last executing test programs: 3.964033579s ago: executing program 1 (id=1856): r0 = socket$kcm(0x10, 0x2, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000003c0)={r1, 0x0, 0x0}, 0x10) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000001500)={&(0x7f00000001c0)="f676ea47185392a40f7aac3e9bb8597e7a0156e7dd1b62ade315de7b9d12d11dd988cc1e15b79da155e5dc57398f9cb2e4a44428571c44b25ea8077028ddcf2ff308b540032094eb714ddc2286fb9a647c4f44cc6553c91bb09dbb8c0389fdab372dd490", &(0x7f00000003c0)=""/4096, &(0x7f00000013c0)="190b228224eee548fa06a9e091b789e8", &(0x7f0000001400)="63341f4882f05cef69ca9cf821160aa5667777a0b13e6772a09091f199d53e2e3cce0b379546fff4231990f2bf2ecc795047f2c828222be1ab8cf5fa4b345011e52fbe0a24dfd8db4f319fb8fcfb1c84b78d3a186b23c5ccc0e3b06296754828e09a02657466f40ea6567a61a5e04f449136bf03b0142463656bb2539c64cbd68b009226a5e9ae6897d4d05ba233afb37223dc8bd2e1bfc5f0111da0997bc97100d2940a7da6ccc4a91fd00d38167a2e32e2d7ada36b30bfa0ae25337904ff4a73aff4b3253e5646b8ca757e3c39d507dec9fbd142da4bb943d07324b4d2b409c12b47d8c31b7e1f2f", 0x3, r1}, 0x38) close(r0) (async) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000380)={0x0, 0x0}) (async) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000880)}, 0x4048841) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904, 0x1000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r4 = socket$kcm(0x23, 0x2, 0x0) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480), 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0xb, 0x0, &(0x7f0000000040)="f4b84de4115d64244a0e83", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) (async) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f00000003c0)={&(0x7f0000000000)=@phonet, 0x80, &(0x7f0000000180)=[{0x0, 0xea}], 0x1}, 0x0) (async) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x4000}, 0x0) (async) recvmsg(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001) (async) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r6, 0x6, 0xd, 0x0, 0xc7) (async) sendmsg$inet(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1}, 0x8001) recvmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x61) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001980)={&(0x7f0000001840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x7, [@restrict={0xa}, @volatile={0x6}, @decl_tag={0x3, 0x0, 0x0, 0x11, 0x1, 0x3}, @ptr={0xf, 0x0, 0x0, 0x2, 0x4}, @float={0xb, 0x0, 0x0, 0x10, 0x2}]}, {0x0, [0x0, 0x5f, 0x2e, 0x0, 0x0]}}, &(0x7f00000018c0)=""/135, 0x5f, 0x87, 0x1, 0xd1d8, 0x10000}, 0x28) 3.684645757s ago: executing program 2 (id=1859): r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x4480, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000780)={0x4, 0x80, 0x2c, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x12000000000, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, r0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$ENABLE_STATS(0x20, &(0x7f0000000000), 0x4) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xfff) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[], 0x50) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYRESHEX=r0, @ANYRES32=r2, @ANYRESHEX, @ANYBLOB="8890b4e26c3e3ea977ef008914439c1f44895fe77cdd8e543a095484994480e8463b1e3b376d58a97eeb501c233753bf647adf9b26d5f0b44b94a7160277a5f1a4d8f4a45376d4e90e5d0f45559d7fbc4a3671bf2bfa1d4a77b5422f0061fed37fabe5e74cf4112971fd70c45c77786d659fa246639c4dd730148b314289bd3559d0d75793b5917c8a54b0774b78de3a673057f0c48e2ccb5b352d610dfc116c2af99b6c15acfbafe54f3e17094fcab3b1b54d3958db23b13d9ee0098112239e969a1a2f9c8764e11acf217ded4ed9d694818019fbad929c40ed8c8502cec41ae0d3c52b27bd0afac660d679a463ec81d3e60a0ae26b77bd7bdcb9b01d", @ANYRES16=r0, @ANYRESHEX, @ANYRES8=r2], 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0xff, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe49, 0x2, @perf_bp={0x0, 0x2}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000500)={0x0, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0xda12000000, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x81, 0x6, 0x2, 0x0, 0x4, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffa, 0x4}}, 0x0, 0x9, 0xffffffffffffffff, 0x8) r3 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r3, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x4008804) sendmsg$kcm(r3, 0x0, 0x8400) sendmsg$inet(r3, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10, 0x0}, 0x0) recvmsg(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/4096, 0x1000}], 0x1}, 0x40010040) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000012006b04000000d86e6c1d000a887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 3.499642111s ago: executing program 2 (id=1860): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000003"], 0x48) syz_clone(0x2900000, &(0x7f0000000a00)="4d73475a0ca4d14368270ddd9e8cd3e54c2ee00827286cbcb26c8b822857a14cdcef26c4a5c3f6690afa67fb5406e6ed69f1e3d55135c7946bd715accbeab0b50bec08301d079b", 0x47, &(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)="4d57203dfae1a356db34c9062e7db7de1acde9baf80500a174ce2926a6ba53754808bd95f0e0c9032f64a3706c8c72ad779a02f0a8be63269044dacb584e9db6e8f2ccd63071461e0906a0702b4b366e33b7febe1f07") (async) syz_clone(0x2900000, &(0x7f0000000a00)="4d73475a0ca4d14368270ddd9e8cd3e54c2ee00827286cbcb26c8b822857a14cdcef26c4a5c3f6690afa67fb5406e6ed69f1e3d55135c7946bd715accbeab0b50bec08301d079b", 0x47, &(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)="4d57203dfae1a356db34c9062e7db7de1acde9baf80500a174ce2926a6ba53754808bd95f0e0c9032f64a3706c8c72ad779a02f0a8be63269044dacb584e9db6e8f2ccd63071461e0906a0702b4b366e33b7febe1f07") bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x4000000, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000008c0)={r0, 0x58, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x6, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="18024eed7bfdffff000000000800000085000000410000009500000000000000d80553167ef22e412d80161f26faa5699925ebc37a670379f831e25c8b2d9172b2f840dbfddce5424f9a05b9176a4c293112871172cd462e77ea85d8e67a5fe50041488dcb4e966267384e0ceb873d6987814fd01f43cf2db8463de93e4233"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) syz_clone(0x3204200, &(0x7f0000000480)="8e6da460424c6c5d4880b7c4caf2750167ad9d6c2dfe2b866f93409a8d25a95864afef29fd2c52bd0366786bcd6ea76ad12b7ac317c6b2f58acf35965c9f0b058441f47329184374fc47a6b8cb65990363ed14f2bc872277794726df730abfe9137147beaf5426230efe06dc29a793d563c7ea4e18ade1436e6c1a20eea7cc849d19b9fb6898a21de89d8af1165ba7a0ade53d264a089aabfd400aa72df51f5ea4f2630e963e18df26dcfe5abbaa912fae885fc10d21e5f9eb1a78211a7279", 0xbf, &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000780)="adecb0ac26b15ac3cdf05a5c04d19b02e1e6e6593caa7b05d08aa1e5416683ff40cc4e5feca896ec53c44680b92402abde2fd2b2121969e9305480da2f91219a75814c9e3cfb93e693de74c3c4e47f027871b679c9f26fcc13b4cdb260a6ca39f1bfd6a257b5a6737b9d8fb1d1f84205d9fee0e04b9a76cdaf4575cc2bc3fd15346561597bf5a693a1a5eac3b31f09f5a1ae5c5206de0f8d150066d89c4f3b555fa83245c0af76c505e306a1de0a84c7d4c0f2b5f2aade88cc") (async) syz_clone(0x3204200, &(0x7f0000000480)="8e6da460424c6c5d4880b7c4caf2750167ad9d6c2dfe2b866f93409a8d25a95864afef29fd2c52bd0366786bcd6ea76ad12b7ac317c6b2f58acf35965c9f0b058441f47329184374fc47a6b8cb65990363ed14f2bc872277794726df730abfe9137147beaf5426230efe06dc29a793d563c7ea4e18ade1436e6c1a20eea7cc849d19b9fb6898a21de89d8af1165ba7a0ade53d264a089aabfd400aa72df51f5ea4f2630e963e18df26dcfe5abbaa912fae885fc10d21e5f9eb1a78211a7279", 0xbf, &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000780)="adecb0ac26b15ac3cdf05a5c04d19b02e1e6e6593caa7b05d08aa1e5416683ff40cc4e5feca896ec53c44680b92402abde2fd2b2121969e9305480da2f91219a75814c9e3cfb93e693de74c3c4e47f027871b679c9f26fcc13b4cdb260a6ca39f1bfd6a257b5a6737b9d8fb1d1f84205d9fee0e04b9a76cdaf4575cc2bc3fd15346561597bf5a693a1a5eac3b31f09f5a1ae5c5206de0f8d150066d89c4f3b555fa83245c0af76c505e306a1de0a84c7d4c0f2b5f2aade88cc") r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}, 0x10c511, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x1) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000"], 0xfdef) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xcc0}, 0x94) (async) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xcc0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1b) (async) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x8}, 0x8000, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1b) perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, 0x3efd7ab4c41335d9, @perf_config_ext={0x2, 0x9}, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, 0x3efd7ab4c41335d9, @perf_config_ext={0x2, 0x9}, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x10, 0x2, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000002340)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000001000000600000000000085003c"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000002340)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000001000000600000000000085003c"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedc0790701757df37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r4, 0x0, 0x0, 0xaa, &(0x7f0000000300), &(0x7f00000006c0)=""/170, 0xffff, 0x0, 0x44, 0x8c, &(0x7f0000000780)="8712673f700e0e0cc3af61e44433c4dac3ad4a7c8ee1763e7c7daae4451955a055811414f1b13a5732dd007e1f4091870a9ce244d44eada8f908452fa26eede3d01879da", &(0x7f0000000800)="8a8a5d55a8cbccb4829c0219ea05c53922755cca84c543f35d4fc2de6b2f0bcff8784436909d58b6c6b1b703398bc6ddfd10826bb749fb05278ffa5f48abc5ac383a23b68545f2ca589eef2e7e712579fb87542a778e23e8f484338e32af471e84d2ac883ad9ccc110f4089ed420268fa0ea769868df92a5e646569d4d0b5663387ae0514f28120e72376877", 0x3, 0x0, 0x4}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f00000002c0)}, 0x20) perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, @perf_bp={0x0, 0x9}, 0x42, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x1ff, 0x0, 0x400000000a8}, 0x0, 0x3, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6tnl0\x00', 0x210}) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89f1, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.056591753s ago: executing program 1 (id=1861): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/32], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) close(0xffffffffffffffff) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000a40)={@fallback, 0xffffffffffffffff, 0x2f}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={@cgroup, 0xffffffffffffffff, 0x2f, 0x18, 0x4}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$kcm(0x2, 0x922000000001, 0x106) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, 0x0, 0x0) recvmsg$unix(r2, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x41, &(0x7f0000000040)=r4, 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000004850000008600000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70200000000e3008500000017000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) 2.924860146s ago: executing program 3 (id=1862): syz_clone(0x8c001000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x40802000, &(0x7f0000000000)="416cb2a6c4f38b82d8a45ad55e237021f949262735d1b00315b05fbd13a0e6c4fad12e06b9ad87bd2a1cb77efe6bfb775f367d56d58e7b2b0a198d172791bd6e429b140c4e6a2b5d3d7ed10a0007cd047708b55379ed57fedce77120342e5cd504f98fa580b8aac431dd38c5eaeace2d88ed81460163b85af63e473dfe8af281a8f2bb784208c6a494ec18aa21ff7a7c0ea603b05b6554bb47d18c836930509f4091a16407ea7e9bf8fa31210da8bc7b63e50da8d1d1f15c77fda9864d542b0ff641aed3846eb850120598527146cb32777d8ac40fa1dee94940f3d583dd6b9fb2b67a610a66063e04e374f6642294aea48176454ccdcafaef4f671813", 0xfd, &(0x7f0000000100), &(0x7f0000000140), &(0x7f00000001c0)="317f24a1745423500a95a0b9b589") 2.865402527s ago: executing program 2 (id=1863): bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000007c0)={{}, 0x0, &(0x7f0000000780)='%pI4 \x00'}, 0x20) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0x100000001}, 0x4000, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000800)) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$kcm(0x2c, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events.local\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x11b, 0x6, &(0x7f0000000000)=r2, 0x4) openat$cgroup_freezer_state(r2, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r3}, &(0x7f00000007c0), &(0x7f0000000640)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r3, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a40)={{r4}, &(0x7f0000000740), &(0x7f0000000a00)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000006b113200000000008510000002000000850000006c00000095000000000000009500a505"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x94) 2.516843846s ago: executing program 0 (id=1865): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={0x1}, 0x4) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, &(0x7f0000000100)=r0, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xd01, 0x80040033, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r1) r2 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r2, 0x84, 0x8, 0x0, 0x0) 2.414365629s ago: executing program 0 (id=1866): bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x9922, 0x2, 0x0, 0x0, 0xe, 0x0, 0x9}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) write$cgroup_int(r2, 0x0, 0x0) write$cgroup_int(r2, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2, @perf_bp={0x0}, 0xc800, 0x40, 0xfffffffc, 0x9, 0xb0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x90, 0x0, &(0x7f0000000100)="b9ff03316844268cb89e14f088a847e0ffff00124000632f77fbac14fe1688a8030a07080403fe80000020006558845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b6206368", 0x0, 0x8024, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e0000000000000001"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x27, 0x8, 0x0, &(0x7f0000000180)="0005000000000001", 0x0, 0x405, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = perf_event_open(&(0x7f0000000b00)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000003c0)="d80000001a00810a1d08007b490d4f1e81f8d804000100ff05142603600e12080005007a01e300a80016002000034004000000035c0461c9d67f6f940071342e8728a84942de4fe3aefb8000a007a290457f01e84460dd46302af989b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025c4679ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e78", 0xd8}], 0x1}, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r6, &(0x7f0000000180)=ANY=[@ANYRES8=r1, @ANYBLOB="3ee901"], 0x9a) 2.36696226s ago: executing program 3 (id=1867): r0 = socket$kcm(0x2, 0x1000000000000002, 0x0) (async) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) (async) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000000)={0x3, 0x80, 0x0, 0x8, 0x6, 0xb, 0x0, 0x6, 0x70180, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1000007, 0x2, @perf_config_ext={0xffff0880b890dffc, 0x4}, 0x18046, 0x4000000000000009, 0x4, 0x8, 0x22, 0xffffffff, 0x1, 0x0, 0x7, 0x0, 0x6}) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)}, 0x9cdc2384056b48b8) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="0000186df4b1768c36153d42", @ANYRES32, @ANYBLOB="1c00000000000300000000000000010045"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'tunl0\x00'}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x30000, 0x0) ioctl$TUNSETVNETBE(r2, 0x400454de, &(0x7f0000000140)) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f3, &(0x7f0000000080)) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000100)) sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e1f, @multicast2=0xe0000001}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000040)="00446916ab", 0xffe3}], 0x1, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xe}, @multicast2}}}], 0x20}, 0x7000000) 2.262565943s ago: executing program 2 (id=1868): r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x4480, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000780)={0x4, 0x80, 0x2c, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x12000000000, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, r0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$ENABLE_STATS(0x20, &(0x7f0000000000), 0x4) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xfff) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[], 0x50) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYRESHEX=r0, @ANYRES32=r2, @ANYRESHEX, @ANYBLOB="8890b4e26c3e3ea977ef008914439c1f44895fe77cdd8e543a095484994480e8463b1e3b376d58a97eeb501c233753bf647adf9b26d5f0b44b94a7160277a5f1a4d8f4a45376d4e90e5d0f45559d7fbc4a3671bf2bfa1d4a77b5422f0061fed37fabe5e74cf4112971fd70c45c77786d659fa246639c4dd730148b314289bd3559d0d75793b5917c8a54b0774b78de3a673057f0c48e2ccb5b352d610dfc116c2af99b6c15acfbafe54f3e17094fcab3b1b54d3958db23b13d9ee0098112239e969a1a2f9c8764e11acf217ded4ed9d694818019fbad929c40ed8c8502cec41ae0d3c52b27bd0afac660d679a463ec81d3e60a0ae26b77bd7bdcb9b01d", @ANYRES16=r0, @ANYRESHEX, @ANYRES8=r2], 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0xff, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe49, 0x2, @perf_bp={0x0, 0x2}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000500)={0x0, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0xda12000000, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x81, 0x6, 0x2, 0x0, 0x4, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffa, 0x4}}, 0x0, 0x9, 0xffffffffffffffff, 0x8) r3 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r3, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x4008804) sendmsg$kcm(r3, 0x0, 0x8400) sendmsg$inet(r3, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10, 0x0}, 0x0) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000012006b04000000d86e6c1d000a887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2.132784177s ago: executing program 0 (id=1869): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000040)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, 0x0, 0x0, 0x0, 0x3d}, 0x4044890) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a118001500060014ea000000120800030043000040a8002b000a", 0x35}], 0x1}, 0x20000880) (async) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) (async) r1 = gettid() bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000200)={0x2}, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0xffffffffffffffff}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000600142603600e1208000f0000000401a80016002000034004000200035c0461c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0b42a1a83", 0xd4}, {&(0x7f00000014c0)="5c9ebe30", 0x4}], 0x2}, 0x0) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000580)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000005000000030000000100000fffffff0307ffffff030000000500001200000004000000000000302e"], 0x0, 0x3d, 0x0, 0x0, 0x100000}, 0x28) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="b4020000000000007911300000000000850000002e0000009500000000000000358bb9f43d86b13600"/50], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xc5, &(0x7f0000000300)=""/197, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000002c0), 0xffffffffffffff35}, 0x54) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b11d25a806f8c6394f90524fc60040f030048000000053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) socket$kcm(0x29, 0x5, 0x0) 2.066099498s ago: executing program 1 (id=1870): r0 = socket$kcm(0xa, 0x2, 0x3a) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000880)="5c00000012006bab9a", 0x9}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$kcm(r0, &(0x7f0000000440)={&(0x7f0000000800)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000780)="80005b020eaa4da2", 0xfdef}], 0x1, 0x0, 0x0, 0x900}, 0x0) recvmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100), 0xb, 0x0, 0x900}, 0x0) 1.928494402s ago: executing program 3 (id=1871): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001b80)=""/4118, 0x1016}, {&(0x7f00000039c0)=""/4083, 0xff3}, {&(0x7f00000006c0)=""/235, 0xeb}, {&(0x7f0000000400)=""/61, 0x3d}, {&(0x7f0000001a80)=""/219, 0xdb}], 0x5}, 0x22) recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0xffc3, 0x0, 0x0, 0x0, 0x0, 0xfffd}, 0x80) 1.620312629s ago: executing program 2 (id=1872): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000004a00)=[{&(0x7f0000000440)="d8000000050081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003400220000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd4000000004c94215d121cd0c53e27eec317", 0xd8}], 0x1}, 0x800) 1.492639113s ago: executing program 0 (id=1873): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x15, 0x2112, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f89c5e0254db814583000000b703000000000000850000000600000095730b99beeaadf37bad1423637bcc377815e77f63b51841baf6afe171e5452298f913417433f0e82ee47302"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x657a, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x46, 0x0, 0xf0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x8, &(0x7f0000000140)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x4e, 0x1, 0x0, 0x0, 0x0, 0x210e, 0x480, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x4ac269b8, 0xaea}, 0x4010, 0x30, 0x10000, 0x8, 0x3, 0x90000000, 0x6, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x40082406, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x5}, 0x0, 0x0, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_open_procfs$namespace(0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x0, 0x33, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_netprio_ifpriomap(r6, &(0x7f0000000040), 0x2, 0x0) r8 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @empty, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="10000000000000802900000037000000e52eff6d90807b4b61872efa"], 0x10}, 0x97) write$cgroup_netprio_ifpriomap(r7, &(0x7f0000000200)=ANY=[@ANYBLOB='gretap0 8'], 0xa) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'sit0\x00', @local}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000040)={'sit0\x00', @random="4f33e363a4b1"}) 1.456897083s ago: executing program 3 (id=1874): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) setsockopt$sock_attach_bpf(r0, 0x6, 0xd, &(0x7f0000000000), 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x9, 0x25, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000730e0000000000004100000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083100000bf0900000000000055090100000020009500000002000000184a0000fcffffff000000000000020095000000000000003521ffff04000000950000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ff0000008500000006000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x2, 0x9f, &(0x7f0000000300)=""/159, 0x40f00, 0x15, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x1, 0x2, 0x3, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000780)={r1, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000004c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, &(0x7f0000000500)=[0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xa9, &(0x7f0000000580)=[{}], 0x8, 0x10, &(0x7f00000005c0), &(0x7f0000000600), 0x8, 0x8d, 0x8, 0x8, &(0x7f0000000640)}}, 0x10) 1.20333974s ago: executing program 2 (id=1875): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x2, 0x1, 0x84) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, r0, 0x1, 0x2, 0x2}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) recvmsg(r2, &(0x7f0000000940)={&(0x7f0000000680)=@nfc, 0x80, &(0x7f0000000900)=[{&(0x7f0000000700)=""/148, 0x94}, {&(0x7f00000007c0)=""/4, 0x4}, {&(0x7f0000000800)=""/201, 0xc9}], 0x3}, 0x20021) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000080040000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000000f000000bf09000000000000550901000074f6967d00000000000000180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r3, &(0x7f0000000640)={&(0x7f0000000200)=@isdn={0x22, 0x0, 0x86, 0x4, 0x4}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000300)="d4ceeed126df46684d889eef29437068946b60e6f6783f13127f1ce2a5f6826f1e6d8c736690f48e57129e03407a5f4d16621c1205ab44ede34e7829c0da81e18e8672eb4866e75289fcb4bbf9643059cf576580ecabec7d75f62fc68e95c1db30b4eb6607993c216c572aa998a2afe3a2b18c1bf6eed26292e72bdd6ff10b37e8652ad76998cdb3120bb92c69a174d8b45cbc058b2e762ba1076a783b1ad6c3e5a95ac8868c3bb50ad58e0d81596a34e22c47e427424b39e84da8", 0xbb}, {&(0x7f00000003c0)="fec97f7c3912a89e8d120ade08a1357c08ac09396ae63011", 0x18}, {&(0x7f0000000400)="234d6d7bece7b94b00541a4bc8141ec54c8ff88411dbb80d40dea71b34a67ae7314e942dcfec60c796f2045791d9fef368d212", 0x33}, {&(0x7f0000000500)="682255f6929d0a28b77e257e22bc8ec3cef8fc6585c1633b606b7c4cc73fed5ddf1acfa17c1b5140015f3613a1040d75de2deb3179b522d0e10c96edcbc2812dbc", 0x41}], 0x4, &(0x7f00000005c0)=[@mark={{0x14, 0x1, 0x24, 0x7ad}}, @timestamping={{0x14, 0x1, 0x25, 0x100}}, @txtime={{0x18, 0x1, 0x3d, 0xbc5c}}, @timestamping={{0x14, 0x1, 0x25, 0x1ff}}, @mark={{0x14, 0x1, 0x24, 0x3}}], 0x78}, 0x4000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000b00)={r1, 0x58, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000d40)={r2, 0x20, &(0x7f0000000d00)={&(0x7f0000000b80)=""/170, 0xaa, 0x0, &(0x7f0000000c40)=""/182, 0xb6}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0x1f, 0x8, &(0x7f0000000100)=@raw=[@printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}], &(0x7f0000000280)='syzkaller\x00', 0x2, 0x5d, &(0x7f0000000a00)=""/93, 0x40f00, 0x2c, '\x00', r4, @fallback=0x2d, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000b40)={0x0, 0x9, 0x5, 0x390}, 0x10, r5, 0xffffffffffffffff, 0x0, &(0x7f0000000d80)=[r1], 0x0, 0x10, 0x2}, 0x94) 972.661426ms ago: executing program 1 (id=1876): bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000007c0)={{}, 0x0, &(0x7f0000000780)='%pI4 \x00'}, 0x20) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0x100000001}, 0x4000, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000800)) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$kcm(0x2c, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events.local\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x11b, 0x6, &(0x7f0000000000)=r2, 0x4) openat$cgroup_freezer_state(r2, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r3}, &(0x7f00000007c0), &(0x7f0000000640)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r3, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a40)={{r4}, &(0x7f0000000740), &(0x7f0000000a00)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000006b113200000000008510000002000000850000006c00000095000000000000009500a50500"], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x94) 769.053331ms ago: executing program 3 (id=1877): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x4}}}, 0x80, &(0x7f0000000840)=[{0x0, 0x55}, {&(0x7f0000000440)="495bb4d8379fd36a26b300088c007d9f97ce2a31951a49427754a4ca6d692b1d690154ecfb18c95adce65b9dda0ed4864a9b3af06f81c3e2a1927565625326d65e6dbe2ae1f3c5befac6b5bef16dd86ad140f1908b"}, {&(0x7f00000004c0)="26bb7c3986b4e1c1dc15cc4e93f79fe8402e127d168fecc13d872f2bd6c60af82748bd59487a3bae4f325e776b893e29030dcf1794fd7a399566daaeb988177b64a6d4ffa42eebce44690e01f429c89359475d6ef17f"}, {&(0x7f0000000540)="7bccc625b34f5db6e9ff8f54939db292ce4af60317fde51d40dd08fe7aab6669a8939dca89114dc7c4e7ec932acf4a87d3a6fdf27f07ad51b7f6"}, {&(0x7f0000000a80)="4ded0d2fcaf737dc6b1a84101660a7a6301eca15488366bf3dbf255d3979f1e9773c0f327e23de80e195ca15a28cdff44ac6a013baffe234595a2f748622ad7013e3448743eec8fb0983febecf12c5e0c0c531b1c081fd65eb5c4bbcc1a1b607bf7d0621f932a3351a9f062d44631dd4f745e84e8bfd69772ed876b890a6e7dac164007f956bd069f92835af21326946c492df50c6b9dc9ca80420e33b3c89f888c9002338cf4f3bcfb88bc6ab71d9db167058f323ce895da1a7d04f69"}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec76064bef2f000000fb71caef932f3889d1fdda5b57000000860f5878437ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110700000094412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0xff00) 560.215026ms ago: executing program 1 (id=1878): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/32], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) close(0xffffffffffffffff) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000a40)={@fallback, 0xffffffffffffffff, 0x2f}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={@cgroup, 0xffffffffffffffff, 0x2f, 0x18, 0x4}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$kcm(0x2, 0x922000000001, 0x106) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001780)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r2, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x41, &(0x7f0000000040), 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000004850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70200000000e3008500000017000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) 424.53379ms ago: executing program 1 (id=1879): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0xf2ee, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000940)={0x1, 0x80, 0x0, 0x6, 0x2, 0x0, 0x0, 0x5d2f, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x9, 0x8}, 0x1020, 0x2, 0x80, 0x3, 0x0, 0x4000000, 0x2020, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x11, 0x200000000000002, 0x300) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xb, &(0x7f0000000480)=@raw=[@generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @cb_func={0x18, 0x4, 0x4, 0x0, 0xfffffffffffffff8}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair(0x1, 0x4, 0x0, &(0x7f0000000000)) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="18020000fffdffdf00000000000000008500000041000000850000002a00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x11, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000100"/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000000), &(0x7f0000000140)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=r2], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xbf}, 0x0, 0x1, 0xffffffffffffffff, 0x1) socket$kcm(0x2c, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[], 0x0}, 0x94) close(r4) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x1ff) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000090000000000000003000000850000001300000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r5, 0x0, 0x16, 0x0, &(0x7f00000008c0)="c1dfb080cd21d308098e000081007e2288a8849088a8", 0x0, 0x8006, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r6}, &(0x7f0000000200)=0xa00, &(0x7f00000003c0)}, 0x20) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="020000000400"/20, @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="030000000100"/28], 0x50) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r7}, &(0x7f0000000200), &(0x7f00000003c0)='%ps \x00'}, 0x20) 357.235391ms ago: executing program 3 (id=1880): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) close(0x3) bpf$MAP_CREATE(0x0, 0x0, 0x48) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) openat$cgroup_devices(r0, 0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0xc00, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1f, 0x15, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000fcffffff00000000090000001801", @ANYRES32, @ANYBLOB="0000000000000000b7080000040000007b8af8ff00000000bfa200000000000007020000f8"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x11}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100008}, 0x94) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000500)=""/4096, 0x1000}], 0x1}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r3, &(0x7f0000000040)={0x0, 0xa, &(0x7f0000000100)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002d000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff00}, 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 354.465361ms ago: executing program 0 (id=1888): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001140)={&(0x7f0000001300)=@in6={0xa, 0x4e22, 0x3, @mcast2={0xff, 0x5}, 0xd}, 0x80, 0x0}, 0x24048844) 0s ago: executing program 0 (id=1881): bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x200, 0x8}, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x8, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0xc}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000680)='%pI4 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r1, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x29, &(0x7f00000006c0)=ANY=[@ANYBLOB="1808fff800000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000fcffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a5000000b7080000000000007b8af8ff00000000b7080000b61e00007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a5000000de9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) kernel console output (not intermixed with test programs): aa/0x120 [ 221.879050][ T8270] ? __lock_acquire+0x7d80/0x7d80 [ 221.883036][ T8274] tap0: tun_chr_ioctl cmd 1074025692 [ 221.884095][ T8270] should_fail_ex+0x394/0x4c0 [ 221.894093][ T8270] _copy_from_user+0x2f/0xe0 [ 221.898723][ T8270] __sys_bpf+0x23e/0x890 [ 221.903126][ T8270] ? bpf_link_show_fdinfo+0x390/0x390 [ 221.908560][ T8270] ? lock_chain_count+0x20/0x20 [ 221.913459][ T8270] __x64_sys_bpf+0x7c/0x90 [ 221.917917][ T8270] do_syscall_64+0x55/0xb0 [ 221.922370][ T8270] ? clear_bhb_loop+0x40/0x90 [ 221.927088][ T8270] ? clear_bhb_loop+0x40/0x90 [ 221.931830][ T8270] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 221.937884][ T8270] RIP: 0033:0x7fe86fd9e0d9 [ 221.942323][ T8270] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 221.961938][ T8270] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 221.970351][ T8270] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 221.978343][ T8270] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 221.986331][ T8270] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 221.994309][ T8270] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 222.002295][ T8270] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 222.010272][ T8270] [ 222.362219][ T8286] netlink: 'syz.0.807': attribute type 29 has an invalid length. [ 222.372374][ T8286] netlink: 'syz.0.807': attribute type 29 has an invalid length. [ 222.397980][ T8286] netlink: 'syz.0.807': attribute type 29 has an invalid length. [ 222.418444][ T8286] netlink: 'syz.0.807': attribute type 29 has an invalid length. [ 222.989857][ T8294] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.810'. [ 223.014692][ T8297] netlink: 132 bytes leftover after parsing attributes in process `syz.0.810'. [ 223.035070][ T8294] openvswitch: netlink: Tunnel attr 0 has unexpected len 5 expected 8 [ 223.118389][ T8299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 223.244815][ T8305] netlink: 'syz.3.813': attribute type 4 has an invalid length. [ 223.252483][ T8305] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.813'. [ 223.330049][ T8308] netlink: 'syz.1.816': attribute type 10 has an invalid length. [ 223.510480][ T8315] netlink: 'syz.1.818': attribute type 10 has an invalid length. [ 223.523729][ T8315] netlink: 40 bytes leftover after parsing attributes in process `syz.1.818'. [ 224.774563][ T8330] netlink: 'syz.0.823': attribute type 2 has an invalid length. [ 224.784514][ T8329] netlink: 17259 bytes leftover after parsing attributes in process `syz.0.823'. [ 224.794617][ T8330] netlink: 17259 bytes leftover after parsing attributes in process `syz.0.823'. [ 226.168776][ T8319] validate_nla: 1 callbacks suppressed [ 226.168787][ T8319] netlink: 'syz.1.820': attribute type 10 has an invalid length. [ 226.182240][ T8319] netlink: 65015 bytes leftover after parsing attributes in process `syz.1.820'. [ 226.362193][ T8338] netlink: 'syz.1.826': attribute type 10 has an invalid length. [ 226.706545][ T8350] netlink: 15974 bytes leftover after parsing attributes in process `syz.1.829'. [ 227.181188][ T8359] netlink: 'syz.3.832': attribute type 29 has an invalid length. [ 227.199656][ T8359] netlink: 'syz.3.832': attribute type 29 has an invalid length. [ 227.218594][ T8359] netlink: 'syz.3.832': attribute type 29 has an invalid length. [ 227.236810][ T8359] netlink: 'syz.3.832': attribute type 29 has an invalid length. [ 227.532439][ T8371] syzkaller0: entered promiscuous mode [ 227.541300][ T8371] syzkaller0: entered allmulticast mode [ 227.562494][ T8370] netlink: 'syz.1.837': attribute type 10 has an invalid length. [ 227.583326][ T8378] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.838'. [ 227.604590][ T8378] netlink: 'syz.2.838': attribute type 9 has an invalid length. [ 227.613908][ T8378] netlink: 'syz.2.838': attribute type 23 has an invalid length. [ 227.629013][ T8378] netlink: 156008 bytes leftover after parsing attributes in process `syz.2.838'. [ 229.468415][ T8396] netlink: 'syz.1.846': attribute type 29 has an invalid length. [ 230.124775][ T8422] FAULT_INJECTION: forcing a failure. [ 230.124775][ T8422] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.148015][ T8422] CPU: 0 PID: 8422 Comm: syz.0.858 Not tainted syzkaller #0 [ 230.155364][ T8422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 230.165436][ T8422] Call Trace: [ 230.168719][ T8422] [ 230.171654][ T8422] dump_stack_lvl+0x18c/0x250 [ 230.176347][ T8422] ? show_regs_print_info+0x20/0x20 [ 230.181558][ T8422] ? load_image+0x420/0x420 [ 230.186062][ T8422] ? __might_fault+0xaa/0x120 [ 230.190735][ T8422] ? __lock_acquire+0x7d80/0x7d80 [ 230.195759][ T8422] ? __virt_addr_valid+0x10c/0x380 [ 230.200873][ T8422] should_fail_ex+0x394/0x4c0 [ 230.205554][ T8422] _copy_to_user+0x2f/0xa0 [ 230.209970][ T8422] __htab_map_lookup_and_delete_batch+0x1061/0x1400 [ 230.216577][ T8422] ? __fget_files+0x28/0x460 [ 230.221179][ T8422] ? jhash+0x740/0x740 [ 230.225251][ T8422] ? __fdget+0x180/0x210 [ 230.229496][ T8422] ? htab_map_lookup_and_delete_elem+0x40/0x40 [ 230.235647][ T8422] bpf_map_do_batch+0x48c/0x600 [ 230.240497][ T8422] ? bpf_lsm_xfrm_policy_delete_security+0x10/0x10 [ 230.247004][ T8422] __sys_bpf+0x78c/0x890 [ 230.251249][ T8422] ? bpf_link_show_fdinfo+0x390/0x390 [ 230.256632][ T8422] ? lock_chain_count+0x20/0x20 [ 230.261492][ T8422] __x64_sys_bpf+0x7c/0x90 [ 230.265901][ T8422] do_syscall_64+0x55/0xb0 [ 230.270313][ T8422] ? clear_bhb_loop+0x40/0x90 [ 230.274984][ T8422] ? clear_bhb_loop+0x40/0x90 [ 230.279658][ T8422] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 230.285545][ T8422] RIP: 0033:0x7fe0ce59e0d9 [ 230.289955][ T8422] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.309560][ T8422] RSP: 002b:00007fe0cf3e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 230.317975][ T8422] RAX: ffffffffffffffda RBX: 00007fe0ce825fa0 RCX: 00007fe0ce59e0d9 [ 230.325946][ T8422] RDX: 0000000000000038 RSI: 0000200000000800 RDI: 0000000000000019 [ 230.333911][ T8422] RBP: 00007fe0cf3e9090 R08: 0000000000000000 R09: 0000000000000000 [ 230.341883][ T8422] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 230.349857][ T8422] R13: 00007fe0ce826038 R14: 00007fe0ce825fa0 R15: 00007ffc113b1958 [ 230.357839][ T8422] [ 230.970792][ T8448] netlink: 144 bytes leftover after parsing attributes in process `syz.0.868'. [ 231.392410][ T8448] team0: Port device team_slave_0 removed [ 231.451866][ T8448] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 231.651986][ T8448] syz.0.868 (8448) used greatest stack depth: 18984 bytes left [ 231.754712][ T8464] netlink: 14 bytes leftover after parsing attributes in process `syz.3.872'. [ 231.792338][ T8464] hsr_slave_0: left promiscuous mode [ 231.819143][ T8464] hsr_slave_1: left promiscuous mode [ 231.920927][ T8474] validate_nla: 5 callbacks suppressed [ 231.920943][ T8474] netlink: 'syz.0.874': attribute type 10 has an invalid length. [ 235.279940][ T8508] netlink: 'syz.2.885': attribute type 10 has an invalid length. [ 235.526669][ T8512] netlink: 132 bytes leftover after parsing attributes in process `syz.3.887'. [ 235.991752][ T8537] netlink: 'syz.2.895': attribute type 2 has an invalid length. [ 236.013111][ T8537] netlink: 17259 bytes leftover after parsing attributes in process `syz.2.895'. [ 236.308999][ T8545] netlink: 'syz.2.898': attribute type 10 has an invalid length. [ 236.349575][ T8543] netlink: 128 bytes leftover after parsing attributes in process `syz.3.897'. [ 236.384768][ T8543] A link change request failed with some changes committed already. Interface 26±ÿÿÿÿa–ïD may have been left with an inconsistent configuration, please check. [ 236.698728][ T8559] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 236.769161][ T8563] FAULT_INJECTION: forcing a failure. [ 236.769161][ T8563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 236.791087][ T8563] CPU: 1 PID: 8563 Comm: syz.2.907 Not tainted syzkaller #0 [ 236.798439][ T8563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.800866][ T8560] bridge0: port 3(team0) entered disabled state [ 236.808502][ T8563] Call Trace: [ 236.808515][ T8563] [ 236.808524][ T8563] dump_stack_lvl+0x18c/0x250 [ 236.808553][ T8563] ? show_regs_print_info+0x20/0x20 [ 236.808571][ T8563] ? load_image+0x420/0x420 [ 236.808594][ T8563] ? __might_fault+0xaa/0x120 [ 236.808612][ T8563] ? __lock_acquire+0x7d80/0x7d80 [ 236.808639][ T8563] should_fail_ex+0x394/0x4c0 [ 236.808665][ T8563] _copy_from_iter+0x1cd/0x1290 [ 236.808690][ T8563] ? rcu_is_watching+0x15/0xb0 [ 236.808718][ T8563] ? copyout_mc+0x70/0x70 [ 236.808738][ T8563] ? __virt_addr_valid+0x10c/0x380 [ 236.808760][ T8563] ? __virt_addr_valid+0x10c/0x380 [ 236.808782][ T8563] ? __virt_addr_valid+0x10c/0x380 [ 236.808807][ T8563] ? __check_object_size+0x4fc/0xa40 [ 236.808830][ T8563] netlink_sendmsg+0x76b/0xbf0 [ 236.808857][ T8563] ? netlink_getsockopt+0x590/0x590 [ 236.808878][ T8563] ? apparmor_socket_sendmsg+0x8e/0x330 [ 236.808900][ T8563] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 236.808921][ T8563] ? security_socket_sendmsg+0x80/0xa0 [ 236.808939][ T8563] ? netlink_getsockopt+0x590/0x590 [ 236.808959][ T8563] ____sys_sendmsg+0x61b/0x980 [ 236.808985][ T8563] ? __asan_memset+0x22/0x40 [ 236.809009][ T8563] ? __sys_sendmsg_sock+0x30/0x30 [ 236.809026][ T8563] ? __import_iovec+0x5f2/0x850 [ 236.809057][ T8563] ? import_iovec+0x73/0xa0 [ 236.809084][ T8563] ___sys_sendmsg+0x2a6/0x360 [ 236.809103][ T8563] ? get_pid_task+0x20/0x1e0 [ 236.809130][ T8563] ? __sys_sendmsg+0x2b0/0x2b0 [ 236.809168][ T8563] ? __lock_acquire+0x7d80/0x7d80 [ 236.809213][ T8563] __se_sys_sendmsg+0x1d0/0x2c0 [ 236.809236][ T8563] ? __x64_sys_sendmsg+0x80/0x80 [ 236.809269][ T8563] ? lockdep_hardirqs_on+0x98/0x150 [ 236.809296][ T8563] do_syscall_64+0x55/0xb0 [ 236.809313][ T8563] ? clear_bhb_loop+0x40/0x90 [ 236.809332][ T8563] ? clear_bhb_loop+0x40/0x90 [ 236.809353][ T8563] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 236.809371][ T8563] RIP: 0033:0x7fcbd639e0d9 [ 236.809389][ T8563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 236.809404][ T8563] RSP: 002b:00007fcbd7222028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 236.809425][ T8563] RAX: ffffffffffffffda RBX: 00007fcbd6625fa0 RCX: 00007fcbd639e0d9 [ 236.809438][ T8563] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 236.809450][ T8563] RBP: 00007fcbd7222090 R08: 0000000000000000 R09: 0000000000000000 [ 236.809461][ T8563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 236.809472][ T8563] R13: 00007fcbd6626038 R14: 00007fcbd6625fa0 R15: 00007ffedad53338 [ 236.809508][ T8563] [ 237.158630][ T8560] bridge_slave_1: left allmulticast mode [ 237.169006][ T8560] bridge_slave_1: left promiscuous mode [ 237.178172][ T8560] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.218424][ T8560] bridge_slave_0: left allmulticast mode [ 237.226371][ T8560] bridge_slave_0: left promiscuous mode [ 237.239221][ T8560] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.482592][ T8569] netlink: 'syz.2.910': attribute type 19 has an invalid length. [ 237.492621][ T8569] netlink: 14552 bytes leftover after parsing attributes in process `syz.2.910'. [ 237.697799][ T8581] FAULT_INJECTION: forcing a failure. [ 237.697799][ T8581] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 237.735046][ T8581] CPU: 0 PID: 8581 Comm: syz.1.914 Not tainted syzkaller #0 [ 237.742451][ T8581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.752581][ T8581] Call Trace: [ 237.755934][ T8581] [ 237.758936][ T8581] dump_stack_lvl+0x18c/0x250 [ 237.763713][ T8581] ? show_regs_print_info+0x20/0x20 [ 237.768990][ T8581] ? load_image+0x420/0x420 [ 237.773589][ T8581] ? __might_fault+0xaa/0x120 [ 237.778358][ T8581] ? __lock_acquire+0x7d80/0x7d80 [ 237.783500][ T8581] should_fail_ex+0x394/0x4c0 [ 237.788293][ T8581] _copy_from_iter+0x1cd/0x1290 [ 237.793244][ T8581] ? rcu_is_watching+0x15/0xb0 [ 237.798111][ T8581] ? copyout_mc+0x70/0x70 [ 237.802512][ T8581] ? __virt_addr_valid+0x10c/0x380 [ 237.807744][ T8581] ? __virt_addr_valid+0x10c/0x380 [ 237.812934][ T8581] ? __virt_addr_valid+0x10c/0x380 [ 237.818154][ T8581] ? __check_object_size+0x4fc/0xa40 [ 237.823532][ T8581] netlink_sendmsg+0x76b/0xbf0 [ 237.828432][ T8581] ? netlink_getsockopt+0x590/0x590 [ 237.833718][ T8581] ? apparmor_socket_sendmsg+0x8e/0x330 [ 237.839338][ T8581] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 237.844677][ T8581] ? security_socket_sendmsg+0x80/0xa0 [ 237.850182][ T8581] ? netlink_getsockopt+0x590/0x590 [ 237.855453][ T8581] ____sys_sendmsg+0x61b/0x980 [ 237.860294][ T8581] ? __asan_memset+0x22/0x40 [ 237.864942][ T8581] ? __sys_sendmsg_sock+0x30/0x30 [ 237.870014][ T8581] ? __import_iovec+0x5f2/0x850 [ 237.874969][ T8581] ? import_iovec+0x73/0xa0 [ 237.879559][ T8581] ___sys_sendmsg+0x2a6/0x360 [ 237.884315][ T8581] ? __sys_sendmsg+0x2b0/0x2b0 [ 237.889212][ T8581] ? __lock_acquire+0x7d80/0x7d80 [ 237.894384][ T8581] __se_sys_sendmsg+0x1d0/0x2c0 [ 237.896316][ T8578] netlink: 'syz.2.913': attribute type 10 has an invalid length. [ 237.899281][ T8581] ? __x64_sys_sendmsg+0x80/0x80 [ 237.899376][ T8581] ? lockdep_hardirqs_on+0x98/0x150 [ 237.899420][ T8581] do_syscall_64+0x55/0xb0 [ 237.899444][ T8581] ? clear_bhb_loop+0x40/0x90 [ 237.899468][ T8581] ? clear_bhb_loop+0x40/0x90 [ 237.899501][ T8581] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.899523][ T8581] RIP: 0033:0x7fe86fd9e0d9 [ 237.941602][ T8581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.961271][ T8581] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 237.969750][ T8581] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 237.977771][ T8581] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000006 [ 237.985800][ T8581] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 237.993825][ T8581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 238.001848][ T8581] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 238.009947][ T8581] [ 238.017421][ T8579] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 238.556903][ T8594] syzkaller0: entered promiscuous mode [ 238.563418][ T8594] syzkaller0: entered allmulticast mode [ 238.851632][ T8621] netlink: 121460 bytes leftover after parsing attributes in process `syz.0.927'. [ 240.113868][ T8617] netlink: 'syz.1.925': attribute type 10 has an invalid length. [ 240.124567][ T8621] netlink: 21068 bytes leftover after parsing attributes in process `syz.0.927'. [ 240.134164][ T8621] tipc: Started in network mode [ 240.139040][ T8621] tipc: Node identity b, cluster identity 73 [ 240.145370][ T8621] tipc: Node number set to 11 [ 240.231623][ T8624] netlink: 60 bytes leftover after parsing attributes in process `syz.1.929'. [ 240.242432][ T8624] netlink: 60 bytes leftover after parsing attributes in process `syz.1.929'. [ 240.252257][ T8624] netlink: 60 bytes leftover after parsing attributes in process `syz.1.929'. [ 240.262270][ T8624] netlink: 60 bytes leftover after parsing attributes in process `syz.1.929'. [ 240.432765][ T8637] FAULT_INJECTION: forcing a failure. [ 240.432765][ T8637] name failslab, interval 1, probability 0, space 0, times 0 [ 240.452419][ T8637] CPU: 0 PID: 8637 Comm: syz.2.933 Not tainted syzkaller #0 [ 240.459778][ T8637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 240.469878][ T8637] Call Trace: [ 240.473178][ T8637] [ 240.476118][ T8637] dump_stack_lvl+0x18c/0x250 [ 240.480798][ T8637] ? show_regs_print_info+0x20/0x20 [ 240.486000][ T8637] ? load_image+0x420/0x420 [ 240.490513][ T8637] ? __might_sleep+0xe0/0xe0 [ 240.495102][ T8637] ? __lock_acquire+0x7d80/0x7d80 [ 240.500123][ T8637] ? mark_lock+0x94/0x320 [ 240.504457][ T8637] should_fail_ex+0x394/0x4c0 [ 240.509143][ T8637] should_failslab+0x9/0x20 [ 240.513657][ T8637] slab_pre_alloc_hook+0x59/0x300 [ 240.518686][ T8637] ? __get_vm_area_node+0x125/0x370 [ 240.523886][ T8637] __kmem_cache_alloc_node+0x53/0x250 [ 240.529261][ T8637] ? __get_vm_area_node+0x125/0x370 [ 240.534457][ T8637] kmalloc_node_trace+0x26/0xe0 [ 240.539317][ T8637] __get_vm_area_node+0x125/0x370 [ 240.544440][ T8637] __vmalloc_node_range+0x36f/0x1320 [ 240.549725][ T8637] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 240.555271][ T8637] ? mark_lock+0x94/0x320 [ 240.559599][ T8637] ? __lock_acquire+0x1336/0x7d80 [ 240.564721][ T8637] ? aa_get_newest_label+0xfd/0x5c0 [ 240.569919][ T8637] ? free_vm_area+0x50/0x50 [ 240.574424][ T8637] ? end_current_label_crit_section+0x170/0x170 [ 240.580665][ T8637] ? verify_lock_unused+0x140/0x140 [ 240.585866][ T8637] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 240.591406][ T8637] __vmalloc+0x7a/0x90 [ 240.595474][ T8637] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 240.601018][ T8637] bpf_prog_alloc_no_stats+0x46/0x430 [ 240.606393][ T8637] bpf_prog_alloc+0x3d/0x1a0 [ 240.610980][ T8637] bpf_prog_load+0x6b2/0x1610 [ 240.615662][ T8637] ? map_freeze+0x420/0x420 [ 240.620164][ T8637] ? __might_fault+0xaa/0x120 [ 240.624838][ T8637] ? __lock_acquire+0x7d80/0x7d80 [ 240.629881][ T8637] ? file_end_write+0x159/0x250 [ 240.634735][ T8637] ? __might_fault+0xaa/0x120 [ 240.639407][ T8637] ? __might_fault+0xc6/0x120 [ 240.644075][ T8637] ? __might_fault+0xaa/0x120 [ 240.648748][ T8637] ? bpf_lsm_bpf+0x9/0x10 [ 240.653074][ T8637] ? security_bpf+0x7e/0xa0 [ 240.657575][ T8637] __sys_bpf+0x5ba/0x890 [ 240.661816][ T8637] ? bpf_link_show_fdinfo+0x390/0x390 [ 240.667195][ T8637] ? lock_chain_count+0x20/0x20 [ 240.672055][ T8637] __x64_sys_bpf+0x7c/0x90 [ 240.676474][ T8637] do_syscall_64+0x55/0xb0 [ 240.680928][ T8637] ? clear_bhb_loop+0x40/0x90 [ 240.685602][ T8637] ? clear_bhb_loop+0x40/0x90 [ 240.690275][ T8637] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 240.696175][ T8637] RIP: 0033:0x7fcbd639e0d9 [ 240.700590][ T8637] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.720198][ T8637] RSP: 002b:00007fcbd7222028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 240.728619][ T8637] RAX: ffffffffffffffda RBX: 00007fcbd6625fa0 RCX: 00007fcbd639e0d9 [ 240.736586][ T8637] RDX: 0000000000000094 RSI: 0000200000000340 RDI: 0000000000000005 [ 240.744555][ T8637] RBP: 00007fcbd7222090 R08: 0000000000000000 R09: 0000000000000000 [ 240.752609][ T8637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 240.760573][ T8637] R13: 00007fcbd6626038 R14: 00007fcbd6625fa0 R15: 00007ffedad53338 [ 240.768551][ T8637] [ 240.805162][ T8637] syz.2.933: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 240.846682][ T8637] CPU: 1 PID: 8637 Comm: syz.2.933 Not tainted syzkaller #0 [ 240.854087][ T8637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 240.864148][ T8637] Call Trace: [ 240.867427][ T8637] [ 240.870359][ T8637] dump_stack_lvl+0x18c/0x250 [ 240.875045][ T8637] ? show_regs_print_info+0x20/0x20 [ 240.880248][ T8637] ? load_image+0x420/0x420 [ 240.884764][ T8637] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 240.891199][ T8637] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 240.897708][ T8637] warn_alloc+0x246/0x340 [ 240.902037][ T8637] ? __get_vm_area_node+0x125/0x370 [ 240.907247][ T8637] ? zone_watermark_ok_safe+0x230/0x230 [ 240.912795][ T8637] ? rcu_is_watching+0x15/0xb0 [ 240.917573][ T8637] ? __get_vm_area_node+0x356/0x370 [ 240.922783][ T8637] __vmalloc_node_range+0x394/0x1320 [ 240.928080][ T8637] ? mark_lock+0x94/0x320 [ 240.932415][ T8637] ? __lock_acquire+0x1336/0x7d80 [ 240.937453][ T8637] ? aa_get_newest_label+0xfd/0x5c0 [ 240.942656][ T8637] ? free_vm_area+0x50/0x50 [ 240.947158][ T8637] ? end_current_label_crit_section+0x170/0x170 [ 240.953403][ T8637] ? verify_lock_unused+0x140/0x140 [ 240.958605][ T8637] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 240.964148][ T8637] __vmalloc+0x7a/0x90 [ 240.968219][ T8637] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 240.973774][ T8637] bpf_prog_alloc_no_stats+0x46/0x430 [ 240.979151][ T8637] bpf_prog_alloc+0x3d/0x1a0 [ 240.983744][ T8637] bpf_prog_load+0x6b2/0x1610 [ 240.988431][ T8637] ? map_freeze+0x420/0x420 [ 240.992937][ T8637] ? __might_fault+0xaa/0x120 [ 240.997639][ T8637] ? __lock_acquire+0x7d80/0x7d80 [ 241.002667][ T8637] ? file_end_write+0x159/0x250 [ 241.007529][ T8637] ? __might_fault+0xaa/0x120 [ 241.012206][ T8637] ? __might_fault+0xc6/0x120 [ 241.016899][ T8637] ? __might_fault+0xaa/0x120 [ 241.021606][ T8637] ? bpf_lsm_bpf+0x9/0x10 [ 241.025959][ T8637] ? security_bpf+0x7e/0xa0 [ 241.030467][ T8637] __sys_bpf+0x5ba/0x890 [ 241.034715][ T8637] ? bpf_link_show_fdinfo+0x390/0x390 [ 241.040145][ T8637] ? lock_chain_count+0x20/0x20 [ 241.045032][ T8637] __x64_sys_bpf+0x7c/0x90 [ 241.049465][ T8637] do_syscall_64+0x55/0xb0 [ 241.053913][ T8637] ? clear_bhb_loop+0x40/0x90 [ 241.058593][ T8637] ? clear_bhb_loop+0x40/0x90 [ 241.063269][ T8637] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 241.069165][ T8637] RIP: 0033:0x7fcbd639e0d9 [ 241.073579][ T8637] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.093184][ T8637] RSP: 002b:00007fcbd7222028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 241.101605][ T8637] RAX: ffffffffffffffda RBX: 00007fcbd6625fa0 RCX: 00007fcbd639e0d9 [ 241.109694][ T8637] RDX: 0000000000000094 RSI: 0000200000000340 RDI: 0000000000000005 [ 241.117679][ T8637] RBP: 00007fcbd7222090 R08: 0000000000000000 R09: 0000000000000000 [ 241.125653][ T8637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 241.133623][ T8637] R13: 00007fcbd6626038 R14: 00007fcbd6625fa0 R15: 00007ffedad53338 [ 241.141610][ T8637] [ 241.152307][ T8637] Mem-Info: [ 241.156288][ T8637] active_anon:5280 inactive_anon:0 isolated_anon:0 [ 241.156288][ T8637] active_file:17294 inactive_file:40017 isolated_file:0 [ 241.156288][ T8637] unevictable:768 dirty:100 writeback:0 [ 241.156288][ T8637] slab_reclaimable:10530 slab_unreclaimable:92000 [ 241.156288][ T8637] mapped:24596 shmem:1361 pagetables:499 [ 241.156288][ T8637] sec_pagetables:0 bounce:0 [ 241.156288][ T8637] kernel_misc_reclaimable:0 [ 241.156288][ T8637] free:1347333 free_pcp:12529 free_cma:0 [ 241.203224][ T8637] Node 0 active_anon:21120kB inactive_anon:0kB active_file:69176kB inactive_file:159868kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:98384kB dirty:396kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11340kB pagetables:1996kB sec_pagetables:0kB all_unreclaimable? no [ 241.254168][ T8637] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 241.313416][ T8637] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 241.351804][ T8637] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 241.359294][ T8637] Node 0 DMA32 free:1482676kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:21000kB inactive_anon:0kB active_file:69176kB inactive_file:159044kB unevictable:1536kB writepending:396kB present:3129332kB managed:2586840kB mlocked:0kB bounce:0kB free_pcp:29980kB local_pcp:18564kB free_cma:0kB [ 241.405880][ T8637] lowmem_reserve[]: 0 0 0 0 0 [ 241.411135][ T8637] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 241.453378][ T8637] lowmem_reserve[]: 0 0 0 0 0 [ 241.497283][ T8637] Node 1 Normal free:3891292kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:20640kB local_pcp:12992kB free_cma:0kB [ 241.544477][ T8637] lowmem_reserve[]: 0 0 0 0 0 [ 241.549334][ T8637] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 241.574036][ T8637] Node 0 DMA32: 651*4kB (UME) 1191*8kB (UME) 1333*16kB (UME) 830*32kB (UM) 259*64kB (UME) 257*128kB (UME) 124*256kB (UME) 30*512kB (UM) 7*1024kB (ME) 4*2048kB (M) 320*4096kB (UM) = 1482676kB [ 241.596234][ T8637] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 241.608715][ T8637] Node 1 Normal: 255*4kB (UE) 68*8kB (UE) 48*16kB (UE) 90*32kB (UE) 24*64kB (UME) 6*128kB (UME) 1*256kB (U) 1*512kB (M) 2*1024kB (UE) 1*2048kB (E) 947*4096kB (M) = 3891292kB [ 241.631407][ T8637] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 241.687644][ T8637] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 241.712209][ T8637] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 241.733625][ T8637] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 241.747976][ T8637] 58672 total pagecache pages [ 241.781491][ T8637] 0 pages in swap cache [ 241.792876][ T8637] Free swap = 124996kB [ 241.797213][ T8637] Total swap = 124996kB [ 241.801386][ T8637] 2097051 pages RAM [ 241.817547][ T8637] 0 pages HighMem/MovableOnly [ 241.822284][ T8637] 416955 pages reserved [ 241.827309][ T8637] 0 pages cma reserved [ 242.051930][ T8653] netlink: 'syz.3.940': attribute type 3 has an invalid length. [ 242.063225][ T8653] netlink: 'syz.3.940': attribute type 1 has an invalid length. [ 242.073239][ T8653] netlink: 191376 bytes leftover after parsing attributes in process `syz.3.940'. [ 242.254663][ T8669] netlink: 'syz.0.945': attribute type 39 has an invalid length. [ 242.487781][ T8676] netlink: 'syz.2.948': attribute type 11 has an invalid length. [ 242.642205][ T8687] FAULT_INJECTION: forcing a failure. [ 242.642205][ T8687] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 242.657528][ T8687] CPU: 0 PID: 8687 Comm: syz.3.952 Not tainted syzkaller #0 [ 242.664860][ T8687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 242.674919][ T8687] Call Trace: [ 242.678201][ T8687] [ 242.681125][ T8687] dump_stack_lvl+0x18c/0x250 [ 242.685803][ T8687] ? show_regs_print_info+0x20/0x20 [ 242.690998][ T8687] ? load_image+0x420/0x420 [ 242.695501][ T8687] ? __might_fault+0xaa/0x120 [ 242.700172][ T8687] ? __lock_acquire+0x7d80/0x7d80 [ 242.705197][ T8687] should_fail_ex+0x394/0x4c0 [ 242.709878][ T8687] _copy_from_user+0x2f/0xe0 [ 242.714466][ T8687] ___sys_recvmsg+0x174/0x590 [ 242.719145][ T8687] ? __sys_recvmsg+0x2a0/0x2a0 [ 242.723905][ T8687] ? ksys_write+0x1d2/0x260 [ 242.728442][ T8687] ? __fget_files+0x3fc/0x460 [ 242.733148][ T8687] __x64_sys_recvmsg+0x21e/0x2f0 [ 242.738099][ T8687] ? ___sys_recvmsg+0x590/0x590 [ 242.742958][ T8687] ? lockdep_hardirqs_on+0x98/0x150 [ 242.748162][ T8687] do_syscall_64+0x55/0xb0 [ 242.752570][ T8687] ? clear_bhb_loop+0x40/0x90 [ 242.757243][ T8687] ? clear_bhb_loop+0x40/0x90 [ 242.761915][ T8687] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 242.767805][ T8687] RIP: 0033:0x7f4f8259e0d9 [ 242.772217][ T8687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.791816][ T8687] RSP: 002b:00007f4f834e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 242.800229][ T8687] RAX: ffffffffffffffda RBX: 00007f4f82825fa0 RCX: 00007f4f8259e0d9 [ 242.808199][ T8687] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 242.816170][ T8687] RBP: 00007f4f834e9090 R08: 0000000000000000 R09: 0000000000000000 [ 242.824136][ T8687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 242.832122][ T8687] R13: 00007f4f82826038 R14: 00007f4f82825fa0 R15: 00007fff1e4f3898 [ 242.840101][ T8687] [ 243.587298][ T8714] netlink: 60 bytes leftover after parsing attributes in process `syz.3.957'. [ 244.431651][ T8714] netlink: 60 bytes leftover after parsing attributes in process `syz.3.957'. [ 244.745667][ T8732] ±ÿÿÿÿa–ïD: renamed from lo (while UP) [ 245.785086][ T8747] netlink: 'syz.1.967': attribute type 46 has an invalid length. [ 245.823479][ T8747] netlink: 830 bytes leftover after parsing attributes in process `syz.1.967'. [ 246.804841][ T8768] bridge_slave_0: left allmulticast mode [ 246.843833][ T8768] bridge_slave_0: left promiscuous mode [ 246.864744][ T8768] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.165389][ T8789] netlink: 'syz.3.981': attribute type 10 has an invalid length. [ 247.181021][ T8789] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 247.188406][ T8789] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 247.205224][ T8789] team0: Port device wlan1 removed [ 247.215603][ T8789] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 247.358083][ T8790] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 247.558871][ T8803] netlink: 4 bytes leftover after parsing attributes in process `syz.1.989'. [ 247.571805][ T8801] veth1_to_bond: entered allmulticast mode [ 248.324881][ T8828] veth1_to_bond: entered allmulticast mode [ 248.632394][ T8836] FAULT_INJECTION: forcing a failure. [ 248.632394][ T8836] name failslab, interval 1, probability 0, space 0, times 0 [ 248.652125][ T8836] CPU: 1 PID: 8836 Comm: syz.0.1001 Not tainted syzkaller #0 [ 248.659560][ T8836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 248.669638][ T8836] Call Trace: [ 248.672941][ T8836] [ 248.675890][ T8836] dump_stack_lvl+0x18c/0x250 [ 248.680599][ T8836] ? show_regs_print_info+0x20/0x20 [ 248.685827][ T8836] ? load_image+0x420/0x420 [ 248.690370][ T8836] ? __might_sleep+0xe0/0xe0 [ 248.694989][ T8836] ? __lock_acquire+0x7d80/0x7d80 [ 248.700043][ T8836] should_fail_ex+0x394/0x4c0 [ 248.704755][ T8836] should_failslab+0x9/0x20 [ 248.709294][ T8836] slab_pre_alloc_hook+0x59/0x300 [ 248.714354][ T8836] kmem_cache_alloc_node+0x5e/0x310 [ 248.719583][ T8836] ? __alloc_skb+0x103/0x2c0 [ 248.724234][ T8836] __alloc_skb+0x103/0x2c0 [ 248.728683][ T8836] tipc_buf_acquire+0x2b/0xe0 [ 248.733391][ T8836] tipc_msg_build+0x8d4/0xe60 [ 248.738112][ T8836] ? skb_copy_to_linear_data_offset+0x60/0x60 [ 248.744224][ T8836] ? tipc_group_bc_cong+0x15c/0x210 [ 248.749454][ T8836] tipc_send_group_bcast+0x7d8/0xad0 [ 248.754795][ T8836] ? tipc_wait_for_connect+0x650/0x650 [ 248.760294][ T8836] ? wait_woken+0x180/0x180 [ 248.764848][ T8836] __tipc_sendmsg+0x314/0x2b20 [ 248.769643][ T8836] ? __lock_acquire+0x1336/0x7d80 [ 248.774708][ T8836] ? rht_unlock+0x1d0/0x1d0 [ 248.779287][ T8836] ? verify_lock_unused+0x140/0x140 [ 248.784510][ T8836] ? verify_lock_unused+0x140/0x140 [ 248.789742][ T8836] ? perf_trace_lock+0xfc/0x3b0 [ 248.794624][ T8836] ? trace_event_raw_event_lock+0x240/0x240 [ 248.800548][ T8836] ? mark_lock+0x94/0x320 [ 248.804916][ T8836] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 248.810941][ T8836] ? __local_bh_enable_ip+0x13a/0x1c0 [ 248.816342][ T8836] ? lockdep_hardirqs_on+0x98/0x150 [ 248.821603][ T8836] ? __local_bh_enable_ip+0x13a/0x1c0 [ 248.827004][ T8836] ? _local_bh_enable+0xa0/0xa0 [ 248.831891][ T8836] tipc_sendmsg+0x55/0x70 [ 248.836254][ T8836] sock_write_iter+0x2dc/0x420 [ 248.841052][ T8836] ? sock_read_iter+0x3f0/0x3f0 [ 248.845956][ T8836] ? common_file_perm+0x198/0x1f0 [ 248.851019][ T8836] vfs_write+0x474/0x9a0 [ 248.855306][ T8836] ? file_end_write+0x250/0x250 [ 248.860209][ T8836] ? __fget_files+0x3fc/0x460 [ 248.864927][ T8836] ? __fdget_pos+0x1d8/0x330 [ 248.869551][ T8836] ? ksys_write+0x74/0x260 [ 248.874002][ T8836] ksys_write+0x151/0x260 [ 248.878367][ T8836] ? __ia32_sys_read+0x90/0x90 [ 248.883167][ T8836] ? lockdep_hardirqs_on+0x98/0x150 [ 248.888399][ T8836] do_syscall_64+0x55/0xb0 [ 248.892838][ T8836] ? clear_bhb_loop+0x40/0x90 [ 248.897529][ T8836] ? clear_bhb_loop+0x40/0x90 [ 248.902226][ T8836] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 248.908116][ T8836] RIP: 0033:0x7fe0ce59e0d9 [ 248.912531][ T8836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 248.932145][ T8836] RSP: 002b:00007fe0cf3e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 248.940552][ T8836] RAX: ffffffffffffffda RBX: 00007fe0ce825fa0 RCX: 00007fe0ce59e0d9 [ 248.948530][ T8836] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000004 [ 248.956510][ T8836] RBP: 00007fe0cf3e9090 R08: 0000000000000000 R09: 0000000000000000 [ 248.964500][ T8836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 248.972471][ T8836] R13: 00007fe0ce826038 R14: 00007fe0ce825fa0 R15: 00007ffc113b1958 [ 248.980455][ T8836] [ 249.170058][ T8846] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1005'. [ 249.196009][ T8848] FAULT_INJECTION: forcing a failure. [ 249.196009][ T8848] name failslab, interval 1, probability 0, space 0, times 0 [ 249.232064][ T8848] CPU: 1 PID: 8848 Comm: syz.2.1006 Not tainted syzkaller #0 [ 249.239506][ T8848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 249.249589][ T8848] Call Trace: [ 249.252887][ T8848] [ 249.255831][ T8848] dump_stack_lvl+0x18c/0x250 [ 249.260517][ T8848] ? sctp_sendmsg+0x1519/0x27b0 [ 249.265367][ T8848] ? ___sys_sendmsg+0x2a6/0x360 [ 249.270231][ T8848] ? show_regs_print_info+0x20/0x20 [ 249.275446][ T8848] ? load_image+0x420/0x420 [ 249.279988][ T8848] should_fail_ex+0x394/0x4c0 [ 249.284689][ T8848] should_failslab+0x9/0x20 [ 249.289202][ T8848] slab_pre_alloc_hook+0x59/0x300 [ 249.294238][ T8848] ? sctp_add_bind_addr+0x8c/0x360 [ 249.299379][ T8848] __kmem_cache_alloc_node+0x53/0x250 [ 249.304776][ T8848] ? sctp_add_bind_addr+0x8c/0x360 [ 249.309924][ T8848] kmalloc_trace+0x2a/0xe0 [ 249.314363][ T8848] sctp_add_bind_addr+0x8c/0x360 [ 249.319415][ T8848] sctp_copy_local_addr_list+0x31b/0x4e0 [ 249.325071][ T8848] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 249.330810][ T8848] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 249.336880][ T8848] ? sctp_v4_is_any+0x35/0x60 [ 249.341565][ T8848] ? sctp_copy_one_addr+0x8c/0x350 [ 249.346677][ T8848] sctp_bind_addr_copy+0xb3/0x3c0 [ 249.351702][ T8848] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 249.358035][ T8848] sctp_connect_new_asoc+0x2f9/0x6a0 [ 249.363328][ T8848] ? __sctp_connect+0xd80/0xd80 [ 249.368187][ T8848] ? __local_bh_enable_ip+0x13a/0x1c0 [ 249.373578][ T8848] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 249.379124][ T8848] ? security_sctp_bind_connect+0x89/0xb0 [ 249.384848][ T8848] sctp_sendmsg+0x1519/0x27b0 [ 249.389533][ T8848] ? sctp_getsockopt+0xb60/0xb60 [ 249.394469][ T8848] ? aa_af_perm+0x330/0x330 [ 249.398970][ T8848] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 249.405414][ T8848] ? sock_rps_record_flow+0x19/0x3f0 [ 249.410704][ T8848] ? inet_sendmsg+0xce/0x2a0 [ 249.415297][ T8848] ? inet_send_prepare+0x250/0x250 [ 249.420404][ T8848] ____sys_sendmsg+0x61b/0x980 [ 249.425167][ T8848] ? __asan_memset+0x22/0x40 [ 249.429764][ T8848] ? __sys_sendmsg_sock+0x30/0x30 [ 249.434781][ T8848] ? __import_iovec+0x5f2/0x850 [ 249.439986][ T8848] ? import_iovec+0x73/0xa0 [ 249.444490][ T8848] ___sys_sendmsg+0x2a6/0x360 [ 249.449186][ T8848] ? __sys_sendmsg+0x2b0/0x2b0 [ 249.453975][ T8848] ? trace_call_bpf+0xc3/0x6c0 [ 249.458785][ T8848] __se_sys_sendmsg+0x1d0/0x2c0 [ 249.463645][ T8848] ? perf_trace_preemptirq_template+0x269/0x330 [ 249.469899][ T8848] ? __x64_sys_sendmsg+0x80/0x80 [ 249.474854][ T8848] ? lockdep_hardirqs_on+0x98/0x150 [ 249.480052][ T8848] do_syscall_64+0x55/0xb0 [ 249.484466][ T8848] ? clear_bhb_loop+0x40/0x90 [ 249.489138][ T8848] ? clear_bhb_loop+0x40/0x90 [ 249.493811][ T8848] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 249.499700][ T8848] RIP: 0033:0x7fcbd639e0d9 [ 249.504109][ T8848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 249.523708][ T8848] RSP: 002b:00007fcbd7222028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 249.532115][ T8848] RAX: ffffffffffffffda RBX: 00007fcbd6625fa0 RCX: 00007fcbd639e0d9 [ 249.540087][ T8848] RDX: 00000000000003e8 RSI: 00002000000004c0 RDI: 0000000000000005 [ 249.548055][ T8848] RBP: 00007fcbd7222090 R08: 0000000000000000 R09: 0000000000000000 [ 249.556019][ T8848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 249.563999][ T8848] R13: 00007fcbd6626038 R14: 00007fcbd6625fa0 R15: 00007ffedad53338 [ 249.571998][ T8848] [ 249.878971][ T8857] netlink: 8183 bytes leftover after parsing attributes in process `syz.2.1008'. [ 250.218879][ T8869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 250.790572][ T8899] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.018569][ T8907] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.074774][ T8906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.101218][ T8911] netlink: 'syz.1.1028': attribute type 3 has an invalid length. [ 251.110471][ T8911] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.1028'. [ 251.238125][ T8912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.569099][ T8924] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.1033'. [ 251.604824][ T8924] netlink: 'syz.2.1033': attribute type 3 has an invalid length. [ 251.612648][ T8924] netlink: 'syz.2.1033': attribute type 1 has an invalid length. [ 251.642953][ T8924] netlink: 193404 bytes leftover after parsing attributes in process `syz.2.1033'. [ 251.938616][ T8931] veth1_to_bond: entered allmulticast mode [ 252.693850][ T8933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 252.781538][ T8944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 253.595940][ T8967] netlink: 'syz.0.1052': attribute type 33 has an invalid length. [ 253.613363][ T8967] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1052'. [ 254.470256][ T8979] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 256.025168][ T9016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 256.054073][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.060463][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.436064][ T9028] netlink: 'syz.1.1073': attribute type 46 has an invalid length. [ 256.456916][ T9028] FAULT_INJECTION: forcing a failure. [ 256.456916][ T9028] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 256.460845][ T9030] netlink: 'syz.2.1074': attribute type 46 has an invalid length. [ 256.475032][ T9028] CPU: 0 PID: 9028 Comm: syz.1.1073 Not tainted syzkaller #0 [ 256.485431][ T9028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 256.495529][ T9028] Call Trace: [ 256.498836][ T9028] [ 256.501791][ T9028] dump_stack_lvl+0x18c/0x250 [ 256.506534][ T9028] ? show_regs_print_info+0x20/0x20 [ 256.511782][ T9028] ? load_image+0x420/0x420 [ 256.516340][ T9028] ? __might_fault+0xaa/0x120 [ 256.521053][ T9028] ? __lock_acquire+0x7d80/0x7d80 [ 256.526130][ T9028] should_fail_ex+0x394/0x4c0 [ 256.530861][ T9028] _copy_from_user+0x2f/0xe0 [ 256.535494][ T9028] ___sys_sendmsg+0x1c7/0x360 [ 256.540221][ T9028] ? get_pid_task+0x20/0x1e0 [ 256.544863][ T9028] ? __sys_sendmsg+0x2b0/0x2b0 [ 256.549710][ T9028] ? __lock_acquire+0x7d80/0x7d80 [ 256.554825][ T9028] __se_sys_sendmsg+0x1d0/0x2c0 [ 256.559726][ T9028] ? __x64_sys_sendmsg+0x80/0x80 [ 256.564747][ T9028] ? lockdep_hardirqs_on+0x98/0x150 [ 256.569991][ T9028] do_syscall_64+0x55/0xb0 [ 256.574431][ T9028] ? clear_bhb_loop+0x40/0x90 [ 256.579137][ T9028] ? clear_bhb_loop+0x40/0x90 [ 256.583847][ T9028] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 256.589775][ T9028] RIP: 0033:0x7fe86fd9e0d9 [ 256.594231][ T9028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 256.613868][ T9028] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 256.622288][ T9028] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 256.630261][ T9028] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000005 [ 256.638254][ T9028] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 256.646272][ T9028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 256.654251][ T9028] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 256.662249][ T9028] [ 257.057887][ T9041] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 257.665147][ T9059] netlink: 'syz.1.1084': attribute type 7 has an invalid length. [ 257.693168][ T9059] netlink: 140 bytes leftover after parsing attributes in process `syz.1.1084'. [ 257.978152][ T9072] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 258.575048][ T9098] netlink: 'syz.2.1098': attribute type 10 has an invalid length. [ 258.661835][ T9099] netlink: 'syz.2.1098': attribute type 1 has an invalid length. [ 258.682998][ T9099] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.1098'. [ 258.781615][ T9099] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.1098'. [ 259.357515][ T9098] team0: Device veth1_vlan failed to register rx_handler [ 259.619058][ T9104] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 260.023281][ T9128] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1108'. [ 260.077727][ T9131] FAULT_INJECTION: forcing a failure. [ 260.077727][ T9131] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 260.091651][ T9131] CPU: 1 PID: 9131 Comm: syz.2.1109 Not tainted syzkaller #0 [ 260.099062][ T9131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 260.109148][ T9131] Call Trace: [ 260.112453][ T9131] [ 260.113056][ T9128] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1108'. [ 260.115381][ T9131] dump_stack_lvl+0x18c/0x250 [ 260.128998][ T9131] ? show_regs_print_info+0x20/0x20 [ 260.134218][ T9131] ? load_image+0x420/0x420 [ 260.138749][ T9131] ? __lock_acquire+0x7d80/0x7d80 [ 260.143792][ T9131] ? perf_trace_lock+0xfc/0x3b0 [ 260.148662][ T9131] should_fail_ex+0x394/0x4c0 [ 260.153370][ T9131] prepare_alloc_pages+0x1e1/0x5b0 [ 260.158514][ T9131] __alloc_pages+0x134/0x460 [ 260.163124][ T9131] ? zone_statistics+0x170/0x170 [ 260.168094][ T9131] ? alloc_pages+0x4e1/0x740 [ 260.172704][ T9131] ? do_raw_spin_unlock+0x121/0x230 [ 260.177920][ T9131] __get_free_pages+0xc/0x30 [ 260.182506][ T9131] kasan_populate_vmalloc_pte+0x35/0x100 [ 260.188142][ T9131] __apply_to_page_range+0x860/0xdd0 [ 260.193434][ T9131] ? kasan_populate_vmalloc+0x70/0x70 [ 260.198806][ T9131] ? apply_to_page_range+0x50/0x50 [ 260.203910][ T9131] ? do_raw_spin_unlock+0x121/0x230 [ 260.209108][ T9131] alloc_vmap_area+0x1d26/0x1e50 [ 260.214059][ T9131] ? vm_map_ram+0xcf0/0xcf0 [ 260.218562][ T9131] ? rcu_is_watching+0x15/0xb0 [ 260.223322][ T9131] __get_vm_area_node+0x162/0x370 [ 260.228350][ T9131] __vmalloc_node_range+0x36f/0x1320 [ 260.233634][ T9131] ? reuseport_array_alloc+0x98/0x120 [ 260.239001][ T9131] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 260.244979][ T9131] ? lock_chain_count+0x20/0x20 [ 260.249831][ T9131] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 260.255986][ T9131] ? free_vm_area+0x50/0x50 [ 260.260487][ T9131] ? security_capable+0x5f/0xb0 [ 260.265333][ T9131] bpf_map_area_alloc+0xf1/0x110 [ 260.270270][ T9131] ? reuseport_array_alloc+0x98/0x120 [ 260.275638][ T9131] reuseport_array_alloc+0x98/0x120 [ 260.280837][ T9131] map_create+0x877/0x12f0 [ 260.285253][ T9131] __sys_bpf+0x651/0x890 [ 260.289492][ T9131] ? bpf_link_show_fdinfo+0x390/0x390 [ 260.294870][ T9131] ? lock_chain_count+0x20/0x20 [ 260.299718][ T9131] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 260.305698][ T9131] __x64_sys_bpf+0x7c/0x90 [ 260.310107][ T9131] do_syscall_64+0x55/0xb0 [ 260.314519][ T9131] ? clear_bhb_loop+0x40/0x90 [ 260.319191][ T9131] ? clear_bhb_loop+0x40/0x90 [ 260.323859][ T9131] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 260.329744][ T9131] RIP: 0033:0x7fcbd639e0d9 [ 260.334159][ T9131] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 260.353762][ T9131] RSP: 002b:00007fcbd7222028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 260.362171][ T9131] RAX: ffffffffffffffda RBX: 00007fcbd6625fa0 RCX: 00007fcbd639e0d9 [ 260.370140][ T9131] RDX: 0000000000000048 RSI: 0000200000000040 RDI: 0000000000000000 [ 260.378103][ T9131] RBP: 00007fcbd7222090 R08: 0000000000000000 R09: 0000000000000000 [ 260.386070][ T9131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 260.394056][ T9131] R13: 00007fcbd6626038 R14: 00007fcbd6625fa0 R15: 00007ffedad53338 [ 260.402032][ T9131] [ 260.914029][ T9145] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 261.516936][ T9171] netlink: 'syz.3.1122': attribute type 10 has an invalid length. [ 261.831786][ T9176] netlink: 'syz.1.1123': attribute type 10 has an invalid length. [ 261.849048][ T9172] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 261.855748][ T9177] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 262.332611][ T9197] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1133'. [ 262.394270][ T9201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1135'. [ 262.722127][ T5790] Bluetooth: hci1: ISO packet for unknown connection handle 2878 [ 262.750778][ T9211] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 263.202561][ T9239] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1151'. [ 263.224709][ T9239] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1151'. [ 263.243567][ T9239] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1151'. [ 263.356356][ T9243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 263.683269][ T9255] netlink: 'syz.3.1158': attribute type 29 has an invalid length. [ 263.698982][ T9255] netlink: 'syz.3.1158': attribute type 29 has an invalid length. [ 263.711908][ T9255] netlink: 'syz.3.1158': attribute type 29 has an invalid length. [ 263.726449][ T9255] netlink: 'syz.3.1158': attribute type 29 has an invalid length. [ 263.739469][ T9255] netlink: 'syz.3.1158': attribute type 29 has an invalid length. [ 265.066355][ T9273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 266.835451][ T9299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 267.057579][ T9309] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1176'. [ 267.086009][ T9309] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 267.608198][ T9325] netlink: 'syz.0.1182': attribute type 10 has an invalid length. [ 267.628032][ T9325] team0: Device veth1_vlan failed to register rx_handler [ 267.718846][ T9328] netlink: 'syz.0.1182': attribute type 1 has an invalid length. [ 267.777772][ T9328] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.1182'. [ 268.020133][ T9325] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.1182'. [ 268.431932][ T9348] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1188'. [ 268.463179][ T9348] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1188'. [ 268.509399][ T9348] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1188'. [ 268.550432][ T9352] FAULT_INJECTION: forcing a failure. [ 268.550432][ T9352] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.550610][ T9348] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 268.571186][ T9352] CPU: 1 PID: 9352 Comm: syz.1.1190 Not tainted syzkaller #0 [ 268.579593][ T9352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 268.589663][ T9352] Call Trace: [ 268.592966][ T9352] [ 268.595905][ T9352] dump_stack_lvl+0x18c/0x250 [ 268.600606][ T9352] ? show_regs_print_info+0x20/0x20 [ 268.605816][ T9352] ? load_image+0x420/0x420 [ 268.610354][ T9352] ? __might_fault+0xaa/0x120 [ 268.615056][ T9352] ? __lock_acquire+0x7d80/0x7d80 [ 268.620096][ T9352] ? __virt_addr_valid+0x10c/0x380 [ 268.625224][ T9352] should_fail_ex+0x394/0x4c0 [ 268.629924][ T9352] _copy_from_user+0x2f/0xe0 [ 268.634532][ T9352] bpf_prog_test_run_xdp+0xd93/0x1140 [ 268.639919][ T9352] ? __lock_acquire+0x7d80/0x7d80 [ 268.644974][ T9352] ? dev_put+0x80/0x80 [ 268.649069][ T9352] ? dev_put+0x80/0x80 [ 268.653159][ T9352] bpf_prog_test_run+0x31f/0x390 [ 268.658123][ T9352] __sys_bpf+0x49d/0x890 [ 268.662388][ T9352] ? bpf_link_show_fdinfo+0x390/0x390 [ 268.667796][ T9352] ? lock_chain_count+0x20/0x20 [ 268.672677][ T9352] __x64_sys_bpf+0x7c/0x90 [ 268.677111][ T9352] do_syscall_64+0x55/0xb0 [ 268.681537][ T9352] ? clear_bhb_loop+0x40/0x90 [ 268.686224][ T9352] ? clear_bhb_loop+0x40/0x90 [ 268.690912][ T9352] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 268.696816][ T9352] RIP: 0033:0x7fe86fd9e0d9 [ 268.701241][ T9352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.720876][ T9352] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 268.729310][ T9352] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 268.737300][ T9352] RDX: 0000000000000050 RSI: 0000200000000c80 RDI: 000000000000000a [ 268.745284][ T9352] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 268.753267][ T9352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 268.761258][ T9352] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 268.769260][ T9352] [ 268.772302][ T9348] CPU: 0 PID: 9348 Comm: syz.0.1188 Not tainted syzkaller #0 [ 268.779702][ T9348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 268.789757][ T9348] Call Trace: [ 268.793032][ T9348] [ 268.795955][ T9348] dump_stack_lvl+0x18c/0x250 [ 268.800637][ T9348] ? show_regs_print_info+0x20/0x20 [ 268.805833][ T9348] ? load_image+0x420/0x420 [ 268.810353][ T9348] sysfs_warn_dup+0x8e/0xa0 [ 268.814855][ T9348] sysfs_do_create_link_sd+0xc0/0x110 [ 268.820219][ T9348] device_add_class_symlinks+0x1cf/0x240 [ 268.825853][ T9348] device_add+0x4f9/0xc40 [ 268.830177][ T9348] wiphy_register+0x1d99/0x2ac0 [ 268.835040][ T9348] ? cfg80211_event_work+0x40/0x40 [ 268.840148][ T9348] ? minstrel_ht_alloc+0x88a/0x990 [ 268.845264][ T9348] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 268.851329][ T9348] ieee80211_register_hw+0x2dd8/0x3b30 [ 268.856793][ T9348] ? ieee80211_register_hw+0xfb1/0x3b30 [ 268.862337][ T9348] ? ieee80211_tasklet_handler+0x20/0x20 [ 268.867963][ T9348] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 268.873858][ T9348] ? __debug_object_init+0xec/0x450 [ 268.879054][ T9348] ? __asan_memset+0x22/0x40 [ 268.883640][ T9348] ? __hrtimer_init+0x189/0x270 [ 268.888488][ T9348] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 268.894222][ T9348] ? mac80211_hwsim_free+0x220/0x220 [ 268.899496][ T9348] ? rcu_is_watching+0x15/0xb0 [ 268.904257][ T9348] ? kstrndup+0xbd/0x140 [ 268.908505][ T9348] hwsim_new_radio_nl+0xdad/0x1a70 [ 268.913610][ T9348] ? mark_lock+0x94/0x320 [ 268.917938][ T9348] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 268.923945][ T9348] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 268.930291][ T9348] ? lockdep_hardirqs_on+0x98/0x150 [ 268.935516][ T9348] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 268.941684][ T9348] ? genl_family_rcv_msg_attrs_parse+0x1ca/0x290 [ 268.948025][ T9348] genl_family_rcv_msg_doit+0x21a/0x310 [ 268.953582][ T9348] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 268.959480][ T9348] ? bpf_lsm_capable+0x9/0x10 [ 268.964155][ T9348] ? security_capable+0x89/0xb0 [ 268.969010][ T9348] genl_rcv_msg+0x611/0x7a0 [ 268.973514][ T9348] ? genl_bind+0x360/0x360 [ 268.977933][ T9348] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 268.984266][ T9348] netlink_rcv_skb+0x235/0x4c0 [ 268.989028][ T9348] ? genl_bind+0x360/0x360 [ 268.993439][ T9348] ? netlink_ack+0x1160/0x1160 [ 268.998208][ T9348] ? __lock_acquire+0x7d80/0x7d80 [ 269.003236][ T9348] ? down_read+0x1ac/0x2e0 [ 269.007652][ T9348] genl_rcv+0x28/0x40 [ 269.011630][ T9348] netlink_unicast+0x7b1/0x930 [ 269.016398][ T9348] netlink_sendmsg+0x8d0/0xbf0 [ 269.021152][ T9348] ? lockdep_hardirqs_on+0x98/0x150 [ 269.026355][ T9348] ? netlink_getsockopt+0x590/0x590 [ 269.031552][ T9348] ? bpf_lsm_socket_accept+0x10/0x10 [ 269.036843][ T9348] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 269.042119][ T9348] ? security_socket_sendmsg+0x80/0xa0 [ 269.047571][ T9348] ? netlink_getsockopt+0x590/0x590 [ 269.052763][ T9348] ____sys_sendmsg+0x61b/0x980 [ 269.057532][ T9348] ? __asan_memset+0x22/0x40 [ 269.062121][ T9348] ? __sys_sendmsg_sock+0x30/0x30 [ 269.067266][ T9348] ? __import_iovec+0x5f2/0x850 [ 269.072139][ T9348] ? import_iovec+0x73/0xa0 [ 269.076655][ T9348] ___sys_sendmsg+0x2a6/0x360 [ 269.081348][ T9348] ? __sys_sendmsg+0x2b0/0x2b0 [ 269.086149][ T9348] __se_sys_sendmsg+0x1d0/0x2c0 [ 269.091001][ T9348] ? __x64_sys_sendmsg+0x80/0x80 [ 269.095949][ T9348] ? syscall_enter_from_user_mode+0x2e/0x80 [ 269.101845][ T9348] do_syscall_64+0x55/0xb0 [ 269.106256][ T9348] ? clear_bhb_loop+0x40/0x90 [ 269.110925][ T9348] ? clear_bhb_loop+0x40/0x90 [ 269.115595][ T9348] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 269.121480][ T9348] RIP: 0033:0x7fe0ce59e0d9 [ 269.125897][ T9348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 269.145500][ T9348] RSP: 002b:00007fe0cf3a7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 269.153921][ T9348] RAX: ffffffffffffffda RBX: 00007fe0ce826180 RCX: 00007fe0ce59e0d9 [ 269.161888][ T9348] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000e [ 269.169851][ T9348] RBP: 00007fe0ce635024 R08: 0000000000000000 R09: 0000000000000000 [ 269.177817][ T9348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 269.185823][ T9348] R13: 00007fe0ce826218 R14: 00007fe0ce826180 R15: 00007ffc113b1958 [ 269.193801][ T9348] [ 269.330572][ T9358] netlink: 'syz.2.1192': attribute type 25 has an invalid length. [ 269.338859][ T9358] netlink: 2418 bytes leftover after parsing attributes in process `syz.2.1192'. [ 269.509383][ T9363] netlink: 'syz.0.1195': attribute type 21 has an invalid length. [ 269.646489][ T9372] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.1196'. [ 269.672365][ T9372] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.1196'. [ 269.728237][ T9367] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.1196'. [ 269.761662][ T9373] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.1196'. [ 269.772948][ T9367] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.1196'. [ 269.904797][ T9376] netlink: 'syz.3.1199': attribute type 21 has an invalid length. [ 269.912709][ T9376] netlink: 'syz.3.1199': attribute type 6 has an invalid length. [ 269.981979][ T9371] netlink: 'syz.0.1197': attribute type 7 has an invalid length. [ 270.013085][ T9371] netlink: 140 bytes leftover after parsing attributes in process `syz.0.1197'. [ 270.222548][ T9382] netlink: 'syz.2.1203': attribute type 46 has an invalid length. [ 270.232626][ T9384] netlink: 'syz.0.1202': attribute type 25 has an invalid length. [ 270.399917][ T9390] FAULT_INJECTION: forcing a failure. [ 270.399917][ T9390] name failslab, interval 1, probability 0, space 0, times 0 [ 270.418762][ T9390] CPU: 1 PID: 9390 Comm: syz.2.1206 Not tainted syzkaller #0 [ 270.426179][ T9390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 270.436257][ T9390] Call Trace: [ 270.439545][ T9390] [ 270.442484][ T9390] dump_stack_lvl+0x18c/0x250 [ 270.447182][ T9390] ? sctp_sendmsg+0x1519/0x27b0 [ 270.452051][ T9390] ? ___sys_sendmsg+0x2a6/0x360 [ 270.456915][ T9390] ? show_regs_print_info+0x20/0x20 [ 270.462109][ T9390] ? load_image+0x420/0x420 [ 270.466635][ T9390] should_fail_ex+0x394/0x4c0 [ 270.471309][ T9390] should_failslab+0x9/0x20 [ 270.475818][ T9390] slab_pre_alloc_hook+0x59/0x300 [ 270.480859][ T9390] ? sctp_add_bind_addr+0x8c/0x360 [ 270.485963][ T9390] __kmem_cache_alloc_node+0x53/0x250 [ 270.491347][ T9390] ? sctp_add_bind_addr+0x8c/0x360 [ 270.496459][ T9390] kmalloc_trace+0x2a/0xe0 [ 270.500870][ T9390] sctp_add_bind_addr+0x8c/0x360 [ 270.505802][ T9390] sctp_copy_local_addr_list+0x31b/0x4e0 [ 270.511430][ T9390] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 270.517156][ T9390] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 270.523259][ T9390] ? sctp_v4_is_any+0x35/0x60 [ 270.527962][ T9390] ? sctp_copy_one_addr+0x8c/0x350 [ 270.533089][ T9390] sctp_bind_addr_copy+0xb3/0x3c0 [ 270.538116][ T9390] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 270.544440][ T9390] sctp_connect_new_asoc+0x2f9/0x6a0 [ 270.549724][ T9390] ? __sctp_connect+0xd80/0xd80 [ 270.554566][ T9390] ? __local_bh_enable_ip+0x13a/0x1c0 [ 270.559936][ T9390] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 270.565479][ T9390] ? security_sctp_bind_connect+0x89/0xb0 [ 270.571208][ T9390] sctp_sendmsg+0x1519/0x27b0 [ 270.575890][ T9390] ? sctp_getsockopt+0xb60/0xb60 [ 270.580827][ T9390] ? aa_af_perm+0x330/0x330 [ 270.585335][ T9390] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 270.591749][ T9390] ? sock_rps_record_flow+0x19/0x3f0 [ 270.597041][ T9390] ? inet_sendmsg+0xce/0x2a0 [ 270.601647][ T9390] ? inet_send_prepare+0x250/0x250 [ 270.606755][ T9390] ____sys_sendmsg+0x61b/0x980 [ 270.611516][ T9390] ? __asan_memset+0x22/0x40 [ 270.616099][ T9390] ? __sys_sendmsg_sock+0x30/0x30 [ 270.621113][ T9390] ? __import_iovec+0x5f2/0x850 [ 270.625966][ T9390] ? import_iovec+0x73/0xa0 [ 270.630464][ T9390] ___sys_sendmsg+0x2a6/0x360 [ 270.635134][ T9390] ? get_pid_task+0x20/0x1e0 [ 270.639724][ T9390] ? __sys_sendmsg+0x2b0/0x2b0 [ 270.644493][ T9390] ? __lock_acquire+0x7d80/0x7d80 [ 270.649530][ T9390] __se_sys_sendmsg+0x1d0/0x2c0 [ 270.654377][ T9390] ? __x64_sys_sendmsg+0x80/0x80 [ 270.659316][ T9390] ? lockdep_hardirqs_on+0x98/0x150 [ 270.664509][ T9390] do_syscall_64+0x55/0xb0 [ 270.668914][ T9390] ? clear_bhb_loop+0x40/0x90 [ 270.673583][ T9390] ? clear_bhb_loop+0x40/0x90 [ 270.678257][ T9390] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 270.684153][ T9390] RIP: 0033:0x7fcbd639e0d9 [ 270.688569][ T9390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 270.708190][ T9390] RSP: 002b:00007fcbd7222028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 270.716609][ T9390] RAX: ffffffffffffffda RBX: 00007fcbd6625fa0 RCX: 00007fcbd639e0d9 [ 270.724570][ T9390] RDX: 00000000000003e8 RSI: 00002000000004c0 RDI: 0000000000000006 [ 270.732533][ T9390] RBP: 00007fcbd7222090 R08: 0000000000000000 R09: 0000000000000000 [ 270.740497][ T9390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 270.748458][ T9390] R13: 00007fcbd6626038 R14: 00007fcbd6625fa0 R15: 00007ffedad53338 [ 270.756431][ T9390] [ 271.011047][ T9410] netlink: 'syz.1.1214': attribute type 21 has an invalid length. [ 271.751735][ T9443] A link change request failed with some changes committed already. Interface 26±ÿÿÿÿa–ïD may have been left with an inconsistent configuration, please check. [ 273.564273][ T9492] validate_nla: 6 callbacks suppressed [ 273.564296][ T9492] netlink: 'syz.2.1250': attribute type 9 has an invalid length. [ 273.627744][ T9492] netlink: 'syz.2.1250': attribute type 23 has an invalid length. [ 273.669245][ T9492] __nla_validate_parse: 7 callbacks suppressed [ 273.669260][ T9492] netlink: 156008 bytes leftover after parsing attributes in process `syz.2.1250'. [ 273.941440][ T9496] netlink: 'syz.3.1251': attribute type 2 has an invalid length. [ 273.958928][ T9496] netlink: 'syz.3.1251': attribute type 8 has an invalid length. [ 273.993216][ T9496] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1251'. [ 274.028351][ T9492] netlink: 'syz.2.1250': attribute type 10 has an invalid length. [ 274.128860][ T9492] nlmon0: entered promiscuous mode [ 274.137531][ T9492] nlmon0: entered allmulticast mode [ 274.144483][ T9492] team0: Device nlmon0 is of different type [ 274.167427][ T9500] netlink: 'syz.3.1251': attribute type 11 has an invalid length. [ 274.221296][ T9503] FAULT_INJECTION: forcing a failure. [ 274.221296][ T9503] name failslab, interval 1, probability 0, space 0, times 0 [ 274.260265][ T9503] CPU: 0 PID: 9503 Comm: syz.1.1253 Not tainted syzkaller #0 [ 274.267701][ T9503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 274.277778][ T9503] Call Trace: [ 274.281065][ T9503] [ 274.283998][ T9503] dump_stack_lvl+0x18c/0x250 [ 274.288679][ T9503] ? show_regs_print_info+0x20/0x20 [ 274.293871][ T9503] ? load_image+0x420/0x420 [ 274.298372][ T9503] ? __might_sleep+0xe0/0xe0 [ 274.302960][ T9503] ? __lock_acquire+0x7d80/0x7d80 [ 274.307981][ T9503] should_fail_ex+0x394/0x4c0 [ 274.312656][ T9503] should_failslab+0x9/0x20 [ 274.317154][ T9503] slab_pre_alloc_hook+0x59/0x300 [ 274.322176][ T9503] ? __lock_acquire+0x7d80/0x7d80 [ 274.327191][ T9503] ? security_sk_alloc+0x4b/0x130 [ 274.332209][ T9503] ? security_sk_alloc+0x4b/0x130 [ 274.337223][ T9503] __kmem_cache_alloc_node+0x53/0x250 [ 274.342597][ T9503] ? security_sk_alloc+0x4b/0x130 [ 274.347610][ T9503] __kmalloc+0xa7/0x240 [ 274.351769][ T9503] security_sk_alloc+0x4b/0x130 [ 274.356614][ T9503] sk_prot_alloc+0x101/0x210 [ 274.361202][ T9503] sk_alloc+0x3a/0x350 [ 274.365273][ T9503] inet_create+0x7a9/0xfe0 [ 274.369686][ T9503] ? inet_create+0x9d/0xfe0 [ 274.374190][ T9503] __sock_create+0x49e/0x940 [ 274.378778][ T9503] udp_sock_create4+0xc6/0x480 [ 274.383534][ T9503] ? free_zapped_rcu+0x250/0x250 [ 274.388465][ T9503] ? erspan_exit_batch_net+0x30/0x30 [ 274.393753][ T9503] rxrpc_lookup_local+0xd16/0x1700 [ 274.398867][ T9503] ? rxrpc_local_dont_fragment+0x70/0x70 [ 274.404502][ T9503] ? __local_bh_enable_ip+0x13a/0x1c0 [ 274.409868][ T9503] ? __local_bh_enable_ip+0x13a/0x1c0 [ 274.415235][ T9503] ? do_raw_spin_unlock+0x121/0x230 [ 274.420431][ T9503] rxrpc_sendmsg+0x2f3/0x5b0 [ 274.425014][ T9503] ? rxrpc_getsockopt+0x150/0x150 [ 274.430053][ T9503] ____sys_sendmsg+0x61b/0x980 [ 274.434817][ T9503] ? __sys_sendmsg_sock+0x30/0x30 [ 274.439837][ T9503] ? __import_iovec+0x3fa/0x850 [ 274.444690][ T9503] ? import_iovec+0x73/0xa0 [ 274.449192][ T9503] ___sys_sendmsg+0x2a6/0x360 [ 274.453862][ T9503] ? get_pid_task+0x20/0x1e0 [ 274.458451][ T9503] ? __sys_sendmsg+0x2b0/0x2b0 [ 274.463221][ T9503] ? __lock_acquire+0x7d80/0x7d80 [ 274.468260][ T9503] __se_sys_sendmsg+0x1d0/0x2c0 [ 274.473105][ T9503] ? perf_trace_preemptirq_template+0x269/0x330 [ 274.479344][ T9503] ? __x64_sys_sendmsg+0x80/0x80 [ 274.484311][ T9503] ? lockdep_hardirqs_on+0x98/0x150 [ 274.489507][ T9503] do_syscall_64+0x55/0xb0 [ 274.493915][ T9503] ? clear_bhb_loop+0x40/0x90 [ 274.498587][ T9503] ? clear_bhb_loop+0x40/0x90 [ 274.503290][ T9503] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 274.509191][ T9503] RIP: 0033:0x7fe86fd9e0d9 [ 274.513603][ T9503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.533206][ T9503] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 274.541618][ T9503] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 274.549585][ T9503] RDX: 0000000000000106 RSI: 0000200000000140 RDI: 000000000000000d [ 274.557547][ T9503] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 274.565507][ T9503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.573468][ T9503] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 274.581468][ T9503] [ 274.702529][ T9505] syz.0.1254[9505] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 274.713500][ T9505] syz.0.1254[9505] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 275.107229][ T9531] netlink: 'syz.2.1260': attribute type 2 has an invalid length. [ 275.131641][ T9531] netlink: 17267 bytes leftover after parsing attributes in process `syz.2.1260'. [ 275.490885][ T9538] netlink: 'syz.1.1264': attribute type 21 has an invalid length. [ 275.583646][ T9541] netlink: 'syz.0.1265': attribute type 2 has an invalid length. [ 276.056022][ T9548] netlink: 17279 bytes leftover after parsing attributes in process `syz.1.1267'. [ 276.109160][ T9551] netlink: 822 bytes leftover after parsing attributes in process `syz.2.1268'. [ 276.305995][ T9555] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.1270'. [ 276.351974][ T9555] tc_dump_action: action bad kind [ 276.492719][ T9557] syzkaller0: entered promiscuous mode [ 276.508720][ T9557] syzkaller0: entered allmulticast mode [ 280.437658][ T9672] netlink: 'syz.3.1293': attribute type 2 has an invalid length. [ 281.823054][ T9695] netlink: 'syz.0.1300': attribute type 3 has an invalid length. [ 281.933168][ T9695] netlink: 201372 bytes leftover after parsing attributes in process `syz.0.1300'. [ 282.297469][ T9677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1295'. [ 283.838925][ T9720] netlink: 'syz.1.1309': attribute type 12 has an invalid length. [ 283.863093][ T9720] netlink: 'syz.1.1309': attribute type 15 has an invalid length. [ 284.707558][ T9737] FAULT_INJECTION: forcing a failure. [ 284.707558][ T9737] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 284.738857][ T9737] CPU: 0 PID: 9737 Comm: syz.2.1315 Not tainted syzkaller #0 [ 284.746291][ T9737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 284.756362][ T9737] Call Trace: [ 284.759655][ T9737] [ 284.762598][ T9737] dump_stack_lvl+0x18c/0x250 [ 284.767298][ T9737] ? show_regs_print_info+0x20/0x20 [ 284.772514][ T9737] ? load_image+0x420/0x420 [ 284.777040][ T9737] ? __might_fault+0xaa/0x120 [ 284.781741][ T9737] ? __lock_acquire+0x7d80/0x7d80 [ 284.786791][ T9737] should_fail_ex+0x394/0x4c0 [ 284.791491][ T9737] _copy_from_iter+0x1cd/0x1290 [ 284.796365][ T9737] ? rcu_is_watching+0x15/0xb0 [ 284.801149][ T9737] ? copyout_mc+0x70/0x70 [ 284.805513][ T9737] ? __virt_addr_valid+0x10c/0x380 [ 284.810643][ T9737] ? __virt_addr_valid+0x10c/0x380 [ 284.815775][ T9737] ? __virt_addr_valid+0x10c/0x380 [ 284.820907][ T9737] ? __check_object_size+0x4fc/0xa40 [ 284.826210][ T9737] netlink_sendmsg+0x76b/0xbf0 [ 284.830998][ T9737] ? netlink_getsockopt+0x590/0x590 [ 284.836212][ T9737] ? apparmor_socket_sendmsg+0x8e/0x330 [ 284.841772][ T9737] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 284.847079][ T9737] ? security_socket_sendmsg+0x80/0xa0 [ 284.852553][ T9737] ? netlink_getsockopt+0x590/0x590 [ 284.857763][ T9737] ____sys_sendmsg+0x61b/0x980 [ 284.862541][ T9737] ? __asan_memset+0x22/0x40 [ 284.867146][ T9737] ? __sys_sendmsg_sock+0x30/0x30 [ 284.872177][ T9737] ? __import_iovec+0x5f2/0x850 [ 284.877048][ T9737] ? import_iovec+0x73/0xa0 [ 284.881566][ T9737] ___sys_sendmsg+0x2a6/0x360 [ 284.886249][ T9737] ? get_pid_task+0x20/0x1e0 [ 284.890852][ T9737] ? __sys_sendmsg+0x2b0/0x2b0 [ 284.895640][ T9737] ? __lock_acquire+0x7d80/0x7d80 [ 284.900689][ T9737] __se_sys_sendmsg+0x1d0/0x2c0 [ 284.905551][ T9737] ? __x64_sys_sendmsg+0x80/0x80 [ 284.910512][ T9737] ? lockdep_hardirqs_on+0x98/0x150 [ 284.915730][ T9737] do_syscall_64+0x55/0xb0 [ 284.920153][ T9737] ? clear_bhb_loop+0x40/0x90 [ 284.924837][ T9737] ? clear_bhb_loop+0x40/0x90 [ 284.929523][ T9737] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.935423][ T9737] RIP: 0033:0x7fcbd639e0d9 [ 284.939845][ T9737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.959465][ T9737] RSP: 002b:00007fcbd7201028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 284.967890][ T9737] RAX: ffffffffffffffda RBX: 00007fcbd6626090 RCX: 00007fcbd639e0d9 [ 284.975869][ T9737] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 284.983845][ T9737] RBP: 00007fcbd7201090 R08: 0000000000000000 R09: 0000000000000000 [ 284.991819][ T9737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 284.999798][ T9737] R13: 00007fcbd6626128 R14: 00007fcbd6626090 R15: 00007ffedad53338 [ 285.007789][ T9737] [ 285.354026][ T9751] FAULT_INJECTION: forcing a failure. [ 285.354026][ T9751] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 285.441017][ T9751] CPU: 0 PID: 9751 Comm: syz.1.1320 Not tainted syzkaller #0 [ 285.448475][ T9751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 285.458568][ T9751] Call Trace: [ 285.461873][ T9751] [ 285.464833][ T9751] dump_stack_lvl+0x18c/0x250 [ 285.469554][ T9751] ? show_regs_print_info+0x20/0x20 [ 285.474793][ T9751] ? load_image+0x420/0x420 [ 285.479348][ T9751] ? __might_fault+0xaa/0x120 [ 285.484067][ T9751] should_fail_ex+0x394/0x4c0 [ 285.488791][ T9751] copyin+0x1a/0x90 [ 285.492670][ T9751] _copy_from_iter+0x3ec/0x1290 [ 285.497543][ T9751] ? copyout_mc+0x70/0x70 [ 285.501884][ T9751] ? copyout_mc+0x70/0x70 [ 285.506215][ T9751] ? __virt_addr_valid+0x10c/0x380 [ 285.511336][ T9751] ? page_copy_sane+0x16a/0x270 [ 285.516190][ T9751] copy_page_from_iter+0x7b/0x100 [ 285.521221][ T9751] skb_copy_datagram_from_iter+0x2ea/0x6f0 [ 285.527047][ T9751] packet_sendmsg+0x345e/0x4c70 [ 285.531920][ T9751] ? set_user_nice+0x620/0xb20 [ 285.536699][ T9751] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 285.542427][ T9751] ? aa_sk_perm+0x83c/0x970 [ 285.546935][ T9751] ? perf_trace_lock+0x303/0x3b0 [ 285.551882][ T9751] ? packet_getsockopt+0xad0/0xad0 [ 285.556996][ T9751] ? tomoyo_write_file+0x2d0/0xc50 [ 285.562108][ T9751] ? aa_sock_msg_perm+0x94/0x150 [ 285.567047][ T9751] ? apparmor_socket_sendmsg+0x8e/0x330 [ 285.572592][ T9751] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 285.577883][ T9751] ? security_socket_sendmsg+0x80/0xa0 [ 285.583339][ T9751] ? packet_getsockopt+0xad0/0xad0 [ 285.588451][ T9751] ____sys_sendmsg+0x61b/0x980 [ 285.593223][ T9751] ? __asan_memset+0x22/0x40 [ 285.597825][ T9751] ? __sys_sendmsg_sock+0x30/0x30 [ 285.602857][ T9751] ? __import_iovec+0x3fa/0x850 [ 285.607721][ T9751] ? import_iovec+0x73/0xa0 [ 285.612236][ T9751] ___sys_sendmsg+0x2a6/0x360 [ 285.616923][ T9751] ? __sys_sendmsg+0x2b0/0x2b0 [ 285.621714][ T9751] ? __lock_acquire+0x7d80/0x7d80 [ 285.626785][ T9751] __se_sys_sendmsg+0x1d0/0x2c0 [ 285.631639][ T9751] ? __x64_sys_sendmsg+0x80/0x80 [ 285.636599][ T9751] ? lockdep_hardirqs_on+0x98/0x150 [ 285.641805][ T9751] do_syscall_64+0x55/0xb0 [ 285.646220][ T9751] ? clear_bhb_loop+0x40/0x90 [ 285.650893][ T9751] ? clear_bhb_loop+0x40/0x90 [ 285.655572][ T9751] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 285.661463][ T9751] RIP: 0033:0x7fe86fd9e0d9 [ 285.665878][ T9751] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 285.685480][ T9751] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 285.693891][ T9751] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 285.701858][ T9751] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 285.709830][ T9751] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 285.717798][ T9751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 285.725766][ T9751] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 285.733762][ T9751] [ 286.055310][ T9769] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.1326'. [ 289.333730][ T9795] syzkaller0: entered promiscuous mode [ 289.342886][ T9795] syzkaller0: entered allmulticast mode [ 289.463310][ T9803] netlink: 'syz.1.1337': attribute type 2 has an invalid length. [ 289.474538][ T9803] netlink: 'syz.1.1337': attribute type 1 has an invalid length. [ 289.488009][ T9803] netlink: 'syz.1.1337': attribute type 1 has an invalid length. [ 289.498453][ T9803] netlink: 'syz.1.1337': attribute type 2 has an invalid length. [ 289.507009][ T9803] netlink: 198776 bytes leftover after parsing attributes in process `syz.1.1337'. [ 292.584844][ T9842] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 292.645745][ T9850] netlink: 'syz.0.1354': attribute type 16 has an invalid length. [ 292.662479][ T9850] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1354'. [ 292.682240][ T9850] veth1_macvtap: entered allmulticast mode [ 293.013842][ T9860] -1: renamed from syzkaller0 [ 293.298191][ T9876] netlink: 'syz.2.1364': attribute type 10 has an invalid length. [ 293.316295][ T9875] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.777866][ T9900] netlink: 'syz.1.1371': attribute type 3 has an invalid length. [ 293.787624][ T9900] netlink: 'syz.1.1371': attribute type 275 has an invalid length. [ 294.219041][ T9914] netlink: 'syz.1.1376': attribute type 10 has an invalid length. [ 294.238095][ T9912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 294.406880][ T9920] netlink: 'syz.1.1378': attribute type 5 has an invalid length. [ 296.000467][ T9939] netlink: 'syz.0.1385': attribute type 2 has an invalid length. [ 296.263409][ T9939] netlink: 'syz.0.1385': attribute type 8 has an invalid length. [ 296.271453][ T9939] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1385'. [ 296.326078][ T9943] netlink: 'syz.2.1387': attribute type 10 has an invalid length. [ 296.354000][ T9940] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 296.504280][ T9952] syz.3.1390[9952] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 296.504698][ T9952] syz.3.1390[9952] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 297.157532][ T9968] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.1395'. [ 297.494844][ T9974] netlink: 'syz.3.1399': attribute type 10 has an invalid length. [ 297.589726][ T9974] bond0: (slave wlan1): Releasing backup interface [ 297.633931][ T9974] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 297.647322][ T9974] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 297.659550][ T9974] team0: Port device wlan1 added [ 297.697047][ T9972] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 298.489656][T10013] netlink: 'syz.0.1413': attribute type 10 has an invalid length. [ 298.537668][T10012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 298.815098][T10019] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 299.774250][T10053] netlink: 'syz.0.1424': attribute type 10 has an invalid length. [ 299.807817][T10052] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 300.189143][T10073] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1431'. [ 300.944364][T10073] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1431'. [ 301.045966][T10087] netlink: 'syz.0.1434': attribute type 21 has an invalid length. [ 301.067944][T10087] netlink: 'syz.0.1434': attribute type 1 has an invalid length. [ 301.092984][T10087] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1434'. [ 301.136576][T10078] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1431'. [ 302.265875][T10098] netlink: 160 bytes leftover after parsing attributes in process `syz.0.1438'. [ 302.279067][T10099] netlink: 160 bytes leftover after parsing attributes in process `syz.0.1438'. [ 302.302887][T10101] netlink: 'syz.3.1437': attribute type 12 has an invalid length. [ 302.310748][T10101] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1437'. [ 302.724976][T10116] mac80211_hwsim hwsim5 .3ãc¤±: renamed from wlan1 [ 305.330353][T10140] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 306.221408][T10142] netlink: 'syz.3.1451': attribute type 10 has an invalid length. [ 306.836560][ T5822] page_pool_release_retry() stalled pool shutdown 1 inflight 60 sec [ 307.417342][T10186] netlink: 'syz.1.1459': attribute type 27 has an invalid length. [ 307.443084][T10186] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1459'. [ 307.735237][T10194] netlink: 'syz.0.1468': attribute type 10 has an invalid length. [ 307.764817][T10193] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 308.135603][T10210] netlink: 'syz.0.1474': attribute type 21 has an invalid length. [ 308.183289][T10210] netlink: 'syz.0.1474': attribute type 1 has an invalid length. [ 308.417679][T10221] netlink: 'syz.0.1478': attribute type 3 has an invalid length. [ 308.441874][T10221] netlink: 'syz.0.1478': attribute type 1 has an invalid length. [ 308.466680][T10221] netlink: 130160 bytes leftover after parsing attributes in process `syz.0.1478'. [ 308.854002][T10230] netlink: 'syz.0.1482': attribute type 10 has an invalid length. [ 308.877282][T10229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 309.184522][T10244] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1487'. [ 309.212120][T10244] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 309.603694][T10256] netlink: 'syz.1.1490': attribute type 3 has an invalid length. [ 309.631769][T10256] netlink: 'syz.1.1490': attribute type 1 has an invalid length. [ 309.650146][T10256] netlink: 130160 bytes leftover after parsing attributes in process `syz.1.1490'. [ 310.069181][T10267] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 310.069602][T10271] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.1498'. [ 310.101423][T10271] FAULT_INJECTION: forcing a failure. [ 310.101423][T10271] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 310.116696][T10271] CPU: 0 PID: 10271 Comm: syz.0.1498 Not tainted syzkaller #0 [ 310.124187][T10271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 310.134246][T10271] Call Trace: [ 310.137520][T10271] [ 310.140442][T10271] dump_stack_lvl+0x18c/0x250 [ 310.145123][T10271] ? show_regs_print_info+0x20/0x20 [ 310.150322][T10271] ? load_image+0x420/0x420 [ 310.154828][T10271] ? __lock_acquire+0x7d80/0x7d80 [ 310.159858][T10271] ? snprintf+0xe9/0x140 [ 310.164100][T10271] should_fail_ex+0x394/0x4c0 [ 310.168776][T10271] _copy_to_user+0x2f/0xa0 [ 310.173193][T10271] simple_read_from_buffer+0xe7/0x150 [ 310.178561][T10271] proc_fail_nth_read+0x1e8/0x260 [ 310.183582][T10271] ? proc_fault_inject_write+0x360/0x360 [ 310.189208][T10271] ? fsnotify_perm+0x271/0x5e0 [ 310.193968][T10271] ? proc_fault_inject_write+0x360/0x360 [ 310.199593][T10271] vfs_read+0x298/0x990 [ 310.203746][T10271] ? kernel_read+0x1e0/0x1e0 [ 310.208331][T10271] ? __fget_files+0x28/0x460 [ 310.212923][T10271] ? __fget_files+0x3fc/0x460 [ 310.217608][T10271] ? __fdget_pos+0x2a3/0x330 [ 310.222196][T10271] ? ksys_read+0x74/0x260 [ 310.226520][T10271] ksys_read+0x151/0x260 [ 310.230758][T10271] ? vfs_write+0x9a0/0x9a0 [ 310.235176][T10271] ? lockdep_hardirqs_on+0x98/0x150 [ 310.240370][T10271] do_syscall_64+0x55/0xb0 [ 310.244785][T10271] ? clear_bhb_loop+0x40/0x90 [ 310.249453][T10271] ? clear_bhb_loop+0x40/0x90 [ 310.254120][T10271] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 310.260009][T10271] RIP: 0033:0x7fe0ce55e90e [ 310.264413][T10271] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 310.284012][T10271] RSP: 002b:00007fe0cf3e8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 310.292415][T10271] RAX: ffffffffffffffda RBX: 00007fe0cf3e96c0 RCX: 00007fe0ce55e90e [ 310.300374][T10271] RDX: 000000000000000f RSI: 00007fe0cf3e90a0 RDI: 0000000000000008 [ 310.308336][T10271] RBP: 00007fe0cf3e9090 R08: 0000000000000000 R09: 0000000000000000 [ 310.316301][T10271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 310.324270][T10271] R13: 00007fe0ce826038 R14: 00007fe0ce825fa0 R15: 00007ffc113b1958 [ 310.332242][T10271] [ 310.526100][T10277] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1500'. [ 310.556255][T10281] netlink: 130160 bytes leftover after parsing attributes in process `syz.2.1501'. [ 310.593965][T10278] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 310.898626][T10288] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.1503'. [ 311.330342][T10309] validate_nla: 10 callbacks suppressed [ 311.330358][T10309] netlink: 'syz.2.1513': attribute type 10 has an invalid length. [ 311.360654][T10307] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 311.918182][T10346] FAULT_INJECTION: forcing a failure. [ 311.918182][T10346] name failslab, interval 1, probability 0, space 0, times 0 [ 311.932735][T10346] CPU: 1 PID: 10346 Comm: syz.1.1524 Not tainted syzkaller #0 [ 311.940227][T10346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 311.950288][T10346] Call Trace: [ 311.953574][T10346] [ 311.956519][T10346] dump_stack_lvl+0x18c/0x250 [ 311.961217][T10346] ? show_regs_print_info+0x20/0x20 [ 311.966409][T10346] ? load_image+0x420/0x420 [ 311.970926][T10346] ? __might_sleep+0xe0/0xe0 [ 311.975521][T10346] ? __lock_acquire+0x7d80/0x7d80 [ 311.980541][T10346] should_fail_ex+0x394/0x4c0 [ 311.985229][T10346] should_failslab+0x9/0x20 [ 311.989741][T10346] slab_pre_alloc_hook+0x59/0x300 [ 311.994757][T10346] ? __lock_acquire+0x7d80/0x7d80 [ 311.999765][T10346] ? kvmalloc_node+0x70/0x180 [ 312.004431][T10346] ? kvmalloc_node+0x70/0x180 [ 312.009093][T10346] __kmem_cache_alloc_node+0x53/0x250 [ 312.014460][T10346] ? __schedule_delayed_monitor_work+0x200/0x200 [ 312.020780][T10346] ? kvmalloc_node+0x70/0x180 [ 312.025447][T10346] __kmalloc_node+0xa6/0x240 [ 312.030030][T10346] kvmalloc_node+0x70/0x180 [ 312.034553][T10346] bpf_test_run_xdp_live+0x1c2/0x1b30 [ 312.039951][T10346] ? 0xffffffffa0004740 [ 312.044106][T10346] ? 0xffffffffa0004740 [ 312.048243][T10346] ? bpf_dispatcher_change_prog+0xc96/0xf10 [ 312.054128][T10346] ? xdp_convert_md_to_buff+0x330/0x330 [ 312.059696][T10346] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 312.065943][T10346] ? _copy_from_user+0xa5/0xe0 [ 312.070703][T10346] ? bpf_test_init+0x119/0x140 [ 312.075475][T10346] ? xdp_convert_md_to_buff+0x5b/0x330 [ 312.080945][T10346] bpf_prog_test_run_xdp+0x7d8/0x1140 [ 312.086322][T10346] ? __lock_acquire+0x7d80/0x7d80 [ 312.091361][T10346] ? dev_put+0x80/0x80 [ 312.095426][T10346] ? dev_put+0x80/0x80 [ 312.099483][T10346] bpf_prog_test_run+0x31f/0x390 [ 312.104411][T10346] __sys_bpf+0x49d/0x890 [ 312.108644][T10346] ? bpf_link_show_fdinfo+0x390/0x390 [ 312.114018][T10346] ? lock_chain_count+0x20/0x20 [ 312.118862][T10346] __x64_sys_bpf+0x7c/0x90 [ 312.123265][T10346] do_syscall_64+0x55/0xb0 [ 312.127672][T10346] ? clear_bhb_loop+0x40/0x90 [ 312.132333][T10346] ? clear_bhb_loop+0x40/0x90 [ 312.137013][T10346] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 312.142914][T10346] RIP: 0033:0x7fe86fd9e0d9 [ 312.147340][T10346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 312.166952][T10346] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 312.175380][T10346] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 312.183351][T10346] RDX: 0000000000000050 RSI: 0000200000000680 RDI: 000000000000000a [ 312.191347][T10346] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 312.199307][T10346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 312.207263][T10346] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 312.215244][T10346] [ 312.306168][T10349] netlink: 'syz.2.1525': attribute type 10 has an invalid length. [ 312.335990][T10348] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 312.565291][T10361] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1529'. [ 313.122280][T10381] netlink: 'syz.3.1537': attribute type 10 has an invalid length. [ 313.149541][T10380] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 313.311055][T10387] FAULT_INJECTION: forcing a failure. [ 313.311055][T10387] name failslab, interval 1, probability 0, space 0, times 0 [ 313.338161][T10387] CPU: 0 PID: 10387 Comm: syz.0.1540 Not tainted syzkaller #0 [ 313.345674][T10387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 313.355745][T10387] Call Trace: [ 313.359035][T10387] [ 313.361978][T10387] dump_stack_lvl+0x18c/0x250 [ 313.366683][T10387] ? show_regs_print_info+0x20/0x20 [ 313.371905][T10387] ? load_image+0x420/0x420 [ 313.376444][T10387] ? __lock_acquire+0x7d80/0x7d80 [ 313.381493][T10387] should_fail_ex+0x394/0x4c0 [ 313.386196][T10387] should_failslab+0x9/0x20 [ 313.390719][T10387] slab_pre_alloc_hook+0x59/0x300 [ 313.395772][T10387] ? security_sk_alloc+0x4b/0x130 [ 313.400816][T10387] ? security_sk_alloc+0x4b/0x130 [ 313.405855][T10387] __kmem_cache_alloc_node+0x53/0x250 [ 313.411250][T10387] ? security_sk_alloc+0x4b/0x130 [ 313.416292][T10387] __kmalloc+0xa7/0x240 [ 313.420467][T10387] ? sk_prot_alloc+0xe7/0x210 [ 313.425175][T10387] security_sk_alloc+0x4b/0x130 [ 313.430048][T10387] sk_prot_alloc+0x101/0x210 [ 313.434651][T10387] ? sk_alloc+0x24/0x350 [ 313.438908][T10387] sk_alloc+0x3a/0x350 [ 313.442985][T10387] ? bpf_ctx_init+0x154/0x190 [ 313.447670][T10387] bpf_prog_test_run_skb+0x371/0x18f0 [ 313.453053][T10387] ? __fget_files+0x28/0x460 [ 313.457654][T10387] ? __fget_files+0x3fc/0x460 [ 313.462369][T10387] ? cpu_online+0x60/0x60 [ 313.466707][T10387] bpf_prog_test_run+0x31f/0x390 [ 313.471655][T10387] __sys_bpf+0x49d/0x890 [ 313.475909][T10387] ? bpf_link_show_fdinfo+0x390/0x390 [ 313.481297][T10387] ? lock_chain_count+0x20/0x20 [ 313.486162][T10387] __x64_sys_bpf+0x7c/0x90 [ 313.490583][T10387] do_syscall_64+0x55/0xb0 [ 313.495008][T10387] ? clear_bhb_loop+0x40/0x90 [ 313.499689][T10387] ? clear_bhb_loop+0x40/0x90 [ 313.504380][T10387] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 313.510278][T10387] RIP: 0033:0x7fe0ce59e0d9 [ 313.514698][T10387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.534306][T10387] RSP: 002b:00007fe0cf3e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 313.542726][T10387] RAX: ffffffffffffffda RBX: 00007fe0ce825fa0 RCX: 00007fe0ce59e0d9 [ 313.550702][T10387] RDX: 0000000000000048 RSI: 00002000000000c0 RDI: 000000000000000a [ 313.558673][T10387] RBP: 00007fe0cf3e9090 R08: 0000000000000000 R09: 0000000000000000 [ 313.566647][T10387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.574615][T10387] R13: 00007fe0ce826038 R14: 00007fe0ce825fa0 R15: 00007ffc113b1958 [ 313.582610][T10387] [ 316.508443][T10413] netlink: 'syz.3.1550': attribute type 10 has an invalid length. [ 316.533068][T10411] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 316.596433][T10419] FAULT_INJECTION: forcing a failure. [ 316.596433][T10419] name failslab, interval 1, probability 0, space 0, times 0 [ 316.620006][T10419] CPU: 0 PID: 10419 Comm: syz.0.1553 Not tainted syzkaller #0 [ 316.627509][T10419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 316.637569][T10419] Call Trace: [ 316.640838][T10419] [ 316.643772][T10419] dump_stack_lvl+0x18c/0x250 [ 316.648477][T10419] ? show_regs_print_info+0x20/0x20 [ 316.653697][T10419] ? load_image+0x420/0x420 [ 316.658269][T10419] ? __might_sleep+0xe0/0xe0 [ 316.662880][T10419] ? __lock_acquire+0x7d80/0x7d80 [ 316.667919][T10419] ? mark_lock+0x94/0x320 [ 316.672275][T10419] should_fail_ex+0x394/0x4c0 [ 316.676978][T10419] should_failslab+0x9/0x20 [ 316.681506][T10419] slab_pre_alloc_hook+0x59/0x300 [ 316.686558][T10419] ? __get_vm_area_node+0x125/0x370 [ 316.691780][T10419] __kmem_cache_alloc_node+0x53/0x250 [ 316.697182][T10419] ? __get_vm_area_node+0x125/0x370 [ 316.702398][T10419] kmalloc_node_trace+0x26/0xe0 [ 316.707275][T10419] __get_vm_area_node+0x125/0x370 [ 316.712320][T10419] __vmalloc_node_range+0x36f/0x1320 [ 316.717611][T10419] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 316.723164][T10419] ? mark_lock+0x94/0x320 [ 316.727497][T10419] ? __lock_acquire+0x1336/0x7d80 [ 316.732526][T10419] ? aa_get_newest_label+0xfd/0x5c0 [ 316.737717][T10419] ? free_vm_area+0x50/0x50 [ 316.742215][T10419] ? end_current_label_crit_section+0x170/0x170 [ 316.748451][T10419] ? verify_lock_unused+0x140/0x140 [ 316.753641][T10419] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 316.759183][T10419] __vmalloc+0x7a/0x90 [ 316.763251][T10419] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 316.768788][T10419] bpf_prog_alloc_no_stats+0x46/0x430 [ 316.774156][T10419] bpf_prog_alloc+0x3d/0x1a0 [ 316.778739][T10419] bpf_prog_load+0x6b2/0x1610 [ 316.783413][T10419] ? map_freeze+0x420/0x420 [ 316.787915][T10419] ? __might_fault+0xaa/0x120 [ 316.792579][T10419] ? __lock_acquire+0x7d80/0x7d80 [ 316.797596][T10419] ? file_end_write+0x159/0x250 [ 316.802443][T10419] ? __might_fault+0xaa/0x120 [ 316.807110][T10419] ? __might_fault+0xc6/0x120 [ 316.811776][T10419] ? __might_fault+0xaa/0x120 [ 316.816440][T10419] ? bpf_lsm_bpf+0x9/0x10 [ 316.820764][T10419] ? security_bpf+0x7e/0xa0 [ 316.825260][T10419] __sys_bpf+0x5ba/0x890 [ 316.829495][T10419] ? bpf_link_show_fdinfo+0x390/0x390 [ 316.834866][T10419] ? lock_chain_count+0x20/0x20 [ 316.839712][T10419] __x64_sys_bpf+0x7c/0x90 [ 316.844124][T10419] do_syscall_64+0x55/0xb0 [ 316.848532][T10419] ? clear_bhb_loop+0x40/0x90 [ 316.853201][T10419] ? clear_bhb_loop+0x40/0x90 [ 316.857867][T10419] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 316.863751][T10419] RIP: 0033:0x7fe0ce59e0d9 [ 316.868159][T10419] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 316.887784][T10419] RSP: 002b:00007fe0cf3e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 316.896194][T10419] RAX: ffffffffffffffda RBX: 00007fe0ce825fa0 RCX: 00007fe0ce59e0d9 [ 316.904159][T10419] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 316.912124][T10419] RBP: 00007fe0cf3e9090 R08: 0000000000000000 R09: 0000000000000000 [ 316.920091][T10419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.928058][T10419] R13: 00007fe0ce826038 R14: 00007fe0ce825fa0 R15: 00007ffc113b1958 [ 316.936037][T10419] [ 316.958750][T10419] syz.0.1553: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 316.975795][T10419] CPU: 1 PID: 10419 Comm: syz.0.1553 Not tainted syzkaller #0 [ 316.983278][T10419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 316.993326][T10419] Call Trace: [ 316.996595][T10419] [ 316.999523][T10419] dump_stack_lvl+0x18c/0x250 [ 317.004201][T10419] ? show_regs_print_info+0x20/0x20 [ 317.009393][T10419] ? load_image+0x420/0x420 [ 317.013897][T10419] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 317.020311][T10419] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 317.026810][T10419] warn_alloc+0x246/0x340 [ 317.031133][T10419] ? __get_vm_area_node+0x125/0x370 [ 317.036330][T10419] ? zone_watermark_ok_safe+0x230/0x230 [ 317.041866][T10419] ? rcu_is_watching+0x15/0xb0 [ 317.047061][T10419] ? __get_vm_area_node+0x356/0x370 [ 317.052256][T10419] __vmalloc_node_range+0x394/0x1320 [ 317.057536][T10419] ? mark_lock+0x94/0x320 [ 317.061856][T10419] ? __lock_acquire+0x1336/0x7d80 [ 317.066893][T10419] ? aa_get_newest_label+0xfd/0x5c0 [ 317.072095][T10419] ? free_vm_area+0x50/0x50 [ 317.076613][T10419] ? end_current_label_crit_section+0x170/0x170 [ 317.082870][T10419] ? verify_lock_unused+0x140/0x140 [ 317.088075][T10419] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 317.093889][T10419] __vmalloc+0x7a/0x90 [ 317.097960][T10419] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 317.103506][T10419] bpf_prog_alloc_no_stats+0x46/0x430 [ 317.108875][T10419] bpf_prog_alloc+0x3d/0x1a0 [ 317.113461][T10419] bpf_prog_load+0x6b2/0x1610 [ 317.118143][T10419] ? map_freeze+0x420/0x420 [ 317.122648][T10419] ? __might_fault+0xaa/0x120 [ 317.127321][T10419] ? __lock_acquire+0x7d80/0x7d80 [ 317.132341][T10419] ? file_end_write+0x159/0x250 [ 317.137188][T10419] ? __might_fault+0xaa/0x120 [ 317.141857][T10419] ? __might_fault+0xc6/0x120 [ 317.146528][T10419] ? __might_fault+0xaa/0x120 [ 317.151193][T10419] ? bpf_lsm_bpf+0x9/0x10 [ 317.155519][T10419] ? security_bpf+0x7e/0xa0 [ 317.160015][T10419] __sys_bpf+0x5ba/0x890 [ 317.164262][T10419] ? bpf_link_show_fdinfo+0x390/0x390 [ 317.169636][T10419] ? lock_chain_count+0x20/0x20 [ 317.174482][T10419] __x64_sys_bpf+0x7c/0x90 [ 317.178890][T10419] do_syscall_64+0x55/0xb0 [ 317.183300][T10419] ? clear_bhb_loop+0x40/0x90 [ 317.187977][T10419] ? clear_bhb_loop+0x40/0x90 [ 317.192646][T10419] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 317.198527][T10419] RIP: 0033:0x7fe0ce59e0d9 [ 317.202947][T10419] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 317.222563][T10419] RSP: 002b:00007fe0cf3e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 317.230976][T10419] RAX: ffffffffffffffda RBX: 00007fe0ce825fa0 RCX: 00007fe0ce59e0d9 [ 317.238948][T10419] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 317.246916][T10419] RBP: 00007fe0cf3e9090 R08: 0000000000000000 R09: 0000000000000000 [ 317.254878][T10419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 317.262848][T10419] R13: 00007fe0ce826038 R14: 00007fe0ce825fa0 R15: 00007ffc113b1958 [ 317.270822][T10419] [ 317.291165][T10420] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 317.347982][T10419] Mem-Info: [ 317.351216][T10419] active_anon:6234 inactive_anon:0 isolated_anon:0 [ 317.351216][T10419] active_file:18691 inactive_file:40048 isolated_file:0 [ 317.351216][T10419] unevictable:768 dirty:263 writeback:0 [ 317.351216][T10419] slab_reclaimable:10941 slab_unreclaimable:91617 [ 317.351216][T10419] mapped:25283 shmem:2251 pagetables:547 [ 317.351216][T10419] sec_pagetables:0 bounce:0 [ 317.351216][T10419] kernel_misc_reclaimable:0 [ 317.351216][T10419] free:1351372 free_pcp:5801 free_cma:0 [ 317.406813][T10419] Node 0 active_anon:26836kB inactive_anon:0kB active_file:74764kB inactive_file:159992kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:103132kB dirty:1052kB writeback:0kB shmem:9468kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11288kB pagetables:2088kB sec_pagetables:0kB all_unreclaimable? no [ 317.447937][T10419] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 317.491294][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.498345][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.622912][T10419] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 317.692893][T10419] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 317.698718][T10419] Node 0 DMA32 free:1489260kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:32700kB inactive_anon:0kB active_file:74764kB inactive_file:159168kB unevictable:1536kB writepending:1052kB present:3129332kB managed:2586840kB mlocked:0kB bounce:0kB free_pcp:5792kB local_pcp:3288kB free_cma:0kB [ 317.770395][T10419] lowmem_reserve[]: 0 0 0 0 0 [ 317.780512][T10419] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 317.787538][T10441] netlink: 'syz.2.1560': attribute type 4 has an invalid length. [ 317.843132][T10419] lowmem_reserve[]: 0 0 0 0 0 [ 317.863234][T10419] Node 1 Normal free:3892572kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:19456kB local_pcp:12800kB free_cma:0kB [ 317.972986][T10419] lowmem_reserve[]: 0 0 0 0 0 [ 317.977763][T10419] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 318.012933][T10419] Node 0 DMA32: 535*4kB (UM) 669*8kB (UE) 696*16kB (UME) 968*32kB (UME) 518*64kB (UME) 280*128kB (UME) 142*256kB (UM) 26*512kB (UM) 6*1024kB (M) 4*2048kB (UM) 317*4096kB (UM) = 1481028kB [ 318.031950][T10448] netlink: 184 bytes leftover after parsing attributes in process `syz.2.1562'. [ 318.072926][T10419] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 318.092774][T10419] Node 1 Normal: 255*4kB (UE) 68*8kB (UE) 48*16kB (UE) 110*32kB (UE) 32*64kB (UME) 7*128kB (UME) 1*256kB (U) 1*512kB (M) 2*1024kB (UE) 1*2048kB (E) 947*4096kB (M) = 3892572kB [ 318.143418][T10419] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 318.152591][T10450] netlink: 'syz.1.1563': attribute type 10 has an invalid length. [ 318.162891][T10419] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 318.162913][T10419] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 318.162929][T10419] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 318.162945][T10419] 65815 total pagecache pages [ 318.162954][T10419] 0 pages in swap cache [ 318.162961][T10419] Free swap = 124996kB [ 318.162968][T10419] Total swap = 124996kB [ 318.162977][T10419] 2097051 pages RAM [ 318.162984][T10419] 0 pages HighMem/MovableOnly [ 318.162991][T10419] 416955 pages reserved [ 318.162998][T10419] 0 pages cma reserved [ 318.393092][T10449] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 318.786461][T10469] netlink: 'syz.3.1570': attribute type 12 has an invalid length. [ 318.827316][T10469] netlink: 14585 bytes leftover after parsing attributes in process `syz.3.1570'. [ 319.026717][T10483] netlink: 'syz.1.1572': attribute type 1 has an invalid length. [ 319.128526][T10483] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.1572'. [ 319.864693][T10504] netlink: 'syz.0.1581': attribute type 10 has an invalid length. [ 319.907905][T10503] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 320.182032][T10511] FAULT_INJECTION: forcing a failure. [ 320.182032][T10511] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 320.236721][T10511] CPU: 0 PID: 10511 Comm: syz.0.1583 Not tainted syzkaller #0 [ 320.244240][T10511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 320.254303][T10511] Call Trace: [ 320.257587][T10511] [ 320.260521][T10511] dump_stack_lvl+0x18c/0x250 [ 320.265201][T10511] ? show_regs_print_info+0x20/0x20 [ 320.270392][T10511] ? load_image+0x420/0x420 [ 320.274893][T10511] ? __might_fault+0xaa/0x120 [ 320.279564][T10511] ? __lock_acquire+0x7d80/0x7d80 [ 320.284581][T10511] ? __virt_addr_valid+0x10c/0x380 [ 320.289714][T10511] should_fail_ex+0x394/0x4c0 [ 320.294392][T10511] _copy_to_user+0x2f/0xa0 [ 320.298801][T10511] __htab_map_lookup_and_delete_batch+0x1061/0x1400 [ 320.305400][T10511] ? __fget_files+0x28/0x460 [ 320.309985][T10511] ? jhash+0x740/0x740 [ 320.314065][T10511] ? __fdget+0x180/0x210 [ 320.318302][T10511] ? htab_map_lookup_and_delete_elem+0x40/0x40 [ 320.324461][T10511] bpf_map_do_batch+0x48c/0x600 [ 320.329304][T10511] ? bpf_lsm_xfrm_policy_delete_security+0x10/0x10 [ 320.335804][T10511] __sys_bpf+0x78c/0x890 [ 320.340040][T10511] ? bpf_link_show_fdinfo+0x390/0x390 [ 320.345702][T10511] ? lock_chain_count+0x20/0x20 [ 320.350559][T10511] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 320.356541][T10511] __x64_sys_bpf+0x7c/0x90 [ 320.360949][T10511] do_syscall_64+0x55/0xb0 [ 320.365357][T10511] ? clear_bhb_loop+0x40/0x90 [ 320.370026][T10511] ? clear_bhb_loop+0x40/0x90 [ 320.374696][T10511] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 320.380579][T10511] RIP: 0033:0x7fe0ce59e0d9 [ 320.384985][T10511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.404584][T10511] RSP: 002b:00007fe0cf3c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 320.412992][T10511] RAX: ffffffffffffffda RBX: 00007fe0ce826090 RCX: 00007fe0ce59e0d9 [ 320.420952][T10511] RDX: 0000000000000038 RSI: 0000200000000800 RDI: 0000000000000019 [ 320.428920][T10511] RBP: 00007fe0cf3c8090 R08: 0000000000000000 R09: 0000000000000000 [ 320.436901][T10511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 320.444861][T10511] R13: 00007fe0ce826128 R14: 00007fe0ce826090 R15: 00007ffc113b1958 [ 320.452838][T10511] [ 320.738514][T10518] FAULT_INJECTION: forcing a failure. [ 320.738514][T10518] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 320.766385][T10518] CPU: 0 PID: 10518 Comm: syz.0.1587 Not tainted syzkaller #0 [ 320.773892][T10518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 320.783970][T10518] Call Trace: [ 320.787258][T10518] [ 320.790195][T10518] dump_stack_lvl+0x18c/0x250 [ 320.794894][T10518] ? show_regs_print_info+0x20/0x20 [ 320.800110][T10518] ? load_image+0x420/0x420 [ 320.804645][T10518] ? __might_fault+0xaa/0x120 [ 320.809334][T10518] ? __lock_acquire+0x7d80/0x7d80 [ 320.814373][T10518] ? __virt_addr_valid+0x10c/0x380 [ 320.819501][T10518] should_fail_ex+0x394/0x4c0 [ 320.824201][T10518] _copy_from_user+0x2f/0xe0 [ 320.828811][T10518] generic_map_update_batch+0x53e/0x800 [ 320.834377][T10518] ? rcu_read_unlock+0xa0/0xa0 [ 320.839161][T10518] ? __fdget+0x180/0x210 [ 320.843423][T10518] ? rcu_read_unlock+0xa0/0xa0 [ 320.848202][T10518] bpf_map_do_batch+0x3f2/0x600 [ 320.853071][T10518] ? bpf_lsm_xfrm_policy_delete_security+0x10/0x10 [ 320.859598][T10518] __sys_bpf+0x381/0x890 [ 320.863865][T10518] ? bpf_link_show_fdinfo+0x390/0x390 [ 320.869269][T10518] ? lock_chain_count+0x20/0x20 [ 320.874136][T10518] __x64_sys_bpf+0x7c/0x90 [ 320.878550][T10518] do_syscall_64+0x55/0xb0 [ 320.882958][T10518] ? clear_bhb_loop+0x40/0x90 [ 320.887633][T10518] ? clear_bhb_loop+0x40/0x90 [ 320.892301][T10518] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 320.898187][T10518] RIP: 0033:0x7fe0ce59e0d9 [ 320.902593][T10518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.922192][T10518] RSP: 002b:00007fe0cf3e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 320.930595][T10518] RAX: ffffffffffffffda RBX: 00007fe0ce825fa0 RCX: 00007fe0ce59e0d9 [ 320.938557][T10518] RDX: 0000000000000038 RSI: 0000200000000300 RDI: 000000000000001a [ 320.946516][T10518] RBP: 00007fe0cf3e9090 R08: 0000000000000000 R09: 0000000000000000 [ 320.954475][T10518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 320.962434][T10518] R13: 00007fe0ce826038 R14: 00007fe0ce825fa0 R15: 00007ffc113b1958 [ 320.970405][T10518] [ 321.042804][T10520] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1588'. [ 321.080612][T10520] netlink: 'syz.1.1588': attribute type 39 has an invalid length. [ 321.298630][T10522] netlink: 'syz.3.1589': attribute type 10 has an invalid length. [ 321.348137][T10522] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1589'. [ 323.139032][ T5790] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 323.287587][T10588] FAULT_INJECTION: forcing a failure. [ 323.287587][T10588] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 323.342461][T10588] CPU: 0 PID: 10588 Comm: syz.0.1605 Not tainted syzkaller #0 [ 323.349987][T10588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 323.360070][T10588] Call Trace: [ 323.363377][T10588] [ 323.366337][T10588] dump_stack_lvl+0x18c/0x250 [ 323.371055][T10588] ? show_regs_print_info+0x20/0x20 [ 323.376285][T10588] ? load_image+0x420/0x420 [ 323.380833][T10588] ? __might_fault+0xaa/0x120 [ 323.385540][T10588] ? __lock_acquire+0x7d80/0x7d80 [ 323.390598][T10588] ? __virt_addr_valid+0x10c/0x380 [ 323.395743][T10588] should_fail_ex+0x394/0x4c0 [ 323.400462][T10588] _copy_to_user+0x2f/0xa0 [ 323.404914][T10588] __htab_map_lookup_and_delete_batch+0x10c8/0x1400 [ 323.411590][T10588] ? __fget_files+0x28/0x460 [ 323.416219][T10588] ? jhash+0x740/0x740 [ 323.420331][T10588] ? __fdget+0x180/0x210 [ 323.424614][T10588] ? htab_map_lookup_and_delete_elem+0x40/0x40 [ 323.430801][T10588] bpf_map_do_batch+0x48c/0x600 [ 323.435680][T10588] ? bpf_lsm_xfrm_policy_delete_security+0x10/0x10 [ 323.442223][T10588] __sys_bpf+0x78c/0x890 [ 323.446492][T10588] ? bpf_link_show_fdinfo+0x390/0x390 [ 323.451889][T10588] ? lock_chain_count+0x20/0x20 [ 323.456754][T10588] __x64_sys_bpf+0x7c/0x90 [ 323.461171][T10588] do_syscall_64+0x55/0xb0 [ 323.465585][T10588] ? clear_bhb_loop+0x40/0x90 [ 323.470260][T10588] ? clear_bhb_loop+0x40/0x90 [ 323.474942][T10588] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 323.480831][T10588] RIP: 0033:0x7fe0ce59e0d9 [ 323.485249][T10588] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.504854][T10588] RSP: 002b:00007fe0cf3c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 323.513272][T10588] RAX: ffffffffffffffda RBX: 00007fe0ce826090 RCX: 00007fe0ce59e0d9 [ 323.521239][T10588] RDX: 0000000000000038 RSI: 0000200000000800 RDI: 0000000000000019 [ 323.529208][T10588] RBP: 00007fe0cf3c8090 R08: 0000000000000000 R09: 0000000000000000 [ 323.537178][T10588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 323.545147][T10588] R13: 00007fe0ce826128 R14: 00007fe0ce826090 R15: 00007ffc113b1958 [ 323.553138][T10588] [ 323.584512][T10585] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1609'. [ 323.656570][T10585] netlink: 'syz.2.1609': attribute type 39 has an invalid length. [ 323.923025][T10598] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1611'. [ 323.932064][T10598] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1611'. [ 323.995388][T10598] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1611'. [ 324.629421][T10612] FAULT_INJECTION: forcing a failure. [ 324.629421][T10612] name failslab, interval 1, probability 0, space 0, times 0 [ 324.683048][T10612] CPU: 0 PID: 10612 Comm: syz.2.1616 Not tainted syzkaller #0 [ 324.690576][T10612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 324.700646][T10612] Call Trace: [ 324.703934][T10612] [ 324.706870][T10612] dump_stack_lvl+0x18c/0x250 [ 324.711557][T10612] ? sctp_sendmsg+0x1519/0x27b0 [ 324.716418][T10612] ? ___sys_sendmsg+0x2a6/0x360 [ 324.721282][T10612] ? show_regs_print_info+0x20/0x20 [ 324.726490][T10612] ? load_image+0x420/0x420 [ 324.731015][T10612] should_fail_ex+0x394/0x4c0 [ 324.735706][T10612] should_failslab+0x9/0x20 [ 324.740222][T10612] slab_pre_alloc_hook+0x59/0x300 [ 324.745259][T10612] ? sctp_add_bind_addr+0x8c/0x360 [ 324.750375][T10612] __kmem_cache_alloc_node+0x53/0x250 [ 324.755766][T10612] ? sctp_add_bind_addr+0x8c/0x360 [ 324.760885][T10612] kmalloc_trace+0x2a/0xe0 [ 324.765314][T10612] sctp_add_bind_addr+0x8c/0x360 [ 324.770262][T10612] sctp_copy_local_addr_list+0x31b/0x4e0 [ 324.775912][T10612] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 324.781636][T10612] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 324.787711][T10612] ? sctp_v6_is_any+0x64/0x70 [ 324.792396][T10612] ? sctp_copy_one_addr+0x8c/0x350 [ 324.797526][T10612] sctp_bind_addr_copy+0xb3/0x3c0 [ 324.802558][T10612] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 324.808896][T10612] sctp_connect_new_asoc+0x2f9/0x6a0 [ 324.814191][T10612] ? __sctp_connect+0xd80/0xd80 [ 324.819048][T10612] ? __local_bh_enable_ip+0x13a/0x1c0 [ 324.824433][T10612] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 324.829986][T10612] ? security_sctp_bind_connect+0x89/0xb0 [ 324.835714][T10612] sctp_sendmsg+0x1519/0x27b0 [ 324.840420][T10612] ? sctp_getsockopt+0xb60/0xb60 [ 324.845371][T10612] ? aa_af_perm+0x330/0x330 [ 324.849882][T10612] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 324.856309][T10612] ? sock_rps_record_flow+0x19/0x3f0 [ 324.861604][T10612] ? inet_sendmsg+0xce/0x2a0 [ 324.866202][T10612] ? inet_send_prepare+0x250/0x250 [ 324.871327][T10612] ____sys_sendmsg+0x61b/0x980 [ 324.876103][T10612] ? __asan_memset+0x22/0x40 [ 324.880699][T10612] ? __sys_sendmsg_sock+0x30/0x30 [ 324.885729][T10612] ? __import_iovec+0x5f2/0x850 [ 324.890602][T10612] ? import_iovec+0x73/0xa0 [ 324.895116][T10612] ___sys_sendmsg+0x2a6/0x360 [ 324.899797][T10612] ? get_pid_task+0x20/0x1e0 [ 324.904400][T10612] ? __sys_sendmsg+0x2b0/0x2b0 [ 324.909188][T10612] ? __lock_acquire+0x7d80/0x7d80 [ 324.914240][T10612] __se_sys_sendmsg+0x1d0/0x2c0 [ 324.919099][T10612] ? __x64_sys_sendmsg+0x80/0x80 [ 324.924055][T10612] ? lockdep_hardirqs_on+0x98/0x150 [ 324.929262][T10612] do_syscall_64+0x55/0xb0 [ 324.933683][T10612] ? clear_bhb_loop+0x40/0x90 [ 324.938358][T10612] ? clear_bhb_loop+0x40/0x90 [ 324.943038][T10612] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 324.948931][T10612] RIP: 0033:0x7fcbd639e0d9 [ 324.953347][T10612] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 324.972956][T10612] RSP: 002b:00007fcbd7222028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 324.981377][T10612] RAX: ffffffffffffffda RBX: 00007fcbd6625fa0 RCX: 00007fcbd639e0d9 [ 324.989351][T10612] RDX: 0000000000040040 RSI: 00002000000003c0 RDI: 0000000000000003 [ 324.997326][T10612] RBP: 00007fcbd7222090 R08: 0000000000000000 R09: 0000000000000000 [ 325.005313][T10612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 325.013302][T10612] R13: 00007fcbd6626038 R14: 00007fcbd6625fa0 R15: 00007ffedad53338 [ 325.021293][T10612] [ 325.271560][T10619] ±ÿÿÿÿa–ïD: renamed from lo (while UP) [ 326.151968][T10632] netlink: 'syz.0.1624': attribute type 3 has an invalid length. [ 326.204321][T10632] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1624'. [ 326.249787][T10635] syzkaller0: left promiscuous mode [ 326.299753][T10635] syzkaller0: left allmulticast mode [ 326.913021][T10652] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1632'. [ 326.957322][T10652] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1632'. [ 327.010854][T10652] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1632'. [ 327.024049][T10652] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1632'. [ 327.251404][T10661] Ÿë: port 1(ip6gretap0) entered blocking state [ 327.260829][T10661] Ÿë: port 1(ip6gretap0) entered disabled state [ 327.271076][T10661] ip6gretap0: entered allmulticast mode [ 327.284284][T10661] ip6gretap0: entered promiscuous mode [ 327.891891][T10674] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1639'. [ 328.570193][T10691] dvmrp1: tun_chr_ioctl cmd 21731 [ 328.779896][T10689] netlink: set zone limit has 8 unknown bytes [ 328.836675][T10695] netlink: 'syz.0.1650': attribute type 10 has an invalid length. [ 328.878671][T10694] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 329.221137][T10708] netlink: 'syz.1.1653': attribute type 9 has an invalid length. [ 329.255834][T10708] __nla_validate_parse: 1 callbacks suppressed [ 329.255877][T10708] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.1653'. [ 330.911174][T10753] netlink: 'syz.1.1671': attribute type 4 has an invalid length. [ 330.922279][T10753] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1671'. [ 331.541354][T10776] netlink: 'syz.0.1680': attribute type 19 has an invalid length. [ 331.551638][T10776] netlink: 14552 bytes leftover after parsing attributes in process `syz.0.1680'. [ 331.820835][T10788] netlink: 'syz.3.1686': attribute type 2 has an invalid length. [ 331.829239][T10788] netlink: 'syz.3.1686': attribute type 8 has an invalid length. [ 331.843334][T10788] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1686'. [ 333.287549][T10836] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1700'. [ 333.325984][T10836] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1700'. [ 333.460596][T10837] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1700'. [ 333.506604][T10837] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1700'. [ 333.641590][T10839] netlink: 'syz.3.1702': attribute type 19 has an invalid length. [ 333.654217][T10839] netlink: 14552 bytes leftover after parsing attributes in process `syz.3.1702'. [ 333.959684][T10849] netlink: 'syz.0.1703': attribute type 9 has an invalid length. [ 333.989076][T10849] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.1703'. [ 334.614509][T10861] FAULT_INJECTION: forcing a failure. [ 334.614509][T10861] name failslab, interval 1, probability 0, space 0, times 0 [ 334.662913][T10861] CPU: 0 PID: 10861 Comm: syz.3.1709 Not tainted syzkaller #0 [ 334.670433][T10861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 334.680507][T10861] Call Trace: [ 334.683809][T10861] [ 334.686761][T10861] dump_stack_lvl+0x18c/0x250 [ 334.691475][T10861] ? show_regs_print_info+0x20/0x20 [ 334.696690][T10861] ? load_image+0x420/0x420 [ 334.701204][T10861] ? __lock_acquire+0x7d80/0x7d80 [ 334.706229][T10861] should_fail_ex+0x394/0x4c0 [ 334.710909][T10861] should_failslab+0x9/0x20 [ 334.715407][T10861] slab_pre_alloc_hook+0x59/0x300 [ 334.720430][T10861] ? security_sk_alloc+0x4b/0x130 [ 334.725451][T10861] ? security_sk_alloc+0x4b/0x130 [ 334.730467][T10861] __kmem_cache_alloc_node+0x53/0x250 [ 334.735841][T10861] ? security_sk_alloc+0x4b/0x130 [ 334.740859][T10861] __kmalloc+0xa7/0x240 [ 334.745010][T10861] ? sk_prot_alloc+0xe7/0x210 [ 334.749683][T10861] security_sk_alloc+0x4b/0x130 [ 334.754529][T10861] sk_prot_alloc+0x101/0x210 [ 334.759116][T10861] ? sk_alloc+0x24/0x350 [ 334.763385][T10861] sk_alloc+0x3a/0x350 [ 334.767451][T10861] alg_create+0xa4/0x140 [ 334.771692][T10861] __sock_create+0x49e/0x940 [ 334.776280][T10861] __sys_socketpair+0x236/0x550 [ 334.781129][T10861] __x64_sys_socketpair+0x9b/0xb0 [ 334.787502][T10861] do_syscall_64+0x55/0xb0 [ 334.791919][T10861] ? clear_bhb_loop+0x40/0x90 [ 334.796593][T10861] ? clear_bhb_loop+0x40/0x90 [ 334.801272][T10861] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 334.807165][T10861] RIP: 0033:0x7f4f8259e0d9 [ 334.811580][T10861] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.831204][T10861] RSP: 002b:00007f4f834e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 334.839623][T10861] RAX: ffffffffffffffda RBX: 00007f4f82825fa0 RCX: 00007f4f8259e0d9 [ 334.847592][T10861] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000026 [ 334.855564][T10861] RBP: 00007f4f834e9090 R08: 0000000000000000 R09: 0000000000000000 [ 334.863532][T10861] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 334.871499][T10861] R13: 00007f4f82826038 R14: 00007f4f82825fa0 R15: 00007fff1e4f3898 [ 334.879484][T10861] [ 335.252723][T10873] ±ÿÿÿÿa–ïD: renamed from lo (while UP) [ 335.400375][T10878] netlink: 'syz.0.1715': attribute type 41 has an invalid length. [ 335.472558][T10883] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.1717'. [ 335.483960][T10883] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 335.492749][T10883] openvswitch: netlink: Message has 1 unknown bytes. [ 336.467432][T10911] netlink: 'syz.3.1726': attribute type 10 has an invalid length. [ 336.491846][T10911] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 336.513421][T10911] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 336.530964][T10911] FAULT_INJECTION: forcing a failure. [ 336.530964][T10911] name failslab, interval 1, probability 0, space 0, times 0 [ 336.572919][T10911] CPU: 0 PID: 10911 Comm: syz.3.1726 Not tainted syzkaller #0 [ 336.580437][T10911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 336.590516][T10911] Call Trace: [ 336.593816][T10911] [ 336.596758][T10911] dump_stack_lvl+0x18c/0x250 [ 336.601440][T10911] ? show_regs_print_info+0x20/0x20 [ 336.606638][T10911] ? load_image+0x420/0x420 [ 336.611144][T10911] ? __lock_acquire+0x7d80/0x7d80 [ 336.616168][T10911] should_fail_ex+0x394/0x4c0 [ 336.620848][T10911] should_failslab+0x9/0x20 [ 336.625350][T10911] slab_pre_alloc_hook+0x59/0x300 [ 336.630377][T10911] ? br_netlink_fini+0x30/0x30 [ 336.635141][T10911] kmem_cache_alloc_node+0x5e/0x310 [ 336.640337][T10911] ? __alloc_skb+0x103/0x2c0 [ 336.644921][T10911] __alloc_skb+0x103/0x2c0 [ 336.649331][T10911] rtmsg_ifinfo_build_skb+0x83/0x260 [ 336.654614][T10911] rtnetlink_event+0x1b7/0x260 [ 336.659377][T10911] notifier_call_chain+0x18f/0x380 [ 336.664486][T10911] __netdev_upper_dev_unlink+0x206/0x7b0 [ 336.670123][T10911] ? netdev_upper_dev_unlink+0xe0/0xe0 [ 336.675574][T10911] ? __local_bh_enable_ip+0x13a/0x1c0 [ 336.680940][T10911] ? __local_bh_enable_ip+0x13a/0x1c0 [ 336.686302][T10911] ? _local_bh_enable+0xa0/0xa0 [ 336.691143][T10911] ? netdev_upper_dev_unlink+0x8c/0xe0 [ 336.696599][T10911] netdev_upper_dev_unlink+0x9a/0xe0 [ 336.701880][T10911] ? netdev_master_upper_dev_link+0x100/0x100 [ 336.707949][T10911] team_port_del+0x3cd/0xc30 [ 336.712539][T10911] ? team_port_disable+0xb40/0xb40 [ 336.717643][T10911] ? team_del_slave+0x31/0x1b0 [ 336.722402][T10911] ? __dev_change_flags+0x6a0/0x6a0 [ 336.727589][T10911] ? mutex_lock_nested+0x20/0x20 [ 336.732525][T10911] ? dev_get_flags+0x1c0/0x1c0 [ 336.737279][T10911] ? printk_sprint+0x460/0x460 [ 336.742038][T10911] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 336.747934][T10911] team_del_slave+0x3c/0x1b0 [ 336.752556][T10911] do_setlink+0xd64/0x3f40 [ 336.756987][T10911] ? load_image+0x420/0x420 [ 336.761491][T10911] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 336.767638][T10911] ? stack_trace_save+0xaa/0x100 [ 336.772571][T10911] ? stack_trace_snprint+0xf0/0xf0 [ 336.777725][T10911] ? __nla_validate+0x50/0x50 [ 336.782426][T10911] ? validate_linkmsg+0x719/0x910 [ 336.787454][T10911] rtnl_newlink+0x1848/0x2170 [ 336.792146][T10911] ? rtnl_setlink+0x4e0/0x4e0 [ 336.796819][T10911] ? trace_raw_output_contention_end+0xd0/0xd0 [ 336.802968][T10911] ? rcu_is_watching+0x15/0xb0 [ 336.807724][T10911] ? trace_contention_end+0x39/0xe0 [ 336.812912][T10911] ? __mutex_lock+0x30d/0xc80 [ 336.817602][T10911] ? rtnl_setlink+0x4e0/0x4e0 [ 336.822270][T10911] rtnetlink_rcv_msg+0x843/0xf90 [ 336.827245][T10911] ? rtnetlink_rcv_msg+0x220/0xf90 [ 336.832369][T10911] ? rtnetlink_bind+0x80/0x80 [ 336.837070][T10911] ? perf_trace_preemptirq_template+0xac/0x330 [ 336.843224][T10911] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 336.849202][T10911] ? lock_chain_count+0x20/0x20 [ 336.854053][T10911] ? __local_bh_enable_ip+0x13a/0x1c0 [ 336.859437][T10911] ? lockdep_hardirqs_on+0x98/0x150 [ 336.864648][T10911] ? __local_bh_enable_ip+0x13a/0x1c0 [ 336.870026][T10911] ? _local_bh_enable+0xa0/0xa0 [ 336.874880][T10911] ? __dev_queue_xmit+0x275/0x3630 [ 336.879986][T10911] ? __dev_queue_xmit+0x1bc2/0x3630 [ 336.885194][T10911] ? __dev_queue_xmit+0x275/0x3630 [ 336.890315][T10911] ? perf_trace_lock+0xfc/0x3b0 [ 336.895167][T10911] netlink_rcv_skb+0x235/0x4c0 [ 336.899926][T10911] ? rtnetlink_bind+0x80/0x80 [ 336.904614][T10911] ? netlink_ack+0x1160/0x1160 [ 336.909399][T10911] ? __lock_acquire+0x7d80/0x7d80 [ 336.914441][T10911] ? netlink_deliver_tap+0x2e/0x1b0 [ 336.919638][T10911] netlink_unicast+0x7b1/0x930 [ 336.924415][T10911] netlink_sendmsg+0x8d0/0xbf0 [ 336.929178][T10911] ? netlink_getsockopt+0x590/0x590 [ 336.934371][T10911] ? apparmor_socket_sendmsg+0x8e/0x330 [ 336.939908][T10911] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 336.945185][T10911] ? security_socket_sendmsg+0x80/0xa0 [ 336.950657][T10911] ? netlink_getsockopt+0x590/0x590 [ 336.955861][T10911] ____sys_sendmsg+0x61b/0x980 [ 336.960633][T10911] ? __asan_memset+0x22/0x40 [ 336.965224][T10911] ? __sys_sendmsg_sock+0x30/0x30 [ 336.970243][T10911] ? __import_iovec+0x5f2/0x850 [ 336.975138][T10911] ? import_iovec+0x73/0xa0 [ 336.979648][T10911] ___sys_sendmsg+0x2a6/0x360 [ 336.984333][T10911] ? __sys_sendmsg+0x2b0/0x2b0 [ 336.989108][T10911] ? __lock_acquire+0x7d80/0x7d80 [ 336.994147][T10911] __se_sys_sendmsg+0x1d0/0x2c0 [ 336.998993][T10911] ? __x64_sys_sendmsg+0x80/0x80 [ 337.003934][T10911] ? lockdep_hardirqs_on+0x98/0x150 [ 337.009133][T10911] do_syscall_64+0x55/0xb0 [ 337.013539][T10911] ? clear_bhb_loop+0x40/0x90 [ 337.018210][T10911] ? clear_bhb_loop+0x40/0x90 [ 337.022883][T10911] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 337.028768][T10911] RIP: 0033:0x7f4f8259e0d9 [ 337.033182][T10911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 337.052811][T10911] RSP: 002b:00007f4f834c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.061230][T10911] RAX: ffffffffffffffda RBX: 00007f4f82826090 RCX: 00007f4f8259e0d9 [ 337.069194][T10911] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000004 [ 337.077156][T10911] RBP: 00007f4f834c8090 R08: 0000000000000000 R09: 0000000000000000 [ 337.085118][T10911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 337.093091][T10911] R13: 00007f4f82826128 R14: 00007f4f82826090 R15: 00007fff1e4f3898 [ 337.101088][T10911] [ 337.182345][T10911] team0: Port device wlan1 removed [ 337.191653][T10911] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 338.628884][T10951] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1739'. [ 338.675765][T10952] FAULT_INJECTION: forcing a failure. [ 338.675765][T10952] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 338.702150][T10951] netlink: get zone limit has 4 unknown bytes [ 338.759631][T10952] CPU: 1 PID: 10952 Comm: syz.1.1741 Not tainted syzkaller #0 [ 338.767147][T10952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 338.777215][T10952] Call Trace: [ 338.780504][T10952] [ 338.783487][T10952] dump_stack_lvl+0x18c/0x250 [ 338.788190][T10952] ? show_regs_print_info+0x20/0x20 [ 338.793412][T10952] ? load_image+0x420/0x420 [ 338.797934][T10952] ? __might_fault+0xaa/0x120 [ 338.802628][T10952] ? __lock_acquire+0x7d80/0x7d80 [ 338.807675][T10952] should_fail_ex+0x394/0x4c0 [ 338.812380][T10952] _copy_from_iter+0x1cd/0x1290 [ 338.817272][T10952] ? copyout_mc+0x70/0x70 [ 338.821626][T10952] ? __virt_addr_valid+0x10c/0x380 [ 338.826753][T10952] ? __virt_addr_valid+0x10c/0x380 [ 338.831879][T10952] ? __virt_addr_valid+0x10c/0x380 [ 338.837005][T10952] ? __check_object_size+0x4fc/0xa40 [ 338.842306][T10952] tipc_msg_build+0x87a/0xe60 [ 338.847014][T10952] ? skb_copy_to_linear_data_offset+0x60/0x60 [ 338.853104][T10952] ? net_generic+0x1e/0x240 [ 338.857622][T10952] ? tipc_group_bc_cong+0x15c/0x210 [ 338.862840][T10952] tipc_send_group_bcast+0x7d8/0xad0 [ 338.868162][T10952] ? tipc_wait_for_connect+0x650/0x650 [ 338.873652][T10952] ? wait_woken+0x180/0x180 [ 338.878177][T10952] ? tomoyo_check_open_permission+0x1cf/0x460 [ 338.884295][T10952] __tipc_sendmsg+0x314/0x2b20 [ 338.889108][T10952] ? __lock_acquire+0x1336/0x7d80 [ 338.894173][T10952] ? rht_unlock+0x1d0/0x1d0 [ 338.898712][T10952] ? verify_lock_unused+0x140/0x140 [ 338.903935][T10952] ? verify_lock_unused+0x140/0x140 [ 338.909158][T10952] ? kernel_text_address+0xa0/0xd0 [ 338.914293][T10952] ? __might_sleep+0xe0/0xe0 [ 338.918913][T10952] ? mark_lock+0x94/0x320 [ 338.923260][T10952] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 338.929262][T10952] ? __local_bh_enable_ip+0x13a/0x1c0 [ 338.934646][T10952] ? lockdep_hardirqs_on+0x98/0x150 [ 338.939877][T10952] ? __local_bh_enable_ip+0x13a/0x1c0 [ 338.945265][T10952] ? _local_bh_enable+0xa0/0xa0 [ 338.950145][T10952] tipc_sendmsg+0x55/0x70 [ 338.954500][T10952] sock_write_iter+0x2dc/0x420 [ 338.959286][T10952] ? sock_read_iter+0x3f0/0x3f0 [ 338.964165][T10952] ? common_file_perm+0x198/0x1f0 [ 338.969212][T10952] vfs_write+0x474/0x9a0 [ 338.973480][T10952] ? file_end_write+0x250/0x250 [ 338.978352][T10952] ? __fget_files+0x3fc/0x460 [ 338.983054][T10952] ? __fdget_pos+0x1d8/0x330 [ 338.987661][T10952] ? ksys_write+0x74/0x260 [ 338.992100][T10952] ksys_write+0x151/0x260 [ 338.996453][T10952] ? __ia32_sys_read+0x90/0x90 [ 339.001242][T10952] ? lockdep_hardirqs_on+0x98/0x150 [ 339.006464][T10952] do_syscall_64+0x55/0xb0 [ 339.010886][T10952] ? clear_bhb_loop+0x40/0x90 [ 339.015565][T10952] ? clear_bhb_loop+0x40/0x90 [ 339.020245][T10952] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 339.026138][T10952] RIP: 0033:0x7fe86fd9e0d9 [ 339.030549][T10952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 339.050149][T10952] RSP: 002b:00007fe870d2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 339.058560][T10952] RAX: ffffffffffffffda RBX: 00007fe870025fa0 RCX: 00007fe86fd9e0d9 [ 339.066523][T10952] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000004 [ 339.074486][T10952] RBP: 00007fe870d2d090 R08: 0000000000000000 R09: 0000000000000000 [ 339.082448][T10952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 339.090416][T10952] R13: 00007fe870026038 R14: 00007fe870025fa0 R15: 00007ffd1fcdee18 [ 339.098396][T10952] [ 340.979952][T11004] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.1758'. [ 341.021330][T11004] netlink: 'syz.1.1758': attribute type 3 has an invalid length. [ 341.046719][T11004] netlink: 'syz.1.1758': attribute type 1 has an invalid length. [ 341.065102][T11004] netlink: 193404 bytes leftover after parsing attributes in process `syz.1.1758'. [ 341.620137][T11022] netlink: 'syz.3.1762': attribute type 3 has an invalid length. [ 341.668748][T11022] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1762'. [ 342.343635][T11041] netlink: 'syz.2.1770': attribute type 49 has an invalid length. [ 345.485375][T11065] netlink: 15999 bytes leftover after parsing attributes in process `syz.2.1777'. [ 345.983284][T11083] netlink: 'syz.0.1785': attribute type 1 has an invalid length. [ 346.013075][T11083] netlink: 'syz.0.1785': attribute type 4 has an invalid length. [ 346.036931][T11083] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.1785'. [ 346.693528][T11104] netlink: set zone limit has 8 unknown bytes [ 346.977649][T11111] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1796'. [ 347.480247][T11130] netlink: 'syz.1.1803': attribute type 10 has an invalid length. [ 347.642001][T11130] team_slave_0: left promiscuous mode [ 347.659527][T11130] team_slave_0: left allmulticast mode [ 348.194740][T11130] team0 (unregistering): Port device team_slave_0 removed [ 348.213233][T11130] team_slave_1: left promiscuous mode [ 348.234452][T11130] team_slave_1: left allmulticast mode [ 348.263783][T11130] team0 (unregistering): Port device team_slave_1 removed [ 348.275351][T11130] mac80211_hwsim hwsim9 wlan1: left promiscuous mode [ 348.282383][T11130] mac80211_hwsim hwsim9 wlan1: left allmulticast mode [ 348.314463][T11130] team0 (unregistering): Port device wlan1 removed Stopping sshd: stopped /usr/sbin/sshd (pid 5531) OK Stopping crond: stopped /usr/sbin/crond (pid 5515) OK Stopping dhcpcd... stopped /sbin/dhcpcd (pid 5436) Stopping network: [ 352.679321][T11194] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1818'. OK Stopping iptables: OK [ 353.354308][ T5790] Bluetooth: hci2: ACL packet too small Stopping system message bus: [ 353.373220][T11224] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 353.380224][T11224] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 353.924319][T11238] netlink: 'syz.1.1831': attribute type 10 has an invalid length. [ 353.938766][T11238] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1831'. done [ 354.148393][T11247] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1833'. [ 354.213868][T11247] sctp: [Deprecated]: syz.3.1833 (pid 11247) Use of struct sctp_assoc_value in delayed_ack socket option. [ 354.213868][T11247] Use struct sctp_sack_info instead [ 354.713908][T11272] sit0: left promiscuous mode [ 354.880107][T11270] netlink: 'syz.0.1840': attribute type 10 has an invalid length. [ 354.949142][T11277] FAULT_INJECTION: forcing a failure. [ 354.949142][T11277] name failslab, interval 1, probability 0, space 0, times 0 [ 354.984481][T11277] CPU: 0 PID: 11277 Comm: syz.3.1841 Not tainted syzkaller #0 [ 354.991996][T11277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 355.002068][T11277] Call Trace: [ 355.005416][T11277] [ 355.008422][T11277] dump_stack_lvl+0x18c/0x250 [ 355.013265][T11277] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 355.019567][T11277] ? show_regs_print_info+0x20/0x20 [ 355.024772][T11277] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 355.030959][T11277] should_fail_ex+0x394/0x4c0 [ 355.035704][T11277] should_failslab+0x9/0x20 [ 355.040258][T11277] slab_pre_alloc_hook+0x59/0x300 [ 355.045337][T11277] kmem_cache_alloc_lru+0x4d/0x2b0 [ 355.050462][T11277] ? __d_alloc+0x31/0x710 [ 355.054805][T11277] __d_alloc+0x31/0x710 [ 355.058982][T11277] d_alloc_pseudo+0x1d/0x70 [ 355.063505][T11277] alloc_file_pseudo+0xe4/0x210 [ 355.068376][T11277] ? fput+0x1a0/0x1a0 [ 355.072375][T11277] ? _raw_spin_unlock+0x28/0x40 [ 355.077333][T11277] ? alloc_fd+0x590/0x640 [ 355.081693][T11277] anon_inode_getfd+0xca/0x1c0 [ 355.086496][T11277] btf_new_fd+0x848/0x9e0 [ 355.090872][T11277] ? bpf_btf_show_fdinfo+0x80/0x80 [ 355.096005][T11277] ? capable+0x88/0xe0 [ 355.100126][T11277] __sys_bpf+0x670/0x890 [ 355.104391][T11277] ? bpf_link_show_fdinfo+0x390/0x390 [ 355.109803][T11277] __x64_sys_bpf+0x7c/0x90 [ 355.114240][T11277] do_syscall_64+0x55/0xb0 [ 355.118673][T11277] ? clear_bhb_loop+0x40/0x90 [ 355.123374][T11277] ? clear_bhb_loop+0x40/0x90 [ 355.128072][T11277] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 355.133983][T11277] RIP: 0033:0x7f4f8259e0d9 [ 355.138486][T11277] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 355.158168][T11277] RSP: 002b:00007f4f834e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 355.166678][T11277] RAX: ffffffffffffffda RBX: 00007f4f82825fa0 RCX: 00007f4f8259e0d9 [ 355.174676][T11277] RDX: 0000000000000028 RSI: 0000200000000380 RDI: 0000000000000012 [ 355.182670][T11277] RBP: 00007f4f834e9090 R08: 0000000000000000 R09: 0000000000000000 [ 355.190667][T11277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 355.198657][T11277] R13: 00007f4f82826038 R14: 00007f4f82825fa0 R15: 00007fff1e4f3898 [ 355.206664][T11277] [ 355.338003][T11270] team0 (unregistering): Port device team_slave_1 removed [ 355.347760][ T5790] Bluetooth: hci3: ACL packet too small [ 355.362426][T11270] team0 (unregistering): Port device ..ãc¤± removed [ 355.396545][T11274] sit0: entered promiscuous mode [ 355.431381][T11271] netlink: 'syz.0.1840': attribute type 10 has an invalid length. [ 355.492676][T11285] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 355.524023][T11289] sctp: [Deprecated]: syz.2.1844 (pid 11289) Use of int in maxseg socket option. [ 355.524023][T11289] Use struct sctp_assoc_value instead [ 355.536446][T11285] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 356.020670][T11296] netlink: 198048 bytes leftover after parsing attributes in process `syz.0.1847'. [ 356.060645][T11296] netlink: 'syz.0.1847': attribute type 2 has an invalid length. [ 356.094300][T11296] netlink: 'syz.0.1847': attribute type 1 has an invalid length. Stopping klogd: OK Stopping acpid: OK Stopping syslogd: stopped /sbin/syslogd (pid 5123) OK [ 358.330128][ T5790] Bluetooth: hci0: ACL packet too small [ 358.331794][T11331] mac80211_hwsim hwsim14 wlan1: entered promiscuous mode [ 358.362980][T11331] mac80211_hwsim hwsim14 wlan1: entered allmulticast mode [ 358.530015][T11344] netlink: 196 bytes leftover after parsing attributes in process `syz.3.1858'. umount: can't remount debugfs read-only [ 360.120098][T11380] C: renamed from team_slave_0 [ 360.180991][T11380] netlink: 'syz.0.1869': attribute type 2 has an invalid length. [ 360.215704][T11380] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1869'. [ 360.239379][T11380] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 360.275077][T11383] netlink: 'syz.0.1869': attribute type 21 has an invalid length. [ 360.304243][T11383] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1869'. [ 360.433317][T11388] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1871'. [ 360.473133][T11388] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1871'. [ 360.536611][T11389] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1871'. [ 360.591337][T11388] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1871'. [ 361.128181][T11391] sit0: entered allmulticast mode [ 361.371547][T11398] sit0: entered promiscuous mode umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes Connection to 10.128.1.112 closed by remote host. Sent SIGKILL to all processes Requesting system poweroff [ 364.302118][ T1144] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.378803][ T1144] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.437671][ T1144] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.476157][ T1144] netdevsim netdevsim3 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.558565][ T1144] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.619533][ T1144] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.706013][ T1144] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.750494][ T1144] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.830455][T11421] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 364.849228][T11421] ACPI: PM: Preparing to enter system sleep state S5 [ 364.869711][ T1144] tipc: Left network mode [ 364.870441][T11421] kvm: exiting hardware virtualization [ 364.886275][T11421] reboot: Power down serialport: VM disconnected.