016002000014003000000035c0461c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6cc", 0xd8}], 0x1}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000140)=ANY=[@ANYBLOB="050000000000000063112100000000008510000002000000850000000500000095000000000000009500a505000000009e1398140f0ce2661f987f9f256d400e289d7f741150d389d9a1cb6c5a30052af7a06572628528500272ef286ee60298ba2a749588e4768437b6f4b504f31aa414dd02cd83f349ef4333a19b70127a160f1e31927d272108285432b0efd9b8a8e1a8663b8d"], &(0x7f0000000080)='GPL\x00', 0x2, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)) kernel console output (not intermixed with test programs): [ T9166] netlink: 'syz.2.1146': attribute type 3 has an invalid length. [ 276.172762][ T9164] netlink: 'syz.0.1143': attribute type 3 has an invalid length. [ 276.191366][ T9166] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1146'. [ 276.200657][ T9164] netlink: 'syz.0.1143': attribute type 1 has an invalid length. [ 276.223295][ T9164] netlink: 'syz.0.1143': attribute type 1 has an invalid length. [ 276.272579][ T9164] netlink: 'syz.0.1143': attribute type 2 has an invalid length. [ 276.280441][ T9164] netlink: 198100 bytes leftover after parsing attributes in process `syz.0.1143'. [ 277.539537][ T9197] netlink: 'syz.2.1156': attribute type 4 has an invalid length. [ 277.948710][ T9216] netlink: 'syz.1.1164': attribute type 2 has an invalid length. [ 280.119460][ T9300] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.1194'. [ 281.219411][ T9308] netlink: 'syz.3.1196': attribute type 4 has an invalid length. [ 281.875748][ T9316] netlink: 'syz.1.1199': attribute type 4 has an invalid length. [ 281.934581][ T9319] FAULT_INJECTION: forcing a failure. [ 281.934581][ T9319] name failslab, interval 1, probability 0, space 0, times 0 [ 281.969097][ T9319] CPU: 0 PID: 9319 Comm: syz.1.1199 Not tainted syzkaller #0 [ 281.976596][ T9319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 281.986778][ T9319] Call Trace: [ 281.990082][ T9319] [ 281.993033][ T9319] dump_stack_lvl+0x18c/0x250 [ 281.997829][ T9319] ? show_regs_print_info+0x20/0x20 [ 282.003485][ T9319] ? load_image+0x420/0x420 [ 282.008022][ T9319] ? __might_sleep+0xe0/0xe0 [ 282.012637][ T9319] ? __lock_acquire+0x7d80/0x7d80 [ 282.017699][ T9319] should_fail_ex+0x394/0x4c0 [ 282.022413][ T9319] should_failslab+0x9/0x20 [ 282.026941][ T9319] slab_pre_alloc_hook+0x59/0x300 [ 282.031995][ T9319] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 282.037829][ T9319] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 282.043576][ T9319] __kmem_cache_alloc_node+0x53/0x250 [ 282.048993][ T9319] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 282.054740][ T9319] __kmalloc+0xa7/0x240 [ 282.058932][ T9319] tomoyo_realpath_from_path+0xe6/0x5c0 [ 282.064527][ T9319] ? tomoyo_domain+0xd6/0x120 [ 282.069335][ T9319] tomoyo_path_number_perm+0x248/0x5e0 [ 282.074823][ T9319] ? tomoyo_path_number_perm+0x217/0x5e0 [ 282.080518][ T9319] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 282.086010][ T9319] ? ksys_write+0x1d2/0x260 [ 282.090697][ T9319] ? __fget_files+0x28/0x460 [ 282.095340][ T9319] security_file_ioctl+0x70/0xa0 [ 282.100312][ T9319] __se_sys_ioctl+0x48/0x170 [ 282.104934][ T9319] do_syscall_64+0x55/0xb0 [ 282.109374][ T9319] ? clear_bhb_loop+0x40/0x90 [ 282.114071][ T9319] ? clear_bhb_loop+0x40/0x90 [ 282.118772][ T9319] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 282.124688][ T9319] RIP: 0033:0x7f9cb479e0d9 [ 282.129125][ T9319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 282.148939][ T9319] RSP: 002b:00007f9cb56a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 282.157554][ T9319] RAX: ffffffffffffffda RBX: 00007f9cb4a26090 RCX: 00007f9cb479e0d9 [ 282.165562][ T9319] RDX: 0000200000000080 RSI: 0000000000008b06 RDI: 0000000000000009 [ 282.173559][ T9319] RBP: 00007f9cb56a2090 R08: 0000000000000000 R09: 0000000000000000 [ 282.181558][ T9319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 282.189547][ T9319] R13: 00007f9cb4a26128 R14: 00007f9cb4a26090 R15: 00007fff86350cd8 [ 282.197573][ T9319] [ 282.266223][ T9319] ERROR: Out of memory at tomoyo_realpath_from_path. [ 283.924699][ T9361] netlink: 62836 bytes leftover after parsing attributes in process `syz.1.1213'. [ 285.001703][ T9365] bond0: (slave macvlan0): Releasing backup interface [ 285.493093][ T9397] netlink: 'syz.0.1227': attribute type 29 has an invalid length. [ 285.601893][ T9397] netlink: 'syz.0.1227': attribute type 29 has an invalid length. [ 285.619803][ T9400] netlink: 'syz.3.1228': attribute type 10 has an invalid length. [ 285.637153][ T9400] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1228'. [ 285.683966][ T9398] netlink: 'syz.0.1227': attribute type 29 has an invalid length. [ 286.554576][ T9418] netlink: 62836 bytes leftover after parsing attributes in process `syz.2.1233'. [ 286.610960][ T9420] netlink: 'syz.3.1234': attribute type 4 has an invalid length. [ 286.640314][ T9420] FAULT_INJECTION: forcing a failure. [ 286.640314][ T9420] name failslab, interval 1, probability 0, space 0, times 0 [ 286.685237][ T9420] CPU: 1 PID: 9420 Comm: syz.3.1234 Not tainted syzkaller #0 [ 286.692784][ T9420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 286.702881][ T9420] Call Trace: [ 286.706195][ T9420] [ 286.709160][ T9420] dump_stack_lvl+0x18c/0x250 [ 286.713978][ T9420] ? show_regs_print_info+0x20/0x20 [ 286.719223][ T9420] ? load_image+0x420/0x420 [ 286.723785][ T9420] ? __might_sleep+0xe0/0xe0 [ 286.728460][ T9420] ? __lock_acquire+0x7d80/0x7d80 [ 286.733534][ T9420] should_fail_ex+0x394/0x4c0 [ 286.738258][ T9420] should_failslab+0x9/0x20 [ 286.742797][ T9420] slab_pre_alloc_hook+0x59/0x300 [ 286.747941][ T9420] ? tomoyo_encode+0x2ad/0x570 [ 286.752725][ T9420] ? tomoyo_encode+0x2ad/0x570 [ 286.757503][ T9420] __kmem_cache_alloc_node+0x53/0x250 [ 286.762896][ T9420] ? tomoyo_encode+0x2ad/0x570 [ 286.767761][ T9420] __kmalloc+0xa7/0x240 [ 286.771938][ T9420] tomoyo_encode+0x2ad/0x570 [ 286.776550][ T9420] tomoyo_realpath_from_path+0x57c/0x5c0 [ 286.782208][ T9420] ? tomoyo_domain+0xd6/0x120 [ 286.787086][ T9420] tomoyo_path_number_perm+0x248/0x5e0 [ 286.792563][ T9420] ? tomoyo_path_number_perm+0x217/0x5e0 [ 286.798300][ T9420] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 286.803781][ T9420] ? ksys_write+0x1d2/0x260 [ 286.808330][ T9420] ? __fget_files+0x28/0x460 [ 286.812954][ T9420] security_file_ioctl+0x70/0xa0 [ 286.817915][ T9420] __se_sys_ioctl+0x48/0x170 [ 286.822531][ T9420] do_syscall_64+0x55/0xb0 [ 286.826963][ T9420] ? clear_bhb_loop+0x40/0x90 [ 286.831655][ T9420] ? clear_bhb_loop+0x40/0x90 [ 286.836342][ T9420] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 286.842271][ T9420] RIP: 0033:0x7f4ebf99e0d9 [ 286.846700][ T9420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.866400][ T9420] RSP: 002b:00007f4ec08f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 286.874918][ T9420] RAX: ffffffffffffffda RBX: 00007f4ebfc26180 RCX: 00007f4ebf99e0d9 [ 286.882986][ T9420] RDX: 0000200000000080 RSI: 0000000000008b06 RDI: 0000000000000009 [ 286.890980][ T9420] RBP: 00007f4ec08f8090 R08: 0000000000000000 R09: 0000000000000000 [ 286.898982][ T9420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.907054][ T9420] R13: 00007f4ebfc26218 R14: 00007f4ebfc26180 R15: 00007ffeaceb3328 [ 286.915244][ T9420] [ 286.971875][ T9420] ERROR: Out of memory at tomoyo_realpath_from_path. [ 287.858191][ T9441] syz.3.1240[9441] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 287.858480][ T9441] syz.3.1240[9441] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 289.893964][ T9472] FAULT_INJECTION: forcing a failure. [ 289.893964][ T9472] name failslab, interval 1, probability 0, space 0, times 0 [ 289.929612][ T9472] CPU: 0 PID: 9472 Comm: syz.2.1253 Not tainted syzkaller #0 [ 289.937071][ T9472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 289.947160][ T9472] Call Trace: [ 289.950476][ T9472] [ 289.953472][ T9472] dump_stack_lvl+0x18c/0x250 [ 289.958211][ T9472] ? sctp_sendmsg+0x1519/0x27b0 [ 289.963121][ T9472] ? ___sys_sendmsg+0x2a6/0x360 [ 289.968035][ T9472] ? show_regs_print_info+0x20/0x20 [ 289.973287][ T9472] ? load_image+0x420/0x420 [ 289.977858][ T9472] should_fail_ex+0x394/0x4c0 [ 289.982590][ T9472] should_failslab+0x9/0x20 [ 289.987151][ T9472] slab_pre_alloc_hook+0x59/0x300 [ 289.992229][ T9472] ? sctp_add_bind_addr+0x8c/0x360 [ 289.997393][ T9472] __kmem_cache_alloc_node+0x53/0x250 [ 290.002829][ T9472] ? sctp_add_bind_addr+0x8c/0x360 [ 290.007979][ T9472] kmalloc_trace+0x2a/0xe0 [ 290.012434][ T9472] sctp_add_bind_addr+0x8c/0x360 [ 290.017403][ T9472] sctp_copy_local_addr_list+0x31b/0x4e0 [ 290.023067][ T9472] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 290.028810][ T9472] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 290.034991][ T9472] ? sctp_v6_is_any+0x64/0x70 [ 290.039687][ T9472] ? sctp_copy_one_addr+0x8c/0x350 [ 290.044834][ T9472] sctp_bind_addr_copy+0xb3/0x3c0 [ 290.049878][ T9472] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 290.056270][ T9472] sctp_connect_new_asoc+0x2f9/0x6a0 [ 290.061668][ T9472] ? __sctp_connect+0xd80/0xd80 [ 290.066536][ T9472] ? __local_bh_enable_ip+0x13a/0x1c0 [ 290.071934][ T9472] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 290.077500][ T9472] ? security_sctp_bind_connect+0x89/0xb0 [ 290.083249][ T9472] sctp_sendmsg+0x1519/0x27b0 [ 290.087970][ T9472] ? sctp_getsockopt+0xb60/0xb60 [ 290.092937][ T9472] ? aa_af_perm+0x330/0x330 [ 290.097479][ T9472] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 290.103927][ T9472] ? sock_rps_record_flow+0x19/0x3f0 [ 290.109239][ T9472] ? inet_sendmsg+0xce/0x2a0 [ 290.113876][ T9472] ? inet_send_prepare+0x250/0x250 [ 290.119016][ T9472] ____sys_sendmsg+0x61b/0x980 [ 290.123817][ T9472] ? __sys_sendmsg_sock+0x30/0x30 [ 290.128942][ T9472] ? __import_iovec+0x5f2/0x850 [ 290.133833][ T9472] ? import_iovec+0x73/0xa0 [ 290.138362][ T9472] ___sys_sendmsg+0x2a6/0x360 [ 290.143162][ T9472] ? get_pid_task+0x20/0x1e0 [ 290.147806][ T9472] ? __sys_sendmsg+0x2b0/0x2b0 [ 290.152652][ T9472] ? __lock_acquire+0x7d80/0x7d80 [ 290.157777][ T9472] __se_sys_sendmsg+0x1d0/0x2c0 [ 290.162676][ T9472] ? perf_trace_preemptirq_template+0x269/0x330 [ 290.168966][ T9472] ? __x64_sys_sendmsg+0x80/0x80 [ 290.173958][ T9472] ? lockdep_hardirqs_on+0x98/0x150 [ 290.179189][ T9472] do_syscall_64+0x55/0xb0 [ 290.183627][ T9472] ? clear_bhb_loop+0x40/0x90 [ 290.188321][ T9472] ? clear_bhb_loop+0x40/0x90 [ 290.193018][ T9472] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 290.198940][ T9472] RIP: 0033:0x7f320fb9e0d9 [ 290.203478][ T9472] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 290.223257][ T9472] RSP: 002b:00007f32109e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 290.231710][ T9472] RAX: ffffffffffffffda RBX: 00007f320fe25fa0 RCX: 00007f320fb9e0d9 [ 290.239787][ T9472] RDX: 0000000000000880 RSI: 0000200000000600 RDI: 0000000000000004 [ 290.247774][ T9472] RBP: 00007f32109e5090 R08: 0000000000000000 R09: 0000000000000000 [ 290.255762][ T9472] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 290.263837][ T9472] R13: 00007f320fe26038 R14: 00007f320fe25fa0 R15: 00007fffe7681458 [ 290.271851][ T9472] [ 291.739267][ T9497] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1262'. [ 291.765508][ T9497] openvswitch: netlink: Flow key attribute not present in set flow. [ 293.016796][ T9519] netlink: 'syz.0.1271': attribute type 25 has an invalid length. [ 293.031381][ T9519] netlink: 'syz.0.1271': attribute type 3 has an invalid length. [ 293.049147][ T9519] netlink: 'syz.0.1271': attribute type 10 has an invalid length. [ 293.058292][ T9519] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1271'. [ 293.078588][ T9523] netlink: 'syz.3.1272': attribute type 2 has an invalid length. [ 293.199474][ T9525] netlink: 'syz.2.1276': attribute type 9 has an invalid length. [ 293.233613][ T9525] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.1276'. [ 293.314458][ T9530] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1275'. [ 293.364976][ T9530] openvswitch: netlink: Flow key attribute not present in set flow. [ 294.773785][ T9556] netlink: 'syz.0.1283': attribute type 21 has an invalid length. [ 296.696319][ T9597] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1300'. [ 298.115865][ T9624] netlink: 'syz.2.1308': attribute type 10 has an invalid length. [ 298.151006][ T9624] netlink: 55 bytes leftover after parsing attributes in process `syz.2.1308'. [ 298.442053][ T9631] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1312'. [ 298.495440][ T9631] netlink: 'syz.3.1312': attribute type 4 has an invalid length. [ 299.490082][ T9664] FAULT_INJECTION: forcing a failure. [ 299.490082][ T9664] name failslab, interval 1, probability 0, space 0, times 0 [ 299.503436][ T9664] CPU: 0 PID: 9664 Comm: syz.2.1326 Not tainted syzkaller #0 [ 299.510842][ T9664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 299.520936][ T9664] Call Trace: [ 299.524242][ T9664] [ 299.527185][ T9664] dump_stack_lvl+0x18c/0x250 [ 299.531891][ T9664] ? sctp_sendmsg+0x1519/0x27b0 [ 299.536757][ T9664] ? ___sys_sendmsg+0x2a6/0x360 [ 299.541723][ T9664] ? show_regs_print_info+0x20/0x20 [ 299.547124][ T9664] ? load_image+0x420/0x420 [ 299.551773][ T9664] should_fail_ex+0x394/0x4c0 [ 299.556486][ T9664] should_failslab+0x9/0x20 [ 299.561033][ T9664] slab_pre_alloc_hook+0x59/0x300 [ 299.566120][ T9664] ? sctp_add_bind_addr+0x8c/0x360 [ 299.571271][ T9664] __kmem_cache_alloc_node+0x53/0x250 [ 299.576663][ T9664] ? sctp_add_bind_addr+0x8c/0x360 [ 299.581798][ T9664] kmalloc_trace+0x2a/0xe0 [ 299.586230][ T9664] sctp_add_bind_addr+0x8c/0x360 [ 299.591189][ T9664] sctp_copy_local_addr_list+0x31b/0x4e0 [ 299.596926][ T9664] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 299.602657][ T9664] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 299.608739][ T9664] ? sctp_v6_is_any+0x64/0x70 [ 299.613424][ T9664] ? sctp_copy_one_addr+0x8c/0x350 [ 299.618554][ T9664] sctp_bind_addr_copy+0xb3/0x3c0 [ 299.623593][ T9664] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 299.629937][ T9664] sctp_connect_new_asoc+0x2f9/0x6a0 [ 299.635259][ T9664] ? __sctp_connect+0xd80/0xd80 [ 299.640214][ T9664] ? __local_bh_enable_ip+0x13a/0x1c0 [ 299.645604][ T9664] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 299.651167][ T9664] ? security_sctp_bind_connect+0x89/0xb0 [ 299.656900][ T9664] sctp_sendmsg+0x1519/0x27b0 [ 299.661603][ T9664] ? sctp_getsockopt+0xb60/0xb60 [ 299.666559][ T9664] ? aa_af_perm+0x330/0x330 [ 299.671115][ T9664] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 299.677671][ T9664] ? sock_rps_record_flow+0x19/0x3f0 [ 299.682973][ T9664] ? inet_sendmsg+0xce/0x2a0 [ 299.687576][ T9664] ? inet_send_prepare+0x250/0x250 [ 299.692703][ T9664] ____sys_sendmsg+0x61b/0x980 [ 299.697491][ T9664] ? __sys_sendmsg_sock+0x30/0x30 [ 299.702524][ T9664] ? __import_iovec+0x5f2/0x850 [ 299.707396][ T9664] ? import_iovec+0x73/0xa0 [ 299.711924][ T9664] ___sys_sendmsg+0x2a6/0x360 [ 299.716622][ T9664] ? __sys_sendmsg+0x2b0/0x2b0 [ 299.721442][ T9664] ? trace_call_bpf+0xc3/0x6c0 [ 299.726245][ T9664] __se_sys_sendmsg+0x1d0/0x2c0 [ 299.731108][ T9664] ? perf_trace_preemptirq_template+0x269/0x330 [ 299.737388][ T9664] ? __x64_sys_sendmsg+0x80/0x80 [ 299.742353][ T9664] ? lockdep_hardirqs_on+0x98/0x150 [ 299.747569][ T9664] do_syscall_64+0x55/0xb0 [ 299.751998][ T9664] ? clear_bhb_loop+0x40/0x90 [ 299.756694][ T9664] ? clear_bhb_loop+0x40/0x90 [ 299.761394][ T9664] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 299.767299][ T9664] RIP: 0033:0x7f320fb9e0d9 [ 299.771729][ T9664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.791446][ T9664] RSP: 002b:00007f32109c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 299.799877][ T9664] RAX: ffffffffffffffda RBX: 00007f320fe26090 RCX: 00007f320fb9e0d9 [ 299.807864][ T9664] RDX: 0000000000000880 RSI: 0000200000000600 RDI: 0000000000000004 [ 299.815952][ T9664] RBP: 00007f32109c4090 R08: 0000000000000000 R09: 0000000000000000 [ 299.823962][ T9664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 299.831945][ T9664] R13: 00007f320fe26128 R14: 00007f320fe26090 R15: 00007fffe7681458 [ 299.839943][ T9664] [ 303.470449][ T9710] netlink: 'syz.0.1341': attribute type 4 has an invalid length. [ 303.691858][ T9716] netlink: 134736 bytes leftover after parsing attributes in process `syz.0.1345'. [ 304.063115][ T9729] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1348'. [ 305.906815][ T9775] netlink: 'syz.0.1366': attribute type 2 has an invalid length. [ 305.944394][ T9775] netlink: 17259 bytes leftover after parsing attributes in process `syz.0.1366'. [ 306.769315][ T9791] netlink: 'syz.1.1375': attribute type 2 has an invalid length. [ 307.226255][ T9796] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1368'. [ 307.271427][ T9796] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1368'. [ 307.299283][ T9806] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1368'. [ 307.317066][ T9794] netlink: 'syz.0.1376': attribute type 10 has an invalid length. [ 307.352063][ T9779] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1368'. [ 307.361703][ T9794] netlink: 157196 bytes leftover after parsing attributes in process `syz.0.1376'. [ 308.397112][ T9825] netlink: 'syz.3.1386': attribute type 4 has an invalid length. [ 309.037903][ T9834] syzkaller0: create flow: hash 2713559746 index 2 [ 309.482974][ T9837] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1390'. [ 309.608448][ T9837] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 309.624908][ T9829] netlink: 'syz.0.1387': attribute type 11 has an invalid length. [ 309.636316][ T4719] syzkaller0: tun_net_xmit 76 [ 309.642701][ T4719] syzkaller0: tun_net_xmit 48 [ 309.661479][ T175] syzkaller0: tun_net_xmit 76 [ 309.698677][ T9828] syzkaller0: delete flow: hash 2713559746 index 2 [ 309.741646][ T175] syzkaller0: tun_net_xmit 76 [ 311.670180][ T9884] FAULT_INJECTION: forcing a failure. [ 311.670180][ T9884] name failslab, interval 1, probability 0, space 0, times 0 [ 311.684049][ T9884] CPU: 1 PID: 9884 Comm: syz.2.1410 Not tainted syzkaller #0 [ 311.691475][ T9884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 311.701565][ T9884] Call Trace: [ 311.704880][ T9884] [ 311.707836][ T9884] dump_stack_lvl+0x18c/0x250 [ 311.712702][ T9884] ? sctp_sendmsg+0x1519/0x27b0 [ 311.717578][ T9884] ? ___sys_sendmsg+0x2a6/0x360 [ 311.722467][ T9884] ? show_regs_print_info+0x20/0x20 [ 311.727703][ T9884] ? load_image+0x420/0x420 [ 311.732230][ T9884] should_fail_ex+0x394/0x4c0 [ 311.736942][ T9884] should_failslab+0x9/0x20 [ 311.741465][ T9884] slab_pre_alloc_hook+0x59/0x300 [ 311.746551][ T9884] ? sctp_add_bind_addr+0x8c/0x360 [ 311.751971][ T9884] __kmem_cache_alloc_node+0x53/0x250 [ 311.757369][ T9884] ? sctp_add_bind_addr+0x8c/0x360 [ 311.762511][ T9884] kmalloc_trace+0x2a/0xe0 [ 311.766990][ T9884] sctp_add_bind_addr+0x8c/0x360 [ 311.771967][ T9884] sctp_copy_local_addr_list+0x31b/0x4e0 [ 311.777631][ T9884] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 311.783453][ T9884] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 311.789574][ T9884] ? sctp_v6_is_any+0x64/0x70 [ 311.794337][ T9884] ? sctp_copy_one_addr+0x8c/0x350 [ 311.799453][ T9884] sctp_bind_addr_copy+0xb3/0x3c0 [ 311.804503][ T9884] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 311.810880][ T9884] sctp_connect_new_asoc+0x2f9/0x6a0 [ 311.816188][ T9884] ? __sctp_connect+0xd80/0xd80 [ 311.821059][ T9884] ? __local_bh_enable_ip+0x13a/0x1c0 [ 311.826461][ T9884] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 311.832018][ T9884] ? security_sctp_bind_connect+0x89/0xb0 [ 311.837841][ T9884] sctp_sendmsg+0x1519/0x27b0 [ 311.842577][ T9884] ? sctp_getsockopt+0xb60/0xb60 [ 311.847574][ T9884] ? aa_af_perm+0x330/0x330 [ 311.852129][ T9884] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 311.858564][ T9884] ? sock_rps_record_flow+0x19/0x3f0 [ 311.863873][ T9884] ? inet_sendmsg+0xce/0x2a0 [ 311.868517][ T9884] ? inet_send_prepare+0x250/0x250 [ 311.873633][ T9884] ____sys_sendmsg+0x61b/0x980 [ 311.878403][ T9884] ? __sys_sendmsg_sock+0x30/0x30 [ 311.883437][ T9884] ? __import_iovec+0x5f2/0x850 [ 311.888320][ T9884] ? import_iovec+0x73/0xa0 [ 311.892851][ T9884] ___sys_sendmsg+0x2a6/0x360 [ 311.897541][ T9884] ? get_pid_task+0x20/0x1e0 [ 311.902224][ T9884] ? __sys_sendmsg+0x2b0/0x2b0 [ 311.907033][ T9884] ? __lock_acquire+0x7d80/0x7d80 [ 311.912081][ T9884] __se_sys_sendmsg+0x1d0/0x2c0 [ 311.917018][ T9884] ? perf_trace_preemptirq_template+0x269/0x330 [ 311.923278][ T9884] ? __x64_sys_sendmsg+0x80/0x80 [ 311.928274][ T9884] ? lockdep_hardirqs_on+0x98/0x150 [ 311.933502][ T9884] do_syscall_64+0x55/0xb0 [ 311.937919][ T9884] ? clear_bhb_loop+0x40/0x90 [ 311.942627][ T9884] ? clear_bhb_loop+0x40/0x90 [ 311.947329][ T9884] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 311.953224][ T9884] RIP: 0033:0x7f320fb9e0d9 [ 311.957660][ T9884] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 311.977279][ T9884] RSP: 002b:00007f32109e5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 311.985713][ T9884] RAX: ffffffffffffffda RBX: 00007f320fe25fa0 RCX: 00007f320fb9e0d9 [ 311.993687][ T9884] RDX: 0000000000000880 RSI: 0000200000000600 RDI: 0000000000000004 [ 312.001668][ T9884] RBP: 00007f32109e5090 R08: 0000000000000000 R09: 0000000000000000 [ 312.009655][ T9884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 312.017645][ T9884] R13: 00007f320fe26038 R14: 00007f320fe25fa0 R15: 00007fffe7681458 [ 312.025632][ T9884] [ 312.828739][ T9876] netlink: 15974 bytes leftover after parsing attributes in process `syz.3.1406'. [ 312.932458][ T9896] netlink: 'syz.1.1415': attribute type 2 has an invalid length. [ 313.112094][ T9900] netlink: 'syz.1.1417': attribute type 10 has an invalid length. [ 313.161075][ T9900] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 313.591812][ T9898] netlink: 'syz.3.1416': attribute type 10 has an invalid length. [ 313.605258][ T9898] netlink: 157196 bytes leftover after parsing attributes in process `syz.3.1416'. [ 315.281568][ T9910] netlink: 65027 bytes leftover after parsing attributes in process `syz.2.1418'. [ 319.422393][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 319.428781][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.972657][ T9944] netlink: 188 bytes leftover after parsing attributes in process `syz.0.1428'. [ 322.675566][ T9965] netlink: 'syz.1.1434': attribute type 10 has an invalid length. [ 322.717996][ T9965] netlink: 157196 bytes leftover after parsing attributes in process `syz.1.1434'. [ 323.642557][ T9993] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.1447'. [ 323.718734][ T9993] netlink: 166900 bytes leftover after parsing attributes in process `syz.0.1447'. [ 324.093699][ T9997] netlink: 'syz.2.1449': attribute type 10 has an invalid length. [ 324.103242][ T9997] netlink: 157196 bytes leftover after parsing attributes in process `syz.2.1449'. [ 326.521125][T10044] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 326.579685][T10044] netlink: 'syz.1.1466': attribute type 9 has an invalid length. [ 326.598587][T10044] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.1466'. [ 326.747506][T10047] netlink: 'syz.1.1466': attribute type 9 has an invalid length. [ 326.784204][T10047] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.1466'. [ 328.015821][T10076] netlink: 'syz.2.1478': attribute type 39 has an invalid length. [ 328.223595][T10081] sctp: [Deprecated]: syz.1.1480 (pid 10081) Use of struct sctp_assoc_value in delayed_ack socket option. [ 328.223595][T10081] Use struct sctp_sack_info instead [ 330.459930][T10111] netlink: 'syz.2.1492': attribute type 2 has an invalid length. [ 330.511370][T10111] netlink: 1045 bytes leftover after parsing attributes in process `syz.2.1492'. [ 330.639235][T10128] netlink: 'syz.1.1498': attribute type 9 has an invalid length. [ 330.672039][T10128] netlink: 'syz.1.1498': attribute type 23 has an invalid length. [ 330.679941][T10128] netlink: 156008 bytes leftover after parsing attributes in process `syz.1.1498'. [ 331.520578][T10143] netlink: 'syz.2.1501': attribute type 9 has an invalid length. [ 331.636359][T10143] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.1501'. [ 332.079333][T10138] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 332.339277][T10147] netlink: 'syz.2.1501': attribute type 9 has an invalid length. [ 332.384968][T10147] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.1501'. [ 332.892047][T10164] FAULT_INJECTION: forcing a failure. [ 332.892047][T10164] name failslab, interval 1, probability 0, space 0, times 0 [ 332.924639][T10164] CPU: 1 PID: 10164 Comm: syz.1.1509 Not tainted syzkaller #0 [ 332.932181][T10164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 332.942271][T10164] Call Trace: [ 332.945588][T10164] [ 332.948555][T10164] dump_stack_lvl+0x18c/0x250 [ 332.953298][T10164] ? show_regs_print_info+0x20/0x20 [ 332.958541][T10164] ? load_image+0x420/0x420 [ 332.963187][T10164] ? __might_sleep+0xe0/0xe0 [ 332.967817][T10164] ? __lock_acquire+0x7d80/0x7d80 [ 332.973061][T10164] should_fail_ex+0x394/0x4c0 [ 332.977800][T10164] should_failslab+0x9/0x20 [ 332.982362][T10164] slab_pre_alloc_hook+0x59/0x300 [ 332.987437][T10164] ? tomoyo_encode+0x2ad/0x570 [ 332.992291][T10164] ? tomoyo_encode+0x2ad/0x570 [ 332.997096][T10164] __kmem_cache_alloc_node+0x53/0x250 [ 333.002530][T10164] ? tomoyo_encode+0x2ad/0x570 [ 333.007353][T10164] __kmalloc+0xa7/0x240 [ 333.011559][T10164] tomoyo_encode+0x2ad/0x570 [ 333.016207][T10164] tomoyo_realpath_from_path+0x57c/0x5c0 [ 333.021894][T10164] ? tomoyo_domain+0xd6/0x120 [ 333.026683][T10164] tomoyo_path_number_perm+0x248/0x5e0 [ 333.032158][T10164] ? tomoyo_path_number_perm+0x217/0x5e0 [ 333.037806][T10164] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 333.043291][T10164] ? ksys_write+0x1d2/0x260 [ 333.047843][T10164] ? __fget_files+0x28/0x460 [ 333.052548][T10164] security_file_ioctl+0x70/0xa0 [ 333.057513][T10164] __se_sys_ioctl+0x48/0x170 [ 333.062126][T10164] do_syscall_64+0x55/0xb0 [ 333.066650][T10164] ? clear_bhb_loop+0x40/0x90 [ 333.071349][T10164] ? clear_bhb_loop+0x40/0x90 [ 333.076040][T10164] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 333.082029][T10164] RIP: 0033:0x7f9cb479e0d9 [ 333.086457][T10164] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 333.106191][T10164] RSP: 002b:00007f9cb56c3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 333.114625][T10164] RAX: ffffffffffffffda RBX: 00007f9cb4a25fa0 RCX: 00007f9cb479e0d9 [ 333.122605][T10164] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000000 [ 333.130587][T10164] RBP: 00007f9cb56c3090 R08: 0000000000000000 R09: 0000000000000000 [ 333.138572][T10164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 333.146640][T10164] R13: 00007f9cb4a26038 R14: 00007f9cb4a25fa0 R15: 00007fff86350cd8 [ 333.154661][T10164] [ 333.185918][T10164] ERROR: Out of memory at tomoyo_realpath_from_path. [ 334.601110][T10194] netlink: 'syz.0.1519': attribute type 9 has an invalid length. [ 334.616266][T10194] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.1519'. [ 336.708486][T10190] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 336.715779][T10190] IPv6: NLM_F_CREATE should be set when creating new route [ 336.723139][T10190] IPv6: NLM_F_CREATE should be set when creating new route [ 336.730368][T10190] IPv6: NLM_F_CREATE should be set when creating new route [ 336.782804][T10197] netlink: 'syz.0.1519': attribute type 9 has an invalid length. [ 336.801365][T10197] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.1519'. [ 337.898664][T10217] netlink: 61967 bytes leftover after parsing attributes in process `syz.0.1529'. [ 338.910170][T10227] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1532'. [ 338.947627][T10235] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1532'. [ 339.062371][T10247] netlink: 'syz.3.1536': attribute type 153 has an invalid length. [ 339.070362][T10247] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.1536'. [ 339.322960][T10235] team0: Port device team_slave_0 removed [ 339.761764][T10246] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.1536'. [ 341.938566][T10279] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.1545'. [ 342.745633][T10290] netlink: 'syz.3.1548': attribute type 2 has an invalid length. [ 343.078735][T10296] netlink: 'syz.1.1551': attribute type 39 has an invalid length. [ 345.723217][T10357] bridge0: entered promiscuous mode [ 345.728499][T10357] bridge0: entered allmulticast mode [ 347.751181][T10399] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1588'. [ 347.805966][T10407] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1588'. [ 347.985411][T10407] team0: Port device team_slave_0 removed [ 348.383293][T10417] FAULT_INJECTION: forcing a failure. [ 348.383293][T10417] name failslab, interval 1, probability 0, space 0, times 0 [ 348.421519][T10417] CPU: 1 PID: 10417 Comm: syz.3.1594 Not tainted syzkaller #0 [ 348.429058][T10417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 348.439159][T10417] Call Trace: [ 348.442502][T10417] [ 348.445481][T10417] dump_stack_lvl+0x18c/0x250 [ 348.450303][T10417] ? show_regs_print_info+0x20/0x20 [ 348.455536][T10417] ? load_image+0x420/0x420 [ 348.460159][T10417] ? __might_sleep+0xe0/0xe0 [ 348.464798][T10417] ? __lock_acquire+0x7d80/0x7d80 [ 348.469876][T10417] should_fail_ex+0x394/0x4c0 [ 348.474604][T10417] should_failslab+0x9/0x20 [ 348.479153][T10417] slab_pre_alloc_hook+0x59/0x300 [ 348.484232][T10417] ? up_read+0x20/0x20 [ 348.488338][T10417] ? ipv6_add_addr+0x566/0x10d0 [ 348.493253][T10417] __kmem_cache_alloc_node+0x53/0x250 [ 348.498671][T10417] ? ipv6_add_addr+0x566/0x10d0 [ 348.503569][T10417] kmalloc_trace+0x2a/0xe0 [ 348.508039][T10417] ipv6_add_addr+0x566/0x10d0 [ 348.512777][T10417] ? ipv6_count_addresses+0x190/0x190 [ 348.518205][T10417] ? addrconf_add_ifaddr+0x147/0x1c0 [ 348.523549][T10417] inet6_addr_add+0x563/0xb30 [ 348.528366][T10417] addrconf_add_ifaddr+0x15a/0x1c0 [ 348.533523][T10417] ? addrconf_set_dstaddr+0x320/0x320 [ 348.539014][T10417] ? __lock_acquire+0x7d80/0x7d80 [ 348.544052][T10417] ? slab_free_freelist_hook+0x130/0x1a0 [ 348.549803][T10417] inet6_ioctl+0x14f/0x2d0 [ 348.554237][T10417] ? inet6_getname+0x670/0x670 [ 348.559014][T10417] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 348.564668][T10417] ? tomoyo_path_number_perm+0x217/0x5e0 [ 348.570315][T10417] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 348.575796][T10417] sock_do_ioctl+0xfc/0x310 [ 348.580403][T10417] ? sock_show_fdinfo+0xb0/0xb0 [ 348.585285][T10417] sock_ioctl+0x5be/0x7e0 [ 348.589630][T10417] ? sock_poll+0x3e0/0x3e0 [ 348.594071][T10417] ? bpf_lsm_file_ioctl+0x9/0x10 [ 348.599021][T10417] ? security_file_ioctl+0x80/0xa0 [ 348.604152][T10417] ? sock_poll+0x3e0/0x3e0 [ 348.608588][T10417] __se_sys_ioctl+0xfd/0x170 [ 348.613195][T10417] do_syscall_64+0x55/0xb0 [ 348.617626][T10417] ? clear_bhb_loop+0x40/0x90 [ 348.622314][T10417] ? clear_bhb_loop+0x40/0x90 [ 348.627009][T10417] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 348.632916][T10417] RIP: 0033:0x7f4ebf99e0d9 [ 348.637343][T10417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.657062][T10417] RSP: 002b:00007f4ec093a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 348.665495][T10417] RAX: ffffffffffffffda RBX: 00007f4ebfc25fa0 RCX: 00007f4ebf99e0d9 [ 348.673498][T10417] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000000 [ 348.681565][T10417] RBP: 00007f4ec093a090 R08: 0000000000000000 R09: 0000000000000000 [ 348.689543][T10417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 348.697695][T10417] R13: 00007f4ebfc26038 R14: 00007f4ebfc25fa0 R15: 00007ffeaceb3328 [ 348.705706][T10417] [ 348.823802][T10423] FAULT_INJECTION: forcing a failure. [ 348.823802][T10423] name failslab, interval 1, probability 0, space 0, times 0 [ 348.855833][T10423] CPU: 0 PID: 10423 Comm: syz.0.1597 Not tainted syzkaller #0 [ 348.863377][T10423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 348.874173][T10423] Call Trace: [ 348.877529][T10423] [ 348.880754][T10423] dump_stack_lvl+0x18c/0x250 [ 348.885475][T10423] ? sctp_sendmsg+0x1519/0x27b0 [ 348.890371][T10423] ? ___sys_sendmsg+0x2a6/0x360 [ 348.895273][T10423] ? show_regs_print_info+0x20/0x20 [ 348.900513][T10423] ? load_image+0x420/0x420 [ 348.905076][T10423] should_fail_ex+0x394/0x4c0 [ 348.909810][T10423] should_failslab+0x9/0x20 [ 348.914354][T10423] slab_pre_alloc_hook+0x59/0x300 [ 348.919436][T10423] ? sctp_add_bind_addr+0x8c/0x360 [ 348.924687][T10423] __kmem_cache_alloc_node+0x53/0x250 [ 348.930209][T10423] ? sctp_add_bind_addr+0x8c/0x360 [ 348.935452][T10423] kmalloc_trace+0x2a/0xe0 [ 348.939923][T10423] sctp_add_bind_addr+0x8c/0x360 [ 348.944920][T10423] sctp_copy_local_addr_list+0x31b/0x4e0 [ 348.950613][T10423] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 348.956377][T10423] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 348.962495][T10423] ? sctp_v6_is_any+0x64/0x70 [ 348.967206][T10423] ? sctp_copy_one_addr+0x8c/0x350 [ 348.972350][T10423] sctp_bind_addr_copy+0xb3/0x3c0 [ 348.977389][T10423] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 348.983739][T10423] sctp_connect_new_asoc+0x2f9/0x6a0 [ 348.989045][T10423] ? __sctp_connect+0xd80/0xd80 [ 348.993909][T10423] ? __local_bh_enable_ip+0x13a/0x1c0 [ 348.999300][T10423] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 349.004857][T10423] ? security_sctp_bind_connect+0x89/0xb0 [ 349.010591][T10423] sctp_sendmsg+0x1519/0x27b0 [ 349.015300][T10423] ? sctp_getsockopt+0xb60/0xb60 [ 349.020254][T10423] ? aa_af_perm+0x330/0x330 [ 349.024780][T10423] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 349.031243][T10423] ? sock_rps_record_flow+0x19/0x3f0 [ 349.036545][T10423] ? inet_sendmsg+0xce/0x2a0 [ 349.041152][T10423] ? inet_send_prepare+0x250/0x250 [ 349.046289][T10423] ____sys_sendmsg+0x61b/0x980 [ 349.051074][T10423] ? __sys_sendmsg_sock+0x30/0x30 [ 349.056108][T10423] ? __import_iovec+0x5f2/0x850 [ 349.060983][T10423] ? import_iovec+0x73/0xa0 [ 349.065513][T10423] ___sys_sendmsg+0x2a6/0x360 [ 349.070291][T10423] ? get_pid_task+0x20/0x1e0 [ 349.074912][T10423] ? __sys_sendmsg+0x2b0/0x2b0 [ 349.079802][T10423] ? __lock_acquire+0x7d80/0x7d80 [ 349.084864][T10423] __se_sys_sendmsg+0x1d0/0x2c0 [ 349.089729][T10423] ? perf_trace_preemptirq_template+0x269/0x330 [ 349.095987][T10423] ? __x64_sys_sendmsg+0x80/0x80 [ 349.100959][T10423] ? lockdep_hardirqs_on+0x98/0x150 [ 349.106173][T10423] do_syscall_64+0x55/0xb0 [ 349.110597][T10423] ? clear_bhb_loop+0x40/0x90 [ 349.115283][T10423] ? clear_bhb_loop+0x40/0x90 [ 349.119971][T10423] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 349.125874][T10423] RIP: 0033:0x7f781759e0d9 [ 349.130299][T10423] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.149919][T10423] RSP: 002b:00007f7818393028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 349.158357][T10423] RAX: ffffffffffffffda RBX: 00007f7817825fa0 RCX: 00007f781759e0d9 [ 349.166427][T10423] RDX: 0000000000000880 RSI: 0000200000000600 RDI: 0000000000000004 [ 349.174427][T10423] RBP: 00007f7818393090 R08: 0000000000000000 R09: 0000000000000000 [ 349.182411][T10423] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 349.190394][T10423] R13: 00007f7817826038 R14: 00007f7817825fa0 R15: 00007ffca3ad69d8 [ 349.198393][T10423] [ 349.320107][T10429] netlink: 'syz.2.1600': attribute type 2 has an invalid length. [ 350.884097][T10459] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1612'. [ 353.749839][T10496] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1621'. [ 354.886598][T10531] IPv6: NLM_F_CREATE should be specified when creating new route [ 354.917897][T10531] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1637'. [ 355.009369][T10537] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 355.016756][T10537] IPv6: NLM_F_CREATE should be set when creating new route [ 355.107956][T10543] FAULT_INJECTION: forcing a failure. [ 355.107956][T10543] name failslab, interval 1, probability 0, space 0, times 0 [ 355.150796][T10543] CPU: 1 PID: 10543 Comm: syz.3.1641 Not tainted syzkaller #0 [ 355.158434][T10543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 355.168533][T10543] Call Trace: [ 355.171836][T10543] [ 355.174810][T10543] dump_stack_lvl+0x18c/0x250 [ 355.179637][T10543] ? show_regs_print_info+0x20/0x20 [ 355.184972][T10543] ? load_image+0x420/0x420 [ 355.189559][T10543] ? __might_sleep+0xe0/0xe0 [ 355.194251][T10543] ? __lock_acquire+0x7d80/0x7d80 [ 355.199349][T10543] should_fail_ex+0x394/0x4c0 [ 355.204116][T10543] should_failslab+0x9/0x20 [ 355.208657][T10543] slab_pre_alloc_hook+0x59/0x300 [ 355.213731][T10543] ? fib6_info_alloc+0x30/0xf0 [ 355.218595][T10543] ? fib6_info_alloc+0x30/0xf0 [ 355.223368][T10543] __kmem_cache_alloc_node+0x53/0x250 [ 355.228770][T10543] ? fib6_info_alloc+0x30/0xf0 [ 355.233564][T10543] __kmalloc+0xa7/0x240 [ 355.237760][T10543] fib6_info_alloc+0x30/0xf0 [ 355.242399][T10543] ip6_route_info_create+0x455/0x1260 [ 355.247870][T10543] ? __kasan_kmalloc+0x8f/0xa0 [ 355.252675][T10543] addrconf_f6i_alloc+0x1fa/0x440 [ 355.257735][T10543] ? ip6_route_del+0x14f0/0x14f0 [ 355.262727][T10543] ipv6_add_addr+0x5a4/0x10d0 [ 355.267473][T10543] ? ipv6_count_addresses+0x190/0x190 [ 355.272899][T10543] ? addrconf_add_ifaddr+0x147/0x1c0 [ 355.278210][T10543] inet6_addr_add+0x563/0xb30 [ 355.282928][T10543] addrconf_add_ifaddr+0x15a/0x1c0 [ 355.288061][T10543] ? addrconf_set_dstaddr+0x320/0x320 [ 355.293462][T10543] ? __lock_acquire+0x7d80/0x7d80 [ 355.298507][T10543] ? slab_free_freelist_hook+0x130/0x1a0 [ 355.304163][T10543] inet6_ioctl+0x14f/0x2d0 [ 355.308605][T10543] ? inet6_getname+0x670/0x670 [ 355.313399][T10543] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 355.319085][T10543] ? tomoyo_path_number_perm+0x217/0x5e0 [ 355.324734][T10543] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 355.330217][T10543] sock_do_ioctl+0xfc/0x310 [ 355.334820][T10543] ? sock_show_fdinfo+0xb0/0xb0 [ 355.339704][T10543] sock_ioctl+0x5be/0x7e0 [ 355.344051][T10543] ? sock_poll+0x3e0/0x3e0 [ 355.348498][T10543] ? bpf_lsm_file_ioctl+0x9/0x10 [ 355.353489][T10543] ? security_file_ioctl+0x80/0xa0 [ 355.358628][T10543] ? sock_poll+0x3e0/0x3e0 [ 355.363056][T10543] __se_sys_ioctl+0xfd/0x170 [ 355.367682][T10543] do_syscall_64+0x55/0xb0 [ 355.372159][T10543] ? clear_bhb_loop+0x40/0x90 [ 355.376931][T10543] ? clear_bhb_loop+0x40/0x90 [ 355.381719][T10543] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 355.387796][T10543] RIP: 0033:0x7f4ebf99e0d9 [ 355.392226][T10543] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 355.412300][T10543] RSP: 002b:00007f4ec093a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 355.420743][T10543] RAX: ffffffffffffffda RBX: 00007f4ebfc25fa0 RCX: 00007f4ebf99e0d9 [ 355.428734][T10543] RDX: 0000200000000000 RSI: 0000000000008916 RDI: 0000000000000000 [ 355.436716][T10543] RBP: 00007f4ec093a090 R08: 0000000000000000 R09: 0000000000000000 [ 355.444698][T10543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 355.452678][T10543] R13: 00007f4ebfc26038 R14: 00007f4ebfc25fa0 R15: 00007ffeaceb3328 [ 355.460674][T10543] [ 355.486514][T10548] netlink: 'syz.2.1642': attribute type 2 has an invalid length. [ 359.368309][T10581] netlink: 'syz.2.1654': attribute type 10 has an invalid length. [ 359.410202][T10580] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1653'. [ 360.252888][T10596] FAULT_INJECTION: forcing a failure. [ 360.252888][T10596] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 360.293892][T10596] CPU: 1 PID: 10596 Comm: syz.0.1659 Not tainted syzkaller #0 [ 360.301463][T10596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 360.311574][T10596] Call Trace: [ 360.314911][T10596] [ 360.317972][T10596] dump_stack_lvl+0x18c/0x250 [ 360.322734][T10596] ? show_regs_print_info+0x20/0x20 [ 360.328168][T10596] ? load_image+0x420/0x420 [ 360.332745][T10596] ? __might_fault+0xaa/0x120 [ 360.337487][T10596] ? __lock_acquire+0x7d80/0x7d80 [ 360.342597][T10596] should_fail_ex+0x394/0x4c0 [ 360.347355][T10596] _copy_from_user+0x2f/0xe0 [ 360.352010][T10596] __sys_bpf+0x23e/0x890 [ 360.356325][T10596] ? bpf_link_show_fdinfo+0x390/0x390 [ 360.361814][T10596] ? lock_chain_count+0x20/0x20 [ 360.366767][T10596] __x64_sys_bpf+0x7c/0x90 [ 360.371260][T10596] do_syscall_64+0x55/0xb0 [ 360.375734][T10596] ? clear_bhb_loop+0x40/0x90 [ 360.380467][T10596] ? clear_bhb_loop+0x40/0x90 [ 360.385211][T10596] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 360.391161][T10596] RIP: 0033:0x7f781759e0d9 [ 360.395634][T10596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.415468][T10596] RSP: 002b:00007f7818393028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 360.424140][T10596] RAX: ffffffffffffffda RBX: 00007f7817825fa0 RCX: 00007f781759e0d9 [ 360.432256][T10596] RDX: 0000000000000094 RSI: 00002000000002c0 RDI: 0000000000000005 [ 360.440290][T10596] RBP: 00007f7818393090 R08: 0000000000000000 R09: 0000000000000000 [ 360.448315][T10596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 360.456339][T10596] R13: 00007f7817826038 R14: 00007f7817825fa0 R15: 00007ffca3ad69d8 [ 360.464418][T10596] [ 364.763962][T10617] netlink: 'syz.0.1664': attribute type 21 has an invalid length. [ 366.334014][T10645] netlink: 'syz.2.1674': attribute type 10 has an invalid length. [ 366.582032][T10652] tun0: tun_chr_ioctl cmd 1074812118 [ 370.637960][T10682] syzkaller0: entered promiscuous mode [ 370.644750][T10682] syzkaller0: entered allmulticast mode [ 377.608592][T10740] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 378.811909][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.831455][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 382.105095][T10822] netlink: 'syz.2.1727': attribute type 21 has an invalid length. [ 382.172601][T10822] netlink: 'syz.2.1727': attribute type 1 has an invalid length. [ 382.217910][T10822] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1727'. [ 383.024573][ T5779] Bluetooth: hci1: unexpected event 0x17 length: 151 > 6 [ 383.635270][T10864] netlink: 'syz.3.1744': attribute type 1 has an invalid length. [ 383.701486][T10864] netlink: 161700 bytes leftover after parsing attributes in process `syz.3.1744'. [ 384.437224][T10887] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.1752'. [ 387.304953][T10918] syzkaller0: entered promiscuous mode [ 387.321194][T10918] syzkaller0: entered allmulticast mode [ 388.941479][T10956] netlink: 'syz.0.1774': attribute type 29 has an invalid length. [ 391.169682][T10957] netlink: 'syz.2.1773': attribute type 4 has an invalid length. [ 391.184735][T10956] netlink: 'syz.0.1774': attribute type 29 has an invalid length. [ 391.745664][T10982] syzkaller0: entered promiscuous mode [ 391.776708][T10982] syzkaller0: entered allmulticast mode [ 392.482354][T10997] netlink: 'syz.0.1787': attribute type 25 has an invalid length. [ 392.499669][T10980] delete_channel: no stack [ 392.527109][T10997] netlink: 'syz.0.1787': attribute type 29 has an invalid length. [ 392.549598][T11001] netlink: 209832 bytes leftover after parsing attributes in process `syz.2.1788'. [ 392.779569][T11013] netlink: 668 bytes leftover after parsing attributes in process `syz.0.1791'. [ 392.811874][T11013] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 392.823914][T11013] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 393.527547][T11031] netlink: 209820 bytes leftover after parsing attributes in process `syz.2.1795'. [ 394.538536][T11063] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 395.319039][T11089] netlink: 'syz.3.1818': attribute type 3 has an invalid length. [ 395.331333][T11089] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1818'. [ 395.442065][T11089] netlink: 'syz.3.1818': attribute type 21 has an invalid length. [ 395.478646][T11089] netlink: 'syz.3.1818': attribute type 1 has an invalid length. [ 395.582022][T11089] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1818'. [ 396.669353][T11097] netlink: 'syz.0.1821': attribute type 4 has an invalid length. [ 401.866809][T11195] netlink: 'syz.0.1853': attribute type 2 has an invalid length. [ 402.686995][T11198] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 402.711813][T11198] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 402.955652][T11204] syzkaller0: entered promiscuous mode [ 402.971497][T11204] syzkaller0: entered allmulticast mode [ 403.183870][T11217] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1862'. [ 403.940608][T11217] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1862'. [ 403.981864][T11225] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1864'. [ 404.065807][T11220] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1862'. [ 404.802450][T11246] netlink: 'syz.2.1873': attribute type 4 has an invalid length. [ 406.808969][T11290] netlink: 'syz.3.1889': attribute type 2 has an invalid length. [ 406.835354][T11290] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1889'. [ 407.561139][T11301] netlink: 'syz.2.1894': attribute type 10 has an invalid length. [ 407.581808][T11301] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1894'. [ 408.836486][T11318] netlink: 'syz.0.1901': attribute type 46 has an invalid length. [ 408.967311][T11318] netlink: 'syz.0.1901': attribute type 46 has an invalid length. [ 409.860105][T11336] netlink: 'syz.3.1904': attribute type 2 has an invalid length. [ 412.439618][T11381] netlink: 'syz.1.1918': attribute type 4 has an invalid length. [ 413.321660][T11391] netlink: 'syz.2.1920': attribute type 3 has an invalid length. [ 413.329499][T11391] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1920'. [ 414.227900][T11415] netlink: 'syz.0.1932': attribute type 2 has an invalid length. [ 414.238686][T11416] netlink: 'syz.3.1933': attribute type 3 has an invalid length. [ 414.259635][T11416] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.1933'. [ 414.478262][T11426] netlink: 'syz.0.1937': attribute type 21 has an invalid length. [ 414.495613][T11426] netlink: 'syz.0.1937': attribute type 1 has an invalid length. [ 414.514997][T11426] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1937'. [ 417.502826][T11457] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.1949'. [ 418.554046][ T5779] Bluetooth: hci1: SCO packet for unknown connection handle 0 [ 419.064435][T11504] netlink: 'syz.2.1966': attribute type 2 has an invalid length. [ 419.196074][T11507] netlink: 'syz.3.1967': attribute type 13 has an invalid length. [ 419.205680][T11507] netlink: 160 bytes leftover after parsing attributes in process `syz.3.1967'. [ 419.236872][T11507] erspan0: refused to change device tx_queue_len [ 419.262075][T11507] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 419.372658][T11510] netlink: 'syz.2.1968': attribute type 4 has an invalid length. [ 420.422302][T11546] netlink: 'syz.0.1981': attribute type 4 has an invalid length. [ 420.928677][T11554] netlink: 'syz.0.1985': attribute type 10 has an invalid length. [ 420.983018][T11554] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1985'. [ 421.385271][T11571] FAULT_INJECTION: forcing a failure. [ 421.385271][T11571] name failslab, interval 1, probability 0, space 0, times 0 [ 421.406801][T11571] CPU: 0 PID: 11571 Comm: syz.0.2000 Not tainted syzkaller #0 [ 421.414335][T11571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 421.424435][T11571] Call Trace: [ 421.427751][T11571] [ 421.430713][T11571] dump_stack_lvl+0x18c/0x250 [ 421.435621][T11571] ? sctp_sendmsg+0x1519/0x27b0 [ 421.440652][T11571] ? ___sys_sendmsg+0x2a6/0x360 [ 421.445560][T11571] ? show_regs_print_info+0x20/0x20 [ 421.450788][T11571] ? load_image+0x420/0x420 [ 421.455334][T11571] should_fail_ex+0x394/0x4c0 [ 421.460039][T11571] should_failslab+0x9/0x20 [ 421.464571][T11571] slab_pre_alloc_hook+0x59/0x300 [ 421.469626][T11571] ? sctp_add_bind_addr+0x8c/0x360 [ 421.474750][T11571] __kmem_cache_alloc_node+0x53/0x250 [ 421.480143][T11571] ? sctp_add_bind_addr+0x8c/0x360 [ 421.485267][T11571] kmalloc_trace+0x2a/0xe0 [ 421.489705][T11571] sctp_add_bind_addr+0x8c/0x360 [ 421.494933][T11571] sctp_copy_local_addr_list+0x31b/0x4e0 [ 421.500622][T11571] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 421.506461][T11571] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 421.512547][T11571] ? sctp_v6_is_any+0x64/0x70 [ 421.517449][T11571] ? sctp_copy_one_addr+0x8c/0x350 [ 421.522604][T11571] sctp_bind_addr_copy+0xb3/0x3c0 [ 421.527651][T11571] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 421.534003][T11571] sctp_connect_new_asoc+0x2f9/0x6a0 [ 421.539305][T11571] ? __sctp_connect+0xd80/0xd80 [ 421.544166][T11571] ? __local_bh_enable_ip+0x13a/0x1c0 [ 421.549559][T11571] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 421.555213][T11571] ? security_sctp_bind_connect+0x89/0xb0 [ 421.560949][T11571] sctp_sendmsg+0x1519/0x27b0 [ 421.565651][T11571] ? sctp_getsockopt+0xb60/0xb60 [ 421.570609][T11571] ? aa_af_perm+0x330/0x330 [ 421.575131][T11571] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 421.581571][T11571] ? sock_rps_record_flow+0x19/0x3f0 [ 421.586892][T11571] ? inet_sendmsg+0xce/0x2a0 [ 421.591503][T11571] ? inet_send_prepare+0x250/0x250 [ 421.596630][T11571] ____sys_sendmsg+0x61b/0x980 [ 421.601432][T11571] ? __sys_sendmsg_sock+0x30/0x30 [ 421.606481][T11571] ? __import_iovec+0x5f2/0x850 [ 421.611375][T11571] ? import_iovec+0x73/0xa0 [ 421.615914][T11571] ___sys_sendmsg+0x2a6/0x360 [ 421.620601][T11571] ? get_pid_task+0x20/0x1e0 [ 421.625210][T11571] ? __sys_sendmsg+0x2b0/0x2b0 [ 421.630013][T11571] ? __lock_acquire+0x7d80/0x7d80 [ 421.635082][T11571] __se_sys_sendmsg+0x1d0/0x2c0 [ 421.639960][T11571] ? perf_trace_preemptirq_template+0x269/0x330 [ 421.646237][T11571] ? __x64_sys_sendmsg+0x80/0x80 [ 421.651206][T11571] ? lockdep_hardirqs_on+0x98/0x150 [ 421.656429][T11571] do_syscall_64+0x55/0xb0 [ 421.660855][T11571] ? clear_bhb_loop+0x40/0x90 [ 421.665547][T11571] ? clear_bhb_loop+0x40/0x90 [ 421.670240][T11571] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 421.676238][T11571] RIP: 0033:0x7f781759e0d9 [ 421.680754][T11571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.700372][T11571] RSP: 002b:00007f7818393028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 421.708903][T11571] RAX: ffffffffffffffda RBX: 00007f7817825fa0 RCX: 00007f781759e0d9 [ 421.716995][T11571] RDX: 0000000000000880 RSI: 0000200000000600 RDI: 0000000000000004 [ 421.724991][T11571] RBP: 00007f7818393090 R08: 0000000000000000 R09: 0000000000000000 [ 421.733065][T11571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 421.741046][T11571] R13: 00007f7817826038 R14: 00007f7817825fa0 R15: 00007ffca3ad69d8 [ 421.749157][T11571] [ 421.826991][T11577] netlink: 'syz.1.1993': attribute type 4 has an invalid length. [ 422.078364][T11582] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1996'. [ 422.599130][T11603] netlink: 'syz.3.2005': attribute type 29 has an invalid length. [ 422.651891][T11603] netlink: 'syz.3.2005': attribute type 29 has an invalid length. [ 422.686553][T11604] netlink: 'syz.3.2005': attribute type 29 has an invalid length. [ 423.185464][T11614] netlink: 'syz.3.2009': attribute type 5 has an invalid length. [ 424.033151][T11647] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2021'. [ 424.076661][T11647] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2021'. [ 424.119148][T11647] bond0: (slave bond_slave_0): Releasing backup interface [ 424.143619][T11647] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 424.708125][T11658] validate_nla: 1 callbacks suppressed [ 424.708188][T11658] netlink: 'syz.3.2026': attribute type 2 has an invalid length. [ 425.022236][T11671] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2031'. [ 425.050029][T11671] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2031'. [ 427.252988][T11744] netlink: 'syz.3.2058': attribute type 10 has an invalid length. [ 427.271282][T11744] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2058'. [ 427.280720][T11744] team0: entered promiscuous mode [ 427.287075][T11744] team_slave_0: entered promiscuous mode [ 427.293353][T11744] team_slave_1: entered promiscuous mode [ 427.305479][T11744] bond0: entered promiscuous mode [ 427.314734][T11744] bond_slave_0: entered promiscuous mode [ 427.345234][T11744] bond_slave_1: entered promiscuous mode [ 427.353720][T11744] bridge_slave_1: entered promiscuous mode [ 427.360514][T11744] team0: entered allmulticast mode [ 427.374309][T11744] team_slave_0: entered allmulticast mode [ 427.385645][T11744] team_slave_1: entered allmulticast mode [ 427.400253][T11744] bond0: entered allmulticast mode [ 427.410938][T11744] bond_slave_0: entered allmulticast mode [ 427.426024][T11744] bond_slave_1: entered allmulticast mode [ 427.434091][T11744] bridge_slave_1: entered allmulticast mode [ 427.440354][T11744] macvlan0: entered allmulticast mode [ 427.450933][T11744] veth1_vlan: entered allmulticast mode [ 427.458462][T11744] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 427.916840][T11758] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.2063'. [ 427.977289][T11758] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.2063'. [ 428.058948][T11762] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.2063'. [ 428.151041][T11758] netlink: 'syz.3.2063': attribute type 4 has an invalid length. [ 428.362557][T11768] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2067'. [ 428.409276][T11768] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 428.796313][T11782] netlink: 'syz.3.2071': attribute type 10 has an invalid length. [ 428.883366][T11782] syz_tun: entered promiscuous mode [ 429.002546][T11782] syz_tun: entered allmulticast mode [ 429.083194][T11782] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 429.114802][T11790] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2074'. [ 429.190273][T11790] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 430.157513][T11806] netlink: 'syz.3.2081': attribute type 2 has an invalid length. [ 430.823842][T11826] veth1_macvtap: left promiscuous mode [ 431.630956][T11853] netlink: 14463 bytes leftover after parsing attributes in process `syz.0.2099'. [ 432.633284][T11869] netlink: 'syz.1.2106': attribute type 21 has an invalid length. [ 433.187607][T11886] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2113'. [ 433.213085][T11886] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2113'. [ 433.248148][T11886] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2113'. [ 433.274517][T11886] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2113'. [ 433.307873][T11886] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2113'. [ 433.342510][T11886] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2113'. [ 433.445475][T11886] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2113'. [ 433.516307][T11900] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2118'. [ 433.698774][T11900] netlink: 'syz.3.2118': attribute type 4 has an invalid length. [ 433.857350][T11911] syz.2.2122[11911] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 433.857809][T11911] syz.2.2122[11911] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 434.527413][T11924] netlink: 'syz.1.2126': attribute type 1 has an invalid length. [ 434.838194][T11930] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2129'. [ 435.076122][T11942] netlink: 'syz.3.2134': attribute type 2 has an invalid length. [ 439.311659][T11979] bridge0: port 3(batadv0) entered blocking state [ 439.318340][T11979] bridge0: port 3(batadv0) entered disabled state [ 439.402682][T11979] batadv0: entered allmulticast mode [ 439.416422][T11979] batadv0: entered promiscuous mode [ 439.426482][T11979] bridge0: port 3(batadv0) entered blocking state [ 439.433115][T11979] bridge0: port 3(batadv0) entered forwarding state [ 439.712007][ T60] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 439.721388][ T60] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 440.256735][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.263185][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.517701][T12004] netlink: 'syz.0.2155': attribute type 29 has an invalid length. [ 442.526280][T12004] netlink: 'syz.0.2155': attribute type 29 has an invalid length. [ 442.535313][T12004] netlink: 'syz.0.2155': attribute type 29 has an invalid length. [ 442.687114][T12004] netlink: 'syz.0.2155': attribute type 10 has an invalid length. [ 442.701298][T12004] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2155'. [ 442.710935][T12004] ipvlan1: entered promiscuous mode [ 442.739434][T12004] ipvlan1: entered allmulticast mode [ 442.884515][T12004] veth0_vlan: entered allmulticast mode [ 442.894961][T12004] bridge0: port 4(ipvlan1) entered blocking state [ 442.902256][T12004] bridge0: port 4(ipvlan1) entered disabled state [ 442.915146][T12004] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 443.114736][T12013] netlink: 'syz.3.2158': attribute type 1 has an invalid length. [ 443.131597][T12013] netlink: 13951 bytes leftover after parsing attributes in process `syz.3.2158'. [ 444.204399][T12046] netlink: 'syz.0.2172': attribute type 4 has an invalid length. [ 445.512365][T12084] netlink: 'syz.2.2186': attribute type 2 has an invalid length. [ 446.404196][T12122] netlink: 'syz.1.2201': attribute type 5 has an invalid length. [ 447.267549][T12133] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.2204'. [ 448.577082][T12179] netlink: 'syz.1.2223': attribute type 21 has an invalid length. [ 448.603280][T12179] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2223'. [ 449.666371][T12209] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2230'. [ 449.676277][T12215] dvmrp1: tun_chr_ioctl cmd 2148553947 [ 450.251344][T12231] netlink: 'syz.2.2241': attribute type 2 has an invalid length. [ 451.852287][T12269] netlink: 'syz.3.2256': attribute type 21 has an invalid length. [ 451.860392][T12269] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2256'. [ 452.817420][T12285] sit0: entered allmulticast mode [ 452.907479][T12291] sit0: entered promiscuous mode [ 454.431879][T12346] netlink: 'syz.1.2286': attribute type 9 has an invalid length. [ 454.621322][T12359] netlink: 'syz.2.2291': attribute type 2 has an invalid length. [ 454.915089][T12369] netlink: 'syz.1.2296': attribute type 6 has an invalid length. [ 454.931536][T12369] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.2296'. [ 459.309250][T12415] netlink: 'syz.0.2312': attribute type 2 has an invalid length. [ 459.743768][T12423] netlink: 'syz.2.2317': attribute type 10 has an invalid length. [ 460.484596][T12446] netlink: 'syz.3.2325': attribute type 2 has an invalid length. [ 461.785055][T12470] netlink: 'syz.1.2335': attribute type 2 has an invalid length. [ 462.115199][T12477] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2339'. [ 462.169975][T12485] netlink: 16211 bytes leftover after parsing attributes in process `syz.2.2339'. [ 462.190380][T12477] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 462.224588][T12487] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2342'. [ 462.249664][T12484] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2341'. [ 462.327654][T12484] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2341'. [ 462.345934][T12489] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2341'. [ 462.423677][T12484] netlink: 'syz.0.2341': attribute type 4 has an invalid length. [ 462.629158][T12498] netlink: 'syz.2.2346': attribute type 5 has an invalid length. [ 462.666608][T12498] netlink: 'syz.2.2346': attribute type 1 has an invalid length. [ 462.731319][T12498] netlink: 199820 bytes leftover after parsing attributes in process `syz.2.2346'. [ 462.750923][T12500] netlink: 'syz.2.2346': attribute type 5 has an invalid length. [ 462.763082][T12500] netlink: 'syz.2.2346': attribute type 1 has an invalid length. [ 462.771050][T12500] netlink: 199820 bytes leftover after parsing attributes in process `syz.2.2346'. [ 463.349919][T12518] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2355'. [ 463.392081][T12520] netlink: 16211 bytes leftover after parsing attributes in process `syz.3.2355'. [ 463.425454][T12518] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 463.730426][T12527] netlink: 'syz.0.2357': attribute type 2 has an invalid length. [ 463.769440][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 463.783243][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 463.798704][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 463.808233][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 463.833118][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 463.840882][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 464.006838][ T4719] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.033784][T12525] netlink: 'syz.2.2358': attribute type 4 has an invalid length. [ 464.107865][ T4719] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.229057][ T4719] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.357285][ T4719] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.737253][T12533] chnl_net:caif_netlink_parms(): no params data found [ 465.290180][T12533] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.317799][T12533] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.345882][T12533] bridge_slave_0: entered allmulticast mode [ 465.366392][T12533] bridge_slave_0: entered promiscuous mode [ 465.445377][T12533] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.467967][T12533] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.476000][T12533] bridge_slave_1: entered allmulticast mode [ 465.507667][T12533] bridge_slave_1: entered promiscuous mode [ 465.694547][T12533] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 465.736605][T12533] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 465.933566][ T5779] Bluetooth: hci1: command tx timeout [ 465.982111][T12533] team0: Port device team_slave_0 added [ 466.090995][T12533] team0: Port device team_slave_1 added [ 468.001174][ T5779] Bluetooth: hci1: command tx timeout [ 468.882436][T12609] __nla_validate_parse: 5 callbacks suppressed [ 468.882457][T12609] netlink: 14568 bytes leftover after parsing attributes in process `syz.2.2381'. [ 468.951517][T12533] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 468.960752][T12533] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 468.997310][T12533] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 469.171755][T12533] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 469.178926][T12533] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 469.200315][T12618] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2384'. [ 469.250908][T12533] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 469.341423][T12533] hsr_slave_0: entered promiscuous mode [ 469.357262][T12533] hsr_slave_1: entered promiscuous mode [ 469.364469][T12533] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 469.373199][T12533] Cannot create hsr debugfs directory [ 469.817152][T12622] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2384'. [ 470.081674][ T5779] Bluetooth: hci1: command tx timeout [ 472.171217][ T5779] Bluetooth: hci1: command tx timeout [ 473.553658][T12663] netlink: 140 bytes leftover after parsing attributes in process `syz.3.2391'. [ 473.567930][T12663] netlink: 10 bytes leftover after parsing attributes in process `syz.3.2391'. [ 473.583224][T12663] bond0: (slave bond_slave_0): Releasing backup interface [ 473.602425][T12663] bond_slave_0: left promiscuous mode [ 473.608027][T12663] bond_slave_0: left allmulticast mode [ 473.626266][T12663] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 477.193913][T12678] validate_nla: 1 callbacks suppressed [ 477.193933][T12678] netlink: 'syz.2.2394': attribute type 2 has an invalid length. [ 477.211808][T12678] netlink: 164 bytes leftover after parsing attributes in process `syz.2.2394'. [ 477.347849][ T4719] hsr_slave_0: left promiscuous mode [ 477.364588][ T4719] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.382001][ T4719] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.410593][ T4719] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.428486][ T4719] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.436700][ T4719] batadv0: left allmulticast mode [ 477.456262][ T4719] batadv0: left promiscuous mode [ 477.466370][ T4719] bridge0: port 3(batadv0) entered disabled state [ 477.484311][ T4719] bridge_slave_1: left allmulticast mode [ 477.490098][ T4719] bridge_slave_1: left promiscuous mode [ 477.500704][ T4719] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.519978][ T4719] bridge_slave_0: left allmulticast mode [ 477.526459][ T4719] bridge_slave_0: left promiscuous mode [ 477.534174][ T4719] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.578638][ T4719] veth1_macvtap: left promiscuous mode [ 477.585064][ T4719] veth0_macvtap: left promiscuous mode [ 477.591132][ T4719] veth1_vlan: left promiscuous mode [ 477.598928][ T4719] veth0_vlan: left promiscuous mode [ 478.359974][ T4719] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 478.834118][ T4719] team0 (unregistering): Port device team_slave_1 removed [ 478.880881][ T4719] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 478.936228][ T4719] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 479.264677][ T4719] team0 (unregistering): Port device bond0 removed [ 479.299970][ T4719] bond0 (unregistering): Released all slaves [ 479.396363][T12694] netlink: 14568 bytes leftover after parsing attributes in process `syz.0.2400'. [ 479.652869][T12725] netlink: 'syz.2.2413': attribute type 8 has an invalid length. [ 479.653768][T12533] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 479.691315][T12725] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.2413'. [ 479.720519][T12533] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 479.762518][T12533] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 479.803895][T12533] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 479.885711][T12731] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2413'. [ 480.123681][T12533] 8021q: adding VLAN 0 to HW filter on device bond0 [ 480.186248][T12533] 8021q: adding VLAN 0 to HW filter on device team0 [ 480.208046][ T2955] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.215340][ T2955] bridge0: port 1(bridge_slave_0) entered forwarding state [ 480.243434][ T2955] bridge0: port 2(bridge_slave_1) entered blocking state [ 480.250638][ T2955] bridge0: port 2(bridge_slave_1) entered forwarding state [ 480.905180][T12533] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 480.982211][T12762] netlink: 14568 bytes leftover after parsing attributes in process `syz.3.2420'. [ 481.154105][T12533] veth0_vlan: entered promiscuous mode [ 481.197932][T12533] veth1_vlan: entered promiscuous mode [ 481.397357][T12533] veth0_macvtap: entered promiscuous mode [ 481.507839][T12533] veth1_macvtap: entered promiscuous mode [ 481.554664][T12533] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 481.567784][T12533] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 481.584801][T12533] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 481.604336][T12533] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 481.618770][T12533] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 481.636836][T12533] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 481.676647][T12533] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 481.725293][T12533] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 481.739500][T12533] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 481.758158][T12533] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 481.770442][T12533] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 481.792420][T12533] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 481.808944][T12533] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 481.829736][T12533] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 481.868943][T12533] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.880837][T12533] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.891566][T12533] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.900944][T12533] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.103221][ T138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 482.125458][ T138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 482.222718][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 482.244919][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 482.439785][T12799] netlink: 'syz.3.2431': attribute type 2 has an invalid length. [ 482.464611][T12799] netlink: 'syz.3.2431': attribute type 8 has an invalid length. [ 482.491790][T12799] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2431'. [ 483.062857][T12817] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2436'. [ 483.747817][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 483.763122][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 483.778007][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 483.792689][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 483.800779][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 483.809593][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 483.925469][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.077217][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.263894][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.400382][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.740424][T12839] chnl_net:caif_netlink_parms(): no params data found [ 484.887908][T12874] netlink: 'syz.3.2455': attribute type 3 has an invalid length. [ 484.896318][T12874] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.2455'. [ 485.110224][ T5779] Bluetooth: hci2: unexpected subevent 0x05 length: 150 > 12 [ 485.308226][T12839] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.317633][T12839] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.326360][T12839] bridge_slave_0: entered allmulticast mode [ 485.335570][T12839] bridge_slave_0: entered promiscuous mode [ 485.346217][T12839] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.377573][T12839] bridge0: port 2(bridge_slave_1) entered disabled state [ 485.398055][T12839] bridge_slave_1: entered allmulticast mode [ 485.415301][T12839] bridge_slave_1: entered promiscuous mode [ 485.743257][T12839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 485.775028][T12839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 485.931228][ T5779] Bluetooth: hci0: command tx timeout [ 485.960648][T12839] team0: Port device team_slave_0 added [ 485.973250][T12839] team0: Port device team_slave_1 added [ 486.586784][T12839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 486.609598][T12839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 486.639700][T12839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 486.739624][T12917] netlink: 'syz.3.2464': attribute type 10 has an invalid length. [ 486.752856][T12917] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2464'. [ 486.768239][T12917] ipvlan1: entered promiscuous mode [ 486.782473][T12917] ipvlan1: entered allmulticast mode [ 486.811439][T12917] veth0_vlan: entered allmulticast mode [ 486.820475][T12917] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 486.901926][T12839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 486.909222][T12839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 486.938584][T12839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 487.121255][ T5779] Bluetooth: hci2: command 0x0406 tx timeout [ 487.156857][T12839] hsr_slave_0: entered promiscuous mode [ 487.182359][T12839] hsr_slave_1: entered promiscuous mode [ 487.270860][T12931] netlink: 'syz.3.2470': attribute type 21 has an invalid length. [ 487.279064][T12931] netlink: 'syz.3.2470': attribute type 11 has an invalid length. [ 487.439642][ T49] hsr_slave_0: left promiscuous mode [ 487.474439][ T49] hsr_slave_1: left promiscuous mode [ 487.521827][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 487.529303][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 487.575938][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 487.599534][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 487.623935][ T49] batadv0: left allmulticast mode [ 487.639277][ T49] batadv0: left promiscuous mode [ 487.647364][ T49] bridge0: port 3(batadv0) entered disabled state [ 487.667539][ T49] bridge_slave_1: left allmulticast mode [ 487.695422][ T49] bridge_slave_1: left promiscuous mode [ 487.713068][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 487.750665][ T49] bridge_slave_0: left allmulticast mode [ 487.757300][ T49] bridge_slave_0: left promiscuous mode [ 487.764294][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.800613][ T49] veth1_macvtap: left promiscuous mode [ 487.806498][ T49] veth0_macvtap: left promiscuous mode [ 487.813061][ T49] veth1_vlan: left promiscuous mode [ 487.818534][ T49] veth0_vlan: left promiscuous mode [ 488.002072][ T5779] Bluetooth: hci0: command tx timeout [ 488.208820][ T49] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 488.557352][ T49] team0 (unregistering): Port device team_slave_1 removed [ 488.601238][ T49] team0 (unregistering): Port device team_slave_0 removed [ 488.651814][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 488.698728][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 489.023145][ T49] team0 (unregistering): Port device bond0 removed [ 489.057907][ T49] bond0 (unregistering): Released all slaves [ 489.150104][T12957] netlink: 'syz.3.2478': attribute type 2 has an invalid length. [ 489.899896][T12985] netlink: 'syz.1.2487': attribute type 3 has an invalid length. [ 489.945243][T12985] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.2487'. [ 490.081646][ T5779] Bluetooth: hci0: command tx timeout [ 490.097260][T12991] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.2488'. [ 490.381859][T12994] netlink: 'syz.1.2487': attribute type 39 has an invalid length. [ 491.503646][T12839] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 491.619228][T12839] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 491.688460][T12839] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 491.800416][T12839] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 492.186757][ T5779] Bluetooth: hci0: command tx timeout [ 492.332482][T12839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 492.392440][T12839] 8021q: adding VLAN 0 to HW filter on device team0 [ 492.444277][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 492.451494][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 492.514799][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 492.522039][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 493.933671][T12839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 494.120427][T12839] veth0_vlan: entered promiscuous mode [ 494.176837][T12839] veth1_vlan: entered promiscuous mode [ 494.308189][T12839] veth0_macvtap: entered promiscuous mode [ 494.347396][T12839] veth1_macvtap: entered promiscuous mode [ 494.444089][T12839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 494.467405][T12839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 494.491276][T12839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 494.508224][T12839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 494.518619][T12839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 494.539810][T12839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 494.562683][T12839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 494.609225][T12839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 494.638973][T12839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 494.657532][T12839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 494.668439][T12839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 494.696390][T12839] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 494.714090][T12839] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 494.753315][T12839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 494.795720][T12839] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.814094][T12839] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.827124][T12839] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.847982][T12839] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.903367][T13064] syz.2.2500[13064] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 494.903775][T13064] syz.2.2500[13064] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 495.165134][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.208494][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.290163][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.321810][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 496.646968][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 496.663473][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 496.675173][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 496.679377][ T60] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.709228][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 496.733618][ T51] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 496.742629][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 496.990678][ T60] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.807384][ T51] Bluetooth: hci3: command tx timeout [ 499.406980][ T60] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.615666][ T60] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.558039][T13180] netlink: 'syz.3.2530': attribute type 3 has an invalid length. [ 500.589767][T13180] netlink: 'syz.3.2530': attribute type 1 has an invalid length. [ 500.625889][T13180] netlink: 'syz.3.2530': attribute type 6 has an invalid length. [ 500.662650][T13180] netlink: 144448 bytes leftover after parsing attributes in process `syz.3.2530'. [ 500.881980][ T51] Bluetooth: hci3: command tx timeout [ 501.097441][T13126] chnl_net:caif_netlink_parms(): no params data found [ 501.542917][T13126] bridge0: port 1(bridge_slave_0) entered blocking state [ 501.595575][T13126] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.612271][T13126] bridge_slave_0: entered allmulticast mode [ 501.631656][T13126] bridge_slave_0: entered promiscuous mode [ 501.649565][T13126] bridge0: port 2(bridge_slave_1) entered blocking state [ 501.666989][T13126] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.690472][T13126] bridge_slave_1: entered allmulticast mode [ 501.703667][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.712105][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.746229][T13126] bridge_slave_1: entered promiscuous mode [ 501.812750][T13205] netlink: 'syz.0.2533': attribute type 2 has an invalid length. [ 502.623139][T13217] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.2535'. [ 502.939815][T13126] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 502.958072][T13126] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 502.961220][ T51] Bluetooth: hci3: command tx timeout [ 503.013138][T13228] netlink: 'syz.3.2538': attribute type 9 has an invalid length. [ 503.023708][T13228] netlink: 154356 bytes leftover after parsing attributes in process `syz.3.2538'. [ 503.175471][T13126] team0: Port device team_slave_0 added [ 503.199650][T13126] team0: Port device team_slave_1 added [ 503.428176][ T51] Bluetooth: hci0: ACL packet too small [ 503.577776][T13238] netlink: 'syz.0.2540': attribute type 10 has an invalid length. [ 503.589133][T13238] netlink: 55 bytes leftover after parsing attributes in process `syz.0.2540'. [ 503.761614][T13126] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 503.779235][T13126] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 503.841310][T13126] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 503.892522][T13126] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 503.906170][T13126] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 503.957226][T13126] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 504.254022][T13126] hsr_slave_0: entered promiscuous mode [ 504.337574][T13126] hsr_slave_1: entered promiscuous mode [ 504.346759][T13126] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 504.384916][T13126] Cannot create hsr debugfs directory [ 504.753669][ T51] Bluetooth: hci2: ISO packet for unknown connection handle 20 [ 505.042326][ T51] Bluetooth: hci3: command tx timeout [ 505.428900][T13281] netlink: 'syz.1.2554': attribute type 2 has an invalid length. [ 505.636311][T13287] FAULT_INJECTION: forcing a failure. [ 505.636311][T13287] name failslab, interval 1, probability 0, space 0, times 0 [ 505.653231][T13287] CPU: 0 PID: 13287 Comm: syz.0.2556 Not tainted syzkaller #0 [ 505.660740][T13287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 505.670909][T13287] Call Trace: [ 505.674343][T13287] [ 505.677318][T13287] dump_stack_lvl+0x18c/0x250 [ 505.682070][T13287] ? show_regs_print_info+0x20/0x20 [ 505.687322][T13287] ? load_image+0x420/0x420 [ 505.691891][T13287] ? __might_sleep+0xe0/0xe0 [ 505.696494][T13287] ? __lock_acquire+0x7d80/0x7d80 [ 505.701593][T13287] should_fail_ex+0x394/0x4c0 [ 505.706326][T13287] should_failslab+0x9/0x20 [ 505.710873][T13287] slab_pre_alloc_hook+0x59/0x300 [ 505.715941][T13287] ? mutex_lock_nested+0x20/0x20 [ 505.720950][T13287] ? tcx_link_attach+0x165/0x960 [ 505.725891][T13287] __kmem_cache_alloc_node+0x53/0x250 [ 505.731303][T13287] ? tcx_link_attach+0x165/0x960 [ 505.736281][T13287] kmalloc_trace+0x2a/0xe0 [ 505.740729][T13287] tcx_link_attach+0x165/0x960 [ 505.745535][T13287] ? __fget_files+0x28/0x460 [ 505.750148][T13287] ? tcx_prog_query+0x140/0x140 [ 505.755028][T13287] ? __fget_files+0x3fc/0x460 [ 505.759734][T13287] ? bpf_prog_attach_check_attach_type+0x188/0x440 [ 505.766240][T13287] link_create+0x390/0x720 [ 505.770680][T13287] __sys_bpf+0x4d7/0x890 [ 505.774951][T13287] ? bpf_link_show_fdinfo+0x390/0x390 [ 505.780373][T13287] ? lock_chain_count+0x20/0x20 [ 505.785258][T13287] __x64_sys_bpf+0x7c/0x90 [ 505.789692][T13287] do_syscall_64+0x55/0xb0 [ 505.794114][T13287] ? clear_bhb_loop+0x40/0x90 [ 505.798810][T13287] ? clear_bhb_loop+0x40/0x90 [ 505.803510][T13287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 505.809410][T13287] RIP: 0033:0x7fce18b9e0d9 [ 505.813828][T13287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 505.833612][T13287] RSP: 002b:00007fce19b0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 505.842031][T13287] RAX: ffffffffffffffda RBX: 00007fce18e25fa0 RCX: 00007fce18b9e0d9 [ 505.850003][T13287] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 000000000000001c [ 505.857980][T13287] RBP: 00007fce19b0e090 R08: 0000000000000000 R09: 0000000000000000 [ 505.866044][T13287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 505.874044][T13287] R13: 00007fce18e26038 R14: 00007fce18e25fa0 R15: 00007ffc979d1c98 [ 505.882037][T13287] [ 506.091614][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 506.109558][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 506.126562][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 506.142607][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 506.170676][ T60] veth1_macvtap: left promiscuous mode [ 506.176513][ T60] veth0_macvtap: left promiscuous mode [ 507.330320][ T60] team0 (unregistering): Port device team_slave_1 removed [ 507.375739][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 507.729547][ T60] team0 (unregistering): Port device bond0 removed [ 507.764746][ T60] bond0 (unregistering): Released all slaves [ 508.296129][T13333] netlink: 'syz.3.2566': attribute type 10 has an invalid length. [ 508.311889][T13126] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 508.345880][T13126] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 508.362167][T13333] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2566'. [ 508.423078][T13126] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 508.435271][T13333] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 508.492655][T13126] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 508.716248][T13126] 8021q: adding VLAN 0 to HW filter on device bond0 [ 508.818379][T13126] 8021q: adding VLAN 0 to HW filter on device team0 [ 509.757205][T13350] netlink: 'syz.0.2569': attribute type 10 has an invalid length. [ 509.781950][T13350] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2569'. [ 509.792485][T13350] hsr0: entered promiscuous mode [ 509.797804][T13350] bridge0: port 3(hsr0) entered blocking state [ 509.808703][T13350] bridge0: port 3(hsr0) entered disabled state [ 509.816102][T13350] hsr0: entered allmulticast mode [ 509.821432][T13350] hsr_slave_0: entered allmulticast mode [ 509.827792][T13350] hsr_slave_1: entered allmulticast mode [ 509.865059][T13350] bridge0: port 3(hsr0) entered blocking state [ 509.871650][T13350] bridge0: port 3(hsr0) entered forwarding state [ 509.892061][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.899348][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 509.920100][ T138] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.927477][ T138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 510.711996][T13399] FAULT_INJECTION: forcing a failure. [ 510.711996][T13399] name failslab, interval 1, probability 0, space 0, times 0 [ 510.725185][T13399] CPU: 0 PID: 13399 Comm: syz.1.2583 Not tainted syzkaller #0 [ 510.732792][T13399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 510.743160][T13399] Call Trace: [ 510.746477][T13399] [ 510.749442][T13399] dump_stack_lvl+0x18c/0x250 [ 510.754215][T13399] ? show_regs_print_info+0x20/0x20 [ 510.759460][T13399] ? load_image+0x420/0x420 [ 510.764187][T13399] ? mark_lock+0x94/0x320 [ 510.768566][T13399] ? __lock_acquire+0x1336/0x7d80 [ 510.773742][T13399] should_fail_ex+0x394/0x4c0 [ 510.778632][T13399] should_failslab+0x9/0x20 [ 510.783191][T13399] slab_pre_alloc_hook+0x59/0x300 [ 510.788277][T13399] kmem_cache_alloc+0x5a/0x2c0 [ 510.793089][T13399] ? radix_tree_node_alloc+0x7e/0x3a0 [ 510.798547][T13399] radix_tree_node_alloc+0x7e/0x3a0 [ 510.803800][T13399] idr_get_free+0x28f/0xa10 [ 510.808370][T13399] idr_alloc_cyclic+0x28a/0x610 [ 510.813292][T13399] ? idr_alloc+0x2e0/0x2e0 [ 510.817765][T13399] ? do_raw_spin_lock+0x11f/0x2b0 [ 510.822844][T13399] ? __radix_tree_preload+0x82/0x880 [ 510.828184][T13399] ? bpf_link_prime+0x4c/0x1d0 [ 510.832994][T13399] bpf_link_prime+0x6b/0x1d0 [ 510.837617][T13399] tcx_link_attach+0x218/0x960 [ 510.842501][T13399] ? tcx_prog_query+0x140/0x140 [ 510.847363][T13399] ? __fget_files+0x3fc/0x460 [ 510.852067][T13399] ? bpf_prog_attach_check_attach_type+0x188/0x440 [ 510.858616][T13399] link_create+0x390/0x720 [ 510.863066][T13399] __sys_bpf+0x4d7/0x890 [ 510.867415][T13399] ? bpf_link_show_fdinfo+0x390/0x390 [ 510.872818][T13399] ? lock_chain_count+0x20/0x20 [ 510.877743][T13399] __x64_sys_bpf+0x7c/0x90 [ 510.882180][T13399] do_syscall_64+0x55/0xb0 [ 510.886619][T13399] ? clear_bhb_loop+0x40/0x90 [ 510.891308][T13399] ? clear_bhb_loop+0x40/0x90 [ 510.896028][T13399] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 510.901935][T13399] RIP: 0033:0x7feb6939e0d9 [ 510.906360][T13399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 510.926061][T13399] RSP: 002b:00007feb6a33f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 510.934493][T13399] RAX: ffffffffffffffda RBX: 00007feb69625fa0 RCX: 00007feb6939e0d9 [ 510.942481][T13399] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 000000000000001c [ 510.950459][T13399] RBP: 00007feb6a33f090 R08: 0000000000000000 R09: 0000000000000000 [ 510.958442][T13399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.966420][T13399] R13: 00007feb69626038 R14: 00007feb69625fa0 R15: 00007ffd9d586e08 [ 510.974426][T13399] [ 511.116905][T13126] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 511.274382][T13126] veth0_vlan: entered promiscuous mode [ 511.334114][T13126] veth1_vlan: entered promiscuous mode [ 511.418609][T13126] veth0_macvtap: entered promiscuous mode [ 511.460042][T13126] veth1_macvtap: entered promiscuous mode [ 511.498586][T13126] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 511.535172][T13126] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 511.546963][T13126] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 511.568524][T13126] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 511.585991][T13126] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 511.600787][T13126] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 511.613605][T13126] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 511.644764][T13126] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 511.662805][T13126] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 511.681508][T13126] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 511.696620][T13126] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 511.706825][T13126] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 511.719773][T13126] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 511.733101][T13126] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 511.759470][T13126] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.779644][T13126] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.791446][T13126] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.800981][T13126] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.232033][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 512.239892][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 512.380895][ T138] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 512.409396][ T138] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.223832][T13477] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 514.236824][T13477] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 514.254022][T13477] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 514.277941][T13477] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 514.299085][T13477] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 514.307310][T13477] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 514.751862][ T5776] bond0: (slave syz_tun): Releasing backup interface [ 514.760314][ T5776] syz_tun (unregistering): left allmulticast mode [ 514.937204][T13495] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2607'. [ 516.015531][ T42] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 516.386746][ T42] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 516.405873][ T51] Bluetooth: hci4: command tx timeout [ 516.447793][T13530] FAULT_INJECTION: forcing a failure. [ 516.447793][T13530] name failslab, interval 1, probability 0, space 0, times 0 [ 516.494782][T13530] CPU: 1 PID: 13530 Comm: syz.0.2618 Not tainted syzkaller #0 [ 516.502328][T13530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 516.512515][T13530] Call Trace: [ 516.515834][T13530] [ 516.518802][T13530] dump_stack_lvl+0x18c/0x250 [ 516.523705][T13530] ? show_regs_print_info+0x20/0x20 [ 516.529034][T13530] ? load_image+0x420/0x420 [ 516.533660][T13530] ? __might_sleep+0xe0/0xe0 [ 516.538380][T13530] ? __lock_acquire+0x7d80/0x7d80 [ 516.543546][T13530] should_fail_ex+0x394/0x4c0 [ 516.548278][T13530] should_failslab+0x9/0x20 [ 516.552920][T13530] slab_pre_alloc_hook+0x59/0x300 [ 516.558004][T13530] ? d_instantiate+0x6f/0x90 [ 516.562642][T13530] kmem_cache_alloc+0x5a/0x2c0 [ 516.567553][T13530] ? alloc_empty_file+0x9e/0x1d0 [ 516.572561][T13530] alloc_empty_file+0x9e/0x1d0 [ 516.577366][T13530] alloc_file+0x5b/0x600 [ 516.581654][T13530] alloc_file_pseudo+0x184/0x210 [ 516.586635][T13530] ? fput+0x1a0/0x1a0 [ 516.590657][T13530] ? __lock_acquire+0x7d80/0x7d80 [ 516.595785][T13530] ? __local_bh_enable_ip+0x13a/0x1c0 [ 516.601198][T13530] ? _local_bh_enable+0xa0/0xa0 [ 516.606094][T13530] anon_inode_getfile+0xc5/0x1a0 [ 516.611085][T13530] bpf_link_prime+0xa6/0x1d0 [ 516.615724][T13530] tcx_link_attach+0x218/0x960 [ 516.620552][T13530] ? tcx_prog_query+0x140/0x140 [ 516.625711][T13530] ? __fget_files+0x3fc/0x460 [ 516.630453][T13530] ? bpf_prog_attach_check_attach_type+0x188/0x440 [ 516.637014][T13530] link_create+0x390/0x720 [ 516.641673][T13530] __sys_bpf+0x4d7/0x890 [ 516.645981][T13530] ? bpf_link_show_fdinfo+0x390/0x390 [ 516.651441][T13530] ? lock_chain_count+0x20/0x20 [ 516.656348][T13530] __x64_sys_bpf+0x7c/0x90 [ 516.660841][T13530] do_syscall_64+0x55/0xb0 [ 516.665305][T13530] ? clear_bhb_loop+0x40/0x90 [ 516.670116][T13530] ? clear_bhb_loop+0x40/0x90 [ 516.674883][T13530] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 516.680813][T13530] RIP: 0033:0x7fce18b9e0d9 [ 516.685270][T13530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 516.704927][T13530] RSP: 002b:00007fce19aed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 516.713400][T13530] RAX: ffffffffffffffda RBX: 00007fce18e26090 RCX: 00007fce18b9e0d9 [ 516.721498][T13530] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 000000000000001c [ 516.729512][T13530] RBP: 00007fce19aed090 R08: 0000000000000000 R09: 0000000000000000 [ 516.737618][T13530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 516.745638][T13530] R13: 00007fce18e26128 R14: 00007fce18e26090 R15: 00007ffc979d1c98 [ 516.753672][T13530] [ 516.801982][ T42] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.754659][ T42] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.904481][T13541] netlink: 668 bytes leftover after parsing attributes in process `syz.0.2622'. [ 517.990542][T13541] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 517.995645][T13475] chnl_net:caif_netlink_parms(): no params data found [ 518.045298][T13541] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 518.392724][T13475] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.400189][T13475] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.418376][T13475] bridge_slave_0: entered allmulticast mode [ 518.428788][T13475] bridge_slave_0: entered promiscuous mode [ 518.442542][T13475] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.455180][T13475] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.463076][T13475] bridge_slave_1: entered allmulticast mode [ 518.470597][T13475] bridge_slave_1: entered promiscuous mode [ 518.489749][ T51] Bluetooth: hci4: command tx timeout [ 518.759743][T13475] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 518.805397][T13475] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 519.400987][T13475] team0: Port device team_slave_0 added [ 519.445086][T13475] team0: Port device team_slave_1 added [ 519.692787][T13475] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 519.699801][T13475] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 519.755024][T13475] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 519.846843][T13475] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 519.867224][T13475] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 519.938441][T13475] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 520.356563][T13475] hsr_slave_0: entered promiscuous mode [ 520.379459][T13475] hsr_slave_1: entered promiscuous mode [ 520.403497][T13475] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 520.417179][T13475] Cannot create hsr debugfs directory [ 520.430091][T13610] netlink: 'syz.1.2643': attribute type 11 has an invalid length. [ 520.441619][T13610] netlink: 140 bytes leftover after parsing attributes in process `syz.1.2643'. [ 520.561919][ T51] Bluetooth: hci4: command tx timeout [ 521.132574][T13633] netlink: 'syz.1.2650': attribute type 2 has an invalid length. [ 521.481432][T13643] netlink: 'syz.2.2654': attribute type 11 has an invalid length. [ 521.520610][T13643] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2654'. [ 521.628893][T13644] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2653'. [ 521.932265][T13652] FAULT_INJECTION: forcing a failure. [ 521.932265][T13652] name failslab, interval 1, probability 0, space 0, times 0 [ 521.961238][T13652] CPU: 1 PID: 13652 Comm: syz.0.2656 Not tainted syzkaller #0 [ 521.968773][T13652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 521.978865][T13652] Call Trace: [ 521.982264][T13652] [ 521.985233][T13652] dump_stack_lvl+0x18c/0x250 [ 521.989964][T13652] ? show_regs_print_info+0x20/0x20 [ 521.995211][T13652] ? load_image+0x420/0x420 [ 521.999776][T13652] ? __might_sleep+0xe0/0xe0 [ 522.004414][T13652] ? __lock_acquire+0x7d80/0x7d80 [ 522.009509][T13652] should_fail_ex+0x394/0x4c0 [ 522.014238][T13652] should_failslab+0x9/0x20 [ 522.018807][T13652] slab_pre_alloc_hook+0x59/0x300 [ 522.023897][T13652] kmem_cache_alloc_lru+0x4d/0x2b0 [ 522.029058][T13652] ? __d_alloc+0x31/0x710 [ 522.033445][T13652] __d_alloc+0x31/0x710 [ 522.037648][T13652] d_alloc_pseudo+0x1d/0x70 [ 522.042199][T13652] alloc_file_pseudo+0xe4/0x210 [ 522.047101][T13652] ? fput+0x1a0/0x1a0 [ 522.051149][T13652] ? __lock_acquire+0x7d80/0x7d80 [ 522.056224][T13652] ? __local_bh_enable_ip+0x13a/0x1c0 [ 522.061641][T13652] ? _local_bh_enable+0xa0/0xa0 [ 522.066539][T13652] anon_inode_getfile+0xc5/0x1a0 [ 522.071528][T13652] bpf_link_prime+0xa6/0x1d0 [ 522.076169][T13652] tcx_link_attach+0x218/0x960 [ 522.080980][T13652] ? tcx_prog_query+0x140/0x140 [ 522.085870][T13652] ? __fget_files+0x3fc/0x460 [ 522.090612][T13652] ? bpf_prog_attach_check_attach_type+0x188/0x440 [ 522.097166][T13652] link_create+0x390/0x720 [ 522.101642][T13652] __sys_bpf+0x4d7/0x890 [ 522.105931][T13652] ? bpf_link_show_fdinfo+0x390/0x390 [ 522.111363][T13652] ? lock_chain_count+0x20/0x20 [ 522.116263][T13652] __x64_sys_bpf+0x7c/0x90 [ 522.120731][T13652] do_syscall_64+0x55/0xb0 [ 522.125190][T13652] ? clear_bhb_loop+0x40/0x90 [ 522.129906][T13652] ? clear_bhb_loop+0x40/0x90 [ 522.134630][T13652] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 522.140652][T13652] RIP: 0033:0x7fce18b9e0d9 [ 522.145121][T13652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 522.164960][T13652] RSP: 002b:00007fce19b0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 522.173441][T13652] RAX: ffffffffffffffda RBX: 00007fce18e25fa0 RCX: 00007fce18b9e0d9 [ 522.181563][T13652] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 000000000000001c [ 522.189584][T13652] RBP: 00007fce19b0e090 R08: 0000000000000000 R09: 0000000000000000 [ 522.197595][T13652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 522.205606][T13652] R13: 00007fce18e26038 R14: 00007fce18e25fa0 R15: 00007ffc979d1c98 [ 522.213651][T13652] [ 522.643872][ T51] Bluetooth: hci4: command tx timeout [ 523.437856][ T42] hsr_slave_0: left promiscuous mode [ 523.451949][ T42] hsr_slave_1: left promiscuous mode [ 523.467686][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.489113][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 523.523093][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.530609][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 523.599985][ T42] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 523.613086][ T42] batman_adv: batadv0: Removing interface: virt_wifi0 [ 523.677962][ T42] veth0_macvtap: left promiscuous mode [ 523.685397][ T42] veth1_vlan: left allmulticast mode [ 523.696145][ T42] veth1_vlan: left promiscuous mode [ 523.713456][ T42] veth0_vlan: left promiscuous mode [ 523.723124][T13701] netlink: 144316 bytes leftover after parsing attributes in process `syz.1.2673'. [ 525.205268][ T42] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 525.215565][ T42] macvlan0 (unregistering): left allmulticast mode [ 525.549918][ T42] team_slave_1 (unregistering): left promiscuous mode [ 525.558661][ T42] team_slave_1 (unregistering): left allmulticast mode [ 525.569846][ T42] team0 (unregistering): Port device team_slave_1 removed [ 525.615214][ T42] team_slave_0 (unregistering): left promiscuous mode [ 525.622136][ T42] team_slave_0 (unregistering): left allmulticast mode [ 525.630050][ T42] team0 (unregistering): Port device team_slave_0 removed [ 525.674696][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 525.685978][ T42] bond_slave_1 (unregistering): left promiscuous mode [ 525.693033][ T42] bond_slave_1 (unregistering): left allmulticast mode [ 525.782586][ T42] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 525.792993][ T42] bridge_slave_1 (unregistering): left promiscuous mode [ 525.800652][ T42] bridge_slave_1 (unregistering): left allmulticast mode [ 526.109010][ T42] bond0 (unregistering): left promiscuous mode [ 526.115446][ T42] bond0 (unregistering): left allmulticast mode [ 526.124996][ T42] team0 (unregistering): Port device bond0 removed [ 526.159266][ T42] bond0 (unregistering): Released all slaves [ 526.214123][T13696] netlink: 'syz.0.2670': attribute type 21 has an invalid length. [ 526.297910][T13475] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 526.344737][T13475] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 526.361625][T13475] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 526.421852][T13475] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 526.854583][T13475] 8021q: adding VLAN 0 to HW filter on device bond0 [ 526.967005][T13475] 8021q: adding VLAN 0 to HW filter on device team0 [ 527.097159][T13753] FAULT_INJECTION: forcing a failure. [ 527.097159][T13753] name failslab, interval 1, probability 0, space 0, times 0 [ 527.123235][T13753] CPU: 1 PID: 13753 Comm: syz.0.2687 Not tainted syzkaller #0 [ 527.130776][T13753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 527.141052][T13753] Call Trace: [ 527.144390][T13753] [ 527.147717][T13753] dump_stack_lvl+0x18c/0x250 [ 527.152486][T13753] ? show_regs_print_info+0x20/0x20 [ 527.157724][T13753] ? load_image+0x420/0x420 [ 527.162261][T13753] ? __might_sleep+0xe0/0xe0 [ 527.166874][T13753] ? __lock_acquire+0x7d80/0x7d80 [ 527.171920][T13753] should_fail_ex+0x394/0x4c0 [ 527.176635][T13753] should_failslab+0x9/0x20 [ 527.181160][T13753] slab_pre_alloc_hook+0x59/0x300 [ 527.186203][T13753] ? d_instantiate+0x6f/0x90 [ 527.190820][T13753] kmem_cache_alloc+0x5a/0x2c0 [ 527.195611][T13753] ? alloc_empty_file+0x9e/0x1d0 [ 527.200597][T13753] alloc_empty_file+0x9e/0x1d0 [ 527.205413][T13753] alloc_file+0x5b/0x600 [ 527.209697][T13753] alloc_file_pseudo+0x184/0x210 [ 527.214664][T13753] ? fput+0x1a0/0x1a0 [ 527.218677][T13753] ? __lock_acquire+0x7d80/0x7d80 [ 527.223746][T13753] ? __local_bh_enable_ip+0x13a/0x1c0 [ 527.229186][T13753] ? _local_bh_enable+0xa0/0xa0 [ 527.234089][T13753] anon_inode_getfile+0xc5/0x1a0 [ 527.239166][T13753] bpf_link_prime+0xa6/0x1d0 [ 527.243802][T13753] tcx_link_attach+0x218/0x960 [ 527.248592][T13753] ? tcx_prog_query+0x140/0x140 [ 527.253548][T13753] ? __fget_files+0x3fc/0x460 [ 527.258343][T13753] ? bpf_prog_attach_check_attach_type+0x188/0x440 [ 527.264895][T13753] link_create+0x390/0x720 [ 527.269351][T13753] __sys_bpf+0x4d7/0x890 [ 527.273699][T13753] ? bpf_link_show_fdinfo+0x390/0x390 [ 527.279226][T13753] ? lock_chain_count+0x20/0x20 [ 527.284199][T13753] __x64_sys_bpf+0x7c/0x90 [ 527.288812][T13753] do_syscall_64+0x55/0xb0 [ 527.293332][T13753] ? clear_bhb_loop+0x40/0x90 [ 527.298026][T13753] ? clear_bhb_loop+0x40/0x90 [ 527.302830][T13753] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 527.308736][T13753] RIP: 0033:0x7fce18b9e0d9 [ 527.313175][T13753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 527.333061][T13753] RSP: 002b:00007fce19aed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 527.341583][T13753] RAX: ffffffffffffffda RBX: 00007fce18e26090 RCX: 00007fce18b9e0d9 [ 527.349573][T13753] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 000000000000001c [ 527.357646][T13753] RBP: 00007fce19aed090 R08: 0000000000000000 R09: 0000000000000000 [ 527.365628][T13753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 527.373611][T13753] R13: 00007fce18e26128 R14: 00007fce18e26090 R15: 00007ffc979d1c98 [ 527.381616][T13753] [ 527.447844][ T4719] bridge0: port 1(bridge_slave_0) entered blocking state [ 527.455113][ T4719] bridge0: port 1(bridge_slave_0) entered forwarding state [ 527.478735][T13750] netlink: 'syz.1.2688': attribute type 2 has an invalid length. [ 527.497304][T13750] netlink: 'syz.1.2688': attribute type 8 has an invalid length. [ 527.515495][T13750] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2688'. [ 527.555050][ T4719] bridge0: port 2(bridge_slave_1) entered blocking state [ 527.562377][ T4719] bridge0: port 2(bridge_slave_1) entered forwarding state [ 528.324442][T13785] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 528.332864][T13785] IPv6: NLM_F_CREATE should be set when creating new route [ 528.341812][T13785] IPv6: NLM_F_CREATE should be set when creating new route [ 528.349554][T13785] IPv6: NLM_F_CREATE should be set when creating new route [ 529.489605][T13828] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2707'. [ 529.504100][T13828] openvswitch: netlink: Key 32 has unexpected len 3064 expected 2 [ 531.080675][T13818] netlink: 'syz.1.2704': attribute type 10 has an invalid length. [ 531.095126][T13818] team0: Device vxcan1 is of different type [ 531.111355][T13828] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2707'. [ 531.152877][T13475] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 531.347526][T13475] veth0_vlan: entered promiscuous mode [ 531.384834][T13848] netlink: 'syz.0.2711': attribute type 2 has an invalid length. [ 531.417282][T13475] veth1_vlan: entered promiscuous mode [ 531.512197][T13475] veth0_macvtap: entered promiscuous mode [ 531.536574][T13475] veth1_macvtap: entered promiscuous mode [ 531.588168][T13475] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 531.613574][T13475] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 531.642161][T13475] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 531.655899][T13475] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 531.666363][T13475] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 531.677383][T13475] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 531.694828][T13475] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 531.719418][T13475] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 531.735546][T13475] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 531.747148][T13475] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 531.758124][T13475] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 531.769427][T13475] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 531.780882][T13475] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 531.799668][T13475] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 531.829458][T13857] FAULT_INJECTION: forcing a failure. [ 531.829458][T13857] name failslab, interval 1, probability 0, space 0, times 0 [ 531.849078][T13857] CPU: 1 PID: 13857 Comm: syz.0.2715 Not tainted syzkaller #0 [ 531.856602][T13857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 531.866695][T13857] Call Trace: [ 531.870010][T13857] [ 531.872972][T13857] dump_stack_lvl+0x18c/0x250 [ 531.877699][T13857] ? show_regs_print_info+0x20/0x20 [ 531.882919][T13857] ? load_image+0x420/0x420 [ 531.887553][T13857] ? __might_sleep+0xe0/0xe0 [ 531.892247][T13857] ? __lock_acquire+0x7d80/0x7d80 [ 531.897389][T13857] should_fail_ex+0x394/0x4c0 [ 531.902092][T13857] should_failslab+0x9/0x20 [ 531.906613][T13857] slab_pre_alloc_hook+0x59/0x300 [ 531.911659][T13857] kmem_cache_alloc+0x5a/0x2c0 [ 531.916525][T13857] ? security_file_alloc+0x34/0x120 [ 531.921764][T13857] security_file_alloc+0x34/0x120 [ 531.926810][T13857] init_file+0x94/0x1f0 [ 531.930978][T13857] alloc_empty_file+0xb7/0x1d0 [ 531.935754][T13857] alloc_file+0x5b/0x600 [ 531.940012][T13857] alloc_file_pseudo+0x184/0x210 [ 531.944966][T13857] ? fput+0x1a0/0x1a0 [ 531.948965][T13857] ? __lock_acquire+0x7d80/0x7d80 [ 531.954009][T13857] ? __local_bh_enable_ip+0x13a/0x1c0 [ 531.959397][T13857] ? _local_bh_enable+0xa0/0xa0 [ 531.964349][T13857] anon_inode_getfile+0xc5/0x1a0 [ 531.969307][T13857] bpf_link_prime+0xa6/0x1d0 [ 531.973932][T13857] tcx_link_attach+0x218/0x960 [ 531.978724][T13857] ? tcx_prog_query+0x140/0x140 [ 531.983587][T13857] ? __fget_files+0x3fc/0x460 [ 531.988293][T13857] ? bpf_prog_attach_check_attach_type+0x188/0x440 [ 531.994816][T13857] link_create+0x390/0x720 [ 531.999339][T13857] __sys_bpf+0x4d7/0x890 [ 532.003683][T13857] ? bpf_link_show_fdinfo+0x390/0x390 [ 532.009080][T13857] ? lock_chain_count+0x20/0x20 [ 532.013952][T13857] __x64_sys_bpf+0x7c/0x90 [ 532.018381][T13857] do_syscall_64+0x55/0xb0 [ 532.023156][T13857] ? clear_bhb_loop+0x40/0x90 [ 532.027845][T13857] ? clear_bhb_loop+0x40/0x90 [ 532.032537][T13857] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 532.038626][T13857] RIP: 0033:0x7fce18b9e0d9 [ 532.043280][T13857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 532.063249][T13857] RSP: 002b:00007fce19b0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 532.071688][T13857] RAX: ffffffffffffffda RBX: 00007fce18e25fa0 RCX: 00007fce18b9e0d9 [ 532.079756][T13857] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 000000000000001c [ 532.087739][T13857] RBP: 00007fce19b0e090 R08: 0000000000000000 R09: 0000000000000000 [ 532.095726][T13857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 532.103709][T13857] R13: 00007fce18e26038 R14: 00007fce18e25fa0 R15: 00007ffc979d1c98 [ 532.111720][T13857] [ 532.157266][T13475] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.175749][T13475] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.205197][T13475] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.234806][T13475] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.648133][ T4719] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 532.677936][ T4719] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 532.795493][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 532.832504][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 534.511891][T13932] netlink: 'syz.0.2745': attribute type 2 has an invalid length. [ 534.612843][T13934] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.2746'. [ 534.624633][T13934] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.2746'. [ 534.719521][T13936] FAULT_INJECTION: forcing a failure. [ 534.719521][T13936] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 534.748258][T13936] CPU: 1 PID: 13936 Comm: syz.0.2747 Not tainted syzkaller #0 [ 534.755798][T13936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 534.760198][T13939] netlink: 'syz.2.2748': attribute type 2 has an invalid length. [ 534.765877][T13936] Call Trace: [ 534.765891][T13936] [ 534.765900][T13936] dump_stack_lvl+0x18c/0x250 [ 534.765934][T13936] ? show_regs_print_info+0x20/0x20 [ 534.765956][T13936] ? load_image+0x420/0x420 [ 534.765995][T13936] ? __might_fault+0xaa/0x120 [ 534.766017][T13936] ? __lock_acquire+0x7d80/0x7d80 [ 534.766045][T13936] should_fail_ex+0x394/0x4c0 [ 534.766075][T13936] _copy_from_user+0x2f/0xe0 [ 534.766099][T13936] ___sys_sendmsg+0x1c7/0x360 [ 534.766125][T13936] ? get_pid_task+0x20/0x1e0 [ 534.766156][T13936] ? __sys_sendmsg+0x2b0/0x2b0 [ 534.766197][T13936] ? __lock_acquire+0x7d80/0x7d80 [ 534.766245][T13936] __se_sys_sendmsg+0x1d0/0x2c0 [ 534.766271][T13936] ? __x64_sys_sendmsg+0x80/0x80 [ 534.843134][T13936] ? lockdep_hardirqs_on+0x98/0x150 [ 534.848362][T13936] do_syscall_64+0x55/0xb0 [ 534.852789][T13936] ? clear_bhb_loop+0x40/0x90 [ 534.857475][T13936] ? clear_bhb_loop+0x40/0x90 [ 534.862159][T13936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 534.868056][T13936] RIP: 0033:0x7fce18b9e0d9 [ 534.872492][T13936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 534.892119][T13936] RSP: 002b:00007fce19b0e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 534.900546][T13936] RAX: ffffffffffffffda RBX: 00007fce18e25fa0 RCX: 00007fce18b9e0d9 [ 534.908522][T13936] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 534.916592][T13936] RBP: 00007fce19b0e090 R08: 0000000000000000 R09: 0000000000000000 [ 534.924576][T13936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 534.932646][T13936] R13: 00007fce18e26038 R14: 00007fce18e25fa0 R15: 00007ffc979d1c98 [ 534.940670][T13936] [ 535.076437][T13947] netlink: 'syz.2.2751': attribute type 2 has an invalid length. [ 535.862573][T13980] netlink: 'syz.1.2764': attribute type 3 has an invalid length. [ 535.885631][T13979] netlink: 'syz.1.2764': attribute type 3 has an invalid length. [ 535.895315][T13980] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2764'. [ 535.909038][T13979] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2764'. [ 536.276317][T13992] FAULT_INJECTION: forcing a failure. [ 536.276317][T13992] name failslab, interval 1, probability 0, space 0, times 0 [ 536.304071][T13992] CPU: 1 PID: 13992 Comm: syz.0.2768 Not tainted syzkaller #0 [ 536.311606][T13992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 536.321693][T13992] Call Trace: [ 536.324996][T13992] [ 536.327955][T13992] dump_stack_lvl+0x18c/0x250 [ 536.332678][T13992] ? show_regs_print_info+0x20/0x20 [ 536.337907][T13992] ? load_image+0x420/0x420 [ 536.342450][T13992] ? __might_sleep+0xe0/0xe0 [ 536.347175][T13992] ? __lock_acquire+0x7d80/0x7d80 [ 536.352244][T13992] should_fail_ex+0x394/0x4c0 [ 536.356964][T13992] should_failslab+0x9/0x20 [ 536.361503][T13992] slab_pre_alloc_hook+0x59/0x300 [ 536.366563][T13992] ? _local_bh_enable+0xa0/0xa0 [ 536.371443][T13992] ? tcx_link_attach+0x444/0x960 [ 536.376417][T13992] __kmem_cache_alloc_node+0x53/0x250 [ 536.381839][T13992] ? tcx_link_attach+0x444/0x960 [ 536.386811][T13992] kmalloc_trace+0x2a/0xe0 [ 536.391271][T13992] tcx_link_attach+0x444/0x960 [ 536.396091][T13992] ? tcx_prog_query+0x140/0x140 [ 536.400980][T13992] ? __fget_files+0x3fc/0x460 [ 536.405708][T13992] ? bpf_prog_attach_check_attach_type+0x188/0x440 [ 536.412341][T13992] link_create+0x390/0x720 [ 536.416804][T13992] __sys_bpf+0x4d7/0x890 [ 536.421104][T13992] ? bpf_link_show_fdinfo+0x390/0x390 [ 536.426526][T13992] ? lock_chain_count+0x20/0x20 [ 536.431419][T13992] __x64_sys_bpf+0x7c/0x90 [ 536.435868][T13992] do_syscall_64+0x55/0xb0 [ 536.440317][T13992] ? clear_bhb_loop+0x40/0x90 [ 536.445028][T13992] ? clear_bhb_loop+0x40/0x90 [ 536.449754][T13992] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 536.455678][T13992] RIP: 0033:0x7fce18b9e0d9 [ 536.460127][T13992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 536.479768][T13992] RSP: 002b:00007fce19b0e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 536.488218][T13992] RAX: ffffffffffffffda RBX: 00007fce18e25fa0 RCX: 00007fce18b9e0d9 [ 536.496223][T13992] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 000000000000001c [ 536.504223][T13992] RBP: 00007fce19b0e090 R08: 0000000000000000 R09: 0000000000000000 [ 536.512409][T13992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 536.520576][T13992] R13: 00007fce18e26038 R14: 00007fce18e25fa0 R15: 00007ffc979d1c98 [ 536.528687][T13992] [ 536.820584][T13988] ================================================================== [ 536.828740][T13988] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6c7/0x900 [ 536.836625][T13988] Write of size 32 at addr ffff88802b96b260 by task syz.1.2767/13988 [ 536.845169][T13988] [ 536.847623][T13988] CPU: 0 PID: 13988 Comm: syz.1.2767 Not tainted syzkaller #0 [ 536.855146][T13988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 536.865320][T13988] Call Trace: [ 536.868639][T13988] [ 536.871585][T13988] dump_stack_lvl+0x18c/0x250 [ 536.876293][T13988] ? read_lock_is_recursive+0x20/0x20 [ 536.881682][T13988] ? show_regs_print_info+0x20/0x20 [ 536.887152][T13988] ? load_image+0x420/0x420 [ 536.891679][T13988] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 536.897327][T13988] ? __virt_addr_valid+0x10c/0x380 [ 536.902489][T13988] ? __virt_addr_valid+0x10c/0x380 [ 536.907826][T13988] ? __virt_addr_valid+0x10c/0x380 [ 536.913076][T13988] print_report+0xa8/0x210 [ 536.917519][T13988] ? __bpf_get_stackid+0x6c7/0x900 [ 536.922655][T13988] kasan_report+0x117/0x150 [ 536.927211][T13988] ? __bpf_get_stackid+0x6c7/0x900 [ 536.932387][T13988] kasan_check_range+0x241/0x290 [ 536.937539][T13988] ? __bpf_get_stackid+0x6c7/0x900 [ 536.942699][T13988] __asan_memcpy+0x40/0x70 [ 536.947183][T13988] __bpf_get_stackid+0x6c7/0x900 [ 536.952164][T13988] bpf_get_stackid_pe+0x2f0/0x410 [ 536.957321][T13988] bpf_prog_620e6a2847f43590+0x33/0x48 [ 536.962813][T13988] bpf_overflow_handler+0x1fc/0x510 [ 536.968043][T13988] ? do_wp_page+0x150e/0x34d0 [ 536.972741][T13988] ? bpf_overflow_handler+0xde/0x510 [ 536.978069][T13988] ? tp_perf_event_destroy+0x20/0x20 [ 536.983674][T13988] ? __perf_event_account_interrupt+0x187/0x280 [ 536.989950][T13988] __perf_event_overflow+0x461/0x660 [ 536.995288][T13988] perf_swevent_event+0x319/0x570 [ 537.000356][T13988] ? perf_tp_event+0x1550/0x1550 [ 537.005348][T13988] ___perf_sw_event+0x4ab/0x730 [ 537.010225][T13988] ? vma_end_read+0x18/0x170 [ 537.014850][T13988] ? ___perf_sw_event+0x19e/0x730 [ 537.019906][T13988] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 537.026353][T13988] ? perf_trace_preemptirq_template+0xac/0x330 [ 537.032556][T13988] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 537.038580][T13988] ? __lock_acquire+0x7d80/0x7d80 [ 537.043760][T13988] ? lock_chain_count+0x20/0x20 [ 537.048645][T13988] __perf_sw_event+0x139/0x270 [ 537.053435][T13988] do_user_addr_fault+0x1242/0x12d0 [ 537.058651][T13988] ? lock_chain_count+0x20/0x20 [ 537.063518][T13988] ? rcu_is_watching+0x15/0xb0 [ 537.068315][T13988] exc_page_fault+0x64/0x100 [ 537.072932][T13988] asm_exc_page_fault+0x26/0x30 [ 537.077858][T13988] RIP: 0033:0x7ffd9d5a1a21 [ 537.082401][T13988] Code: 48 89 c2 eb a7 4c 29 d2 48 0f ba e2 3e 0f 82 ad 00 00 00 48 bf ff ff ff ff ff ff ff 7f 48 21 fa 49 0f af d1 48 01 c2 48 d3 ea <48> 89 55 c0 31 c0 48 81 fa 00 ca 9a 3b 72 1c 31 c9 48 81 c2 00 36 [ 537.102112][T13988] RSP: 002b:00007feb6a33eff0 EFLAGS: 00010206 [ 537.108282][T13988] RAX: 002e105957bb61f6 RBX: 00007ffd9d59d0b0 RCX: 0000000000000018 [ 537.116265][T13988] RDX: 000000002f0edd5a RSI: 00007feb6a33f0b0 RDI: 7fffffffffffffff [ 537.124332][T13988] RBP: 00007feb6a33f030 R08: 0000000000000218 R09: 0000000000745d1e [ 537.132320][T13988] R10: 000001162cb1158c R11: 0000000000019422 R12: 0000000000000010 [ 537.140399][T13988] R13: 00007feb69626038 R14: 00007ffd9d59d080 R15: 0000000000019422 [ 537.148486][T13988] [ 537.151603][T13988] [ 537.154201][T13988] Allocated by task 13988: [ 537.158638][T13988] kasan_set_track+0x4e/0x70 [ 537.163328][T13988] __kasan_kmalloc+0x8f/0xa0 [ 537.168019][T13988] __kmalloc_node+0xb6/0x240 [ 537.172630][T13988] bpf_map_area_alloc+0x5e/0x110 [ 537.177753][T13988] prealloc_elems_and_freelist+0x86/0x1c0 [ 537.183494][T13988] stack_map_alloc+0x32b/0x4b0 [ 537.188288][T13988] map_create+0x877/0x12f0 [ 537.192813][T13988] __sys_bpf+0x651/0x890 [ 537.197072][T13988] __x64_sys_bpf+0x7c/0x90 [ 537.201502][T13988] do_syscall_64+0x55/0xb0 [ 537.205932][T13988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 537.211855][T13988] [ 537.214199][T13988] Last potentially related work creation: [ 537.219939][T13988] kasan_save_stack+0x3e/0x60 [ 537.224666][T13988] __kasan_record_aux_stack+0xaf/0xc0 [ 537.230166][T13988] call_rcu+0x153/0x900 [ 537.234619][T13988] inetdev_event+0x666/0x1610 [ 537.239451][T13988] notifier_call_chain+0x18f/0x380 [ 537.244606][T13988] unregister_netdevice_many_notify+0x1037/0x1910 [ 537.251348][T13988] default_device_exit_batch+0x962/0xa00 [ 537.257897][T13988] cleanup_net+0x792/0xbb0 [ 537.262359][T13988] process_scheduled_works+0xa60/0x1600 [ 537.267947][T13988] worker_thread+0xa5e/0xfe0 [ 537.272636][T13988] kthread+0x2fa/0x390 [ 537.276731][T13988] ret_from_fork+0x48/0x80 [ 537.281172][T13988] ret_from_fork_asm+0x11/0x20 [ 537.285995][T13988] [ 537.288590][T13988] The buggy address belongs to the object at ffff88802b96b200 [ 537.288590][T13988] which belongs to the cache kmalloc-cg-128 of size 128 [ 537.302928][T13988] The buggy address is located 96 bytes inside of [ 537.302928][T13988] allocated 120-byte region [ffff88802b96b200, ffff88802b96b278) [ 537.317017][T13988] [ 537.319357][T13988] The buggy address belongs to the physical page: [ 537.325864][T13988] page:ffffea0000ae5ac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b96b [ 537.337239][T13988] memcg:ffff88802ff77001 [ 537.341919][T13988] ksm flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 537.350167][T13988] page_type: 0xffffffff() [ 537.355128][T13988] raw: 00fff00000000800 ffff888017c4dc80 ffffea0000856dc0 dead000000000003 [ 537.363827][T13988] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff88802ff77001 [ 537.373236][T13988] page dumped because: kasan: bad access detected [ 537.379683][T13988] page_owner tracks the page as allocated [ 537.385597][T13988] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5775, tgid 5775 (syz-executor), ts 85393307059, free_ts 84687815007 [ 537.404728][T13988] post_alloc_hook+0x1c1/0x200 [ 537.409522][T13988] get_page_from_freelist+0x2181/0x22a0 [ 537.415127][T13988] __alloc_pages+0x1f0/0x460 [ 537.419936][T13988] alloc_slab_page+0x5d/0x180 [ 537.425778][T13988] new_slab+0x87/0x2d0 [ 537.429868][T13988] ___slab_alloc+0xc5c/0x12f0 [ 537.434563][T13988] __kmem_cache_alloc_node+0x11f/0x250 [ 537.441213][T13988] kmalloc_trace+0x2a/0xe0 [ 537.446076][T13988] inet_rtm_newaddr+0x44b/0x1a20 [ 537.451661][T13988] rtnetlink_rcv_msg+0x843/0xf90 [ 537.456982][T13988] netlink_rcv_skb+0x235/0x4c0 [ 537.462023][T13988] netlink_unicast+0x7b1/0x930 [ 537.466860][T13988] netlink_sendmsg+0x8d0/0xbf0 [ 537.471649][T13988] __sys_sendto+0x4a9/0x6b0 [ 537.476262][T13988] __x64_sys_sendto+0xde/0xf0 [ 537.481142][T13988] do_syscall_64+0x55/0xb0 [ 537.485993][T13988] page last free stack trace: [ 537.490785][T13988] free_unref_page_prepare+0x7d7/0x8f0 [ 537.496349][T13988] free_unref_page+0x32/0x2e0 [ 537.501054][T13988] __slab_free+0x35a/0x400 [ 537.505497][T13988] qlist_free_all+0x75/0xd0 [ 537.510026][T13988] kasan_quarantine_reduce+0x143/0x160 [ 537.516079][T13988] __kasan_slab_alloc+0x22/0x80 [ 537.521752][T13988] slab_post_alloc_hook+0x6a/0x4d0 [ 537.527008][T13988] kmem_cache_alloc+0x17e/0x2c0 [ 537.532331][T13988] getname_flags+0xbb/0x500 [ 537.537057][T13988] do_sys_openat2+0xda/0x1d0 [ 537.541704][T13988] __x64_sys_openat+0x139/0x160 [ 537.546750][T13988] do_syscall_64+0x55/0xb0 [ 537.551205][T13988] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 537.557333][T13988] [ 537.559959][T13988] Memory state around the buggy address: [ 537.565958][T13988] ffff88802b96b100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 537.574294][T13988] ffff88802b96b180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 537.582483][T13988] >ffff88802b96b200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 537.590646][T13988] ^ [ 537.598823][T13988] ffff88802b96b280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 537.606991][T13988] ffff88802b96b300: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 537.615686][T13988] ================================================================== [ 537.623859][T13988] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 537.631320][T13988] CPU: 0 PID: 13988 Comm: syz.1.2767 Not tainted syzkaller #0 [ 537.638871][T13988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 537.649023][T13988] Call Trace: [ 537.652349][T13988] [ 537.655420][T13988] dump_stack_lvl+0x18c/0x250 [ 537.660198][T13988] ? show_regs_print_info+0x20/0x20 [ 537.665400][T13988] ? load_image+0x420/0x420 [ 537.669918][T13988] panic+0x2ca/0x720 [ 537.673823][T13988] ? __lock_acquire+0x7d80/0x7d80 [ 537.678865][T13988] ? bpf_jit_dump+0xd0/0xd0 [ 537.683400][T13988] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 537.689314][T13988] ? _raw_spin_unlock+0x40/0x40 [ 537.694178][T13988] ? __bpf_get_stackid+0x6c7/0x900 [ 537.699299][T13988] check_panic_on_warn+0x84/0xa0 [ 537.704243][T13988] ? __bpf_get_stackid+0x6c7/0x900 [ 537.709369][T13988] end_report+0x6f/0x130 [ 537.713620][T13988] kasan_report+0x128/0x150 [ 537.718134][T13988] ? __bpf_get_stackid+0x6c7/0x900 [ 537.723258][T13988] kasan_check_range+0x241/0x290 [ 537.728203][T13988] ? __bpf_get_stackid+0x6c7/0x900 [ 537.733322][T13988] __asan_memcpy+0x40/0x70 [ 537.737834][T13988] __bpf_get_stackid+0x6c7/0x900 [ 537.742786][T13988] bpf_get_stackid_pe+0x2f0/0x410 [ 537.747920][T13988] bpf_prog_620e6a2847f43590+0x33/0x48 [ 537.753386][T13988] bpf_overflow_handler+0x1fc/0x510 [ 537.758598][T13988] ? do_wp_page+0x150e/0x34d0 [ 537.763282][T13988] ? bpf_overflow_handler+0xde/0x510 [ 537.768579][T13988] ? tp_perf_event_destroy+0x20/0x20 [ 537.773882][T13988] ? __perf_event_account_interrupt+0x187/0x280 [ 537.780160][T13988] __perf_event_overflow+0x461/0x660 [ 537.785459][T13988] perf_swevent_event+0x319/0x570 [ 537.790593][T13988] ? perf_tp_event+0x1550/0x1550 [ 537.795541][T13988] ___perf_sw_event+0x4ab/0x730 [ 537.800410][T13988] ? vma_end_read+0x18/0x170 [ 537.805007][T13988] ? ___perf_sw_event+0x19e/0x730 [ 537.810037][T13988] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 537.816469][T13988] ? perf_trace_preemptirq_template+0xac/0x330 [ 537.822647][T13988] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 537.828809][T13988] ? __lock_acquire+0x7d80/0x7d80 [ 537.834019][T13988] ? lock_chain_count+0x20/0x20 [ 537.838877][T13988] __perf_sw_event+0x139/0x270 [ 537.843655][T13988] do_user_addr_fault+0x1242/0x12d0 [ 537.848862][T13988] ? lock_chain_count+0x20/0x20 [ 537.854068][T13988] ? rcu_is_watching+0x15/0xb0 [ 537.858841][T13988] exc_page_fault+0x64/0x100 [ 537.863442][T13988] asm_exc_page_fault+0x26/0x30 [ 537.868303][T13988] RIP: 0033:0x7ffd9d5a1a21 [ 537.872729][T13988] Code: 48 89 c2 eb a7 4c 29 d2 48 0f ba e2 3e 0f 82 ad 00 00 00 48 bf ff ff ff ff ff ff ff 7f 48 21 fa 49 0f af d1 48 01 c2 48 d3 ea <48> 89 55 c0 31 c0 48 81 fa 00 ca 9a 3b 72 1c 31 c9 48 81 c2 00 36 [ 537.892534][T13988] RSP: 002b:00007feb6a33eff0 EFLAGS: 00010206 [ 537.898619][T13988] RAX: 002e105957bb61f6 RBX: 00007ffd9d59d0b0 RCX: 0000000000000018 [ 537.906685][T13988] RDX: 000000002f0edd5a RSI: 00007feb6a33f0b0 RDI: 7fffffffffffffff [ 537.914661][T13988] RBP: 00007feb6a33f030 R08: 0000000000000218 R09: 0000000000745d1e [ 537.922642][T13988] R10: 000001162cb1158c R11: 0000000000019422 R12: 0000000000000010 [ 537.930638][T13988] R13: 00007feb69626038 R14: 00007ffd9d59d080 R15: 0000000000019422 [ 537.938726][T13988] [ 537.941869][T13988] Kernel Offset: disabled [ 537.946205][T13988] Rebooting in 86400 seconds..