last executing test programs: 2m37.440342541s ago: executing program 3 (id=1623): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8971, &(0x7f0000000000)={'vlan0\x00', @random="010000201000"}) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f020033000b35d25a806c8c6f94f90f24fc60100007000300", 0x1a}], 0x1}, 0x0) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="97d9deabea352018000000000000006761110000", @ANYRES32, @ANYRES8=r0], 0x0, 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803001d000b63d25a80648c2594f90124fc60100c06", 0x17}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="3504000040000511d25a35400c0002000200002037153e370c040180060410", 0x1f}], 0x1}, 0x10049014) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b05d25a806f8c6394f91a24fc600702", 0x16}], 0x1, 0x0, 0x0, 0x400300}, 0x20044050) (async) r1 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10) (async) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) 2m37.250806023s ago: executing program 3 (id=1627): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x1c, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000002000000000000000000000218110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000008300", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000001700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000120000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x604800, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_config_ext={0x9, 0xb}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000300)=r6) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x4, @perf_config_ext={0x8, 0x830d}, 0x102302, 0x2, 0xfefffffa, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[@ANYBLOB="364000001a00913a"], 0x82d7) recvmsg(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000005240)=""/4106, 0x100a}, {&(0x7f0000004200)=""/4089, 0xff9}, {&(0x7f0000001800)=""/156, 0x9c}], 0x3}, 0x0) recvmsg(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000600)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000002780)=""/197, 0xc5}], 0x6, &(0x7f0000002880)=""/4096, 0x1000}, 0x10000) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000b5"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xc1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r9, 0x0, 0x18, 0x0, &(0x7f0000000140)="c1dfb082cd21d308098ee6888847d78af51c381b4b8df6cc", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2m30.323013835s ago: executing program 3 (id=1641): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x5, &(0x7f0000000580)=ANY=[@ANYRESOCT=0x0], &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x86}, 0x94) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) r0 = socket$kcm(0x11, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x4, 0x8f, &(0x7f00000001c0)=""/143}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000000c0)=r0, 0x8) socket$kcm(0xa, 0x922000000003, 0x11) socket$kcm(0xa, 0x922000000003, 0x11) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0xc35) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x11, 0xa, 0x300) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000000), 0x4) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r3, &(0x7f0000000040)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x2}, 0x80, &(0x7f0000000140)=[{&(0x7f00000006c0)="62042700920101000301ad2f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee8441e2305e495d04ad68ab8fef69df82de6456fbb48b63f60c9c9097be968ea872c4801e5d0711b4373c7224ed7a9cbd49d40f82bdb6afc0036824be26fc96e49a70e90797e6caa1b38ddacb3cb2b3eac7c068a185b644582f25edfa3d6a46e2a894ca809a422a6a29bd7145bb6e7992570484d6a710292ea0c3f97b7cbff701684b13c5593262534a7af9eab48f2ca2d74d9a4de33", 0xda}, {&(0x7f0000000c00)="294f28dfe56d2c8ba23606bc7ecd1f634665cb5bed07bac5684da6eb21da1d6926910c5a0c653b0106869a804dd2a44ce42557b2e32e2bd367e9d01a5e7380cc4fc8e7c9044cc4115b978ca7427d749beaefdf2e48b369cb169ad7b1ced26bb161297c7e56a3e83e91b379c179017f8b4657d1b22eca6bca33036d33e1a684059c53cea91ca6637ac780ab2bcfc22a666cd4e5876f11e9aee4724b7cb59731c97e70ebd7f7483994eb07de2f3c6a9448c3206cff6d290b433f331c2399e99ee3bdecf5689eddc3e549966c1106a933bbc47b65ca6e9d7efbee6e3b1dbe87313111e85336d6890002db17751b6044f964dc90ea466f90856112be7f0a54b39a3f66cc4c39544300093158af39cdde429f50d8c750", 0x114}, {&(0x7f0000000a40)="0a985d7879f1bbff16c7d66e33657e452299fd0ef8c2afda588eb05891b7da030e01452a7986bea19b59c98dc2996c0ea09604d00ea48336d0c813d83025aca8623a5915ddddce2c11c5e374f2e0f387d2398fe0b899ff60dc7a73addcf253cf32aafbe2b9f90799e7fc583bdd9b564697ba988080270bdceb4714219a2d4c229fffb0d86fb286e3553a8b3ac02badc66ada5fceabe5f63c79da96e641a45901128063d6e1e31b11bcfbc3e70bd3c8c6c0be9f653f977f16", 0xfff0}, {&(0x7f0000000840)="6f4720baeb54", 0x6}], 0x4}, 0x0) 2m30.174858199s ago: executing program 3 (id=1642): r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x140, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001240)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000aecd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad94ed406f21caf5adcf920569c00cc1199684fa75814709fea019af247c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c1faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6fab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b79db2e3d5986c82b5aa94e539b204d58f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c7160ec83070000020000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72b0000000000001cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2cc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78ac02ca3cdf6a662db1c9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad943e392955f4f979ea13201bafedcd2063d11dd665647223c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd89346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca2533659edc8be05cc85451c6a14507434eb54b6f43caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffca9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a294351c5356c1d06c92cf8ce3c7c56cd31121624d74517fd3666277f670e812b28e2f30d035cee5d0e77a3c7220000000000000005a474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f034b8d3ebce68663ef5af469abe75b314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041e12282ce24463aaf28345bd168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f09000000000000004fc4bda3453602004535a976eacd3adaa4d2ee6fe0d072ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d401adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb40f7f02f750d6c977a191852c9ae031db044b2353199546609f9f69a6cfefdf879d447df53f3b9b70d10355b00300000000000000553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f58fab987baab97a9bfbd8f185b5631820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe527340935aa3c0b4f3f45b418a18217747ae442e31560e5b741445ea2a1acee2a81425ff000000d2a0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51423b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f88735fce5115dc83ed73d8ee4a91322608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf5000000000000fa08ad0631c4b839688b22c4da2a6bc4cf45854d221a2d5f96bc64647f15daa2ba79cd0f4254ed55217912ef84bd2927df82fc061aef2920c49b2a90886da75561173fa186cb7ee86dd4285c4721eb428c953296bb2f5d825da54dbef07c1b349b4901e093d13e6b9a0000009b5b22e887bc061d40bcaf0aa18623fd9b7179ccc692ba74b531b65c4decf9d080a8ac7e82d4cde1267aa64b2a94fd87a009e6742c2ddc3a9d7eccbb1831b1fa218277c2814a91cab7cb59c697166d6f1bb1a360470000000000000000000000000000000000000000000000000000f9f9b4ce7e871f507084c8c88e0652decbe579b03ed84ea94597dd1059620a050f69ea03b99b4e19d35f4a3b54e96ae2172effecec80f6baa4bf69a6ebf5392882df78b0983e662dc0cb64b77f3f006b6b25443197ae93f0be6de5a703d003f00720943c0e4b33af00000000000000000021a688b2d7007fcc4b59f719afb0b3b7e0aee306ca70fe42bf4984a68f40e1fc043a03a17e4744359b87dc27c82d51cbeb64e52a28daeb6a78d6fe06181ecc840000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, @perf_bp={0x0}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61105c00000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916b60000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = syz_clone(0x100, &(0x7f0000000240)="d28ddbd3259c58dfc0c5e4fadb8e413ad5caea7dbbd13d5b62731e19d78ed444414ab4aea3cbae93f84b05ff5b168a8f86a26d5fe5d496b0ce8d838350c25e65183bc5c1fcf48158dbc3de61865168b363f632cfd142f36586b6db13c9fc4ba522ef92b226059095026c1c6bb4c24da3a31a8b71106ea5fb21bc55332d52359a24a4f57634ba64c8cc6547b7e9c7789ab73f139b7fd67214ced7e7170c749d31065214d1f8cba819d5bfc75514945e5b81dfddfdd9248e13f3926c5e202585fd98", 0xc1, &(0x7f0000000340), &(0x7f0000000440), &(0x7f0000000500)="07eb935e4ccba239b7232ea377f03d472b54c7e6da358f50956d378bb7392576054c0250433990795cc432d595b0384a34a60daa89f07bd41f3e551911a8d38075c36b703d55497e38114004364acdf324567187a3016588f9bff6af6b0e603772159ba32cdc672d819c637d23a1") syz_open_procfs$namespace(r3, &(0x7f0000000580)='ns/time_for_children\x00') sendmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000100)="d80000001c0081054e81f782db44b904021d08040e000000100d10a118000c000600142603600e1208000f0000810401a8001600290001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee0800080e408e8d8ef52a98516277ce06ebace8017cbec4c2ee5a7cef4090000001fb79107005ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16ca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad8099639cace81ed0bffec193e2a9ecbee7de6ccd4d6e4ed6f3d93452a92954b43370e970189f97bb7fabe5163b0fa79c4fe", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x5}, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) recvmsg$unix(r4, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)="5c00000010006bcd9e3fe3dceb48aa31086b8703110000001fc3000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x40) r8 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r8, 0x6, 0x22, &(0x7f0000000200)=r6, 0x4) 2m27.479958587s ago: executing program 3 (id=1651): r0 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r0, 0x0, 0x11, 0x0, 0xa4) 2m25.127442368s ago: executing program 3 (id=1657): perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1e, 0x10506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x1000000000000801, 0x1}, 0x7402, 0x0, 0x0, 0x9, 0x0, 0xffffffff, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1e, 0x10506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x1000000000000801, 0x1}, 0x7402, 0x0, 0x0, 0x9, 0x0, 0xffffffff, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x0, 0x2c, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0x20f2, 0x8, 0xfffffffffffffd7e, &(0x7f0000000500)}}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000840)={&(0x7f00000006c0)=ANY=[@ANYBLOB="9feb01001800000000000000100002001000800002080000040000000000"], &(0x7f0000000780)=""/191, 0x2a, 0xbf, 0x1, 0x4}, 0x28) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r1 = socket$kcm(0x2, 0x5, 0x84) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x3}, 0x58c8, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x11, 0x2, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x108282, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x108282, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r4, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) (async) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@caif, 0x80, 0x0, 0x0, &(0x7f0000001cc0)=ANY=[@ANYBLOB="10000000000000000301000007000000b8000000000000000000000004000000bb04a5100d87459bc7a590900c3c64d8d3056a2264999ad4b9a2bf6b7ab6f4f13ae2a914fe691dcdd0348830e83c8985a733bf97b70c86d8b115f0e408d35e52082e6dce27e974978bb6e3a93cc6c6826f0cfce99f5065117a8a291fadaa4bc179fd6b54ae029ae6f7c925d65bfc8fca6ff75873053f087d49be89d95c88eece2b6ecbdc7b4f2eeceb4f8a32ef2b4bed2fa837f580ce26954584d96938d8081298612762c9000000180000000000000019010000090000002255000000000000"], 0xe0}, 0x12) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000004000000000000000000d343299b65f78e4987eceedde9ef26a012bca3bcd8d184133428b1a27dda7646e61a93dc44", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r3, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0xe, 0x0, 0x0) recvmsg$kcm(r1, 0x0, 0x2) (async) recvmsg$kcm(r1, 0x0, 0x2) socket$kcm(0x23, 0x2, 0x0) (async) socket$kcm(0x23, 0x2, 0x0) socket$kcm(0x2, 0x3, 0x84) socket$kcm(0x10, 0x2, 0x0) (async) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000011008188040f46ecdb4cb9cca7480ef400000000e3bd6efb440013030e001b000d000008ba8000001201", 0x2e}], 0x1}, 0x0) 2m9.865633196s ago: executing program 32 (id=1657): perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1e, 0x10506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x1000000000000801, 0x1}, 0x7402, 0x0, 0x0, 0x9, 0x0, 0xffffffff, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1e, 0x10506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x1000000000000801, 0x1}, 0x7402, 0x0, 0x0, 0x9, 0x0, 0xffffffff, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfdef) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x0, 0x2c, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0x20f2, 0x8, 0xfffffffffffffd7e, &(0x7f0000000500)}}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000840)={&(0x7f00000006c0)=ANY=[@ANYBLOB="9feb01001800000000000000100002001000800002080000040000000000"], &(0x7f0000000780)=""/191, 0x2a, 0xbf, 0x1, 0x4}, 0x28) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r1 = socket$kcm(0x2, 0x5, 0x84) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x3}, 0x58c8, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x11, 0x2, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x108282, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x108282, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r4, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) (async) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@caif, 0x80, 0x0, 0x0, &(0x7f0000001cc0)=ANY=[@ANYBLOB="10000000000000000301000007000000b8000000000000000000000004000000bb04a5100d87459bc7a590900c3c64d8d3056a2264999ad4b9a2bf6b7ab6f4f13ae2a914fe691dcdd0348830e83c8985a733bf97b70c86d8b115f0e408d35e52082e6dce27e974978bb6e3a93cc6c6826f0cfce99f5065117a8a291fadaa4bc179fd6b54ae029ae6f7c925d65bfc8fca6ff75873053f087d49be89d95c88eece2b6ecbdc7b4f2eeceb4f8a32ef2b4bed2fa837f580ce26954584d96938d8081298612762c9000000180000000000000019010000090000002255000000000000"], 0xe0}, 0x12) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000004000000000000000000d343299b65f78e4987eceedde9ef26a012bca3bcd8d184133428b1a27dda7646e61a93dc44", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r3, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0xe, 0x0, 0x0) recvmsg$kcm(r1, 0x0, 0x2) (async) recvmsg$kcm(r1, 0x0, 0x2) socket$kcm(0x23, 0x2, 0x0) (async) socket$kcm(0x23, 0x2, 0x0) socket$kcm(0x2, 0x3, 0x84) socket$kcm(0x10, 0x2, 0x0) (async) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000011008188040f46ecdb4cb9cca7480ef400000000e3bd6efb440013030e001b000d000008ba8000001201", 0x2e}], 0x1}, 0x0) 24.996660773s ago: executing program 0 (id=2180): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000001180)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000240)="3ec299426150", 0x6}], 0x1, &(0x7f00000007c0)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18, 0x400c5}, 0x10) r1 = socket$kcm(0x23, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x4) sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@phonet, 0x80, 0x0}, 0x0) 24.006198258s ago: executing program 0 (id=2187): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x1c, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000020000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000001700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000120000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x604800, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_config_ext={0x9, 0xb}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000300)=r6) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x4, @perf_config_ext={0x8, 0x830d}, 0x102302, 0x2, 0xfefffffa, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[@ANYBLOB="364000001a00913a"], 0x82d7) recvmsg(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000005240)=""/4106, 0x100a}, {&(0x7f0000004200)=""/4089, 0xff9}, {&(0x7f0000001800)=""/156, 0x9c}], 0x3}, 0x0) recvmsg(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000600)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000002780)=""/197, 0xc5}], 0x6, &(0x7f0000002880)=""/4096, 0x1000}, 0x10000) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000b5"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xc1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r9, 0x0, 0x18, 0x0, &(0x7f0000000140)="c1dfb082cd21d308098ee6888847d78af51c381b4b8df6cc", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 16.407156612s ago: executing program 0 (id=2209): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000001180)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000240)="3ec299426150", 0x6}], 0x1, &(0x7f00000007c0)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18, 0x400c5}, 0x10) r1 = socket$kcm(0x23, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x4) sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@phonet, 0x80, 0x0}, 0x0) 15.516490349s ago: executing program 0 (id=2219): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x1c, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000020000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000001700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000120000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x604800, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_config_ext={0x9, 0xb}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000300)=r6) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x4, @perf_config_ext={0x8, 0x830d}, 0x102302, 0x2, 0xfefffffa, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[@ANYBLOB="364000001a00913a"], 0x82d7) recvmsg(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000005240)=""/4106, 0x100a}, {&(0x7f0000004200)=""/4089, 0xff9}, {&(0x7f0000001800)=""/156, 0x9c}], 0x3}, 0x0) recvmsg(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000600)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000002780)=""/197, 0xc5}], 0x6, &(0x7f0000002880)=""/4096, 0x1000}, 0x10000) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000b5"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xc1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r9, 0x0, 0x18, 0x0, &(0x7f0000000140)="c1dfb082cd21d308098ee6888847d78af51c381b4b8df6cc", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 15.317061993s ago: executing program 4 (id=2221): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x6, 0x3, &(0x7f0000000500)=@framed, &(0x7f0000000580)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r0, 0x0, 0x85, 0xcf, &(0x7f0000000000)="fae68670fef1c45ff0634fe72a6253b4357c978887379648e34b8e43761f35000437ab851cde4821ce97abc68f6a1c3593e2a7a267f78fff0e9e1743899a7dc5c1d2ecae353bd4bcdb61c053b1d7b1223331d664596d93a54d408700062455bf71027a99387a4c190aa0098ed6ed8951ff86c092399a8d11b76c5e00"/133, &(0x7f00000008c0)=""/206, 0x1000, 0x0, 0x1a, 0x64, 0xfffffffffffffffe, &(0x7f00000000c0)="d5231f25b5f85be12036902ce1a29123e3c1d41aa6d9c06ff230c473bf3c", 0x0, 0x8000}, 0x48) 14.895537013s ago: executing program 4 (id=2223): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="0000008000"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000004"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000080)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 14.575836646s ago: executing program 4 (id=2224): perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x10}, 0x0, 0xca, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) r0 = socket$kcm(0xa, 0x2, 0x0) close(r0) socket$kcm(0xa, 0x3, 0x73) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="18020000e2ffffff00000000000000c685000000360000009500001800000000922ae83713ab9600010000801b10fb54a8cb72d232ad558c46fff4208d4990ec11ce9413ac30e00bd0081f8504e19a5183d769676520e98a263345e44d5ad12bca35510100c4d86abeb12303ff1c9fe0d0020000d60400000007d3670000008aff66d6b3181ffc1d62a3954c1198bbc4fa13aee48ca9e8969faebf3183fe803ab3f5024b52dc265b36fc9dae00a09404f01f9504d0976d252bd8d24538556e5e57bee3b8cf464ef3c6a7def8bad3ca6e3abdb21696e340bb8e2a093add57196b40def3858ef569147fa4108328392d322ab5df10a2f69a6bdf72ee7944e810d0223917c3d042410f57466f59544047d6d8ac44060000000000ee16c729300d2301800000000000002b5a8b05fcc154ad5290a8cdb97c343f454ff69dd6cbde49b28a6cb5f4fc0001745cff6e00e7ffffff0000acf3209a08439f1ff01779b6f6df7e02aa6d7760525b595fe1f697bc114ed1778e97a3f0395f946974cfb458be2a34cf924dc37b5592bf17956f3547497aba814382ff67b345b677a9d6523d87008000000400000000003fe8613ca29ff92be0d8deffff7b68136b0046d535dd39c0f35408869e9b342b953f91447e6b9eab304f134306320600a44095254b45a6c1312a13696c7202df5f764713504facc532c5a6d44d99ec7530ed7b0311000000000000e54e9072a22d911f4a2c2e2fa806e63c5cd98a8569a6d6bcfb000064885117e2ad910eae67e0ebe380d0f648713e68153579e02d71c58d147b00821ab9a6475b31e1ebf1369a04000000fbf3983f283f2f00000000992774814d63c933912d000006000000a66acb0a38856929e7d8b1b06c9bd5d7e5490f3b8596b694ea9483bd4bd287c83dd998a74694d18bdd8ad0983bc90770bbd26a82b9d99d5fc04563b523c47ef8c33400e90d02000000000000000edf1147a7afe772cd45af8aeffe2753088e02ca6bb2feec446ce7dbce66f0a93a03371320980865c7c62ea4d8f8a864dce9fa85aeb0454349100296ee2dba39c3f6fd6cf96714e11fe03b5062809a7418b165dd0336d226bac1e1223be1c97b15175d0e664beb126000e96549e1a1228c686edb475b705eaa9515c96f4fc6b3c925ea404e0f1de61026dc6c6618580fd6ce9eac602c1756f6d1056712412131ed9925989e01eae489ec7052e0ed72c326c7a8aa63999e2297c54ce1822d14b7c7699a9d0600f11f2e7f474cffbc35bc8623cd5eb68af82275a940be0400000000000000bcc3fbe7d90de96d6a8e9f32f18d1f606b381e4903b500000000000000000000004a2357ba5f03000000000000005dcf4f2aaee86d4802000000000000007cdb686d5da2a42e4b5024b6535811f362201d4f82012e6af704973d04ea923c19e6cb723c1923b3eea2d73e176dff383c9fbbac53dfdcb1a68c98e96fe39eec23963faf3ebed3409144c7c53d6318ced678a621450a9b01e9f2772e5f2999d3435da02556e36c3215d2bd4e96c93bff3ad06b11cb2d7556414a86dfa94bb7aa52c7febb1e9b2efcbbc5bccf9d39bed802f4f056976ada362ee9cc624ec454b90200fd9603f96908bddc14500000000000000000000000000044d917c62b27679913075731e8fddb07c10c82002d60181588ae63a440454287de9e340f611267f37bdd0f2d21cb06fcaf45a0a297e396f428d43371424b307eef82c5d6d19f3ef0d3b8f7fa51957e3099caab31133b34a1d3eebc0f0c9056df2e9667ba0b55695c7894010079b07e7aef7785e2486472b5cba1f3346c1e8e23deb8c83ab6eb2c72c484241dc3b66da78260f800fffd39368b952f6f4a10295c50c887a31d8b543c5d10f2dbd4d0b84eaad43feb6e169a9f2fcff7000000000000000000e011bc6366f56fa787f212c1f8c0f47f5078191c8a02ad436725771738a2a98891971e3b932352896e1ea10f62e8ef7a87e16151b39d6c27575714540d8c293a3fa4b5a867152823ed853140edda002c16c842b168bb55f6bb713deb57d0aa78d6d4e5fc5be2c402bd246128f41bcb02000000892b135a92e8c844938aa98ba4839a1408a696454d40e5eed4d4dce481ca86bfac54c330331b7f2cde17cbaeb0377696faf546ecbe742d73d47d726a50f6e752f3325255bd7e8b5923aa3cfb6f7e06494f21ca4501391358000000000000000000000800000000000000000075aa0000000000000000000000005560bd9eb81e839e4992e64b074a66cccccf00334fa94da8477be7d99b558ec6a5b1596ac1e7617c6b32eed0cc70286caf2c5189a103f4b0b04aff171c4d388ccf67fea37e782f025c94c853cde330a193a967d907a8c88fcb033e680f559a72150cb900bafcd536f48797915a2fe9922ce27300009e1b36aa4730117d9b00000000003c630000000000008fbbd11b015c415ca04192fbfb1a8b0e3460af35771dbac10062835c9bab3ad09f7a022c52d8000000000000000000004000000000000000000000000000000000000000000400000000000000000000000000006ec473c54399b7b8aa1ee46132fc45da8292631178cecf19550108b8b8423de42957ffe9bb6d752e68d2bc2ce777a17bf4dfdfee5de0f3e4dadf51ab9562827b762fa611ba5f32861c19dffe1dc9fd5c41cd46cf131fd6b0c2ddad90ac33f768f9ecc70327c59918fa5a249befe98262f53c8182d95f6da3698a6a88c2c31d801a8f1f5e0ce05138d5422da0a6a62b9dfe1f39775d1d0c9186096415f544aaf76b0a1c877a6c826a5adcfb22c4a0e5a46271caa3eaf4f389dd5f3c20dbddc0377a4266d7b9fd61b9287e9b4be0a413ee31be0ddecab0ef7b25cba1fb3654ddf291ecb7768ac1e177042cb4c452fa6b3966950000000000000000c187da23d6855500fe8510b51e13a890e394b84a6ea2cc8d42b97c697c29122298d55e2e1cca8e07abda2606a3f381c64b9fec0000000a7965e4854e8e3572ad5149b3872342dea9252132860c9af1bd5fe263c0313dea5d6e0c11a466d6892ed65f34667dd79b07b5cbdd8aa7dd561a26b5562d4861a7e1b0f48930e0b696ea3bee7eb72794e163d7aeac9a0fa5403ac9cb421eae283b0550f1d0d339cd7b96e71d3ab48ad9d7975e0c9b117f71d3ab80a0c9b0284ecc469fa6181c9c71fce07a6ffb23296a107763138e8d9876291af2076890c47925ac773d95d2ca42acb3e5f3a1550665b898462c139ffd0106bc8a61b6117d252efcab7106b4c3a3c13a70ff452e9d2096142c517b0e91b5cf88332faca5b3ee96363065c3ce32d3d39ec36e20d597e05664f2526bd918090649da11f7299789d00f5024df1e99d3efecb9b457642fe810370ba4fbe00fa60a28af966a27a1659e448bbe43a1dcd2ea760018b57a36ac41ef2051a7b703d55c0602540663016e20d50385766df4dac47802a55bd38dd767ee9960c6daa704fc5d01a14591f26b7b538c9bb22f6a2f7a34d1b9edfde3be9e25a110228c64253588ff420644dbc0854e69a7bdda72f93ceaccf92cfe7dd6296c950db10f6dd8a5ef9b73cf6a12a1ba16fdc7e35b805f4fd2fcff0a623722149c1465e4de2d53f0f10b14c21865027abc71a12cb1e9f8029c7a20000000eeb0d53a83e518c8d2052c08b515d9d0bde24ac4e798040c7db0bb03c019507d6377f3d5dd94a27abc6d6b120d61f772407e0d2cb50d29168b68aef9f176b4c3aa8b21279d4ea9c1f669aa8c2c17d5b3a8d1dda58d26f1019af04b7774c85d5bce8be010f27c5211938031c3404680b01279c778bd1fe1b48c4b5b8e0fe756e54a8d76b7cec5e3407d93b4eadc446440607de844acf5524a4657e33af2115547b735b57b5092d0bc8fa6acb832509abe0882d570ce400aaebd7baff88526608d6991aac95751671174129457e4a03aca69d82b64b89e6ad6ed1e275ec5002e48170e4c7b4f3971481098dedb88fba90770e44bf404d5a97fefe2fe8e459fe45933b78c7ab5fe985a480193a20fb07da1455fb283df68af569ac82aa6dc703e29bf158931fb79f2abfa6ff7eb8c4f381c9da58bea460e2ead969933e5391970ca4fddd64da2e5df9c4d82044068caaaab771b37bb06bbe673056d849825525f1120b2250f6b8520381f7a74b1c687781cb6b23e67b918844b83dbaeeb559ec8520d710dd6d6b4e64838bd434a36ed03fc0c488b24571032ffbc9f8ce97041e1bc4729d539358dc9599c1266b9ce2cb6dd0ad57a6e9d3d4a11a27f70b2934c96237e2ba09c58eeda678d4d08b6da99b7a86e946215afb1b48792fde54492e306cb5342e2589874b603a1de972b1f09cc350096f5c3e814118af9ba0793cfdf20c77b34eacfdf63ce59ec4d2f867bf884e941559b068d908325667672b5e1cf71f4829c0493e8b141489ed926b822becead7a0a2b4a4c008ab16b616d60f345e4da54f06443507efe57ea62399ef4eb11b2f559e1b056456a53998bf1c6d13c92e75136147f91ae3a75ca15eb1b51bf700b3c0bf54bc3745ff313c5e75dc66386897f6ee45429371b8d0878c469953a63baf85c1390da13efc353ccbef950c29f39ddf436f0d9bf1be1515ed251d8b6f11ecb16b1e8d1ed04196e9b6c2f9e068b7749bb6c1f533e493f22c901662c65cb761dc2eeff2f698bd4dbae83e2dfdc4f1c7f918a00515c1bc189d10ec22b35c92725cbf0ba244fd029c4f026f68e000000060000ab0476c3fd7f7c1e5c000000000000000000000011e43e39d3f4394fbfa13c416b1c443c5e52eea726491ad75100ebad7c6d5a665c59a3fb158e43da904f19e7e8daa4e90390b8da945f6cd78536c0d2be07221f85ad46b180f256d4d84592691d15d65896b66b63a46705338b67b72dc1c3075fcdc5cbffb0366151632ba5be8ae815dfea9fadfd31c473a24a73d3e5116c3023b3563c72d26fbd59877132bde5ca4ef8d92fd3613c768b35223f6fd0b5e9a8b98cccf1e2b4612e620e3a159d6365c9045aaa826aa0ee6d26cf0397ce674c20824584b464ebdc2f3ea26a7aec4570b242a6677a4e9187f8591c3a9bdc00000000002364bbd93964a8d0bdc802b9be250000000000000000000000000000dd4a009b2ba0d648a6975bcb66956a963912e26eb226af29c9f9f6261884db2d6b172b240dae6c7af327a27c533ab69811ca700d51724999cb8c0a8cace25602c3ecb9f0bcbe9ca6c9a444feb4cd9abbf2db2d583d5279de7f4130"], &(0x7f0000000040)='GPL\x00', 0x4, 0x1076, &(0x7f0000000300)=""/4096, 0x0, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffed1}, 0x70) setsockopt$sock_attach_bpf(r0, 0x29, 0x37, &(0x7f0000000100)=r1, 0x120) socketpair(0x23, 0xaa5479311a3298be, 0x84, &(0x7f00000000c0)) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000002600)=@l2tp6={0xa, 0x0, 0x8, @remote, 0x2, 0x1}, 0x80, 0x0}, 0x4008040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000020000000000000000000000850000002000e4489500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000100)=@nl=@unspec, 0x80, 0x0}, 0x20000004) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400}, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x800}, 0x0, 0xffffffefffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0x1c, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$kcm(0x2, 0x1, 0x84) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0000ebff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00'}, 0x6b) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 14.146898867s ago: executing program 4 (id=2230): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_config_ext={0x9, 0xb}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x4, @perf_config_ext={0x8, 0x830d}, 0x102302, 0x2, 0xfefffffa, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000020000000a0000000000000a07000000080000000000000b0400000009000000010000130c00000007"], 0x0, 0x4a, 0x0, 0x1, 0x800, 0x10000}, 0x28) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22041800"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 13.434757726s ago: executing program 4 (id=2234): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="0000008000"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000004"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000080)) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x100}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 13.361950688s ago: executing program 5 (id=2236): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340), 0x8) r0 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r0}, 0x8) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffff, 0x100000000}, 0x0, 0x0, 0x0, 0x8, 0x2, 0xfffffffc}, 0x0, 0x100000000, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xcd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$kcm(0x2, 0x922000000001, 0x106) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) 12.840817595s ago: executing program 5 (id=2238): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000fc0000000000000000000000850000000800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000f9ffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000a00b704000002000000850000003300000095"], 0x0, 0x0, 0x0, 0x0, 0x21700, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000240)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xb}, 0x2e) 12.692904819s ago: executing program 5 (id=2239): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0xb4) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc2ba}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) r1 = socket$kcm(0xa, 0x922000000003, 0x11) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x14, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x100) r2 = socket$kcm(0x10, 0x7, 0x4) recvmsg$kcm(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x86bf2056334f3ae6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001100)={0x5, 0x80, 0x9, 0x8, 0xb, 0xfb, 0x0, 0x3c, 0xc002, 0xa, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x18842, 0x0, 0x7fffffff, 0x7, 0x9, 0x3, 0x7, 0x0, 0x8, 0x0, 0x7}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x3, 0x66, &(0x7f00000002c0)=""/102, 0x41100, 0x64, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[0xffffffffffffffff, 0x1, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x8001}, 0x94) r3 = socket$kcm(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffa}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000120000"], &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000880)={r4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff484f}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[], 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r5, 0x58, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0d00000002000000040000000100000000000000", @ANYRES32=r5, @ANYBLOB='\x00'/20, @ANYRES32=r6, @ANYBLOB="0000000000d3893699708f671a640400"/28], 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="120000000c0000000400", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r7, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000380)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r8, &(0x7f0000000500), &(0x7f0000000400)=""/198}, 0x20) sendmsg$kcm(r3, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000001000000000000", 0x20}], 0x1}, 0x40000) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x541b, &(0x7f0000000240)) sendmsg(r3, 0x0, 0x4000080) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) syz_clone(0x41f, &(0x7f0000001000), 0x0, 0x0, 0x0, 0x0) 11.838169471s ago: executing program 1 (id=2244): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_config_ext={0x9, 0xb}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x4, @perf_config_ext={0x8, 0x830d}, 0x102302, 0x2, 0xfefffffa, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000020000000a0000000000000a07000000080000000000000b0400000009000000010000130c00000007"], 0x0, 0x4a, 0x0, 0x1, 0x800, 0x10000}, 0x28) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22041800"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 8.671236258s ago: executing program 1 (id=2245): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000001180)=ANY=[@ANYBLOB], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000240)="3ec299426150", 0x6}], 0x1, &(0x7f00000007c0)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18, 0x400c5}, 0x10) r1 = socket$kcm(0x23, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x4) sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@phonet, 0x80, 0x0}, 0x0) 8.121773259s ago: executing program 1 (id=2249): r0 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xfe123, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_config_ext={0xd, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x1}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x18, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r4) r5 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0x66137, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r7 = bpf$ITER_CREATE(0xb, &(0x7f00000002c0)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) (fail_nth: 19) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r8) bpf$ENABLE_STATS(0x20, 0x0, 0x0) 7.564369082s ago: executing program 1 (id=2252): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, 0x0, 0x840) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$kcm(0x11, 0x200000000000002, 0x300) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x0, 0x36, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68886dd", 0x0, 0xadf0, 0x8000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.05073366s ago: executing program 1 (id=2255): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x10c002, 0x89}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b", 0x281}], 0x1}, 0x0) write$cgroup_subtree(r1, &(0x7f00000002c0)=ANY=[], 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000300)="53a8dc4d7aabc52f3be4e79047df3fe5757d7c086665f452e006beb66e667d9cabc84e51bf4506f7c1c0e57fec671db97d2357168c1dba235a65cc601ec8d78ed6c8c0ecfe4a1adbb9ee9bb30eccbe0a931f0bae40a64f6d220aa194514acabd3b7a8288891a29ce775cfc4fd9f870f6ed18eacdf896f70f0f3093b206fbec862130174b6ee399f7fef45ab9a3f36fccb4d20adb9ada1f1ae580daf237f8a54af50868787599d4bc57b4d69f60ffbcce83bd3b5f692578b116b5073a60616a01dd3390b53f353a015399620fc957954087a2f1e6f8f075dd739ea0e200"/233, 0xe9}], 0x1}, 0x41) recvmsg(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001) 4.823862637s ago: executing program 1 (id=2256): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001f80)=ANY=[@ANYBLOB="b702000026f90000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000050404000001007d60b7030000000000006a0a00fe00000000850000002b000000b7000000000000009500000000000000496cf27fb6d2c643db7e2d5fb4b0936cdf827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923dd29c034055b67dafe6c8dc525d78c07f17e4d5b3185b310efcfa89147a09000000f110026e6d2ef831ab7ea0c34f17e3ad6eecbb622003b534dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c214733a18c8b6619f28d9961b6fbce3f897226c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e60a0ac346dfebd31a0806000000020000000000000048f941b13d924bcf334d83239dd27080e71113610e10d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08ab1e1ad828267d4eadd3964663e88535c063f7130856f756436303767d2e24f29e5dad9796edb697a6ea1182babc190ae2ebf8aad34732181feb215139f15ea7e8cb0bae7c34d5ac5e7c805210600000000000000c3dec04b25dfc17975238345d4f71ab158c36657b7218baa0700f781c0a99bd50499ccc421ace5e845885efb5b9964e4beba3da8223fe5308e4e65ee93e107000000f8ddebf70132a4d0175b989b8eccf707882042e716df9b57b290c661d4e85031086197bcc5cb0e221a0c34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb0015982730711c599e1c72ffa11ed8be1a6830d7507005154c46bd3ca96318c570d338f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d1cdac944779dc08a705414888700a30e2366c6a06b3367a389ca39059787790017b0689a411f450f173db9c24db65c1e00015c1d093dab18fd0699fe3304000000323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab926150363fb099408885afc2bf9a46a076b7babfcddeff8c35030669ea69f5e4be1b8e0d6697e97186f9ae97d5670dba6623279f73db9dec75070cd9ab0fda6b069ef6d2857ca3e4effcf7462710d133d541da86e0477e4a6cc999dc21c3ef408e6b178e7c9f274d7fafc8d757d33dfa35aa2000034837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cadecc13219ba7518aa4f7db34ead13484742067ab743c1d82a5687f2ed690000000000000000000000000000000000000000000099d4fa0000000000003f0ecdc7c82e72919c91d2039afe17e95edeeeba72205beff7771bcb293747b88486cacee403000000a2919a4bff2ed893f2c814679fa69fc7e0cf761f918725704a01c56009a9f748e5aaf30a10bd8c409b1870c1f75ee905000000d3f8e0048e55ae289ce2ad779ce71d4dc30cbb2cc4289d2f884d66cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c1540bf3d162dc1c27fa30f0dc60b9f257db5d1c7ed2e152cb2cf06f8edb30177fead735a952ffce676a93110904d5ee2abdab2ef3ff84c4d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354da8de21eada75d3a3afb2c76ff0700007981699b6c0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d2503a3ea376721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e6712824a85eb9ee0a3b68c9e209756623adf685dd715d68ed11e4b4d5502f5124948f8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb20407ff7098b7174bef660200a99b5c0c20b378065fac4ef9ac2d00000060e5d3f1749feaecf69ba83a71caa9bdddc679f1b826f54b6563a4be1fd82b73c8c2bc65f63982b951fb058fd3c7b6341c4580376b6c16bd94d2da66059de81abfa15eeeb88b6ae5882ad341032c73f1285e21fff5a1d138e061b1dc7bbda199b5fab8e0719e9cd69b47dcb52b0be6a3a73afdf328132e1d4f21065716be0c53a23940d07188b015fa341dbc92231c8b5e5717eac184f46c9f61b69f55cd2231bcf821052429a1f250e8b734be0605a15f25923d599544b319319ff0a32621019347df460a098119a6f47eb1bac47946d7a009cbc6ec74c19a93cc7c7138b28c95270116181fd5f553573c48104d2ad0e10d3663488e664401453f22f0d76d2162635365258af61ae1f46f4a7862f302d91e3f7c2781f602220522e84602a939a8d5e4137ae31ccd397404dc72e06715a6503d4d865182803ee6725da7293b23daeebefd6fce7411c9624a7e8d5ba5a13e1c32adc4f3274497c6882a72475e4280a4d9a47c003c6ed3071330c58145be498ca2b42496c479a0a71e2f6f9bad8c84bc6be20281bde0b348cd2c60538a505ad4a0510eebb023e4954c9eb6cd70627f5c03d867dbf3ad5d1f1dc852064dd0efafc3df20ed65af3d194db76127f88f284fa1b71ab964fdd2474471da76373e65e9a8bf844bdfdd348bc7d00c4c7e7afe8a1f8cde79b7a6c5aafe954b8ba37818e40c14b37c23f9f614576b689436fef2f27f8b1e756e00262e22bca49c43fd73e7e99b2fa44a8c1db99c2cf2735ad6c5fabf082e0df0f8ba7e24272165f2f5b28230c02b53d44bd84bf6770157e96bbb96b5e1f165c87e7ad68a3600b3d357fa9a7d53c281d88ebb175a4dbb82130e6870982947913110f091d21760d985afd3163f2e6880682432f9b3b97d57a9f980edfa1116a3d04d58872a07d6a7e12db673acd2f7b8988d833e71943fe2c1c65a3cf36b955c56b55bfd3ecf0af694c71a03f2996c15b1ba971de1cb9c7e6a0000000000000014783ef54c51199317413f98dca8ff3d0bda50f6c0af58dbd6c031b1a5a7512c5896514adfa17d31429c68db50a93d88199defd3b4625fea426ff9293a28a544a6a9e2a79b55daa1b3c6b14c4ec6d164e902ce4913843d65d841973468729ea12bf6d3499036dbb66718f3497855c3baa6cc07c0fa388ec9df0617c1a28ef5a595ee267a76175b8a057e6efaf4fefe46def451f2858fe71a53e77b1a44e98843bb3a40102da3703dfb9f61bdcea2fb810b32d52e2157a150a63ea6135d1cf6f864c2e68884d7245bc5d61dc5a114d10ffb22e76678bbfc1e3865d17d128306d1b81884a934cb00000000000000000098a4526e6468987dbc63bff7590eb388afaba43d811996333eef7e9f472bee293f0c40d434b8be07cbd52325296e22802493edb5c590ad208bac683a8b2d4c9d2d57ff846ae8c422e0b28546671f11d8157bb762c91f3fbcca8e21589c92446ae65d408c0637ffcc2d44d715ce003dd1e12b085e186d069a55c2e96efbe5024d61a56a36d988c0f51a973a6c238e545b28211a92000000001501aed8d72af0fcd540a9d4e293690c5e697b3a1480e46df5371bca1cfb28a57c1b3c956ec81397e81fbf870a67385fea04220423f52ad8178b9fd04bdc7e5fee4bd52db996e633792118efdb6b88023e80da74fdf723c7f0b2e9f3bb90613508c00a292a0c5b87a4f8ff35eba73ce9ebf77d0c842063a7b42c757d828678d38e6a868eaead4f19cdeb7cfc100ceabb4a3999cce5d36ecfe80def20f7187bab75515226f4d9b30e0567612210d492468781999ce795522b726bdf37b15e9afde32a7052cc909efe6ae7804e5044f9f7ae2d8cb08cca312c557bff04cf1fbb0dcfe8ac00"/2832], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff4f}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76389e147583dd040000006a5cfd", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf1}, 0xfffffffffffffebf) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r3 = syz_clone(0x630c1100, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x43001000, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000800)={0x2, 0x80, 0xcb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8}, 0x0, 0xc, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x204, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0xb0, 0x0, 0x4, 0x0, 0x800, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x3300, 0x0, 0xfffffffd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff}, 0x0, 0x6, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x1, 0x84) socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x76d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) socket$kcm(0x2, 0x5, 0x2) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000280)=@o_path={&(0x7f0000000200)='./file0\x00', 0x0, 0x10, r4}, 0x18) socket$kcm(0xa, 0x2, 0x3a) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000380)={0x3, 0x80, 0xf6, 0x8, 0x0, 0x1, 0x0, 0x6, 0x20, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xe88f5d9965ff4a44, @perf_bp={0x0, 0x2}, 0x14000, 0xca, 0x0, 0x0, 0x0, 0x8, 0x7, 0x0, 0x0, 0x0, 0x400100}, r3, 0x13, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x5, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40050, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000400), 0xe}, 0x10c002, 0x2ac5d, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r6) recvmsg$unix(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) 3.730932979s ago: executing program 4 (id=2257): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x8c, 0x1, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x1, @perf_config_ext={0x7ffe, 0xc}, 0x0, 0x0, 0xfffffffe, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x204, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x6, 0x5, &(0x7f0000000840)=ANY=[@ANYBLOB="180000000effd001000000000400070007010000080700007500fcff0000000095"], &(0x7f0000000100)='GPL\x00', 0x3, 0xfa, &(0x7f0000000a00)=""/250}, 0x94) r2 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x84, 0x64, &(0x7f0000000000), 0x10) ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000200), 0x4) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="d8000000210081044e810382db44b9040a00000000fe0500002015000600142603600e1209001100800000000001060000b94dcf5c0468c1d67f6f94007134cfeee0800089e408e8d8ef52b40800de00e06bbace8017cbec4c2ee5a7cef4090000001fb79164075ee4ce1b14d6d930dfe1d9db22fe7c9f8775730d16a4683f1aeb4edbb57a5035ccb29e00360db70100000040fad95667e006dcdf969b3ef35ce3bb9ae5abb3dbe08141a90bffece0b42a9ecbee5de6ccd40dd6e4edef3d93c42a83954b43370e9701008400002d3bc75dc0bb9dd33e438c", 0xd8}], 0x1}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f00000002c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'nicvf0\x00', 0x1432}) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r4) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040), 0x0, 0x0, 0x0, 0x808e}, 0x40000100) syz_clone(0x8001000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xf, 0x0, &(0x7f0000000080)='GPL\x00'}, 0x94) 3.66713441s ago: executing program 2 (id=2258): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0xc29a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = socket$kcm(0x23, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x400c84c) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89ed, 0x0) 3.60491593s ago: executing program 5 (id=2259): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000001180)=ANY=[@ANYBLOB], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000240)="3ec299426150", 0x6}], 0x1, &(0x7f00000007c0)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18, 0x400c5}, 0x10) r1 = socket$kcm(0x23, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x4) sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@phonet, 0x80, 0x0}, 0x0) 3.54755699s ago: executing program 0 (id=2260): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x8c, 0x1, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x7ffe, 0xe}, 0x0, 0x0, 0xfffffffe, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2000000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x6, 0x5, &(0x7f0000000840)=ANY=[@ANYBLOB="1880ff000effd001000000000400070007010000080700007500fcff0000000095"], &(0x7f0000000100)='GPL\x00', 0x3, 0xfa, &(0x7f0000000a00)=""/250}, 0x94) r2 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x84, 0x64, &(0x7f0000000000), 0x10) ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000200), 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f00000002c0)={'bond0\x00', 0x4000}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'nicvf0\x00', 0x1432}) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r3) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040), 0x0, 0x0, 0x0, 0x808e}, 0x40000100) syz_clone(0x8001000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xf, 0x0, &(0x7f0000000080)='GPL\x00'}, 0x94) 3.102034924s ago: executing program 2 (id=2261): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000fc0000000000000000000000850000000800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000f9ffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000a00b704000002000000850000003300000095"], 0x0, 0x0, 0x0, 0x0, 0x21700, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000240)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xb}, 0x2e) 2.243580456s ago: executing program 2 (id=2262): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x108282, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x11, 0xa, 0x300) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6307ce22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0xff00, 0x0, 0x0, 0x2}, 0x48) 1.519566847s ago: executing program 2 (id=2263): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000001180)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) r0 = socket$kcm(0x23, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f00000002c0)=r1, 0x4) sendmsg$kcm(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) 1.518889397s ago: executing program 5 (id=2264): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffe}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xe, 0x0, &(0x7f0000000040)="ffff53f2081e87f89b60160b08ff", 0x0, 0x63, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3f}, 0x50) socket$kcm(0x10, 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x28, 0x5, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) socket$kcm(0x11, 0x2, 0x300) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="07000000040000000001000001"], 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="00000000000000000000000095930800"/31], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x10c002, 0xac63, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x12, 0x4001}, 0x50) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000003c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000005c0), 0x12) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000500)="91", 0x1}], 0x1}, 0x4845) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) socket$kcm(0x10, 0x400000002, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x8090) 874.852274ms ago: executing program 0 (id=2265): r0 = socket$kcm(0x29, 0x5, 0x0) r1 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0x66137, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x4800, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socketpair(0x1, 0x80000, 0x6, &(0x7f0000000000)={0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x14, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xf3cc}}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r5, r4}, 0xc) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r3, r5}) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x65ed}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r6) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xdd, 0x708}, 0x0, 0x3, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r7 = socket$kcm(0xa, 0x1, 0x0) setsockopt$sock_attach_bpf(r7, 0x6, 0xe, &(0x7f00000000c0), 0xd8) socket$kcm(0x2b, 0x1, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a00)={r6, 0xe0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, &(0x7f00000001c0)=[0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x68, &(0x7f0000000780)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f00000007c0), &(0x7f0000000800), 0x8, 0x53, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_bp={0x0}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="0206e7ec02000000ffffffff006d97dc", 0x10}], 0x1}, 0x0) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000b80)={&(0x7f0000000a40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x88, 0x88, 0xa, [@datasec={0x10, 0x4, 0x0, 0xf, 0x1, [{0x2, 0x10000, 0x7}, {0x3, 0x0, 0xfffffe01}, {0x4, 0x7, 0x80000000}, {0x3, 0x6, 0xfff}], 's'}, @const={0x2, 0x0, 0x0, 0xa, 0x4}, @datasec={0x7f, 0x2, 0x0, 0xf, 0x3, [{0x4, 0x5, 0x6}, {0x4, 0xb7, 0xfffffffb}], "03d039"}, @func={0x5, 0x0, 0x0, 0xc, 0x5}, @restrict={0x3, 0x0, 0x0, 0xb, 0x5}]}, {0x0, [0x61, 0x2e, 0x2e, 0x0, 0x30, 0x30, 0x30, 0xc603c2e7b1ee1ddf]}}, &(0x7f0000000b00)=""/83, 0xaa, 0x53, 0x0, 0x81, 0x10000}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000bc0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x8, '\x00', r8, r10, 0x3, 0x2}, 0x50) syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x80440, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x3fff, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10, 0x0}, 0x34000001) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000072000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r11, 0x0, 0x0}, 0x10) 617.092937ms ago: executing program 2 (id=2266): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x10c002, 0x89}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b", 0x281}], 0x1}, 0x0) write$cgroup_subtree(r1, &(0x7f00000002c0)=ANY=[], 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000300)="53a8dc4d7aabc52f3be4e79047df3fe5757d7c086665f452e006beb66e667d9cabc84e51bf4506f7c1c0e57fec671db97d2357168c1dba235a65cc601ec8d78ed6c8c0ecfe4a1adbb9ee9bb30eccbe0a931f0bae40a64f6d220aa194514acabd3b7a8288891a29ce775cfc4fd9f870f6ed18eacdf896f70f0f3093b206fbec862130174b6ee399f7fef45ab9a3f36fccb4d20adb9ada1f1ae580daf237f8a54af50868787599d4bc57b4d69f60ffbcce83bd3b5f692578b116b5073a60616a01dd3390b53f353a015399620fc957954087a2f1e6f8f075dd739ea0e200"/233, 0xe9}], 0x1}, 0x41) recvmsg(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001) 172.252381ms ago: executing program 2 (id=2267): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="0000008000"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000004"], 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000080)) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x100}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 0s ago: executing program 5 (id=2268): r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x0, 0x1}, 0x201, 0x0, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001240)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000aecd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad94ed406f21caf5adcf920569c00cc1199684fa75814709fea019af247c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c1faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6fab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b79db2e3d5986c82b5aa94e539b204d58f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c7160ec83070000020000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72b0000000000001cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2cc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78ac02ca3cdf6a662db1c9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad943e392955f4f979ea13201bafedcd2063d11dd665647223c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd89346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca2533659edc8be05cc85451c6a14507434eb54b6f43caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffca9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a294351c5356c1d06c92cf8ce3c7c56cd31121624d74517fd3666277f670e812b28e2f30d035cee5d0e77a3c7220000000000000005a474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f034b8d3ebce68663ef5af469abe75b314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041e12282ce24463aaf28345bd168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f09000000000000004fc4bda3453602004535a976eacd3adaa4d2ee6fe0d072ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d401adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb40f7f02f750d6c977a191852c9ae031db044b2353199546609f9f69a6cfefdf879d447df53f3b9b70d10355b00300000000000000553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f58fab987baab97a9bfbd8f185b5631820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe527340935aa3c0b4f3f45b418a18217747ae442e31560e5b741445ea2a1acee2a81425ff000000d2a0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51423b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f88735fce5115dc83ed73d8ee4a91322608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf5000000000000fa08ad0631c4b839688b22c4da2a6bc4cf45854d221a2d5f96bc64647f15daa2ba79cd0f4254ed55217912ef84bd2927df82fc061aef2920c49b2a90886da75561173fa186cb7ee86dd4285c4721eb428c953296bb2f5d825da54dbef07c1b349b4901e093d13e6b9a0000009b5b22e887bc061d40bcaf0aa18623fd9b7179ccc692ba74b531b65c4decf9d080a8ac7e82d4cde1267aa64b2a94fd87a009e6742c2ddc3a9d7eccbb1831b1fa218277c2814a91cab7cb59c697166d6f1bb1a360470000000000000000000000000000000000000000000000000000f9f9b4ce7e871f507084c8c88e0652decbe579b03ed84ea94597dd1059620a050f69ea03b99b4e19d35f4a3b54e96ae2172effecec80f6baa4bf69a6ebf5392882df78b0983e662dc0cb64b77f3f006b6b25443197ae93f0be6de5a703d003f00720943c0e4b33af00000000000000000021a688b2d7007fcc4b59f719afb0b3b7e0aee306ca70fe42bf4984a68f40e1fc043a03a17e4744359b87dc27c82d51cbeb64e52a28daeb6a78d6fe06181ecc840000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015401e00142603600e1208000b0000000401a80016000800014009001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) kernel console output (not intermixed with test programs): committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 333.485437][ T7860] device syzkaller0 entered promiscuous mode [ 333.797483][ T4282] Bluetooth: hci2: command 0x0409 tx timeout [ 333.834432][ T4282] Bluetooth: hci0: unexpected subevent 0x0c length: 150 > 5 [ 333.977131][ T4672] wlan1: Trigger new scan to find an IBSS to join [ 334.988430][ T5072] wlan1: Creating new IBSS network, BSSID 3a:13:2f:9b:ab:93 [ 336.762573][ T7896] netlink: 'syz.2.1016': attribute type 2 has an invalid length. [ 336.770842][ T7896] FAULT_INJECTION: forcing a failure. [ 336.770842][ T7896] name failslab, interval 1, probability 0, space 0, times 0 [ 336.784616][ T7896] CPU: 1 PID: 7896 Comm: syz.2.1016 Not tainted syzkaller #0 [ 336.792022][ T7896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 336.802174][ T7896] Call Trace: [ 336.805520][ T7896] [ 336.808455][ T7896] dump_stack_lvl+0x188/0x24e [ 336.813161][ T7896] ? show_regs_print_info+0x12/0x12 [ 336.818410][ T7896] ? load_image+0x400/0x400 [ 336.822923][ T7896] should_fail_ex+0x399/0x4d0 [ 336.827642][ T7896] should_failslab+0x5/0x20 [ 336.832171][ T7896] slab_pre_alloc_hook+0x59/0x310 [ 336.837199][ T7896] ? phonet_address_add+0x150/0x2c0 [ 336.842435][ T7896] __kmem_cache_alloc_node+0x4f/0x260 [ 336.847839][ T7896] ? phonet_address_add+0x150/0x2c0 [ 336.853048][ T7896] kmalloc_trace+0x26/0xe0 [ 336.857475][ T7896] phonet_address_add+0x150/0x2c0 [ 336.862528][ T7896] addr_doit+0x345/0x480 [ 336.866890][ T7896] ? fill_route+0x5e0/0x5e0 [ 336.871516][ T7896] ? rtnetlink_rcv_msg+0x226/0xfc0 [ 336.876650][ T7896] ? rtnetlink_rcv_msg+0x226/0xfc0 [ 336.881780][ T7896] ? fill_route+0x5e0/0x5e0 [ 336.886289][ T7896] rtnetlink_rcv_msg+0x87c/0xfc0 [ 336.891260][ T7896] ? rtnetlink_bind+0x80/0x80 [ 336.895994][ T7896] ? __local_bh_enable_ip+0x136/0x1c0 [ 336.901388][ T7896] ? lockdep_hardirqs_on+0x94/0x140 [ 336.906604][ T7896] ? __local_bh_enable_ip+0x136/0x1c0 [ 336.911989][ T7896] ? _local_bh_enable+0xa0/0xa0 [ 336.916902][ T7896] ? __dev_queue_xmit+0x26b/0x37c0 [ 336.922031][ T7896] ? __dev_queue_xmit+0x26b/0x37c0 [ 336.927246][ T7896] ? __dev_queue_xmit+0x1cd2/0x37c0 [ 336.932577][ T7896] ? __dev_queue_xmit+0x26b/0x37c0 [ 336.937803][ T7896] ? perf_trace_lock+0xf8/0x390 [ 336.942784][ T7896] ? __copy_skb_header+0x3ba/0x4f0 [ 336.947944][ T7896] ? trace_event_raw_event_lock+0x250/0x250 [ 336.953890][ T7896] ? __skb_clone+0x480/0x790 [ 336.958532][ T7896] netlink_rcv_skb+0x1fb/0x450 [ 336.963453][ T7896] ? rtnetlink_bind+0x80/0x80 [ 336.968159][ T7896] ? netlink_ack+0x1170/0x1170 [ 336.972956][ T7896] ? netlink_deliver_tap+0x2e/0x1b0 [ 336.978386][ T7896] netlink_unicast+0x74d/0x8d0 [ 336.983208][ T7896] netlink_sendmsg+0x8ad/0xbd0 [ 336.988033][ T7896] ? netlink_getsockopt+0x550/0x550 [ 336.993436][ T7896] ? aa_sock_msg_perm+0x94/0x150 [ 336.998475][ T7896] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 337.003945][ T7896] ? security_socket_sendmsg+0x7c/0xa0 [ 337.009447][ T7896] ? netlink_getsockopt+0x550/0x550 [ 337.014702][ T7896] ____sys_sendmsg+0x5be/0x970 [ 337.019512][ T7896] ? __sys_sendmsg_sock+0x30/0x30 [ 337.024650][ T7896] ? __import_iovec+0x315/0x500 [ 337.029701][ T7896] ? import_iovec+0x6f/0xa0 [ 337.034221][ T7896] ___sys_sendmsg+0x2a2/0x360 [ 337.038927][ T7896] ? __sys_sendmsg+0x290/0x290 [ 337.043734][ T7896] ? __lock_acquire+0x7d10/0x7d10 [ 337.048834][ T7896] __se_sys_sendmsg+0x1bb/0x2a0 [ 337.053826][ T7896] ? ct_nmi_exit+0x145/0x1c0 [ 337.058456][ T7896] ? __x64_sys_sendmsg+0x80/0x80 [ 337.063441][ T7896] ? lockdep_hardirqs_on+0x94/0x140 [ 337.068683][ T7896] do_syscall_64+0x4c/0xa0 [ 337.073117][ T7896] ? clear_bhb_loop+0x60/0xb0 [ 337.077892][ T7896] ? clear_bhb_loop+0x60/0xb0 [ 337.082984][ T7896] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 337.088915][ T7896] RIP: 0033:0x7f2a1fb9c819 [ 337.093350][ T7896] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 337.112982][ T7896] RSP: 002b:00007f2a20a8f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.121424][ T7896] RAX: ffffffffffffffda RBX: 00007f2a1fe15fa0 RCX: 00007f2a1fb9c819 [ 337.129526][ T7896] RDX: 0000000020000800 RSI: 0000200000000080 RDI: 0000000000000003 [ 337.137601][ T7896] RBP: 00007f2a20a8f090 R08: 0000000000000000 R09: 0000000000000000 [ 337.146132][ T7896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.154250][ T7896] R13: 00007f2a1fe16038 R14: 00007f2a1fe15fa0 R15: 00007ffe5f596af8 [ 337.162279][ T7896] [ 337.189387][ T7890] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 337.388770][ T7903] device syzkaller0 entered promiscuous mode [ 337.606612][ T7917] netlink: 'syz.4.1019': attribute type 10 has an invalid length. [ 337.860616][ T7924] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1023'. [ 337.889389][ T7917] netlink: 184 bytes leftover after parsing attributes in process `syz.4.1019'. [ 339.957549][ T41] wlan1: Trigger new scan to find an IBSS to join [ 341.083275][ T7937] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 341.354790][ T7955] netlink: 'syz.4.1029': attribute type 28 has an invalid length. [ 341.384464][ T7955] netlink: 2 bytes leftover after parsing attributes in process `syz.4.1029'. [ 341.709965][ T7960] netlink: 'syz.3.1032': attribute type 29 has an invalid length. [ 342.297428][ T7966] netlink: 175 bytes leftover after parsing attributes in process `syz.1.1033'. [ 342.340803][ T7966] netlink: 'syz.1.1033': attribute type 10 has an invalid length. [ 342.530693][ T7968] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 342.540082][ T4282] Bluetooth: hci4: unexpected subevent 0x0c length: 150 > 5 [ 342.833111][ T4282] Bluetooth: hci2: unexpected event 0x0b length: 15 > 11 [ 343.233887][ T9] wlan1: Trigger new scan to find an IBSS to join [ 343.235240][ T41] wlan1: Trigger new scan to find an IBSS to join [ 343.296725][ T7982] skbuff: bad partial csum: csum=65535/127 headroom=178 headlen=65664 [ 343.322959][ T7982] netlink: 'syz.0.1039': attribute type 21 has an invalid length. [ 343.365024][ T7982] netlink: 'syz.0.1039': attribute type 3 has an invalid length. [ 343.425486][ T7989] netlink: 'syz.1.1040': attribute type 29 has an invalid length. [ 343.443895][ T7982] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1039'. [ 343.529338][ T7993] netlink: 'syz.1.1040': attribute type 10 has an invalid length. [ 343.650331][ T7993] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 343.707798][ T7993] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 343.719453][ T7993] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 343.735507][ T7993] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 343.894185][ T7989] netlink: 'syz.1.1040': attribute type 29 has an invalid length. [ 343.911939][ T7995] netlink: 'syz.2.1041': attribute type 3 has an invalid length. [ 344.158422][ T7995] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1041'. [ 344.285780][ T7996] netlink: 'syz.2.1041': attribute type 3 has an invalid length. [ 344.408595][ T7996] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.1041'. [ 344.500813][ T41] wlan1: Creating new IBSS network, BSSID 4e:84:32:b7:84:ba [ 344.847026][ T8012] netlink: 'syz.2.1045': attribute type 28 has an invalid length. [ 344.863117][ T8012] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1045'. [ 344.890782][ T4282] Bluetooth: hci0: unexpected subevent 0x0c length: 150 > 5 [ 344.917732][ T4333] wlan1: Trigger new scan to find an IBSS to join [ 345.079806][ T8020] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.1050'. [ 345.433351][ T8025] netlink: 'syz.1.1051': attribute type 13 has an invalid length. [ 345.508412][ T8025] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1051'. [ 345.679625][ T4282] Bluetooth: hci3: unexpected event 0x0b length: 15 > 11 [ 345.716383][ T8025] syz_tun: refused to change device tx_queue_len [ 345.943709][ T8025] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 346.098592][ T8022] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1051'. [ 346.493449][ T8022] syz_tun: refused to change device tx_queue_len [ 346.509198][ T8022] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 346.576701][ T8032] team0: Port device netdevsim0 added [ 346.601752][ T8040] netlink: 55 bytes leftover after parsing attributes in process `syz.3.1055'. [ 346.650390][ T8045] skbuff: bad partial csum: csum=65535/127 headroom=178 headlen=65664 [ 346.690879][ T8018] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 346.844471][ T8037] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1054'. [ 346.998095][ T4672] wlan1: Trigger new scan to find an IBSS to join [ 347.216138][ T8056] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1058'. [ 347.692412][ T8058] validate_nla: 5 callbacks suppressed [ 347.692433][ T8058] netlink: 'syz.3.1057': attribute type 3 has an invalid length. [ 347.771502][ T8063] netlink: 'syz.3.1057': attribute type 3 has an invalid length. [ 348.164613][ T65] wlan1: Creating new IBSS network, BSSID ee:c6:03:83:9b:8b [ 348.190304][ T8065] FAULT_INJECTION: forcing a failure. [ 348.190304][ T8065] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 348.211257][ T8065] CPU: 1 PID: 8065 Comm: syz.4.1062 Not tainted syzkaller #0 [ 348.218891][ T8065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 348.229169][ T8065] Call Trace: [ 348.232494][ T8065] [ 348.235473][ T8065] dump_stack_lvl+0x188/0x24e [ 348.240216][ T8065] ? show_regs_print_info+0x12/0x12 [ 348.245561][ T8065] ? load_image+0x400/0x400 [ 348.250118][ T8065] ? __lock_acquire+0x7d10/0x7d10 [ 348.255290][ T8065] should_fail_ex+0x399/0x4d0 [ 348.260032][ T8065] _copy_from_user+0x2c/0x170 [ 348.264766][ T8065] kstrtouint_from_user+0xda/0x170 [ 348.269930][ T8065] ? kstrtol_from_user+0x190/0x190 [ 348.275086][ T8065] proc_fail_nth_write+0x8b/0x200 [ 348.280222][ T8065] ? proc_fail_nth_read+0x220/0x220 [ 348.285549][ T8065] ? common_file_perm+0x171/0x1c0 [ 348.290611][ T8065] ? proc_fail_nth_read+0x220/0x220 [ 348.295830][ T8065] vfs_write+0x2e6/0xa30 [ 348.300209][ T8065] ? file_end_write+0x250/0x250 [ 348.305089][ T8065] ? __fget_files+0x28/0x4b0 [ 348.309703][ T8065] ? __fget_files+0x28/0x4b0 [ 348.314332][ T8065] ? __fget_files+0x43d/0x4b0 [ 348.319051][ T8065] ? __fdget_pos+0x2ae/0x360 [ 348.323665][ T8065] ? ksys_write+0x71/0x250 [ 348.328108][ T8065] ksys_write+0x14c/0x250 [ 348.332637][ T8065] ? __ia32_sys_read+0x80/0x80 [ 348.337429][ T8065] ? lockdep_hardirqs_on+0x94/0x140 [ 348.342658][ T8065] do_syscall_64+0x4c/0xa0 [ 348.347103][ T8065] ? clear_bhb_loop+0x60/0xb0 [ 348.351879][ T8065] ? clear_bhb_loop+0x60/0xb0 [ 348.356756][ T8065] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 348.362784][ T8065] RIP: 0033:0x7f706775d04e [ 348.367311][ T8065] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 348.386948][ T8065] RSP: 002b:00007f706872dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 348.395383][ T8065] RAX: ffffffffffffffda RBX: 00007f706872e6c0 RCX: 00007f706775d04e [ 348.403368][ T8065] RDX: 0000000000000001 RSI: 00007f706872e0a0 RDI: 0000000000000007 [ 348.411359][ T8065] RBP: 00007f706872e090 R08: 0000000000000000 R09: 0000000000000000 [ 348.419451][ T8065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 348.427451][ T8065] R13: 00007f7067a16038 R14: 00007f7067a15fa0 R15: 00007ffdc1f27f58 [ 348.435465][ T8065] [ 348.544265][ T8070] __nla_validate_parse: 2 callbacks suppressed [ 348.544284][ T8070] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1064'. [ 348.772271][ T8072] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1064'. [ 348.929013][ T8073] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 348.936401][ T8073] IPv6: NLM_F_CREATE should be set when creating new route [ 348.943824][ T8073] IPv6: NLM_F_CREATE should be set when creating new route [ 348.951261][ T8073] IPv6: NLM_F_CREATE should be set when creating new route [ 348.997738][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 349.323825][ T8089] netlink: 'syz.0.1069': attribute type 10 has an invalid length. [ 349.372683][ T8089] netlink: 55 bytes leftover after parsing attributes in process `syz.0.1069'. [ 350.138973][ T5072] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 350.252746][ T8084] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 350.291974][ T8096] netlink: 'syz.2.1071': attribute type 21 has an invalid length. [ 350.441839][ T8096] netlink: 'syz.2.1071': attribute type 3 has an invalid length. [ 350.570070][ T8096] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1071'. [ 350.656487][ T8115] netlink: 'syz.3.1074': attribute type 28 has an invalid length. [ 350.679227][ T8115] netlink: 2 bytes leftover after parsing attributes in process `syz.3.1074'. [ 350.770898][ T8112] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1075'. [ 351.456326][ T8122] netlink: 'syz.0.1078': attribute type 3 has an invalid length. [ 351.501908][ T8122] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1078'. [ 351.599190][ T8128] netlink: 'syz.0.1078': attribute type 3 has an invalid length. [ 351.670839][ T8128] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.1078'. [ 351.895855][ T4282] Bluetooth: hci4: unexpected subevent 0x0c length: 150 > 5 [ 352.290543][ T8144] netlink: 'syz.2.1087': attribute type 10 has an invalid length. [ 352.319615][ T8144] netlink: 55 bytes leftover after parsing attributes in process `syz.2.1087'. [ 352.885822][ T8154] netlink: 'syz.3.1090': attribute type 21 has an invalid length. [ 352.924536][ T8154] netlink: 'syz.3.1090': attribute type 3 has an invalid length. [ 352.935037][ T4282] Bluetooth: hci3: unexpected subevent 0x0c length: 150 > 5 [ 352.938059][ T8154] netlink: 144 bytes leftover after parsing attributes in process `syz.3.1090'. [ 353.006246][ T41] wlan1: Trigger new scan to find an IBSS to join [ 353.150190][ T4282] Bluetooth: hci1: unexpected subevent 0x0c length: 150 > 5 [ 353.363979][ T8181] C: renamed from team_slave_0 [ 353.391677][ T8181] netlink: 'syz.2.1098': attribute type 3 has an invalid length. [ 353.408482][ T8181] netlink: 'syz.2.1098': attribute type 1 has an invalid length. [ 353.662022][ T8195] __nla_validate_parse: 2 callbacks suppressed [ 353.662058][ T8195] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1101'. [ 353.972378][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 354.541902][ T4282] Bluetooth: hci2: unexpected subevent 0x0c length: 150 > 5 [ 354.607054][ T4282] Bluetooth: hci4: unexpected subevent 0x0c length: 150 > 5 [ 354.643858][ T8213] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1110'. [ 354.709185][ T8217] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1113'. [ 354.917112][ T5072] wlan1: Creating new IBSS network, BSSID 8a:41:24:f5:26:3e [ 355.153221][ T8230] netlink: 'syz.2.1116': attribute type 7 has an invalid length. [ 355.161388][ T8230] netlink: 126644 bytes leftover after parsing attributes in process `syz.2.1116'. [ 356.704087][ T8246] netlink: 'syz.2.1121': attribute type 21 has an invalid length. [ 356.805818][ T4282] Bluetooth: hci1: unexpected subevent 0x0c length: 150 > 5 [ 356.921713][ T8261] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.929662][ T8261] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.053274][ T8252] can: request_module (can-proto-0) failed. [ 357.059926][ T8266] device bridge_slave_1 left promiscuous mode [ 357.139198][ T8269] netlink: 'syz.3.1128': attribute type 1 has an invalid length. [ 357.150703][ T8266] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.154631][ T8268] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1130'. [ 357.182144][ T8269] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.1128'. [ 357.420206][ T8266] device bridge_slave_0 left promiscuous mode [ 357.427736][ T8266] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.493436][ T8264] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.1128'. [ 357.957819][ T5072] wlan1: Trigger new scan to find an IBSS to join [ 357.993871][ T4282] Bluetooth: hci4: unexpected subevent 0x0c length: 150 > 5 [ 358.366363][ T8304] IPv6: NLM_F_CREATE should be specified when creating new route [ 358.393511][ T8304] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1144'. [ 358.990786][ T8314] FAULT_INJECTION: forcing a failure. [ 358.990786][ T8314] name failslab, interval 1, probability 0, space 0, times 0 [ 359.012392][ T8314] CPU: 0 PID: 8314 Comm: syz.0.1146 Not tainted syzkaller #0 [ 359.019846][ T8314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 359.030042][ T8314] Call Trace: [ 359.033367][ T8314] [ 359.036337][ T8314] dump_stack_lvl+0x188/0x24e [ 359.041161][ T8314] ? show_regs_print_info+0x12/0x12 [ 359.046419][ T8314] ? load_image+0x400/0x400 [ 359.050959][ T8314] ? __might_sleep+0xd0/0xd0 [ 359.055674][ T8314] ? __lock_acquire+0x7d10/0x7d10 [ 359.060753][ T8314] should_fail_ex+0x399/0x4d0 [ 359.065468][ T8314] should_failslab+0x5/0x20 [ 359.069999][ T8314] slab_pre_alloc_hook+0x59/0x310 [ 359.075062][ T8314] ? sk_prot_alloc+0xe7/0x210 [ 359.079803][ T8314] __kmem_cache_alloc_node+0x4f/0x260 [ 359.085300][ T8314] ? sk_prot_alloc+0xe7/0x210 [ 359.090187][ T8314] __kmalloc+0xa0/0x240 [ 359.094397][ T8314] sk_prot_alloc+0xe7/0x210 [ 359.098938][ T8314] ? sk_alloc+0x20/0x340 [ 359.103237][ T8314] sk_alloc+0x36/0x340 [ 359.107445][ T8314] ? bpf_ctx_init+0x163/0x1a0 [ 359.112258][ T8314] ? bpf_prog_test_run_skb+0x26f/0x12a0 [ 359.117944][ T8314] bpf_prog_test_run_skb+0x35e/0x12a0 [ 359.123361][ T8314] ? __fget_files+0x28/0x4b0 [ 359.128006][ T8314] ? __fget_files+0x43d/0x4b0 [ 359.132838][ T8314] ? cpu_online+0xa0/0xa0 [ 359.137207][ T8314] bpf_prog_test_run+0x31e/0x390 [ 359.142189][ T8314] __sys_bpf+0x62b/0x780 [ 359.146478][ T8314] ? bpf_link_show_fdinfo+0x380/0x380 [ 359.151936][ T8314] ? lock_chain_count+0x20/0x20 [ 359.156840][ T8314] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 359.162983][ T8314] __x64_sys_bpf+0x78/0x90 [ 359.167459][ T8314] do_syscall_64+0x4c/0xa0 [ 359.171925][ T8314] ? clear_bhb_loop+0x60/0xb0 [ 359.176643][ T8314] ? clear_bhb_loop+0x60/0xb0 [ 359.181374][ T8314] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 359.187403][ T8314] RIP: 0033:0x7fc4dd19c819 [ 359.192028][ T8314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.211855][ T8314] RSP: 002b:00007fc4de12c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 359.220410][ T8314] RAX: ffffffffffffffda RBX: 00007fc4dd416090 RCX: 00007fc4dd19c819 [ 359.228688][ T8314] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 359.236872][ T8314] RBP: 00007fc4de12c090 R08: 0000000000000000 R09: 0000000000000000 [ 359.244888][ T8314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 359.252904][ T8314] R13: 00007fc4dd416128 R14: 00007fc4dd416090 R15: 00007ffd23acd068 [ 359.260934][ T8314] [ 359.969249][ T65] wlan1: Trigger new scan to find an IBSS to join [ 360.561380][ T6322] wlan1: Creating new IBSS network, BSSID e6:51:e4:3f:e8:10 [ 361.227564][ T8327] can: request_module (can-proto-0) failed. [ 361.303630][ T8331] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.311125][ T8331] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.318992][ T4282] Bluetooth: hci1: unexpected subevent 0x0c length: 150 > 5 [ 361.344069][ T8334] device bridge_slave_1 left promiscuous mode [ 361.358561][ T8334] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.419919][ T8334] device bridge_slave_0 left promiscuous mode [ 361.426144][ T8334] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.500193][ T8344] FAULT_INJECTION: forcing a failure. [ 361.500193][ T8344] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 361.567672][ T8344] CPU: 1 PID: 8344 Comm: syz.0.1156 Not tainted syzkaller #0 [ 361.575130][ T8344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 361.585232][ T8344] Call Trace: [ 361.588643][ T8344] [ 361.591606][ T8344] dump_stack_lvl+0x188/0x24e [ 361.596463][ T8344] ? show_regs_print_info+0x12/0x12 [ 361.601713][ T8344] ? load_image+0x400/0x400 [ 361.606338][ T8344] ? __might_fault+0xa6/0x120 [ 361.611138][ T8344] should_fail_ex+0x399/0x4d0 [ 361.615853][ T8344] copyin+0x1b/0x120 [ 361.619859][ T8344] _copy_from_iter+0x447/0x1130 [ 361.624776][ T8344] ? copyout_mc+0x110/0x110 [ 361.629333][ T8344] ? __virt_addr_valid+0x188/0x540 [ 361.634485][ T8344] ? __virt_addr_valid+0x188/0x540 [ 361.639714][ T8344] ? __virt_addr_valid+0x465/0x540 [ 361.644949][ T8344] ? __check_object_size+0x500/0xa40 [ 361.650266][ T8344] netlink_sendmsg+0x755/0xbd0 [ 361.655077][ T8344] ? netlink_getsockopt+0x550/0x550 [ 361.660504][ T8344] ? aa_sock_msg_perm+0x94/0x150 [ 361.665471][ T8344] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 361.670871][ T8344] ? security_socket_sendmsg+0x7c/0xa0 [ 361.676369][ T8344] ? netlink_getsockopt+0x550/0x550 [ 361.681609][ T8344] ____sys_sendmsg+0x5be/0x970 [ 361.686441][ T8344] ? __sys_sendmsg_sock+0x30/0x30 [ 361.691562][ T8344] ? __import_iovec+0x315/0x500 [ 361.696565][ T8344] ? import_iovec+0x6f/0xa0 [ 361.701194][ T8344] ___sys_sendmsg+0x2a2/0x360 [ 361.705947][ T8344] ? __sys_sendmsg+0x290/0x290 [ 361.710941][ T8344] ? __lock_acquire+0x7d10/0x7d10 [ 361.716127][ T8344] __se_sys_sendmsg+0x1bb/0x2a0 [ 361.721119][ T8344] ? __x64_sys_sendmsg+0x80/0x80 [ 361.726306][ T8344] ? lockdep_hardirqs_on+0x94/0x140 [ 361.731539][ T8344] do_syscall_64+0x4c/0xa0 [ 361.735993][ T8344] ? clear_bhb_loop+0x60/0xb0 [ 361.740722][ T8344] ? clear_bhb_loop+0x60/0xb0 [ 361.745456][ T8344] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 361.751385][ T8344] RIP: 0033:0x7fc4dd19c819 [ 361.755844][ T8344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 361.775481][ T8344] RSP: 002b:00007fc4de14d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 361.784018][ T8344] RAX: ffffffffffffffda RBX: 00007fc4dd415fa0 RCX: 00007fc4dd19c819 [ 361.792012][ T8344] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 361.800094][ T8344] RBP: 00007fc4de14d090 R08: 0000000000000000 R09: 0000000000000000 [ 361.808177][ T8344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 361.817150][ T8344] R13: 00007fc4dd416038 R14: 00007fc4dd415fa0 R15: 00007ffd23acd068 [ 361.825174][ T8344] [ 361.955557][ T8353] FAULT_INJECTION: forcing a failure. [ 361.955557][ T8353] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 361.991769][ T8353] CPU: 1 PID: 8353 Comm: syz.1.1159 Not tainted syzkaller #0 [ 361.999616][ T8353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 362.009828][ T8353] Call Trace: [ 362.013164][ T8353] [ 362.016136][ T8353] dump_stack_lvl+0x188/0x24e [ 362.020971][ T8353] ? show_regs_print_info+0x12/0x12 [ 362.026320][ T8353] ? load_image+0x400/0x400 [ 362.030900][ T8353] ? __lock_acquire+0x7d10/0x7d10 [ 362.035978][ T8353] should_fail_ex+0x399/0x4d0 [ 362.040799][ T8353] _copy_from_user+0x2c/0x170 [ 362.045543][ T8353] ___sys_sendmsg+0x1c3/0x360 [ 362.050388][ T8353] ? __sys_sendmsg+0x290/0x290 [ 362.055334][ T8353] ? __lock_acquire+0x7d10/0x7d10 [ 362.060442][ T8353] __se_sys_sendmsg+0x1bb/0x2a0 [ 362.065458][ T8353] ? __x64_sys_sendmsg+0x80/0x80 [ 362.070549][ T8353] ? lockdep_hardirqs_on+0x94/0x140 [ 362.075948][ T8353] do_syscall_64+0x4c/0xa0 [ 362.080495][ T8353] ? clear_bhb_loop+0x60/0xb0 [ 362.085299][ T8353] ? clear_bhb_loop+0x60/0xb0 [ 362.090048][ T8353] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 362.096064][ T8353] RIP: 0033:0x7f430359c819 [ 362.100535][ T8353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 362.121068][ T8353] RSP: 002b:00007f4304460028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 362.129517][ T8353] RAX: ffffffffffffffda RBX: 00007f4303815fa0 RCX: 00007f430359c819 [ 362.137631][ T8353] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 362.145952][ T8353] RBP: 00007f4304460090 R08: 0000000000000000 R09: 0000000000000000 [ 362.154057][ T8353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 362.162154][ T8353] R13: 00007f4303816038 R14: 00007f4303815fa0 R15: 00007ffcfadf4e78 [ 362.170319][ T8353] [ 362.917499][ T9] wlan1: Trigger new scan to find an IBSS to join [ 363.554614][ T8387] FAULT_INJECTION: forcing a failure. [ 363.554614][ T8387] name failslab, interval 1, probability 0, space 0, times 0 [ 363.691754][ T8387] CPU: 0 PID: 8387 Comm: syz.3.1171 Not tainted syzkaller #0 [ 363.699361][ T8387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 363.709563][ T8387] Call Trace: [ 363.712901][ T8387] [ 363.716070][ T8387] dump_stack_lvl+0x188/0x24e [ 363.720826][ T8387] ? show_regs_print_info+0x12/0x12 [ 363.726109][ T8387] ? load_image+0x400/0x400 [ 363.730717][ T8387] ? __might_sleep+0xd0/0xd0 [ 363.735371][ T8387] ? __lock_acquire+0x7d10/0x7d10 [ 363.740484][ T8387] should_fail_ex+0x399/0x4d0 [ 363.745240][ T8387] should_failslab+0x5/0x20 [ 363.749791][ T8387] slab_pre_alloc_hook+0x59/0x310 [ 363.754873][ T8387] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 363.760803][ T8387] ? rtnl_newlink+0x10c/0x20a0 [ 363.765752][ T8387] __kmem_cache_alloc_node+0x4f/0x260 [ 363.771210][ T8387] ? rtnl_newlink+0x10c/0x20a0 [ 363.776050][ T8387] kmalloc_trace+0x26/0xe0 [ 363.780652][ T8387] ? rtnl_setlink+0x510/0x510 [ 363.785393][ T8387] rtnl_newlink+0x10c/0x20a0 [ 363.790054][ T8387] ? __schedule+0x11d9/0x40e0 [ 363.794810][ T8387] ? __mutex_lock+0x806/0xaf0 [ 363.799630][ T8387] ? __lock_acquire+0x7d10/0x7d10 [ 363.804826][ T8387] ? do_raw_spin_lock+0x128/0x2f0 [ 363.810081][ T8387] ? rtnl_setlink+0x510/0x510 [ 363.814802][ T8387] ? __rwlock_init+0x140/0x140 [ 363.819975][ T8387] ? do_raw_spin_unlock+0x11d/0x230 [ 363.825653][ T8387] ? __mutex_lock+0x810/0xaf0 [ 363.830378][ T8387] ? __mutex_lock+0x3b2/0xaf0 [ 363.835119][ T8387] ? rtnetlink_rcv_msg+0x824/0xfc0 [ 363.840488][ T8387] ? mutex_lock_nested+0x10/0x10 [ 363.845510][ T8387] ? rtnetlink_rcv_msg+0x226/0xfc0 [ 363.850777][ T8387] ? rtnetlink_rcv_msg+0x226/0xfc0 [ 363.856147][ T8387] ? rtnl_setlink+0x510/0x510 [ 363.861064][ T8387] rtnetlink_rcv_msg+0x87c/0xfc0 [ 363.866332][ T8387] ? rtnetlink_bind+0x80/0x80 [ 363.871228][ T8387] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 363.877041][ T8387] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 363.882824][ T8387] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 363.888774][ T8387] ? perf_trace_lock+0x301/0x390 [ 363.893827][ T8387] ? trace_event_raw_event_lock+0x250/0x250 [ 363.900153][ T8387] netlink_rcv_skb+0x1fb/0x450 [ 363.904960][ T8387] ? rtnetlink_bind+0x80/0x80 [ 363.909875][ T8387] ? netlink_ack+0x1170/0x1170 [ 363.914879][ T8387] ? netlink_deliver_tap+0x2e/0x1b0 [ 363.920132][ T8387] netlink_unicast+0x74d/0x8d0 [ 363.925139][ T8387] netlink_sendmsg+0x8ad/0xbd0 [ 363.929967][ T8387] ? netlink_getsockopt+0x550/0x550 [ 363.935214][ T8387] ? aa_sock_msg_perm+0x94/0x150 [ 363.940196][ T8387] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 363.945596][ T8387] ? security_socket_sendmsg+0x7c/0xa0 [ 363.951261][ T8387] ? netlink_getsockopt+0x550/0x550 [ 363.956644][ T8387] ____sys_sendmsg+0x5be/0x970 [ 363.961774][ T8387] ? __sys_sendmsg_sock+0x30/0x30 [ 363.967216][ T8387] ? __import_iovec+0x315/0x500 [ 363.972155][ T8387] ? import_iovec+0x6f/0xa0 [ 363.976715][ T8387] ___sys_sendmsg+0x2a2/0x360 [ 363.981454][ T8387] ? __sys_sendmsg+0x290/0x290 [ 363.986329][ T8387] ? __lock_acquire+0x7d10/0x7d10 [ 363.991498][ T8387] __se_sys_sendmsg+0x1bb/0x2a0 [ 363.996402][ T8387] ? ct_nmi_exit+0x145/0x1c0 [ 364.001126][ T8387] ? __x64_sys_sendmsg+0x80/0x80 [ 364.006147][ T8387] ? lockdep_hardirqs_on+0x94/0x140 [ 364.011508][ T8387] do_syscall_64+0x4c/0xa0 [ 364.016049][ T8387] ? clear_bhb_loop+0x60/0xb0 [ 364.020772][ T8387] ? clear_bhb_loop+0x60/0xb0 [ 364.025505][ T8387] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 364.031538][ T8387] RIP: 0033:0x7fbc49d9c819 [ 364.035985][ T8387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.055885][ T8387] RSP: 002b:00007fbc4acec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 364.064515][ T8387] RAX: ffffffffffffffda RBX: 00007fbc4a015fa0 RCX: 00007fbc49d9c819 [ 364.072605][ T8387] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000003 [ 364.080925][ T8387] RBP: 00007fbc4acec090 R08: 0000000000000000 R09: 0000000000000000 [ 364.089037][ T8387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 364.097133][ T8387] R13: 00007fbc4a016038 R14: 00007fbc4a015fa0 R15: 00007fff75d6c028 [ 364.105376][ T8387] [ 364.179741][ T8391] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 364.341170][ T8400] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.348568][ T8400] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.450929][ T8394] can: request_module (can-proto-0) failed. [ 364.552458][ T8401] device bridge_slave_1 left promiscuous mode [ 364.602060][ T8401] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.653293][ T8401] device bridge_slave_0 left promiscuous mode [ 364.683278][ T8401] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.738937][ T8409] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1173'. [ 364.895534][ T8384] device syzkaller0 entered promiscuous mode [ 364.918714][ T8409] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1173'. [ 365.360498][ T8420] FAULT_INJECTION: forcing a failure. [ 365.360498][ T8420] name failslab, interval 1, probability 0, space 0, times 0 [ 365.386729][ T8420] CPU: 0 PID: 8420 Comm: syz.0.1177 Not tainted syzkaller #0 [ 365.394182][ T8420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 365.404291][ T8420] Call Trace: [ 365.407616][ T8420] [ 365.410796][ T8420] dump_stack_lvl+0x188/0x24e [ 365.415531][ T8420] ? show_regs_print_info+0x12/0x12 [ 365.420814][ T8420] ? load_image+0x400/0x400 [ 365.425362][ T8420] ? __might_sleep+0xd0/0xd0 [ 365.429993][ T8420] ? __lock_acquire+0x7d10/0x7d10 [ 365.435159][ T8420] should_fail_ex+0x399/0x4d0 [ 365.439901][ T8420] should_failslab+0x5/0x20 [ 365.444444][ T8420] slab_pre_alloc_hook+0x59/0x310 [ 365.449539][ T8420] ? tipc_node_find+0xb0/0x480 [ 365.454355][ T8420] kmem_cache_alloc_node+0x5a/0x320 [ 365.459695][ T8420] ? __lock_acquire+0x7d10/0x7d10 [ 365.464940][ T8420] ? __alloc_skb+0xfc/0x7e0 [ 365.469556][ T8420] __alloc_skb+0xfc/0x7e0 [ 365.473935][ T8420] tipc_msg_build+0xc9/0xde0 [ 365.478575][ T8420] ? tipc_node_get_mtu+0x2a0/0x2a0 [ 365.483749][ T8420] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 365.489966][ T8420] __tipc_sendmsg+0x1933/0x2c90 [ 365.494878][ T8420] ? perf_trace_run_bpf_submit+0x1c0/0x1c0 [ 365.500737][ T8420] ? rht_lock+0x150/0x150 [ 365.505118][ T8420] ? perf_swevent_event+0x1c6/0x570 [ 365.510455][ T8420] ? perf_trace_buf_update+0xa8/0x230 [ 365.515874][ T8420] ? perf_tp_event+0xc30/0xc30 [ 365.520691][ T8420] ? perf_trace_buf_alloc+0x300/0x300 [ 365.526117][ T8420] ? perf_tp_event+0xaac/0xc30 [ 365.530937][ T8420] ? perf_trace_run_bpf_submit+0x1c0/0x1c0 [ 365.536801][ T8420] ? mark_lock+0x94/0x320 [ 365.541212][ T8420] ? mark_lock+0x94/0x320 [ 365.545588][ T8420] ? wait_woken+0x1c0/0x1c0 [ 365.550230][ T8420] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 365.556349][ T8420] ? lock_chain_count+0x20/0x20 [ 365.561393][ T8420] __tipc_sendstream+0x10bb/0x12f0 [ 365.566569][ T8420] ? mark_lock+0x94/0x320 [ 365.570952][ T8420] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 365.577074][ T8420] ? lock_chain_count+0x20/0x20 [ 365.582160][ T8420] ? tsk_advance_rx_queue+0x390/0x390 [ 365.587665][ T8420] ? __local_bh_enable_ip+0x136/0x1c0 [ 365.593089][ T8420] ? _local_bh_enable+0xa0/0xa0 [ 365.598088][ T8420] tipc_send_packet+0x78/0x90 [ 365.602804][ T8420] ? tipc_sk_send_ack+0x580/0x580 [ 365.607873][ T8420] ____sys_sendmsg+0x5be/0x970 [ 365.612781][ T8420] ? __sys_sendmsg_sock+0x30/0x30 [ 365.617849][ T8420] ? __import_iovec+0x315/0x500 [ 365.622743][ T8420] ? import_iovec+0x6f/0xa0 [ 365.627321][ T8420] ___sys_sendmsg+0x2a2/0x360 [ 365.632053][ T8420] ? __sys_sendmsg+0x290/0x290 [ 365.636884][ T8420] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 365.642763][ T8420] __se_sys_sendmsg+0x1bb/0x2a0 [ 365.647840][ T8420] ? __x64_sys_sendmsg+0x80/0x80 [ 365.652930][ T8420] ? syscall_enter_from_user_mode+0x2a/0x80 [ 365.658892][ T8420] do_syscall_64+0x4c/0xa0 [ 365.663367][ T8420] ? clear_bhb_loop+0x60/0xb0 [ 365.668094][ T8420] ? clear_bhb_loop+0x60/0xb0 [ 365.672908][ T8420] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 365.678863][ T8420] RIP: 0033:0x7fc4dd19c819 [ 365.683314][ T8420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.703221][ T8420] RSP: 002b:00007fc4de14d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 365.711694][ T8420] RAX: ffffffffffffffda RBX: 00007fc4dd415fa0 RCX: 00007fc4dd19c819 [ 365.719838][ T8420] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000006 [ 365.727861][ T8420] RBP: 00007fc4de14d090 R08: 0000000000000000 R09: 0000000000000000 [ 365.735895][ T8420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 365.744181][ T8420] R13: 00007fc4dd416038 R14: 00007fc4dd415fa0 R15: 00007ffd23acd068 [ 365.752231][ T8420] [ 365.940120][ T4333] tipc: Subscription rejected, illegal request [ 366.919301][ T4333] wlan1: Trigger new scan to find an IBSS to join [ 367.771914][ T8408] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1173'. [ 367.789324][ T8411] netlink: 17263 bytes leftover after parsing attributes in process `syz.4.1173'. [ 368.840268][ T8477] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.847698][ T8477] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.084276][ T8467] can: request_module (can-proto-0) failed. [ 369.107638][ T8477] device bridge_slave_1 left promiscuous mode [ 369.114280][ T8477] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.324087][ T8477] device bridge_slave_0 left promiscuous mode [ 369.361078][ T8477] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.965906][ T4333] wlan1: Trigger new scan to find an IBSS to join [ 370.128731][ T8465] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 370.161042][ T8491] netlink: 'syz.4.1194': attribute type 10 has an invalid length. [ 370.845002][ T8505] netlink: 'syz.2.1198': attribute type 29 has an invalid length. [ 371.027497][ T8505] netlink: 'syz.2.1198': attribute type 29 has an invalid length. [ 371.105467][ T8519] FAULT_INJECTION: forcing a failure. [ 371.105467][ T8519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 371.222650][ T8519] CPU: 0 PID: 8519 Comm: syz.1.1200 Not tainted syzkaller #0 [ 371.230241][ T8519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 371.240422][ T8519] Call Trace: [ 371.243820][ T8519] [ 371.246870][ T8519] dump_stack_lvl+0x188/0x24e [ 371.251580][ T8519] ? show_regs_print_info+0x12/0x12 [ 371.256812][ T8519] ? load_image+0x400/0x400 [ 371.261339][ T8519] ? __lock_acquire+0x7d10/0x7d10 [ 371.266393][ T8519] ? snprintf+0xe5/0x140 [ 371.270653][ T8519] should_fail_ex+0x399/0x4d0 [ 371.275348][ T8519] _copy_to_user+0x2c/0x130 [ 371.279872][ T8519] simple_read_from_buffer+0xe3/0x150 [ 371.285270][ T8519] proc_fail_nth_read+0x1a6/0x220 [ 371.290396][ T8519] ? proc_fault_inject_write+0x310/0x310 [ 371.296056][ T8519] ? fsnotify_perm+0x248/0x550 [ 371.300926][ T8519] ? proc_fault_inject_write+0x310/0x310 [ 371.306592][ T8519] vfs_read+0x2de/0xa00 [ 371.310777][ T8519] ? kernel_read+0x1e0/0x1e0 [ 371.315405][ T8519] ? __fget_files+0x28/0x4b0 [ 371.320011][ T8519] ? __fget_files+0x28/0x4b0 [ 371.324833][ T8519] ? __fget_files+0x43d/0x4b0 [ 371.329533][ T8519] ? __fdget_pos+0x2ae/0x360 [ 371.334228][ T8519] ? ksys_read+0x71/0x250 [ 371.338674][ T8519] ksys_read+0x14c/0x250 [ 371.342939][ T8519] ? vfs_write+0xa30/0xa30 [ 371.347384][ T8519] ? lockdep_hardirqs_on+0x94/0x140 [ 371.352623][ T8519] do_syscall_64+0x4c/0xa0 [ 371.357058][ T8519] ? clear_bhb_loop+0x60/0xb0 [ 371.361751][ T8519] ? clear_bhb_loop+0x60/0xb0 [ 371.366446][ T8519] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 371.372369][ T8519] RIP: 0033:0x7f430355d04e [ 371.376805][ T8519] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 371.396636][ T8519] RSP: 002b:00007f430443efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 371.405159][ T8519] RAX: ffffffffffffffda RBX: 00007f430443f6c0 RCX: 00007f430355d04e [ 371.413156][ T8519] RDX: 000000000000000f RSI: 00007f430443f0a0 RDI: 0000000000000006 [ 371.421156][ T8519] RBP: 00007f430443f090 R08: 0000000000000000 R09: 0000000000000000 [ 371.429212][ T8519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 371.437398][ T8519] R13: 00007f4303816128 R14: 00007f4303816090 R15: 00007ffcfadf4e78 [ 371.445410][ T8519] [ 372.507212][ T8552] netlink: 'syz.2.1213': attribute type 10 has an invalid length. [ 372.512862][ T8558] netlink: 'syz.4.1215': attribute type 29 has an invalid length. [ 372.578149][ T8552] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1213'. [ 372.655754][ T8558] netlink: 'syz.4.1215': attribute type 29 has an invalid length. [ 373.003715][ T46] wlan1: Creating new IBSS network, BSSID 86:d5:ed:97:35:cc [ 373.960851][ T41] wlan1: Trigger new scan to find an IBSS to join [ 373.999853][ T4672] device 0 left promiscuous mode [ 374.386332][ T4672] tipc: Left network mode [ 374.562005][ T65] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 375.377610][ T8606] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.1228'. [ 377.073234][ T41] wlan1: Trigger new scan to find an IBSS to join [ 377.536620][ T8635] netlink: 'syz.4.1237': attribute type 10 has an invalid length. [ 377.594980][ T8635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 377.616632][ T8635] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 377.870937][ T8649] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1242'. [ 378.104396][ T8651] netlink: 'syz.0.1243': attribute type 29 has an invalid length. [ 378.183918][ T46] wlan1: Creating new IBSS network, BSSID f6:be:ed:53:fe:0d [ 378.317895][ T8655] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.1245'. [ 378.358073][ T8651] netlink: 'syz.0.1243': attribute type 29 has an invalid length. [ 378.392615][ T8658] netlink: 'syz.4.1245': attribute type 5 has an invalid length. [ 378.408609][ T8658] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1245'. [ 378.984549][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.991297][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.805767][ T4672] device hsr_slave_0 left promiscuous mode [ 380.828839][ T4672] device hsr_slave_1 left promiscuous mode [ 380.934228][ T4672] device veth1_macvtap left promiscuous mode [ 380.949161][ T4672] device veth0_macvtap left promiscuous mode [ 381.001015][ T4672] device veth1_vlan left promiscuous mode [ 381.027783][ T4672] device veth0_vlan left promiscuous mode [ 381.709220][ T8710] netlink: 'syz.2.1261': attribute type 29 has an invalid length. [ 384.074671][ T4672] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 384.119878][ T4672] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 384.391676][ T4672] bond0 (unregistering): Released all slaves [ 384.431695][ T8710] netlink: 'syz.2.1261': attribute type 29 has an invalid length. [ 384.540106][ T8728] device syzkaller0 entered promiscuous mode [ 384.683153][ T8747] tap0: tun_chr_ioctl cmd 1074025694 [ 385.392224][ T8765] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1276'. [ 387.563588][ T8755] netlink: 'syz.2.1275': attribute type 39 has an invalid length. [ 387.651871][ T8765] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1276'. [ 387.662011][ T8764] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1277'. [ 387.680997][ T8773] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 387.693416][ T8773] syzkaller1: group set to 778 [ 387.764888][ T8776] netlink: 122896 bytes leftover after parsing attributes in process `syz.1.1280'. [ 387.935760][ T8779] netlink: 'syz.3.1282': attribute type 29 has an invalid length. [ 387.966203][ T8779] netlink: 'syz.3.1282': attribute type 29 has an invalid length. [ 388.078963][ T8783] netlink: 9275 bytes leftover after parsing attributes in process `syz.0.1281'. [ 388.623297][ T8785] netlink: 'syz.0.1281': attribute type 11 has an invalid length. [ 388.643308][ T8790] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 389.540918][ T8814] FAULT_INJECTION: forcing a failure. [ 389.540918][ T8814] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.595088][ T8806] device syzkaller0 entered promiscuous mode [ 389.684104][ T8814] CPU: 0 PID: 8814 Comm: syz.2.1293 Not tainted syzkaller #0 [ 389.691575][ T8814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 389.701764][ T8814] Call Trace: [ 389.705065][ T8814] [ 389.708101][ T8814] dump_stack_lvl+0x188/0x24e [ 389.712823][ T8814] ? show_regs_print_info+0x12/0x12 [ 389.718046][ T8814] ? load_image+0x400/0x400 [ 389.722579][ T8814] ? __lock_acquire+0x7d10/0x7d10 [ 389.727651][ T8814] ? snprintf+0xe5/0x140 [ 389.732087][ T8814] should_fail_ex+0x399/0x4d0 [ 389.736784][ T8814] _copy_to_user+0x2c/0x130 [ 389.741332][ T8814] simple_read_from_buffer+0xe3/0x150 [ 389.746746][ T8814] proc_fail_nth_read+0x1a6/0x220 [ 389.751984][ T8814] ? proc_fault_inject_write+0x310/0x310 [ 389.757646][ T8814] ? fsnotify_perm+0x248/0x550 [ 389.762463][ T8814] ? proc_fault_inject_write+0x310/0x310 [ 389.768145][ T8814] vfs_read+0x2de/0xa00 [ 389.772374][ T8814] ? kernel_read+0x1e0/0x1e0 [ 389.777161][ T8814] ? __fget_files+0x28/0x4b0 [ 389.781774][ T8814] ? __fget_files+0x28/0x4b0 [ 389.786384][ T8814] ? __fget_files+0x43d/0x4b0 [ 389.791088][ T8814] ? __fdget_pos+0x2ae/0x360 [ 389.795698][ T8814] ? ksys_read+0x71/0x250 [ 389.800153][ T8814] ksys_read+0x14c/0x250 [ 389.804592][ T8814] ? vfs_write+0xa30/0xa30 [ 389.809152][ T8814] ? lockdep_hardirqs_on+0x94/0x140 [ 389.814461][ T8814] do_syscall_64+0x4c/0xa0 [ 389.818981][ T8814] ? clear_bhb_loop+0x60/0xb0 [ 389.823764][ T8814] ? clear_bhb_loop+0x60/0xb0 [ 389.828654][ T8814] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 389.834825][ T8814] RIP: 0033:0x7f2a1fb5d04e [ 389.839254][ T8814] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 389.858882][ T8814] RSP: 002b:00007f2a20a8efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 389.867404][ T8814] RAX: ffffffffffffffda RBX: 00007f2a20a8f6c0 RCX: 00007f2a1fb5d04e [ 389.875386][ T8814] RDX: 000000000000000f RSI: 00007f2a20a8f0a0 RDI: 0000000000000006 [ 389.883391][ T8814] RBP: 00007f2a20a8f090 R08: 0000000000000000 R09: 0000000000000000 [ 389.891378][ T8814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 389.899447][ T8814] R13: 00007f2a1fe16038 R14: 00007f2a1fe15fa0 R15: 00007ffe5f596af8 [ 389.907462][ T8814] [ 390.098645][ T8807] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1292'. [ 391.010912][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 391.374410][ T8828] FAULT_INJECTION: forcing a failure. [ 391.374410][ T8828] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 391.430764][ T8828] CPU: 0 PID: 8828 Comm: syz.1.1296 Not tainted syzkaller #0 [ 391.438268][ T8828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 391.448387][ T8828] Call Trace: [ 391.451712][ T8828] [ 391.454695][ T8828] dump_stack_lvl+0x188/0x24e [ 391.459436][ T8828] ? show_regs_print_info+0x12/0x12 [ 391.464789][ T8828] ? load_image+0x400/0x400 [ 391.469412][ T8828] ? __lock_acquire+0x7d10/0x7d10 [ 391.474605][ T8828] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 391.480412][ T8828] should_fail_ex+0x399/0x4d0 [ 391.485185][ T8828] _copy_from_user+0x2c/0x170 [ 391.490024][ T8828] ___sys_sendmsg+0x1c3/0x360 [ 391.494779][ T8828] ? __sys_sendmsg+0x290/0x290 [ 391.498905][ T8832] netlink: 'syz.2.1297': attribute type 29 has an invalid length. [ 391.499691][ T8828] ? __lock_acquire+0x7d10/0x7d10 [ 391.499786][ T8828] __se_sys_sendmsg+0x1bb/0x2a0 [ 391.499816][ T8828] ? ct_nmi_exit+0x145/0x1c0 [ 391.499848][ T8828] ? __x64_sys_sendmsg+0x80/0x80 [ 391.499917][ T8828] ? lockdep_hardirqs_on+0x94/0x140 [ 391.499951][ T8828] do_syscall_64+0x4c/0xa0 [ 391.499978][ T8828] ? clear_bhb_loop+0x60/0xb0 [ 391.542158][ T8828] ? clear_bhb_loop+0x60/0xb0 [ 391.546924][ T8828] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 391.553077][ T8828] RIP: 0033:0x7f430359c819 [ 391.557736][ T8828] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 391.577773][ T8828] RSP: 002b:00007f4304460028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 391.586284][ T8828] RAX: ffffffffffffffda RBX: 00007f4303815fa0 RCX: 00007f430359c819 [ 391.594376][ T8828] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 391.602396][ T8828] RBP: 00007f4304460090 R08: 0000000000000000 R09: 0000000000000000 [ 391.610391][ T8828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 391.618387][ T8828] R13: 00007f4303816038 R14: 00007f4303815fa0 R15: 00007ffcfadf4e78 [ 391.626492][ T8828] [ 393.942872][ T8824] netlink: 'syz.0.1295': attribute type 2 has an invalid length. [ 393.950902][ T8825] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 393.966852][ T8832] netlink: 'syz.2.1297': attribute type 29 has an invalid length. [ 394.485340][ T8844] device syzkaller0 entered promiscuous mode [ 394.538745][ T4282] Bluetooth: hci4: unexpected event 0x0b length: 15 > 11 [ 395.967605][ T11] wlan1: Trigger new scan to find an IBSS to join [ 396.941485][ T4672] wlan1: Creating new IBSS network, BSSID 6a:dd:e5:c3:60:67 [ 397.831023][ T8853] device lo entered promiscuous mode [ 397.839971][ T8853] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 397.862206][ T8858] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 397.873113][ T8865] netlink: 'syz.3.1307': attribute type 2 has an invalid length. [ 398.343901][ T8881] device syzkaller0 entered promiscuous mode [ 398.490336][ T8874] can: request_module (can-proto-5) failed. [ 398.643285][ T8893] netlink: 212168 bytes leftover after parsing attributes in process `syz.3.1317'. [ 399.958341][ T9] wlan1: Trigger new scan to find an IBSS to join [ 402.255343][ T8908] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1321'. [ 402.264764][ T8911] netlink: 'syz.1.1322': attribute type 11 has an invalid length. [ 402.279544][ T8914] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 402.866442][ T8931] netlink: 'syz.1.1325': attribute type 2 has an invalid length. [ 403.004283][ T9] wlan1: Trigger new scan to find an IBSS to join [ 403.284246][ T8930] can: request_module (can-proto-5) failed. [ 403.820130][ T8944] netlink: 212168 bytes leftover after parsing attributes in process `syz.4.1332'. [ 404.012835][ T8951] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1335'. [ 404.124234][ T8953] netlink: 'syz.0.1337': attribute type 11 has an invalid length. [ 404.516124][ T8964] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 404.575108][ T8963] netlink: 63503 bytes leftover after parsing attributes in process `syz.2.1340'. [ 404.914294][ T8971] netlink: 'syz.0.1342': attribute type 29 has an invalid length. [ 404.950838][ T8957] device syzkaller0 entered promiscuous mode [ 404.997503][ T65] wlan1: Trigger new scan to find an IBSS to join [ 405.121890][ T8976] can: request_module (can-proto-5) failed. [ 405.132464][ T8971] netlink: 'syz.0.1342': attribute type 29 has an invalid length. [ 405.689652][ T4333] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 405.968638][ T4672] wlan1: Creating new IBSS network, BSSID fe:a0:ec:9f:26:43 [ 407.643476][ T8997] netlink: 'syz.3.1352': attribute type 10 has an invalid length. [ 407.652939][ T8996] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1351'. [ 407.968285][ T41] wlan1: Trigger new scan to find an IBSS to join [ 408.906831][ T9020] can: request_module (can-proto-5) failed. [ 409.612218][ T9005] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 409.829148][ T9045] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1365'. [ 409.900687][ T9042] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.1375'. [ 409.965799][ T9042] bridge_slave_1: default FDB implementation only supports local addresses [ 410.345331][ T9055] netlink: 'syz.3.1369': attribute type 3 has an invalid length. [ 410.370376][ T9055] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1369'. [ 410.802053][ T9065] netlink: 'syz.0.1373': attribute type 10 has an invalid length. [ 410.917956][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 410.918616][ T9065] bond0: (slave bond_slave_0): Releasing backup interface [ 411.080503][ T9072] netlink: 'syz.2.1386': attribute type 29 has an invalid length. [ 411.283257][ T9072] netlink: 'syz.2.1386': attribute type 29 has an invalid length. [ 411.499763][ T4274] Bluetooth: hci4: command 0x0406 tx timeout [ 411.873392][ T9094] netlink: 'syz.0.1384': attribute type 1 has an invalid length. [ 411.886655][ T65] wlan1: Creating new IBSS network, BSSID 06:0d:27:f3:6d:56 [ 411.954356][ T9094] netlink: 83992 bytes leftover after parsing attributes in process `syz.0.1384'. [ 412.184824][ T9099] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.1383'. [ 412.647792][ T9099] bridge_slave_1: default FDB implementation only supports local addresses [ 413.175770][ T9107] FAULT_INJECTION: forcing a failure. [ 413.175770][ T9107] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 413.353807][ T9107] CPU: 1 PID: 9107 Comm: syz.3.1387 Not tainted syzkaller #0 [ 413.361287][ T9107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 413.371399][ T9107] Call Trace: [ 413.374728][ T9107] [ 413.377694][ T9107] dump_stack_lvl+0x188/0x24e [ 413.382440][ T9107] ? show_regs_print_info+0x12/0x12 [ 413.387698][ T9107] ? load_image+0x400/0x400 [ 413.392265][ T9107] ? __lock_acquire+0x7d10/0x7d10 [ 413.397331][ T9107] ? tomoyo_path_number_perm+0x205/0x650 [ 413.403012][ T9107] ? tomoyo_path_number_perm+0x5a4/0x650 [ 413.408791][ T9107] should_fail_ex+0x399/0x4d0 [ 413.413533][ T9107] _copy_from_user+0x2c/0x170 [ 413.418631][ T9107] wext_handle_ioctl+0xc4/0x1d0 [ 413.423552][ T9107] ? call_commit_handler+0xf0/0xf0 [ 413.428856][ T9107] sock_ioctl+0x143/0x710 [ 413.433241][ T9107] ? sock_poll+0x410/0x410 [ 413.437729][ T9107] ? bpf_lsm_file_ioctl+0x5/0x10 [ 413.442723][ T9107] ? security_file_ioctl+0x7c/0xa0 [ 413.447901][ T9107] ? sock_poll+0x410/0x410 [ 413.452361][ T9107] __se_sys_ioctl+0xfa/0x170 [ 413.457098][ T9107] do_syscall_64+0x4c/0xa0 [ 413.461565][ T9107] ? clear_bhb_loop+0x60/0xb0 [ 413.466288][ T9107] ? clear_bhb_loop+0x60/0xb0 [ 413.471031][ T9107] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 413.476971][ T9107] RIP: 0033:0x7fbc49d9c819 [ 413.481433][ T9107] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 413.501086][ T9107] RSP: 002b:00007fbc4acec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 413.509643][ T9107] RAX: ffffffffffffffda RBX: 00007fbc4a015fa0 RCX: 00007fbc49d9c819 [ 413.517841][ T9107] RDX: 0000200000000000 RSI: 0000000000008b05 RDI: 0000000000000004 [ 413.525941][ T9107] RBP: 00007fbc4acec090 R08: 0000000000000000 R09: 0000000000000000 [ 413.534036][ T9107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 413.542041][ T9107] R13: 00007fbc4a016038 R14: 00007fbc4a015fa0 R15: 00007fff75d6c028 [ 413.550173][ T9107] [ 413.649349][ T4274] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 413.658279][ T4274] Bluetooth: hci1: Injecting HCI hardware error event [ 413.666483][ T4282] Bluetooth: hci1: hardware error 0x00 [ 413.900230][ T9117] netlink: 'syz.3.1392': attribute type 29 has an invalid length. [ 414.013616][ T9087] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 414.052454][ T9117] netlink: 'syz.3.1392': attribute type 29 has an invalid length. [ 415.582672][ T9161] netlink: 14548 bytes leftover after parsing attributes in process `syz.4.1402'. [ 415.717489][ T4282] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 415.736555][ T9168] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 415.995554][ T9167] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 416.606546][ T9184] netlink: 'syz.3.1411': attribute type 29 has an invalid length. [ 416.639515][ T9184] netlink: 'syz.3.1411': attribute type 29 has an invalid length. [ 417.887084][ T9221] netlink: 'syz.4.1423': attribute type 3 has an invalid length. [ 417.900819][ T9221] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.1423'. [ 417.967463][ T41] wlan1: Trigger new scan to find an IBSS to join [ 417.978540][ T65] wlan1: Trigger new scan to find an IBSS to join [ 418.072329][ T9214] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 418.293088][ T9233] sctp: [Deprecated]: syz.0.1426 (pid 9233) Use of struct sctp_assoc_value in delayed_ack socket option. [ 418.293088][ T9233] Use struct sctp_sack_info instead [ 418.382705][ T9232] netlink: 'syz.2.1427': attribute type 29 has an invalid length. [ 418.477987][ T9232] netlink: 'syz.2.1427': attribute type 29 has an invalid length. [ 419.441111][ T9242] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 420.446409][ T9277] netlink: 'syz.2.1442': attribute type 29 has an invalid length. [ 420.570000][ T9277] netlink: 'syz.2.1442': attribute type 29 has an invalid length. [ 420.815405][ T9280] netlink: 'syz.1.1443': attribute type 29 has an invalid length. [ 421.008007][ T11] wlan1: Trigger new scan to find an IBSS to join [ 421.211915][ T9280] netlink: 'syz.1.1443': attribute type 29 has an invalid length. [ 422.029573][ T4282] Bluetooth: hci0: unexpected subevent 0x01 length: 150 > 18 [ 422.071373][ T41] wlan1: Creating new IBSS network, BSSID 72:98:85:76:f1:d8 [ 422.094906][ T9299] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1449'. [ 422.136070][ T9299] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1449'. [ 422.270756][ T9306] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1449'. [ 422.334409][ T9307] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 422.978976][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 423.248697][ T9319] device syzkaller0 entered promiscuous mode [ 423.630121][ T9329] device syzkaller0 entered promiscuous mode [ 424.445689][ T6322] wlan1: Creating new IBSS network, BSSID d6:6f:9c:27:93:36 [ 424.551044][ T9334] netdevsim netdevsim1: Direct firmware load for Ö failed with error -2 [ 424.587410][ T9334] netdevsim netdevsim1: Falling back to sysfs fallback for: Ö [ 425.004008][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 425.557706][ T4282] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 425.566631][ T4282] Bluetooth: hci3: Injecting HCI hardware error event [ 425.583403][ T4271] Bluetooth: hci3: hardware error 0x00 [ 426.300946][ T9375] netlink: 'syz.4.1471': attribute type 29 has an invalid length. [ 427.723724][ T4271] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 429.959891][ T9] wlan1: Trigger new scan to find an IBSS to join [ 430.018827][ T9348] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 430.029348][ T9375] netlink: 'syz.4.1471': attribute type 29 has an invalid length. [ 430.039846][ T9379] netlink: 'syz.4.1471': attribute type 10 has an invalid length. [ 430.052427][ T9379] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 430.087717][ T9379] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 430.106140][ T9379] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 430.146616][ T9379] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 430.169411][ T9394] netlink: 'syz.0.1476': attribute type 9 has an invalid length. [ 430.200147][ T9394] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.1476'. [ 430.942629][ T4672] wlan1: Creating new IBSS network, BSSID 62:9f:20:be:ea:8a [ 431.661515][ T9437] netlink: 'syz.1.1489': attribute type 29 has an invalid length. [ 431.665634][ T9422] device syzkaller0 entered promiscuous mode [ 431.729279][ T9437] netlink: 'syz.1.1489': attribute type 29 has an invalid length. [ 432.028291][ T9438] netlink: 'syz.1.1489': attribute type 10 has an invalid length. [ 432.057000][ T9438] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 432.105276][ T9438] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 432.130603][ T9438] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 432.344933][ T9438] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 432.646841][ T9448] netlink: 'syz.4.1494': attribute type 3 has an invalid length. [ 432.692037][ T9448] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.1494'. [ 433.340413][ T9467] netlink: 'syz.3.1499': attribute type 29 has an invalid length. [ 433.957597][ T46] wlan1: Trigger new scan to find an IBSS to join [ 435.017563][ T9459] netlink: 763 bytes leftover after parsing attributes in process `syz.1.1497'. [ 435.036678][ T9467] netlink: 'syz.3.1499': attribute type 29 has an invalid length. [ 435.046690][ T9468] netlink: 'syz.3.1499': attribute type 10 has an invalid length. [ 435.062130][ T9468] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 435.076808][ T9468] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 435.088021][ T9468] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 435.130953][ T9468] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 435.290899][ T9477] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.1501'. [ 435.330615][ T9479] netlink: 'syz.2.1502': attribute type 21 has an invalid length. [ 435.373418][ T9479] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1502'. [ 435.866299][ T9493] netlink: 'syz.0.1507': attribute type 29 has an invalid length. [ 435.910449][ T9493] netlink: 'syz.0.1507': attribute type 29 has an invalid length. [ 435.988021][ T9503] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 436.288829][ T9503] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 436.557923][ T9503] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 436.599039][ T9503] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 436.611188][ T5072] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 437.007367][ T4672] wlan1: Trigger new scan to find an IBSS to join [ 437.052114][ T9509] device syzkaller0 entered promiscuous mode [ 437.289833][ T9517] validate_nla: 1 callbacks suppressed [ 437.289870][ T9517] netlink: 'syz.0.1514': attribute type 29 has an invalid length. [ 437.348723][ T9517] netlink: 'syz.0.1514': attribute type 29 has an invalid length. [ 437.416336][ T9522] netlink: 'syz.0.1514': attribute type 10 has an invalid length. [ 437.456089][ T9522] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 437.499725][ T9522] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 437.500482][ T9521] netlink: 'syz.1.1515': attribute type 6 has an invalid length. [ 437.528827][ T9522] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 437.542629][ T9522] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 437.549902][ T9521] netlink: 127868 bytes leftover after parsing attributes in process `syz.1.1515'. [ 438.024376][ T6322] wlan1: Creating new IBSS network, BSSID 16:2c:50:28:f1:5a [ 440.119748][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.126138][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.216816][ T9542] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.1531'. [ 440.712641][ T9548] netlink: 763 bytes leftover after parsing attributes in process `syz.3.1524'. [ 441.168413][ T9554] netlink: 'syz.1.1525': attribute type 10 has an invalid length. [ 441.183031][ T9554] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 441.198072][ T9554] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 441.246206][ T9554] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 441.264833][ T9554] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 441.361903][ T9563] netlink: 16046 bytes leftover after parsing attributes in process `syz.2.1528'. [ 441.828848][ T9576] device syzkaller0 entered promiscuous mode [ 442.463945][ T9582] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.1537'. [ 443.519545][ T9603] netlink: 'syz.4.1544': attribute type 29 has an invalid length. [ 447.487687][ T9607] netlink: 'syz.4.1544': attribute type 10 has an invalid length. [ 447.495843][ T9607] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 447.511703][ T9607] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 447.537847][ T9607] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 447.564712][ T9607] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 447.588060][ T9603] netlink: 'syz.4.1544': attribute type 29 has an invalid length. [ 447.893588][ T9629] tipc: Started in network mode [ 447.918716][ T9629] tipc: Node identity 9215a268, cluster identity 4711 [ 447.957984][ T9629] tipc: Node number set to 2450891368 [ 448.404813][ T9646] netlink: 'syz.2.1558': attribute type 29 has an invalid length. [ 448.468770][ T9650] netlink: 'syz.2.1558': attribute type 10 has an invalid length. [ 448.504272][ T9646] netlink: 'syz.2.1558': attribute type 29 has an invalid length. [ 448.939686][ T9655] device syzkaller0 entered promiscuous mode [ 452.081570][ T6322] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 453.851602][ T9697] netlink: 'syz.0.1574': attribute type 29 has an invalid length. [ 453.885556][ T9697] netlink: 'syz.0.1574': attribute type 29 has an invalid length. [ 453.952516][ T9704] netlink: 'syz.0.1574': attribute type 10 has an invalid length. [ 453.968318][ T9700] netlink: 'syz.3.1577': attribute type 3 has an invalid length. [ 453.976702][ T9700] netlink: 13435 bytes leftover after parsing attributes in process `syz.3.1577'. [ 454.000641][ T9704] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 454.117456][ T9704] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 454.158711][ T9704] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 454.188792][ T9704] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 454.593496][ T9717] netlink: 188 bytes leftover after parsing attributes in process `syz.0.1584'. [ 454.703393][ T9722] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1585'. [ 454.719358][ T9722] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1585'. [ 454.733752][ T9722] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1585'. [ 454.756520][ T9722] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1585'. [ 455.491879][ T9732] FAULT_INJECTION: forcing a failure. [ 455.491879][ T9732] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 455.509471][ T9732] CPU: 1 PID: 9732 Comm: syz.0.1588 Not tainted syzkaller #0 [ 455.516989][ T9732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 455.527084][ T9732] Call Trace: [ 455.530401][ T9732] [ 455.533364][ T9732] dump_stack_lvl+0x188/0x24e [ 455.538094][ T9732] ? show_regs_print_info+0x12/0x12 [ 455.543380][ T9732] ? load_image+0x400/0x400 [ 455.547918][ T9732] ? __lock_acquire+0x7d10/0x7d10 [ 455.553080][ T9732] should_fail_ex+0x399/0x4d0 [ 455.557801][ T9732] _copy_from_user+0x2c/0x170 [ 455.562514][ T9732] ___sys_sendmsg+0x1c3/0x360 [ 455.567324][ T9732] ? __sys_sendmsg+0x290/0x290 [ 455.572188][ T9732] ? __lock_acquire+0x7d10/0x7d10 [ 455.577275][ T9732] __se_sys_sendmsg+0x1bb/0x2a0 [ 455.582168][ T9732] ? __x64_sys_sendmsg+0x80/0x80 [ 455.587171][ T9732] ? lockdep_hardirqs_on+0x94/0x140 [ 455.592409][ T9732] do_syscall_64+0x4c/0xa0 [ 455.596864][ T9732] ? clear_bhb_loop+0x60/0xb0 [ 455.601573][ T9732] ? clear_bhb_loop+0x60/0xb0 [ 455.606386][ T9732] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 455.612498][ T9732] RIP: 0033:0x7fc4dd19c819 [ 455.617034][ T9732] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 455.637129][ T9732] RSP: 002b:00007fc4de12c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 455.645580][ T9732] RAX: ffffffffffffffda RBX: 00007fc4dd416090 RCX: 00007fc4dd19c819 [ 455.653580][ T9732] RDX: 00000000000052cc RSI: 0000200000000040 RDI: 0000000000000004 [ 455.661667][ T9732] RBP: 00007fc4de12c090 R08: 0000000000000000 R09: 0000000000000000 [ 455.669765][ T9732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 455.678027][ T9732] R13: 00007fc4dd416128 R14: 00007fc4dd416090 R15: 00007ffd23acd068 [ 455.686153][ T9732] [ 458.079192][ T9750] FAULT_INJECTION: forcing a failure. [ 458.079192][ T9750] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 458.160654][ T9750] CPU: 0 PID: 9750 Comm: syz.2.1593 Not tainted syzkaller #0 [ 458.168138][ T9750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 458.178405][ T9750] Call Trace: [ 458.181743][ T9750] [ 458.184731][ T9750] dump_stack_lvl+0x188/0x24e [ 458.189594][ T9750] ? show_regs_print_info+0x12/0x12 [ 458.194880][ T9750] ? load_image+0x400/0x400 [ 458.199530][ T9750] ? __lock_acquire+0x7d10/0x7d10 [ 458.204856][ T9750] should_fail_ex+0x399/0x4d0 [ 458.209823][ T9750] prepare_alloc_pages+0x1e2/0x5f0 [ 458.215109][ T9750] __alloc_pages+0x130/0x4f0 [ 458.219729][ T9750] ? zone_statistics+0x170/0x170 [ 458.224687][ T9750] ? _raw_spin_lock_irqsave+0x100/0x100 [ 458.230617][ T9750] ? copy_page_from_iter+0xe4/0x100 [ 458.235859][ T9750] pipe_write+0x623/0x1b20 [ 458.240340][ T9750] ? pipe_read+0x1260/0x1260 [ 458.244966][ T9750] ? end_current_label_crit_section+0x14b/0x170 [ 458.251224][ T9750] ? common_file_perm+0x171/0x1c0 [ 458.256396][ T9750] vfs_write+0x4b1/0xa30 [ 458.260842][ T9750] ? file_end_write+0x250/0x250 [ 458.265737][ T9750] ? __fget_files+0x43d/0x4b0 [ 458.270438][ T9750] ? __fdget_pos+0x1d4/0x360 [ 458.275101][ T9750] ? ksys_write+0x71/0x250 [ 458.279629][ T9750] ksys_write+0x14c/0x250 [ 458.283981][ T9750] ? __ia32_sys_read+0x80/0x80 [ 458.288876][ T9750] ? lockdep_hardirqs_on+0x94/0x140 [ 458.294163][ T9750] do_syscall_64+0x4c/0xa0 [ 458.298613][ T9750] ? clear_bhb_loop+0x60/0xb0 [ 458.303394][ T9750] ? clear_bhb_loop+0x60/0xb0 [ 458.308093][ T9750] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 458.314002][ T9750] RIP: 0033:0x7f2a1fb9c819 [ 458.318433][ T9750] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 458.338143][ T9750] RSP: 002b:00007f2a20a8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 458.346570][ T9750] RAX: ffffffffffffffda RBX: 00007f2a1fe15fa0 RCX: 00007f2a1fb9c819 [ 458.354645][ T9750] RDX: 00000000fffffdef RSI: 00002000000001c0 RDI: 0000000000000000 [ 458.362889][ T9750] RBP: 00007f2a20a8f090 R08: 0000000000000000 R09: 0000000000000000 [ 458.371067][ T9750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 458.379069][ T9750] R13: 00007f2a1fe16038 R14: 00007f2a1fe15fa0 R15: 00007ffe5f596af8 [ 458.387069][ T9750] [ 459.345573][ T9768] netlink: 'syz.2.1600': attribute type 1 has an invalid length. [ 459.366862][ T9768] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.1600'. [ 460.985130][ T11] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 462.276667][ T9745] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 462.291531][ T9746] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 462.301863][ T9777] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1601'. [ 462.321536][ T9783] netlink: 'syz.2.1603': attribute type 10 has an invalid length. [ 462.480538][ T9787] netlink: 'syz.4.1605': attribute type 13 has an invalid length. [ 462.490589][ T9785] netlink: 'syz.1.1604': attribute type 11 has an invalid length. [ 462.507849][ T9785] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1604'. [ 462.523315][ T9787] netlink: 164 bytes leftover after parsing attributes in process `syz.4.1605'. [ 462.572289][ T9787] syz_tun: refused to change device tx_queue_len [ 463.436657][ T9804] netlink: 'syz.4.1609': attribute type 10 has an invalid length. [ 464.917607][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 464.926139][ T4333] wlan1: Trigger new scan to find an IBSS to join [ 465.512515][ T9784] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 466.244492][ T9818] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 466.820666][ T9829] netlink: 1047 bytes leftover after parsing attributes in process `syz.4.1617'. [ 467.206870][ T9825] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 467.672037][ T9859] netlink: 164 bytes leftover after parsing attributes in process `syz.2.1626'. [ 467.895091][ T9858] device syzkaller0 entered promiscuous mode [ 467.985604][ T4333] wlan1: Trigger new scan to find an IBSS to join [ 467.988706][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 468.031917][ T9865] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 469.958433][ T46] wlan1: Trigger new scan to find an IBSS to join [ 471.957390][ T41] wlan1: Trigger new scan to find an IBSS to join [ 472.915277][ T6322] wlan1: Creating new IBSS network, BSSID 5a:9d:e8:da:6d:b9 [ 473.009332][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 474.380671][ T9890] netlink: 'syz.1.1637': attribute type 10 has an invalid length. [ 474.457759][ T9890] team0 (unregistering): Port device team_slave_0 removed [ 474.487049][ T9890] team0 (unregistering): Port device team_slave_1 removed [ 474.531476][ T9890] team0 (unregistering): Port device wlan1 removed [ 474.576218][ T9890] team0 (unregistering): Port device netdevsim0 removed [ 474.604278][ T9892] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 474.997766][ T41] wlan1: Trigger new scan to find an IBSS to join [ 475.088648][ T9916] netlink: 'syz.0.1644': attribute type 29 has an invalid length. [ 475.183142][ T9921] netlink: 'syz.0.1644': attribute type 10 has an invalid length. [ 475.218443][ T9921] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 475.277407][ T9921] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 475.329208][ T9921] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 475.402204][ T9921] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 475.511813][ T9916] netlink: 'syz.0.1644': attribute type 29 has an invalid length. [ 475.639988][ T9923] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 475.807658][ T9910] netlink: 'syz.3.1642': attribute type 12 has an invalid length. [ 475.818268][ T9926] netlink: 'syz.3.1642': attribute type 10 has an invalid length. [ 475.857574][ T9926] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1642'. [ 475.918065][ T4333] wlan1: Creating new IBSS network, BSSID a2:9e:47:0a:0b:ec [ 476.920333][ T41] wlan1: Trigger new scan to find an IBSS to join [ 478.564936][ T4271] Bluetooth: hci4: unexpected event 0x04 length: 15 > 10 [ 479.835226][ T9958] netlink: 'syz.0.1656': attribute type 2 has an invalid length. [ 480.598242][ T4282] Bluetooth: hci4: command 0x0409 tx timeout [ 481.957654][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 482.260161][ T9981] netlink: 'syz.2.1663': attribute type 12 has an invalid length. [ 482.344004][ T9982] netlink: 'syz.2.1663': attribute type 10 has an invalid length. [ 482.502118][ T9982] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1663'. [ 483.699024][ T9] wlan1: Creating new IBSS network, BSSID e6:3b:54:99:43:d3 [ 486.392982][T10025] netlink: 'syz.1.1677': attribute type 2 has an invalid length. [ 488.178353][T10035] netlink: 'syz.0.1679': attribute type 12 has an invalid length. [ 488.502990][T10040] netlink: 'syz.4.1681': attribute type 10 has an invalid length. [ 488.549263][T10040] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 488.615125][T10040] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 488.741733][T10040] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 488.807973][T10040] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 488.982788][T10035] netlink: 'syz.0.1679': attribute type 10 has an invalid length. [ 489.054015][T10035] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1679'. [ 491.484410][T10064] netlink: 'syz.2.1688': attribute type 2 has an invalid length. [ 491.628875][T10060] netlink: 'syz.1.1687': attribute type 29 has an invalid length. [ 491.668120][T10066] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 491.946483][T10060] netlink: 'syz.1.1687': attribute type 29 has an invalid length. [ 493.985849][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 495.023917][T10082] netlink: 'syz.2.1694': attribute type 29 has an invalid length. [ 495.179556][T10089] netlink: 'syz.2.1694': attribute type 10 has an invalid length. [ 495.333809][T10082] netlink: 'syz.2.1694': attribute type 29 has an invalid length. [ 497.433822][ T5072] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.672147][ T4271] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 497.701603][ T4271] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 497.712231][ T4271] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 497.723520][ T4271] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 497.732451][ T4271] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 497.742015][ T4271] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 497.814919][ T5072] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.034694][ T5072] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.840155][ T5072] device 0 left promiscuous mode [ 498.917408][ T6322] wlan1: Trigger new scan to find an IBSS to join [ 499.036801][ T5072] tipc: Left network mode [ 499.552486][ T9] tipc: Subscription rejected, illegal request [ 499.678708][T10114] chnl_net:caif_netlink_parms(): no params data found [ 499.797428][ T4271] Bluetooth: hci2: command 0x0409 tx timeout [ 499.818241][ T6322] wlan1: Creating new IBSS network, BSSID a6:43:5d:a4:fe:d7 [ 500.428997][T10151] netlink: 'syz.1.1710': attribute type 29 has an invalid length. [ 500.640926][T10151] netlink: 'syz.1.1710': attribute type 29 has an invalid length. [ 500.867720][T10156] netlink: 'syz.1.1710': attribute type 10 has an invalid length. [ 500.927430][T10156] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 500.967693][T10156] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 500.999428][T10156] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 501.036529][T10156] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 501.468285][T10114] bridge0: port 1(bridge_slave_0) entered blocking state [ 501.475523][T10114] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.522331][T10114] device bridge_slave_0 entered promiscuous mode [ 501.570861][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.578271][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.648729][T10114] bridge0: port 2(bridge_slave_1) entered blocking state [ 501.655933][T10114] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.719987][T10114] device bridge_slave_1 entered promiscuous mode [ 501.887453][ T4271] Bluetooth: hci2: command 0x041b tx timeout [ 502.173174][T10173] netlink: 'syz.0.1715': attribute type 29 has an invalid length. [ 502.520917][T10114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 502.592497][T10114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 502.640407][T10177] netlink: 'syz.0.1715': attribute type 10 has an invalid length. [ 502.705683][T10177] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 502.737917][T10177] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 502.778067][T10177] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 502.864154][T10177] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 502.948157][T10173] netlink: 'syz.0.1715': attribute type 29 has an invalid length. [ 502.966037][ T9] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 503.402801][T10114] team0: Port device team_slave_0 added [ 503.431223][T10114] team0: Port device team_slave_1 added [ 503.895082][T10114] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 503.947443][T10114] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 503.977943][ T4271] Bluetooth: hci2: command 0x040f tx timeout [ 504.257427][T10114] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 504.284523][T10114] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 504.298660][T10114] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 504.387794][T10114] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 504.481223][T10203] netlink: 'syz.0.1724': attribute type 2 has an invalid length. [ 504.562534][ T5072] device hsr_slave_0 left promiscuous mode [ 504.578646][ T5072] device hsr_slave_1 left promiscuous mode [ 504.612560][ T5072] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 504.645071][ T5072] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 504.687553][ T5072] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 504.725883][ T5072] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 504.826976][ T5072] device veth1_macvtap left promiscuous mode [ 504.960846][T10210] netlink: 'syz.4.1726': attribute type 10 has an invalid length. [ 504.997012][T10210] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1726'. [ 505.528052][ T5072] bond0 (unregistering): (slave geneve0): Releasing backup interface [ 505.947726][ T4333] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 506.038278][ T4271] Bluetooth: hci2: command 0x0419 tx timeout [ 507.419569][ T5072] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 507.790353][ T5072] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 507.918536][ T5072] bond0 (unregistering): Released all slaves [ 507.995486][T10210] netlink: 'syz.4.1726': attribute type 10 has an invalid length. [ 508.014049][T10210] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1726'. [ 508.023758][T10208] netlink: 'syz.1.1725': attribute type 10 has an invalid length. [ 508.047325][T10208] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 508.059840][T10208] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 508.076265][T10208] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 508.096660][T10208] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 508.172022][T10114] device hsr_slave_0 entered promiscuous mode [ 508.206071][T10114] device hsr_slave_1 entered promiscuous mode [ 509.024891][T10114] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 509.087070][T10114] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 509.139208][T10114] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 509.213014][T10114] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 509.780171][T10266] netlink: 'syz.1.1741': attribute type 10 has an invalid length. [ 509.796863][T10266] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 509.953021][T10266] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 510.319590][T10266] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 510.367601][T10266] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 510.404564][T10114] 8021q: adding VLAN 0 to HW filter on device bond0 [ 510.494605][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 510.513368][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 510.555939][T10114] 8021q: adding VLAN 0 to HW filter on device team0 [ 510.590420][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 510.666607][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 510.691636][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.698962][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 510.764232][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 510.786689][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 510.819136][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 510.828276][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 510.835420][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 510.888145][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 510.928046][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 510.981890][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 511.048919][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 511.080538][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 511.114336][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 511.159566][T10114] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 511.192812][T10114] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 511.273580][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 511.295698][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 511.352234][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 511.464254][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 511.521278][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 511.530643][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 512.300490][T10326] FAULT_INJECTION: forcing a failure. [ 512.300490][T10326] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 512.367592][T10326] CPU: 1 PID: 10326 Comm: syz.1.1755 Not tainted syzkaller #0 [ 512.375158][T10326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 512.385353][T10326] Call Trace: [ 512.388724][T10326] [ 512.391724][T10326] dump_stack_lvl+0x188/0x24e [ 512.396492][T10326] ? show_regs_print_info+0x12/0x12 [ 512.401849][T10326] ? load_image+0x400/0x400 [ 512.406533][T10326] ? __might_fault+0xa6/0x120 [ 512.411296][T10326] should_fail_ex+0x399/0x4d0 [ 512.416043][T10326] copyin+0x1b/0x120 [ 512.420093][T10326] _copy_from_iter+0x447/0x1130 [ 512.426159][T10326] ? copyout_mc+0x110/0x110 [ 512.430897][T10326] ? __virt_addr_valid+0x188/0x540 [ 512.436161][T10326] ? __virt_addr_valid+0x188/0x540 [ 512.441686][T10326] ? __virt_addr_valid+0x465/0x540 [ 512.447045][T10326] ? __check_object_size+0x500/0xa40 [ 512.452488][T10326] netlink_sendmsg+0x755/0xbd0 [ 512.457350][T10326] ? netlink_getsockopt+0x550/0x550 [ 512.462626][T10326] ? aa_sock_msg_perm+0x94/0x150 [ 512.467714][T10326] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 512.473053][T10326] ? security_socket_sendmsg+0x7c/0xa0 [ 512.478768][T10326] ? netlink_getsockopt+0x550/0x550 [ 512.484116][T10326] ____sys_sendmsg+0x5be/0x970 [ 512.488976][T10326] ? __sys_sendmsg_sock+0x30/0x30 [ 512.494145][T10326] ? __import_iovec+0x315/0x500 [ 512.499087][T10326] ? import_iovec+0x6f/0xa0 [ 512.503673][T10326] ___sys_sendmsg+0x2a2/0x360 [ 512.508486][T10326] ? __sys_sendmsg+0x290/0x290 [ 512.513398][T10326] ? __lock_acquire+0x7d10/0x7d10 [ 512.518590][T10326] __se_sys_sendmsg+0x1bb/0x2a0 [ 512.523521][T10326] ? __x64_sys_sendmsg+0x80/0x80 [ 512.528584][T10326] ? lockdep_hardirqs_on+0x94/0x140 [ 512.533854][T10326] do_syscall_64+0x4c/0xa0 [ 512.538341][T10326] ? clear_bhb_loop+0x60/0xb0 [ 512.543088][T10326] ? clear_bhb_loop+0x60/0xb0 [ 512.547837][T10326] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 512.553874][T10326] RIP: 0033:0x7f430359c819 [ 512.558373][T10326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.578173][T10326] RSP: 002b:00007f4304460028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 512.586745][T10326] RAX: ffffffffffffffda RBX: 00007f4303815fa0 RCX: 00007f430359c819 [ 512.594865][T10326] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 512.602976][T10326] RBP: 00007f4304460090 R08: 0000000000000000 R09: 0000000000000000 [ 512.611082][T10326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 512.619193][T10326] R13: 00007f4303816038 R14: 00007f4303815fa0 R15: 00007ffcfadf4e78 [ 512.627273][T10326] [ 512.952762][T10330] FAULT_INJECTION: forcing a failure. [ 512.952762][T10330] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 513.041537][T10330] CPU: 1 PID: 10330 Comm: syz.4.1757 Not tainted syzkaller #0 [ 513.049096][T10330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 513.059358][T10330] Call Trace: [ 513.062678][T10330] [ 513.065654][T10330] dump_stack_lvl+0x188/0x24e [ 513.070434][T10330] ? show_regs_print_info+0x12/0x12 [ 513.075684][T10330] ? load_image+0x400/0x400 [ 513.080242][T10330] ? __lock_acquire+0x7d10/0x7d10 [ 513.085323][T10330] should_fail_ex+0x399/0x4d0 [ 513.090048][T10330] _copy_from_user+0x2c/0x170 [ 513.094778][T10330] ___sys_sendmsg+0x1c3/0x360 [ 513.099518][T10330] ? __sys_sendmsg+0x290/0x290 [ 513.104352][T10330] ? irqentry_enter+0x33/0x50 [ 513.109096][T10330] ? rcu_is_watching+0x11/0xa0 [ 513.114023][T10330] ? __se_sys_sendmsg+0x30/0x2a0 [ 513.119205][T10330] __se_sys_sendmsg+0x1bb/0x2a0 [ 513.124114][T10330] ? __x64_sys_sendmsg+0x80/0x80 [ 513.129249][T10330] ? syscall_enter_from_user_mode+0x2a/0x80 [ 513.135198][T10330] do_syscall_64+0x4c/0xa0 [ 513.139671][T10330] ? clear_bhb_loop+0x60/0xb0 [ 513.144397][T10330] ? clear_bhb_loop+0x60/0xb0 [ 513.149107][T10330] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 513.155020][T10330] RIP: 0033:0x7f706779c819 [ 513.159468][T10330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 513.179109][T10330] RSP: 002b:00007f706872e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 513.187552][T10330] RAX: ffffffffffffffda RBX: 00007f7067a15fa0 RCX: 00007f706779c819 [ 513.195542][T10330] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000007 [ 513.203527][T10330] RBP: 00007f706872e090 R08: 0000000000000000 R09: 0000000000000000 [ 513.211511][T10330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 513.219491][T10330] R13: 00007f7067a16038 R14: 00007f7067a15fa0 R15: 00007ffdc1f27f58 [ 513.227509][T10330] [ 513.244953][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 513.260032][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 513.303448][T10114] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 514.721558][T10374] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1767'. [ 515.115341][T10374] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 515.241733][T10383] FAULT_INJECTION: forcing a failure. [ 515.241733][T10383] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 515.280673][T10374] bond0 (unregistering): (slave geneve0): Releasing backup interface [ 515.355357][T10374] bond0 (unregistering): Released all slaves [ 515.397727][T10383] CPU: 1 PID: 10383 Comm: syz.2.1769 Not tainted syzkaller #0 [ 515.405364][T10383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 515.415455][T10383] Call Trace: [ 515.418851][T10383] [ 515.421810][T10383] dump_stack_lvl+0x188/0x24e [ 515.426655][T10383] ? show_regs_print_info+0x12/0x12 [ 515.431911][T10383] ? load_image+0x400/0x400 [ 515.436551][T10383] ? __lock_acquire+0x7d10/0x7d10 [ 515.441635][T10383] should_fail_ex+0x399/0x4d0 [ 515.446360][T10383] _copy_from_user+0x2c/0x170 [ 515.451097][T10383] kstrtouint_from_user+0xda/0x170 [ 515.456360][T10383] ? kstrtol_from_user+0x190/0x190 [ 515.461645][T10383] proc_fail_nth_write+0x8b/0x200 [ 515.466714][T10383] ? proc_fail_nth_read+0x220/0x220 [ 515.471958][T10383] ? common_file_perm+0x171/0x1c0 [ 515.477019][T10383] ? proc_fail_nth_read+0x220/0x220 [ 515.482531][T10383] vfs_write+0x2e6/0xa30 [ 515.486918][T10383] ? file_end_write+0x250/0x250 [ 515.491830][T10383] ? __fget_files+0x28/0x4b0 [ 515.496501][T10383] ? __fget_files+0x28/0x4b0 [ 515.501295][T10383] ? __fget_files+0x43d/0x4b0 [ 515.506010][T10383] ? __fdget_pos+0x2ae/0x360 [ 515.510624][T10383] ? ksys_write+0x71/0x250 [ 515.515060][T10383] ksys_write+0x14c/0x250 [ 515.519422][T10383] ? __ia32_sys_read+0x80/0x80 [ 515.524214][T10383] ? lockdep_hardirqs_on+0x94/0x140 [ 515.529432][T10383] do_syscall_64+0x4c/0xa0 [ 515.534050][T10383] ? clear_bhb_loop+0x60/0xb0 [ 515.538739][T10383] ? clear_bhb_loop+0x60/0xb0 [ 515.543424][T10383] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 515.549420][T10383] RIP: 0033:0x7f2a1fb5d04e [ 515.553933][T10383] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 515.573808][T10383] RSP: 002b:00007f2a20a6dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 515.582319][T10383] RAX: ffffffffffffffda RBX: 00007f2a20a6e6c0 RCX: 00007f2a1fb5d04e [ 515.590355][T10383] RDX: 0000000000000001 RSI: 00007f2a20a6e0a0 RDI: 0000000000000004 [ 515.598338][T10383] RBP: 00007f2a20a6e090 R08: 0000000000000000 R09: 0000000000000000 [ 515.606426][T10383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 515.614700][T10383] R13: 00007f2a1fe16128 R14: 00007f2a1fe16090 R15: 00007ffe5f596af8 [ 515.622825][T10383] [ 515.642843][T10378] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1768'. [ 515.655547][T10378] device caif0 entered promiscuous mode [ 515.730288][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 515.795273][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 515.869187][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 515.902348][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 515.934868][T10114] device veth0_vlan entered promiscuous mode [ 515.946101][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 515.958494][ T41] wlan1: Trigger new scan to find an IBSS to join [ 515.986190][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 516.023806][T10114] device veth1_vlan entered promiscuous mode [ 516.122582][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 516.149420][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 516.186075][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 516.312131][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 516.533054][T10114] device veth0_macvtap entered promiscuous mode [ 516.575300][T10114] device veth1_macvtap entered promiscuous mode [ 516.634796][T10114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 516.751811][T10114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 516.788835][T10114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 516.845410][T10114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 516.875376][T10114] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 516.911864][ T5072] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 516.968210][ T5072] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 516.999097][ T5072] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 517.038920][ T5072] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 517.134365][T10406] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 517.233549][T10114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 517.297776][T10114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 517.358579][T10114] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 517.426705][T10114] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 517.543920][T10114] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 517.595464][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 517.637738][ T4333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 517.704530][T10114] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.759757][T10114] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.822118][T10114] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.884377][T10114] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.311069][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 518.342605][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 518.422838][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 518.502038][ T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 518.525721][ T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 518.592043][ T5072] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 518.631874][T10410] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 519.418779][T10440] FAULT_INJECTION: forcing a failure. [ 519.418779][T10440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 519.477556][T10440] CPU: 1 PID: 10440 Comm: syz.5.1697 Not tainted syzkaller #0 [ 519.485134][T10440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 519.495341][T10440] Call Trace: [ 519.498663][T10440] [ 519.501646][T10440] dump_stack_lvl+0x188/0x24e [ 519.506393][T10440] ? show_regs_print_info+0x12/0x12 [ 519.511653][T10440] ? load_image+0x400/0x400 [ 519.516281][T10440] ? __lock_acquire+0x7d10/0x7d10 [ 519.521451][T10440] should_fail_ex+0x399/0x4d0 [ 519.526174][T10440] _copy_from_user+0x2c/0x170 [ 519.530903][T10440] iovec_from_user+0x143/0x360 [ 519.535815][T10440] __import_iovec+0x6d/0x500 [ 519.540979][T10440] import_iovec+0x6f/0xa0 [ 519.545345][T10440] ___sys_sendmsg+0x252/0x360 [ 519.550067][T10440] ? __sys_sendmsg+0x290/0x290 [ 519.554879][T10440] ? __lock_acquire+0x7d10/0x7d10 [ 519.559964][T10440] __se_sys_sendmsg+0x1bb/0x2a0 [ 519.564839][T10440] ? __x64_sys_sendmsg+0x80/0x80 [ 519.569829][T10440] ? lockdep_hardirqs_on+0x94/0x140 [ 519.575060][T10440] do_syscall_64+0x4c/0xa0 [ 519.579493][T10440] ? clear_bhb_loop+0x60/0xb0 [ 519.584277][T10440] ? clear_bhb_loop+0x60/0xb0 [ 519.589058][T10440] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 519.594964][T10440] RIP: 0033:0x7f1bdb99c819 [ 519.599421][T10440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.619214][T10440] RSP: 002b:00007f1bdc7b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 519.627736][T10440] RAX: ffffffffffffffda RBX: 00007f1bdbc15fa0 RCX: 00007f1bdb99c819 [ 519.635746][T10440] RDX: 0000000000098010 RSI: 0000200000000240 RDI: 0000000000000003 [ 519.643753][T10440] RBP: 00007f1bdc7b3090 R08: 0000000000000000 R09: 0000000000000000 [ 519.651834][T10440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 519.660169][T10440] R13: 00007f1bdbc16038 R14: 00007f1bdbc15fa0 R15: 00007ffd087b5458 [ 519.668266][T10440] [ 519.869775][T10457] FAULT_INJECTION: forcing a failure. [ 519.869775][T10457] name failslab, interval 1, probability 0, space 0, times 0 [ 519.917401][T10457] CPU: 1 PID: 10457 Comm: syz.0.1788 Not tainted syzkaller #0 [ 519.920519][T10450] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1787'. [ 519.924924][T10457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 519.924941][T10457] Call Trace: [ 519.924950][T10457] [ 519.924958][T10457] dump_stack_lvl+0x188/0x24e [ 519.955130][T10457] ? show_regs_print_info+0x12/0x12 [ 519.960484][T10457] ? load_image+0x400/0x400 [ 519.965165][T10457] ? verify_lock_unused+0x140/0x140 [ 519.970454][T10457] should_fail_ex+0x399/0x4d0 [ 519.975274][T10457] should_failslab+0x5/0x20 [ 519.979848][T10457] slab_pre_alloc_hook+0x59/0x310 [ 519.984950][T10457] kmem_cache_alloc+0x56/0x2f0 [ 519.990026][T10457] ? skb_clone+0x1e7/0x370 [ 519.994505][T10457] skb_clone+0x1e7/0x370 [ 519.998802][T10457] __netlink_deliver_tap+0x3ed/0x800 [ 520.004335][T10457] ? netlink_deliver_tap+0x2e/0x1b0 [ 520.009690][T10457] netlink_deliver_tap+0x19c/0x1b0 [ 520.014854][T10457] netlink_unicast+0x728/0x8d0 [ 520.019771][T10457] netlink_sendmsg+0x8ad/0xbd0 [ 520.022350][T10462] FAULT_INJECTION: forcing a failure. [ 520.022350][T10462] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 520.024590][T10457] ? netlink_getsockopt+0x550/0x550 [ 520.042877][T10457] ? aa_sock_msg_perm+0x94/0x150 [ 520.047882][T10457] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 520.053218][T10457] ? security_socket_sendmsg+0x7c/0xa0 [ 520.058725][T10457] ? netlink_getsockopt+0x550/0x550 [ 520.063960][T10457] ____sys_sendmsg+0x5be/0x970 [ 520.068757][T10457] ? __sys_sendmsg_sock+0x30/0x30 [ 520.073897][T10457] ? __import_iovec+0x315/0x500 [ 520.078819][T10457] ? import_iovec+0x6f/0xa0 [ 520.083348][T10457] ___sys_sendmsg+0x2a2/0x360 [ 520.088077][T10457] ? __sys_sendmsg+0x290/0x290 [ 520.092899][T10457] ? __lock_acquire+0x7d10/0x7d10 [ 520.097991][T10457] __se_sys_sendmsg+0x1bb/0x2a0 [ 520.102886][T10457] ? __x64_sys_sendmsg+0x80/0x80 [ 520.107952][T10457] ? lockdep_hardirqs_on+0x94/0x140 [ 520.113200][T10457] do_syscall_64+0x4c/0xa0 [ 520.117665][T10457] ? clear_bhb_loop+0x60/0xb0 [ 520.122381][T10457] ? clear_bhb_loop+0x60/0xb0 [ 520.127095][T10457] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 520.133013][T10457] RIP: 0033:0x7fc4dd19c819 [ 520.137447][T10457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.157366][T10457] RSP: 002b:00007fc4de14d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 520.165912][T10457] RAX: ffffffffffffffda RBX: 00007fc4dd415fa0 RCX: 00007fc4dd19c819 [ 520.173919][T10457] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 520.181995][T10457] RBP: 00007fc4de14d090 R08: 0000000000000000 R09: 0000000000000000 [ 520.190173][T10457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.198166][T10457] R13: 00007fc4dd416038 R14: 00007fc4dd415fa0 R15: 00007ffd23acd068 [ 520.206181][T10457] [ 520.209214][T10462] CPU: 0 PID: 10462 Comm: syz.1.1790 Not tainted syzkaller #0 [ 520.217008][T10462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 520.227111][T10462] Call Trace: [ 520.230438][T10462] [ 520.233500][T10462] dump_stack_lvl+0x188/0x24e [ 520.238326][T10462] ? show_regs_print_info+0x12/0x12 [ 520.243596][T10462] ? load_image+0x400/0x400 [ 520.248156][T10462] ? __lock_acquire+0x7d10/0x7d10 [ 520.253248][T10462] should_fail_ex+0x399/0x4d0 [ 520.257977][T10462] _copy_from_user+0x2c/0x170 [ 520.262692][T10462] iovec_from_user+0x143/0x360 [ 520.267474][T10462] __import_iovec+0x6d/0x500 [ 520.272173][T10462] import_iovec+0x6f/0xa0 [ 520.276527][T10462] ___sys_sendmsg+0x252/0x360 [ 520.281313][T10462] ? __sys_sendmsg+0x290/0x290 [ 520.286184][T10462] ? __lock_acquire+0x7d10/0x7d10 [ 520.291268][T10462] __se_sys_sendmsg+0x1bb/0x2a0 [ 520.296162][T10462] ? __x64_sys_sendmsg+0x80/0x80 [ 520.301143][T10462] ? lockdep_hardirqs_on+0x94/0x140 [ 520.306361][T10462] do_syscall_64+0x4c/0xa0 [ 520.310803][T10462] ? clear_bhb_loop+0x60/0xb0 [ 520.315562][T10462] ? clear_bhb_loop+0x60/0xb0 [ 520.320370][T10462] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 520.326278][T10462] RIP: 0033:0x7f430359c819 [ 520.330714][T10462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.350420][T10462] RSP: 002b:00007f430443f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 520.358858][T10462] RAX: ffffffffffffffda RBX: 00007f4303816090 RCX: 00007f430359c819 [ 520.366845][T10462] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 520.375173][T10462] RBP: 00007f430443f090 R08: 0000000000000000 R09: 0000000000000000 [ 520.383333][T10462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.391318][T10462] R13: 00007f4303816128 R14: 00007f4303816090 R15: 00007ffcfadf4e78 [ 520.399413][T10462] [ 520.998106][T10463] wlan1: Trigger new scan to find an IBSS to join [ 520.998115][T10481] wlan1: Trigger new scan to find an IBSS to join [ 521.236710][T10496] netlink: 'syz.4.1794': attribute type 21 has an invalid length. [ 521.335164][T10496] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1794'. [ 521.509471][T10496] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1794'. [ 522.062813][T10463] wlan1: Creating new IBSS network, BSSID 5e:42:ba:6f:b8:16 [ 523.397696][ T4271] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 523.406563][ T4271] Bluetooth: hci4: Injecting HCI hardware error event [ 523.415135][ T4282] Bluetooth: hci4: hardware error 0x00 [ 524.404293][T10524] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 525.647801][ T4282] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 525.956025][T10611] netlink: 'syz.5.1829': attribute type 29 has an invalid length. [ 526.019368][T10611] netlink: 'syz.5.1829': attribute type 29 has an invalid length. [ 526.040405][T10614] netlink: 'syz.5.1829': attribute type 29 has an invalid length. [ 526.067629][T10618] netlink: 'syz.5.1829': attribute type 29 has an invalid length. [ 526.255131][T10618] netlink: 'syz.5.1829': attribute type 29 has an invalid length. [ 526.350192][T10623] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 527.026990][ T8404] wlan1: Trigger new scan to find an IBSS to join [ 528.920270][ T4341] wlan1: Trigger new scan to find an IBSS to join [ 530.376383][T10677] netlink: 'syz.2.1845': attribute type 10 has an invalid length. [ 531.083062][T10690] netlink: 'syz.0.1848': attribute type 29 has an invalid length. [ 531.107927][T10690] netlink: 'syz.0.1848': attribute type 29 has an invalid length. [ 531.192035][T10690] netlink: 'syz.0.1848': attribute type 29 has an invalid length. [ 531.957501][ T11] wlan1: Trigger new scan to find an IBSS to join [ 531.967783][T10463] wlan1: Trigger new scan to find an IBSS to join [ 532.809640][T10725] netlink: 'syz.1.1859': attribute type 29 has an invalid length. [ 532.911337][T10725] netlink: 'syz.1.1859': attribute type 29 has an invalid length. [ 532.924350][ T4341] wlan1: Creating new IBSS network, BSSID 76:18:c8:9c:29:ff [ 533.040263][T10726] netlink: 'syz.1.1859': attribute type 10 has an invalid length. [ 533.072069][T10726] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 533.111126][T10726] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 533.130925][T10731] netlink: 'syz.2.1860': attribute type 29 has an invalid length. [ 533.153164][T10726] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 533.167921][T10726] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 533.176802][T10728] mac80211_hwsim hwsim11 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 533.191185][T10731] netlink: 'syz.2.1860': attribute type 29 has an invalid length. [ 533.264688][T10734] netlink: 'syz.2.1860': attribute type 10 has an invalid length. [ 533.993143][ T4341] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 535.236544][T10773] netlink: 'syz.5.1873': attribute type 10 has an invalid length. [ 535.384807][T10773] device hsr0 entered promiscuous mode [ 535.586650][T10773] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 535.759231][T10773] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 535.822024][T10773] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 535.878905][T10773] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 536.006639][T10463] wlan1: Trigger new scan to find an IBSS to join [ 536.543702][T10792] netlink: 14601 bytes leftover after parsing attributes in process `syz.5.1877'. [ 536.615166][T10762] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 538.266578][T10831] netlink: 'syz.4.1887': attribute type 29 has an invalid length. [ 538.315000][T10831] netlink: 'syz.4.1887': attribute type 29 has an invalid length. [ 538.352767][T10833] netlink: 'syz.0.1886': attribute type 29 has an invalid length. [ 538.566913][T10834] netlink: 'syz.4.1887': attribute type 10 has an invalid length. [ 538.618616][T10834] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 538.693854][T10834] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 538.785194][T10834] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 538.854823][T10834] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 538.917543][ T4341] wlan1: Trigger new scan to find an IBSS to join [ 538.927704][T10835] netlink: 'syz.0.1886': attribute type 10 has an invalid length. [ 538.951857][T10833] netlink: 'syz.0.1886': attribute type 29 has an invalid length. [ 540.187939][T10867] FAULT_INJECTION: forcing a failure. [ 540.187939][T10867] name failslab, interval 1, probability 0, space 0, times 0 [ 540.257394][T10867] CPU: 1 PID: 10867 Comm: syz.4.1897 Not tainted syzkaller #0 [ 540.265120][T10867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 540.275320][T10867] Call Trace: [ 540.278818][T10867] [ 540.281780][T10867] dump_stack_lvl+0x188/0x24e [ 540.286556][T10867] ? show_regs_print_info+0x12/0x12 [ 540.291798][T10867] ? load_image+0x400/0x400 [ 540.296357][T10867] ? __might_sleep+0xd0/0xd0 [ 540.301048][T10867] ? __lock_acquire+0x7d10/0x7d10 [ 540.306123][T10867] should_fail_ex+0x399/0x4d0 [ 540.310849][T10867] should_failslab+0x5/0x20 [ 540.315403][T10867] slab_pre_alloc_hook+0x59/0x310 [ 540.320472][T10867] ? tomoyo_realpath_from_path+0xdf/0x5d0 [ 540.326248][T10867] __kmem_cache_alloc_node+0x4f/0x260 [ 540.331689][T10867] ? tomoyo_realpath_from_path+0xdf/0x5d0 [ 540.337551][T10867] __kmalloc+0xa0/0x240 [ 540.341777][T10867] tomoyo_realpath_from_path+0xdf/0x5d0 [ 540.347401][T10867] ? tomoyo_path_number_perm+0x205/0x650 [ 540.353180][T10867] tomoyo_path_number_perm+0x22f/0x650 [ 540.358704][T10867] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 540.364212][T10867] ? ksys_write+0x1c0/0x250 [ 540.368864][T10867] ? common_file_perm+0x171/0x1c0 [ 540.374063][T10867] ? __fget_files+0x28/0x4b0 [ 540.378696][T10867] ? __fget_files+0x28/0x4b0 [ 540.383327][T10867] security_file_ioctl+0x6c/0xa0 [ 540.388385][T10867] __se_sys_ioctl+0x48/0x170 [ 540.393094][T10867] do_syscall_64+0x4c/0xa0 [ 540.397626][T10867] ? clear_bhb_loop+0x60/0xb0 [ 540.403920][T10867] ? clear_bhb_loop+0x60/0xb0 [ 540.408728][T10867] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 540.414665][T10867] RIP: 0033:0x7f706779c819 [ 540.419114][T10867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.438829][T10867] RSP: 002b:00007f706872e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 540.447353][T10867] RAX: ffffffffffffffda RBX: 00007f7067a15fa0 RCX: 00007f706779c819 [ 540.455460][T10867] RDX: 0000200000000940 RSI: 00000000000089e0 RDI: 0000000000000003 [ 540.463461][T10867] RBP: 00007f706872e090 R08: 0000000000000000 R09: 0000000000000000 [ 540.471621][T10867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 540.479613][T10867] R13: 00007f7067a16038 R14: 00007f7067a15fa0 R15: 00007ffdc1f27f58 [ 540.487616][T10867] [ 540.515151][T10867] ERROR: Out of memory at tomoyo_realpath_from_path. [ 540.922871][T10481] wlan1: Trigger new scan to find an IBSS to join [ 541.627609][T10893] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1903'. [ 541.948874][ T11] wlan1: Creating new IBSS network, BSSID be:75:34:52:3b:b5 [ 542.194987][T10907] netlink: 126288 bytes leftover after parsing attributes in process `syz.0.1908'. [ 543.957596][ T4341] wlan1: Trigger new scan to find an IBSS to join [ 544.423532][T10957] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1923'. [ 545.074650][ T9] wlan1: Creating new IBSS network, BSSID 86:fb:ea:9f:d1:d1 [ 545.546489][T10982] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 545.647388][T10984] netlink: 161700 bytes leftover after parsing attributes in process `syz.5.1929'. [ 545.690947][T10984] openvswitch: netlink: Key 2 has unexpected len 41210 expected 4 [ 548.714361][T11046] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1948'. [ 548.922044][T11053] netlink: 'syz.1.1950': attribute type 1 has an invalid length. [ 549.011289][T11053] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.1950'. [ 549.053555][T11053] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1950'. [ 549.113908][T11053] netlink: 'syz.1.1950': attribute type 1 has an invalid length. [ 550.077784][T11080] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 550.923595][T11090] netlink: 'syz.0.1958': attribute type 39 has an invalid length. [ 553.897522][T11180] netlink: 'syz.2.1983': attribute type 9 has an invalid length. [ 553.905617][T11180] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.1983'. [ 553.957657][ T11] wlan1: Trigger new scan to find an IBSS to join [ 553.991577][T11180] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.1983'. [ 554.444257][ T4282] Bluetooth: hci2: unexpected event 0x09 length: 15 > 3 [ 555.136776][T11208] netlink: 'syz.0.1991': attribute type 39 has an invalid length. [ 555.160458][T11209] tap0: tun_chr_ioctl cmd 2147767517 [ 555.180821][T11211] tap0: tun_chr_ioctl cmd 2147767517 [ 555.543894][T11221] netlink: 'syz.0.1995': attribute type 29 has an invalid length. [ 555.609394][T11221] netlink: 'syz.0.1995': attribute type 29 has an invalid length. [ 555.667114][T11225] netlink: 'syz.0.1995': attribute type 29 has an invalid length. [ 555.675643][T11228] netlink: 'syz.1.1994': attribute type 20 has an invalid length. [ 555.714855][T11221] netlink: 'syz.0.1995': attribute type 29 has an invalid length. [ 555.801411][T11224] netlink: 65039 bytes leftover after parsing attributes in process `syz.5.1997'. [ 556.014642][T11235] netlink: 'syz.2.2000': attribute type 10 has an invalid length. [ 556.048179][T11235] netlink: 65015 bytes leftover after parsing attributes in process `syz.2.2000'. [ 556.812317][T11256] netlink: 'syz.1.2003': attribute type 39 has an invalid length. [ 557.204416][T11269] netlink: 'syz.5.2009': attribute type 9 has an invalid length. [ 557.227368][T11269] netlink: 126588 bytes leftover after parsing attributes in process `syz.5.2009'. [ 557.394635][T11271] netlink: 65047 bytes leftover after parsing attributes in process `syz.5.2009'. [ 557.958945][T10463] wlan1: Trigger new scan to find an IBSS to join [ 558.963157][ T11] wlan1: Creating new IBSS network, BSSID 12:55:dd:19:2e:14 [ 559.471644][T11295] mac80211_hwsim hwsim19 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 559.940941][T11326] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2021'. [ 560.148239][T11334] netlink: 'syz.2.2024': attribute type 2 has an invalid length. [ 560.156135][T11334] netlink: 'syz.2.2024': attribute type 1 has an invalid length. [ 560.203421][T11334] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2024'. [ 560.617628][ T4282] Bluetooth: hci2: unexpected event 0x09 length: 15 > 3 [ 561.154317][T11357] netlink: 212168 bytes leftover after parsing attributes in process `syz.4.2030'. [ 562.106667][ T4341] wlan1: Trigger new scan to find an IBSS to join [ 563.017658][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.024139][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.691629][T11412] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2038'. [ 565.011512][ T4282] Bluetooth: hci0: unexpected event 0x09 length: 15 > 3 [ 565.022524][T11424] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2041'. [ 565.064865][T11424] bridge0: port 1(bridge_slave_0) entered disabled state [ 565.336183][T11424] device bridge_slave_0 left promiscuous mode [ 565.360561][T11424] bridge0: port 1(bridge_slave_0) entered disabled state [ 565.967334][ T4309] wlan1: Trigger new scan to find an IBSS to join [ 566.103677][T11440] can: request_module (can-proto-0) failed. [ 566.950030][ T4309] wlan1: Creating new IBSS network, BSSID 9e:0d:d2:d2:d6:52 [ 567.274336][T11467] device syzkaller0 entered promiscuous mode [ 567.412123][T11472] device syzkaller0 entered promiscuous mode [ 567.502832][T11453] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 571.985454][T10480] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 574.722102][T11523] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2076'. [ 574.866614][T11539] netlink: 168 bytes leftover after parsing attributes in process `syz.5.2083'. [ 575.659565][T11552] device syzkaller0 entered promiscuous mode [ 575.822254][T11561] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 576.566249][T11580] netlink: 134056 bytes leftover after parsing attributes in process `syz.4.2095'. [ 577.272308][T11578] device syzkaller0 entered promiscuous mode [ 577.959228][ T4309] wlan1: Trigger new scan to find an IBSS to join [ 581.010774][ T9] wlan1: Trigger new scan to find an IBSS to join [ 581.181577][T11602] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2099'. [ 583.957495][ T9] wlan1: Creating new IBSS network, BSSID 8a:5f:28:a5:99:09 [ 585.891333][T11664] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 585.943344][T11664] device syzkaller0 entered promiscuous mode [ 588.732029][T10481] tipc: Subscription rejected, illegal request [ 590.835968][T11713] device syzkaller0 entered promiscuous mode [ 590.849142][T11732] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2141'. [ 590.898407][T11734] netlink: 128 bytes leftover after parsing attributes in process `syz.5.2141'. [ 590.928633][T11734] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 595.413413][T11777] device syzkaller0 entered promiscuous mode [ 596.969202][T10480] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 599.517025][T11822] netlink: 'syz.5.2168': attribute type 21 has an invalid length. [ 599.525341][T11822] netlink: 'syz.5.2168': attribute type 6 has an invalid length. [ 599.533656][T11822] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2168'. [ 599.655286][T11845] device syzkaller0 entered promiscuous mode [ 599.728763][T11856] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.748362][T11856] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 599.784281][T11856] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 599.810290][T11856] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 599.921562][T11856] bond0: (slave batadv0): Releasing backup interface [ 600.227383][T11869] device bridge_slave_1 left promiscuous mode [ 600.262809][T11869] bridge0: port 2(bridge_slave_1) entered disabled state [ 602.908471][ T4341] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 604.062039][T11904] netlink: 'syz.2.2190': attribute type 10 has an invalid length. [ 604.119375][T11897] device syzkaller0 entered promiscuous mode [ 604.291272][T11924] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 606.831874][T11957] netlink: 'syz.5.2206': attribute type 3 has an invalid length. [ 606.892825][T11957] netlink: 118424 bytes leftover after parsing attributes in process `syz.5.2206'. [ 608.327582][T11954] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.2206'. [ 609.617460][T11987] device syzkaller0 entered promiscuous mode [ 609.726363][T11997] netlink: 'syz.5.2222': attribute type 6 has an invalid length. [ 609.738060][T11997] netlink: 140 bytes leftover after parsing attributes in process `syz.5.2222'. [ 612.021943][ T11] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 616.836839][T12084] FAULT_INJECTION: forcing a failure. [ 616.836839][T12084] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 616.855197][T12084] CPU: 1 PID: 12084 Comm: syz.1.2249 Not tainted syzkaller #0 [ 616.862734][T12084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 616.873132][T12084] Call Trace: [ 616.876444][T12084] [ 616.879663][T12084] dump_stack_lvl+0x188/0x24e [ 616.884456][T12084] ? show_regs_print_info+0x12/0x12 [ 616.889777][T12084] ? load_image+0x400/0x400 [ 616.894675][T12084] ? __lock_acquire+0x7d10/0x7d10 [ 616.899731][T12084] should_fail_ex+0x399/0x4d0 [ 616.904510][T12084] _copy_from_iter+0x1c0/0x1130 [ 616.909395][T12084] ? copyout_mc+0x110/0x110 [ 616.913906][T12084] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 616.919947][T12084] ? lock_chain_count+0x20/0x20 [ 616.924817][T12084] ? _raw_spin_lock_irq+0xb7/0xf0 [ 616.929854][T12084] ? _raw_spin_lock_irqsave+0x100/0x100 [ 616.935530][T12084] ? page_copy_sane+0x4e/0x390 [ 616.940335][T12084] copy_page_from_iter+0x77/0x100 [ 616.945465][T12084] pipe_write+0x87f/0x1b20 [ 616.949913][T12084] ? pipe_read+0x1260/0x1260 [ 616.954528][T12084] ? end_current_label_crit_section+0x14b/0x170 [ 616.960878][T12084] ? common_file_perm+0x171/0x1c0 [ 616.966038][T12084] vfs_write+0x4b1/0xa30 [ 616.970386][T12084] ? file_end_write+0x250/0x250 [ 616.975248][T12084] ? __fget_files+0x43d/0x4b0 [ 616.979942][T12084] ? __fdget_pos+0x1d4/0x360 [ 616.984642][T12084] ? ksys_write+0x71/0x250 [ 616.989087][T12084] ksys_write+0x14c/0x250 [ 616.993457][T12084] ? __ia32_sys_read+0x80/0x80 [ 616.998249][T12084] ? lockdep_hardirqs_on+0x94/0x140 [ 617.003465][T12084] do_syscall_64+0x4c/0xa0 [ 617.007911][T12084] ? clear_bhb_loop+0x60/0xb0 [ 617.012629][T12084] ? clear_bhb_loop+0x60/0xb0 [ 617.017309][T12084] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 617.023245][T12084] RIP: 0033:0x7f430359c819 [ 617.027661][T12084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 617.047323][T12084] RSP: 002b:00007f4304460028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 617.055921][T12084] RAX: ffffffffffffffda RBX: 00007f4303815fa0 RCX: 00007f430359c819 [ 617.064075][T12084] RDX: 00000000fffffdef RSI: 00002000000001c0 RDI: 0000000000000000 [ 617.072243][T12084] RBP: 00007f4304460090 R08: 0000000000000000 R09: 0000000000000000 [ 617.080222][T12084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 617.088199][T12084] R13: 00007f4303816038 R14: 00007f4303815fa0 R15: 00007ffcfadf4e78 [ 617.096270][T12084] [ 621.023717][T12095] netlink: 'syz.2.2254': attribute type 10 has an invalid length. [ 621.409689][ T4271] Bluetooth: hci2: command 0x0406 tx timeout [ 622.208865][T12112] netlink: 168 bytes leftover after parsing attributes in process `syz.4.2257'. [ 624.441906][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.448410][ T1277] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.083438][ T28] INFO: task syz.3.1657:9966 blocked for more than 143 seconds. [ 625.120755][ T28] Not tainted syzkaller #0 [ 625.125773][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 625.197239][ T28] task:syz.3.1657 state:D stack:25424 pid:9966 ppid:4272 flags:0x00004002 [ 625.216894][ T28] Call Trace: [ 625.291038][ T28] [ 625.299009][ T28] __schedule+0x11d1/0x40e0 [ 625.310001][ T28] ? __mutex_lock+0x1ab/0xaf0 [ 625.321266][ T28] ? __sched_text_start+0x8/0x8 [ 625.332260][ T28] ? task_work_cancel+0xa1/0x220 [ 625.345678][ T28] ? task_work_cancel_func+0x210/0x210 [ 625.361191][ T28] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 625.374834][ T28] ? _free_event+0xfd/0x10a0 [ 625.394210][ T28] schedule+0xb9/0x180 [ 625.406684][ T28] _free_event+0x171/0x10a0 [ 625.418702][ T28] ? perf_mmap+0x13d0/0x13d0 [ 625.430068][ T28] ? perf_mmap+0x13d0/0x13d0 [ 625.442391][ T28] perf_event_release_kernel+0x83e/0x8d0 [ 625.456166][ T28] ? __might_sleep+0xd0/0xd0 [ 625.468710][ T28] ? calc_timer_values+0x410/0x410 [ 625.481347][ T28] ? perf_mmap+0x13d0/0x13d0 [ 625.493701][ T28] perf_release+0x37/0x40 [ 625.511107][ T28] __fput+0x22c/0x920 [ 625.521384][ T28] task_work_run+0x1d0/0x260 [ 625.533364][ T28] ? task_work_cancel+0x220/0x220 [ 625.546547][ T28] ? do_raw_spin_unlock+0x11d/0x230 [ 625.562069][ T28] do_exit+0x982/0x2480 [ 625.572367][ T28] ? lock_chain_count+0x20/0x20 [ 625.584673][ T28] ? put_task_struct+0x80/0x80 [ 625.597138][ T28] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 625.621058][ T28] ? lockdep_hardirqs_on+0x94/0x140 [ 625.634889][ T28] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 625.653413][ T28] do_group_exit+0x217/0x2d0 [ 625.665860][ T28] ? _raw_spin_unlock_irq+0x25/0x40 [ 625.680014][ T28] get_signal+0x1272/0x1350 [ 625.692454][ T28] arch_do_signal_or_restart+0xc4/0x1350 [ 625.706069][ T28] ? perf_trace_preemptirq_template+0x268/0x320 [ 625.729737][ T28] ? irqentry_enter+0x33/0x50 [ 625.742547][ T28] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 625.759881][ T28] ? get_sigframe_size+0x10/0x10 [ 625.773078][ T28] ? lock_chain_count+0x20/0x20 [ 625.786694][ T28] ? rcu_is_watching+0x11/0xa0 [ 625.800764][ T28] exit_to_user_mode_loop+0x70/0x110 [ 625.806284][ T28] exit_to_user_mode_prepare+0xee/0x180 [ 625.812225][ T28] syscall_exit_to_user_mode+0x16/0x40 [ 625.817991][ T28] do_syscall_64+0x58/0xa0 [ 625.822602][ T28] ? clear_bhb_loop+0x60/0xb0 [ 625.827596][ T28] ? clear_bhb_loop+0x60/0xb0 [ 625.832762][ T28] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 625.838997][ T28] RIP: 0033:0x7fbc49d9c819 [ 625.843721][ T28] RSP: 002b:00007fbc4acec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 625.853186][ T28] RAX: 000000000000000d RBX: 00007fbc4a015fa0 RCX: 00007fbc49d9c819 [ 625.861393][ T28] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000011 [ 625.869997][ T28] RBP: 00007fbc49e32c91 R08: 0000000000000000 R09: 0000000000000000 [ 625.878194][ T28] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 625.886337][ T28] R13: 00007fbc4a016038 R14: 00007fbc4a015fa0 R15: 00007fff75d6c028 [ 625.904864][ T28] [ 625.924242][ T28] [ 625.924242][ T28] Showing all locks held in the system: [ 625.955388][ T28] 1 lock held by rcu_tasks_kthre/12: [ 625.961956][T12145] netlink: 'syz.5.2268': attribute type 21 has an invalid length. [ 625.967919][ T28] #0: ffffffff8cb2df30 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 [ 626.092233][ T28] 1 lock held by rcu_tasks_trace/13: [ 626.112543][ T28] #0: ffffffff8cb2e750 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 [ 626.143864][ T28] 2 locks held by kworker/0:1/14: [ 626.152125][ T28] #0: ffff888017472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 [ 626.166163][ T28] #1: ffffc90000137d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 [ 626.180930][ T28] 1 lock held by khungtaskd/28: [ 626.186000][ T28] #0: ffffffff8cb2d5a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 [ 626.196566][ T28] 2 locks held by getty/4027: [ 626.206998][ T28] #0: ffff8880300b5098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 [ 626.222216][ T28] #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x429/0x1390 [ 626.233066][ T28] 4 locks held by kworker/u4:7/4341: [ 626.241118][ T28] #0: ffff888017616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 [ 626.251668][ T28] #1: ffffc9000499fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 [ 626.263202][ T28] #2: ffffffff8dd3af10 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 [ 626.272842][ T28] #3: ffffffff8cb33140 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x48/0x600 [ 626.283104][ T28] 2 locks held by syz.1.2256/12099: [ 626.288380][ T28] #0: ffffffff8dd3af10 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x32e/0x5b0 [ 626.297894][ T28] #1: ffffffff8dd47de8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_delete_nets+0xd0/0x370 [ 626.309235][ T28] 2 locks held by syz.0.2265/12133: [ 626.314875][ T28] #0: ffff888054955010 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 [ 626.326777][ T28] #1: ffffffff8cb33278 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 [ 626.342483][ T28] 6 locks held by syz.0.2265/12137: [ 626.348339][ T28] 2 locks held by syz.5.2268/12142: [ 626.353662][ T28] #0: ffffffff8cb82668 (event_mutex){+.+.}-{3:3}, at: perf_trace_destroy+0x2a/0x140 [ 626.367948][ T28] #1: ffffffff8cb33278 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 [ 626.381484][ T28] [ 626.397793][ T28] ============================================= [ 626.397793][ T28] [ 626.406523][ T28] NMI backtrace for cpu 1 [ 626.410973][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 626.418204][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 626.428902][ T28] Call Trace: [ 626.432215][ T28] [ 626.435170][ T28] dump_stack_lvl+0x188/0x24e [ 626.439902][ T28] ? ct_irq_enter_irqson+0x170/0x170 [ 626.445238][ T28] ? show_regs_print_info+0x12/0x12 [ 626.450515][ T28] ? load_image+0x400/0x400 [ 626.455050][ T28] ? vprintk_emit+0x59f/0x6a0 [ 626.459887][ T28] ? nmi_cpu_backtrace+0x1cb/0x460 [ 626.465138][ T28] nmi_cpu_backtrace+0x3e6/0x460 [ 626.470126][ T28] ? nmi_trigger_cpumask_backtrace+0x450/0x450 [ 626.476337][ T28] ? _printk+0xda/0x130 [ 626.480645][ T28] ? load_image+0x400/0x400 [ 626.485191][ T28] ? load_image+0x400/0x400 [ 626.489743][ T28] ? nmi_trigger_cpumask_backtrace+0xf3/0x450 [ 626.495887][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 626.501987][ T28] nmi_trigger_cpumask_backtrace+0x1d4/0x450 [ 626.508000][ T28] watchdog+0xeee/0xf30 [ 626.512179][ T28] ? watchdog+0x1ed/0xf30 [ 626.516528][ T28] kthread+0x29d/0x330 [ 626.520609][ T28] ? hungtask_pm_notify+0x40/0x40 [ 626.525652][ T28] ? kthread_blkcg+0xd0/0xd0 [ 626.530256][ T28] ret_from_fork+0x1f/0x30 [ 626.534822][ T28] [ 626.538815][ T28] Sending NMI from CPU 1 to CPUs 0: [ 626.544099][ C0] NMI backtrace for cpu 0 skipped: idling at default_idle+0xb/0x10 [ 626.545613][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 626.560418][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 626.568021][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 626.578287][ T28] Call Trace: [ 626.581604][ T28] [ 626.584572][ T28] dump_stack_lvl+0x188/0x24e [ 626.589390][ T28] ? memcpy+0x3c/0x60 [ 626.593401][ T28] ? show_regs_print_info+0x12/0x12 [ 626.598812][ T28] ? load_image+0x400/0x400 [ 626.603540][ T28] panic+0x2e5/0x730 [ 626.607467][ T28] ? schedule_preempt_disabled+0x20/0x20 [ 626.613150][ T28] ? bpf_jit_dump+0xd0/0xd0 [ 626.617701][ T28] ? __irq_work_queue_local+0x12c/0x190 [ 626.623295][ T28] ? nmi_trigger_cpumask_backtrace+0x35b/0x450 [ 626.629491][ T28] ? nmi_trigger_cpumask_backtrace+0x360/0x450 [ 626.635687][ T28] watchdog+0xf2d/0xf30 [ 626.639979][ T28] ? watchdog+0x1ed/0xf30 [ 626.644450][ T28] kthread+0x29d/0x330 [ 626.648741][ T28] ? hungtask_pm_notify+0x40/0x40 [ 626.653829][ T28] ? kthread_blkcg+0xd0/0xd0 [ 626.658468][ T28] ret_from_fork+0x1f/0x30 [ 626.662988][ T28] [ 626.666209][ T28] Kernel Offset: disabled [ 626.670642][ T28] Rebooting in 86400 seconds..