last executing test programs: 6.152755139s ago: executing program 2 (id=8503): perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x10001, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x20, 0x400000, 0xb9, 0x0, 0x0, 0xf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x10000, 0x0, 0x4, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x9, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, 0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x4b0842, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="0600"}) 5.792167577s ago: executing program 3 (id=8508): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000240)="723ffc93ac89418045f9ca4d192806", 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 5.69928824s ago: executing program 3 (id=8509): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x9549, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x400, 0x4, 0x0, 0x2, 0xfffff271, 0xfffc}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d0048007ea60864160af365040039001c001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 5.69821989s ago: executing program 2 (id=8517): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x9549, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0xd}, 0x111efa, 0x4, 0x0, 0x0, 0x3, 0xfffff271, 0x1, 0x0, 0x0, 0x0, 0x20}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = socket$kcm(0xa, 0x922000000003, 0x11) recvmsg(r3, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x100) close(r3) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) 5.455357526s ago: executing program 1 (id=8512): perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x1, @perf_config_ext={0x2, 0x8}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) socket$kcm(0x10, 0x2, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) 5.389298148s ago: executing program 2 (id=8513): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000020000000a0000000000000a07000000080000000000000b0400000009000000010000130c00000007"], 0x0, 0x4a, 0x0, 0x1, 0x800, 0x10000}, 0x28) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22041800"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 5.29349394s ago: executing program 3 (id=8515): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r1 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0x101d0) sendmsg$kcm(r1, &(0x7f0000000640)={&(0x7f00000000c0)=@tipc=@name={0x1e, 0x2, 0x3, {{0x41}, 0x5}}, 0x80, 0x0, 0x0, &(0x7f0000000900)=ANY=[], 0x1458}, 0x48800) 5.118781364s ago: executing program 1 (id=8516): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0x100000001}, 0x4000, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xf6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, @perf_config_ext={0xf5, 0x6d}, 0x6000, 0x0, 0x4, 0x2, 0x0, 0x2000000a, 0xfffc, 0x0, 0x5, 0x0, 0x7f}, 0x0, 0x1, 0xffffffffffffffff, 0xd) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedc0790701757df37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x11, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 5.111489714s ago: executing program 2 (id=8518): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000240)="723ffc93ac89418045f9ca4d192806", 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 4.88275807s ago: executing program 2 (id=8520): socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x881d2, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xb6) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x5452, &(0x7f0000000140)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000cc0)='blkio.bfq.time_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, &(0x7f0000000500)=r0, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x200440e4) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x4e26, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x510, 0x29, 0x3, "43b6a6b2aa6470440cf5fbb80cf0ed8b009f0ee0d2f9bcbd77341a94eb9b137867dc3118c2beb60753ecbadb15787b9dd2231417c3c69737aa81d63253a0c33dc0766143b9fc47150f7d3a4d06ef892c1ee3f5fa7950fe76848b97eda3a7ffabb77742d15d76eb3ebdc71d453765271c713a8cd60467930969dd45ec07fcbe0094ed6e2345bf991ccb50168d088cda1216c05fdaec64f788e6722e66e05f3256460763696ac643da6b889503566ca73b719a1045fccd8c03cc206b36137dce4e9ba7f3a5e05a2e8ce050366357e710a6b6055475dd82b2bd74c403e4de4155ba454253a4adf5559ab468e2edbea964ec4669fb486d8c5b18472fa072dea946009053b1e15140e82cc5948cf930014a87c4db296dbe76bcf37ce44cb546aad0d7653720f98f3e5a0d06081b728f62ea070b8441f86ad2c45e085e0f1f24121c1784d222f9fd41ec92e3d5a7a7e881212cfca3236b2e31855c96cf07b0b51afe3bfa61e7fae1cc7d16d15ecdc0cc80ab9442dd8e7c2ac8e74cd7045899e58f9cdd16ece2469bb37ef8ddc79a766611d067cdfb50cdc6672d707160cde9a1bc20b9c4839c2efc93c289cf58b66c7e45d66ffdab0ad89abfbd5d3781b39fd306a2d1158475aae10156688f0b41e966822dc028afd2d0f3016f967046d1077ac43e5165da2a3454a2a2e67c58f0d2c68e696c81050b7c75418527e64530e4c27ad335fc3c12701f35ae234304813649c986f11839962bbbdce29fb79fe7bce6463a28bf29d32d6db48ef4bfff8effce17d83c1bf31f7a36a1c7ea344fcf2deec357be1dc5a297e99ff0997c313b67b968fe7ecf971a109fb6e7c662ddcce04e98aa65e3a256cdd09e769251928813a1a3a6fedb0841baf49e89f44becf2b85bdff9127174f6503be0cf3b3892df6e12612c6f002b04a60c33eb297ab3f9ee16294e90dd2f3e09ca0d7d3cedabaed4d82be93f9cba7e157ffb0a4715664659147df18de6407c684e85fe7b2454c6ea05fa23140ba15a7a11750bbf45d5f848e62582c2ad96d218908d1e3ae686d3d99355d65411c4b516984b2b8859aabed132f8e5b074e46e7543b81cf1af7b48865169b644cf0c810f3eac387b43ae3b94b3171722980cdf7685e969c3f0ed033fa4f7edf12e149fb0b0207203b8c2e46d4023d21e7e6e98cc6f8c3b7b53163d8ed652b09d27180d0f2444b738c81da4191000698fd280786c5188e3ac5aefd7fce299206e410d1015448c92f3769d48cebe717a0b36fb01d1f94fac90fd665e821b45e70497b36d6123003fd89948b204802e78b141232402e7f9c5cefe215ae26f38564b34009b6d3a5069130cf45c63efd666e3a184b560e2fc12dca5e22612dabf12336b75bda73035d2d67f7deeab7aa1d73901eee8f62e906de887e04b5e59b68c50bdfe64987fbdfd8f9ab4707596b40e9bd8adf3b2aa5bd5fae10f173c160868e35c7ebc083501155372631b1c8df43accc945b663109414c8878498a216e1d840d26bddd278f47fd909c1f57e03e24852cc5849f3535206ee5ba895aafcaa90532389eb0d0ef5b321c183fbff08aa87acda39892d44d267fa3c4a53ede397f182c868ac334833279b4c42acbd431dc2df97143a7dc9d28151f2059d16e697ae95ff55753873c039e0e0cc944c46720404c9394b56001499bb09d4b06b6d7ead47485c34c4b9cfbf28accb02a97a199e39ee8bce6b0bb1e2bba69508fe0795d541ece33ea9ff6cf15ec9979b82f2d3d284a761c6f88800710b685feb000ca711d8650695f42919bae79b81"}], 0x510}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f1be3f74001000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093", 0x3d}], 0x1}, 0x0) 4.618883317s ago: executing program 2 (id=8521): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0x100000001}, 0x4000, 0x2, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x6, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x10040, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x100002, 0x20000}, 0x112065, 0x0, 0x4, 0x3, 0x7, 0x1, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0xd) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$cgroup_devices(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd) 4.218174696s ago: executing program 1 (id=8522): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0xa, 0x78e, 0x1}, 0x50) r0 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890b, &(0x7f0000000000)) 4.097931389s ago: executing program 3 (id=8524): r0 = getpid() r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0xa}, 0x114244, 0x0, 0xafe8, 0x4, 0x7fff, 0x7fffffff}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x31}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x10001, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x20, 0x400000, 0xb9, 0x0, 0x0, 0xf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r6, 0x86dd, 0xe, 0x0, &(0x7f0000000080)="c1dfb080cd21d308098ee68888a8", 0x0, 0xaded, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.865600395s ago: executing program 1 (id=8526): perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x10001, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x20, 0x400000, 0xb9, 0x0, 0x0, 0xf, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000012c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e517"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback=r0, 0x2f, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000600000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000080), 0x1103, r1}, 0x38) 989.566916ms ago: executing program 3 (id=8528): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_bp={0x0, 0xf}, 0x10410, 0x4000, 0x40, 0x8, 0x3fd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = socket$kcm(0x29, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) sendmsg$inet(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000001c0)="9e", 0x1}], 0x1}, 0x20044081) r2 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r2, r1}) sendmsg$kcm(r0, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000000880)="1a", 0x100000}], 0x1}, 0x0) 914.826717ms ago: executing program 1 (id=8529): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="09000000040000000c0000000b"], 0x50) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080), 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 820.88433ms ago: executing program 1 (id=8530): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a80)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd63"], 0x36) 771.074521ms ago: executing program 3 (id=8531): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'\x00', 0x202}) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1812"], 0x0, 0x3963, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bridge0\x00', 0x1}) socketpair(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000080)) 586.689145ms ago: executing program 0 (id=8532): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d40)={0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, 0x0) 552.577026ms ago: executing program 0 (id=8533): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x800000, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r1, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x4e24, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f00000000c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x20, 0x0, 0x7, {[@generic={0x7, 0x10, "093288a6d5a96c15ef5b200dd6a0"}]}}}], 0x40}, 0x20002800) 379.330371ms ago: executing program 0 (id=8534): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_bp={0x0, 0xf}, 0x10410, 0x4000, 0x40, 0x8, 0x3fd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0x5421, 0x110e22fff7) 201.427905ms ago: executing program 0 (id=8535): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.time\x00', 0x26e1, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f0000000000)=r0, 0x4) sendmsg$kcm(r1, &(0x7f00000002c0)={&(0x7f0000000580)=@in6={0xa, 0xce63, 0x0, @loopback={0xffffff7f00000000}}, 0x80, 0x0}, 0x0) 88.746688ms ago: executing program 0 (id=8536): ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffecd}, 0x94) r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="004000003a0091460cd934e3ea81e88802"], 0xfe33) 0s ago: executing program 0 (id=8537): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfcdfc612c00000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000001800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1d, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xfe327, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={0x0, 0x8}, 0x2000, 0x9, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) syz_clone(0x126400, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): s installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1165.629388][T24441] syz.2.6244[24441] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1165.977934][T24445] veth1_to_bond: entered allmulticast mode [ 1166.227677][T24456] netlink: 'syz.2.6250': attribute type 2 has an invalid length. [ 1166.235772][T24456] netlink: 'syz.2.6250': attribute type 8 has an invalid length. [ 1166.257186][T24456] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6250'. [ 1166.415639][T24463] netlink: 'syz.1.6253': attribute type 9 has an invalid length. [ 1166.436393][T24463] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.6253'. [ 1166.681682][T24470] netlink: 'syz.3.6256': attribute type 1 has an invalid length. [ 1166.728654][T24470] netlink: 101600 bytes leftover after parsing attributes in process `syz.3.6256'. [ 1167.768412][T24501] netlink: 140 bytes leftover after parsing attributes in process `syz.0.6267'. [ 1168.151025][T24514] FAULT_INJECTION: forcing a failure. [ 1168.151025][T24514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1168.166291][T24514] CPU: 0 PID: 24514 Comm: syz.2.6272 Not tainted syzkaller #0 [ 1168.173843][T24514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1168.183954][T24514] Call Trace: [ 1168.187288][T24514] [ 1168.190259][T24514] dump_stack_lvl+0x18c/0x250 [ 1168.194983][T24514] ? show_regs_print_info+0x20/0x20 [ 1168.200259][T24514] ? load_image+0x420/0x420 [ 1168.204829][T24514] ? __lock_acquire+0x7d80/0x7d80 [ 1168.209905][T24514] ? snprintf+0xe9/0x140 [ 1168.214186][T24514] should_fail_ex+0x394/0x4c0 [ 1168.218934][T24514] _copy_to_user+0x2f/0xa0 [ 1168.223384][T24514] simple_read_from_buffer+0xe7/0x150 [ 1168.228794][T24514] proc_fail_nth_read+0x1e8/0x260 [ 1168.233886][T24514] ? proc_fault_inject_write+0x360/0x360 [ 1168.239561][T24514] ? fsnotify_perm+0x271/0x5e0 [ 1168.244410][T24514] ? proc_fault_inject_write+0x360/0x360 [ 1168.250094][T24514] vfs_read+0x298/0x990 [ 1168.254341][T24514] ? kernel_read+0x1e0/0x1e0 [ 1168.258989][T24514] ? __fget_files+0x28/0x460 [ 1168.263632][T24514] ? __fget_files+0x3fc/0x460 [ 1168.268355][T24514] ? __fdget_pos+0x2a3/0x330 [ 1168.272979][T24514] ? ksys_read+0x74/0x260 [ 1168.277341][T24514] ksys_read+0x151/0x260 [ 1168.281629][T24514] ? vfs_write+0x9a0/0x9a0 [ 1168.286172][T24514] ? lockdep_hardirqs_on+0x98/0x150 [ 1168.291408][T24514] do_syscall_64+0x55/0xb0 [ 1168.295855][T24514] ? clear_bhb_loop+0x40/0x90 [ 1168.300652][T24514] ? clear_bhb_loop+0x40/0x90 [ 1168.305355][T24514] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1168.311363][T24514] RIP: 0033:0x7f4db235e90e [ 1168.315836][T24514] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1168.335471][T24514] RSP: 002b:00007f4db32b4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1168.343916][T24514] RAX: ffffffffffffffda RBX: 00007f4db32b56c0 RCX: 00007f4db235e90e [ 1168.351915][T24514] RDX: 000000000000000f RSI: 00007f4db32b50a0 RDI: 0000000000000005 [ 1168.359911][T24514] RBP: 00007f4db32b5090 R08: 0000000000000000 R09: 0000000000000000 [ 1168.367909][T24514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1168.375902][T24514] R13: 00007f4db2626038 R14: 00007f4db2625fa0 R15: 00007fffffb45708 [ 1168.383921][T24514] [ 1168.730630][T24528] validate_nla: 3 callbacks suppressed [ 1168.730648][T24528] netlink: 'syz.1.6277': attribute type 10 has an invalid length. [ 1169.557664][T24548] __nla_validate_parse: 3 callbacks suppressed [ 1169.557704][T24548] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6286'. [ 1170.423037][T24572] netlink: 'syz.0.6296': attribute type 9 has an invalid length. [ 1170.431517][T24572] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.6296'. [ 1171.134305][T24582] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6301'. [ 1172.058786][T24616] syzkaller0: entered promiscuous mode [ 1172.064606][T24616] syzkaller0: entered allmulticast mode [ 1172.095746][T24623] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1174.584378][T24618] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6314'. [ 1174.593932][T24636] netlink: 'syz.1.6320': attribute type 10 has an invalid length. [ 1174.605272][T24636] bond0: (slave wlan1): Releasing backup interface [ 1174.618443][T24637] netlink: 'syz.1.6320': attribute type 10 has an invalid length. [ 1175.478866][T24649] delete_channel: no stack [ 1175.662607][T24670] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.6333'. [ 1176.007263][T24690] netlink: 'syz.1.6342': attribute type 27 has an invalid length. [ 1176.015190][T24690] netlink: 'syz.1.6342': attribute type 28 has an invalid length. [ 1176.045823][T24690] netlink: 'syz.1.6342': attribute type 29 has an invalid length. [ 1176.055955][T24690] netlink: 'syz.1.6342': attribute type 30 has an invalid length. [ 1176.071997][T24690] netlink: 'syz.1.6342': attribute type 31 has an invalid length. [ 1176.090407][T24690] netlink: 'syz.1.6342': attribute type 32 has an invalid length. [ 1176.107455][T24690] netlink: 'syz.1.6342': attribute type 33 has an invalid length. [ 1176.125793][T24690] netlink: 'syz.1.6342': attribute type 35 has an invalid length. [ 1176.443817][T24702] team0: Device wg1 is of different type [ 1176.647574][T24704] team0: Device nlmon0 is of different type [ 1177.012344][T24723] netlink: 140 bytes leftover after parsing attributes in process `syz.1.6357'. [ 1177.721803][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.731138][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.398041][T24752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1178.918874][T24771] netlink: 2418 bytes leftover after parsing attributes in process `syz.0.6374'. [ 1179.178439][T24775] syzkaller0: entered promiscuous mode [ 1179.184005][T24775] syzkaller0: entered allmulticast mode [ 1179.206422][T24777] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6378'. [ 1179.240063][T24777] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1179.558682][T24785] FAULT_INJECTION: forcing a failure. [ 1179.558682][T24785] name failslab, interval 1, probability 0, space 0, times 0 [ 1179.575951][T24785] CPU: 1 PID: 24785 Comm: syz.2.6381 Not tainted syzkaller #0 [ 1179.583512][T24785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1179.593630][T24785] Call Trace: [ 1179.596967][T24785] [ 1179.599971][T24785] dump_stack_lvl+0x18c/0x250 [ 1179.604793][T24785] ? show_regs_print_info+0x20/0x20 [ 1179.610083][T24785] ? load_image+0x420/0x420 [ 1179.614666][T24785] ? __might_sleep+0xe0/0xe0 [ 1179.619324][T24785] ? __lock_acquire+0x7d80/0x7d80 [ 1179.624424][T24785] should_fail_ex+0x394/0x4c0 [ 1179.629174][T24785] should_failslab+0x9/0x20 [ 1179.633753][T24785] slab_pre_alloc_hook+0x59/0x300 [ 1179.638866][T24785] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1179.644672][T24785] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1179.650482][T24785] __kmem_cache_alloc_node+0x53/0x250 [ 1179.655947][T24785] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 1179.661941][T24785] __kmalloc+0xa7/0x240 [ 1179.666185][T24785] tomoyo_realpath_from_path+0xe6/0x5c0 [ 1179.671812][T24785] ? tomoyo_domain+0xd6/0x120 [ 1179.676609][T24785] tomoyo_path_number_perm+0x248/0x5e0 [ 1179.682146][T24785] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1179.687859][T24785] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1179.693414][T24785] ? ksys_write+0x1d2/0x260 [ 1179.698092][T24785] ? __fget_files+0x28/0x460 [ 1179.702783][T24785] security_file_ioctl+0x70/0xa0 [ 1179.707806][T24785] __se_sys_ioctl+0x48/0x170 [ 1179.712490][T24785] do_syscall_64+0x55/0xb0 [ 1179.716983][T24785] ? clear_bhb_loop+0x40/0x90 [ 1179.721733][T24785] ? clear_bhb_loop+0x40/0x90 [ 1179.726500][T24785] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1179.732477][T24785] RIP: 0033:0x7f4db239e0d9 [ 1179.737051][T24785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1179.756716][T24785] RSP: 002b:00007f4db32b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1179.765203][T24785] RAX: ffffffffffffffda RBX: 00007f4db2625fa0 RCX: 00007f4db239e0d9 [ 1179.773246][T24785] RDX: 0000200000000980 RSI: 0000000000008914 RDI: 0000000000000003 [ 1179.781289][T24785] RBP: 00007f4db32b5090 R08: 0000000000000000 R09: 0000000000000000 [ 1179.789330][T24785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1179.797360][T24785] R13: 00007f4db2626038 R14: 00007f4db2625fa0 R15: 00007fffffb45708 [ 1179.805389][T24785] [ 1179.829451][T24785] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1179.873173][T24786] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.6379'. [ 1181.383828][T24794] validate_nla: 16 callbacks suppressed [ 1181.383849][T24794] netlink: 'syz.0.6384': attribute type 9 has an invalid length. [ 1181.422413][T24794] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.6384'. [ 1184.492033][T24804] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6388'. [ 1184.992508][T24815] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6391'. [ 1185.294150][T24831] netlink: 'syz.3.6395': attribute type 9 has an invalid length. [ 1185.322661][T24831] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.6395'. [ 1186.283862][T24838] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.6394'. [ 1187.581309][T24847] netlink: 16399 bytes leftover after parsing attributes in process `syz.3.6401'. [ 1188.053285][T24853] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6403'. [ 1188.086677][T24861] netlink: 'syz.2.6405': attribute type 9 has an invalid length. [ 1188.115287][T24861] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.6405'. [ 1189.972182][ T5792] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 1190.134301][T24889] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.6412'. [ 1190.810323][T24895] netlink: 'syz.1.6415': attribute type 9 has an invalid length. [ 1190.837003][T24895] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.6415'. [ 1191.056343][T24893] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6414'. [ 1191.072645][T24900] netlink: 'syz.3.6416': attribute type 9 has an invalid length. [ 1191.113969][T24900] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.6416'. [ 1191.246345][T24907] netlink: 'syz.1.6419': attribute type 1 has an invalid length. [ 1191.274922][T24907] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.6419'. [ 1191.318324][T24912] netlink: 'syz.1.6419': attribute type 2 has an invalid length. [ 1191.348658][T24912] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.6419'. [ 1192.271325][T24930] netlink: 'syz.3.6426': attribute type 9 has an invalid length. [ 1192.296665][ T5792] Bluetooth: hci2: ISO packet for unknown connection handle 2622 [ 1192.330719][T24930] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.6426'. [ 1192.581382][T24924] netlink: 63503 bytes leftover after parsing attributes in process `syz.1.6425'. [ 1193.881708][T24939] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6429'. [ 1195.828893][T24944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1195.930745][T24947] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.6433'. [ 1196.118072][T24949] netlink: 'syz.0.6434': attribute type 21 has an invalid length. [ 1196.141736][T24949] netlink: 156 bytes leftover after parsing attributes in process `syz.0.6434'. [ 1196.336885][T24949] sit0: left promiscuous mode [ 1196.518718][T24955] netlink: 'syz.2.6436': attribute type 9 has an invalid length. [ 1196.547023][T24955] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.6436'. [ 1196.898475][T24951] sit0: entered promiscuous mode [ 1197.026491][T24960] netlink: 'syz.1.6432': attribute type 10 has an invalid length. [ 1197.052437][T24960] netlink: 65015 bytes leftover after parsing attributes in process `syz.1.6432'. [ 1198.725344][T24967] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6441'. [ 1199.329894][T24987] netlink: 'syz.2.6445': attribute type 9 has an invalid length. [ 1199.357174][T24987] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.6445'. [ 1199.742249][T24998] netlink: 192436 bytes leftover after parsing attributes in process `syz.2.6449'. [ 1199.933787][T24998] openvswitch: netlink: Duplicate key (type 0). [ 1200.948940][T25007] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6454'. [ 1201.202946][T25018] netlink: 'syz.1.6457': attribute type 9 has an invalid length. [ 1201.230647][T25018] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.6457'. [ 1202.034563][T25030] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6465'. [ 1202.445274][T25040] netlink: 'syz.0.6468': attribute type 6 has an invalid length. [ 1202.453832][T25041] netlink: 'syz.1.6469': attribute type 9 has an invalid length. [ 1202.470340][T25041] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.6469'. [ 1202.504674][T25040] netlink: 164 bytes leftover after parsing attributes in process `syz.0.6468'. [ 1202.938967][T25043] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6467'. [ 1202.985067][T25043] hsr_slave_0: left promiscuous mode [ 1203.060824][T25043] hsr_slave_1: left promiscuous mode [ 1203.876324][T25067] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6477'. [ 1204.218326][T25084] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1204.558201][T25093] netlink: 'syz.0.6485': attribute type 2 has an invalid length. [ 1204.566735][T25093] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.6485'. [ 1205.288071][T25100] hsr0: left allmulticast mode [ 1205.292955][T25100] hsr_slave_0: left allmulticast mode [ 1205.300727][T25100] hsr_slave_1: left allmulticast mode [ 1205.306522][T25100] bridge0: port 3(hsr0) entered disabled state [ 1205.329445][T25100] bridge_slave_1: left allmulticast mode [ 1205.335241][T25100] bridge_slave_1: left promiscuous mode [ 1205.369355][T25100] bridge0: port 2(bridge_slave_1) entered disabled state [ 1205.384397][T25100] bridge_slave_0: left allmulticast mode [ 1205.392111][T25100] bridge_slave_0: left promiscuous mode [ 1205.399995][T25100] bridge0: port 1(bridge_slave_0) entered disabled state [ 1206.161181][T25119] netlink: 'syz.1.6494': attribute type 9 has an invalid length. [ 1206.174217][T25119] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.6494'. [ 1206.240150][T25100] bond0: (slave bridge0): Releasing backup interface [ 1206.255103][T25100] bond0: (slave bridge0): last VLAN challenged slave left bond - VLAN blocking is removed [ 1206.637389][T25134] tap0: tun_chr_ioctl cmd 1074025680 [ 1207.305857][T25140] netlink: 'syz.2.6501': attribute type 6 has an invalid length. [ 1207.318976][T25140] netlink: 164 bytes leftover after parsing attributes in process `syz.2.6501'. [ 1207.701953][T25145] netlink: 'syz.3.6503': attribute type 10 has an invalid length. [ 1208.034802][T25162] netlink: 'syz.3.6509': attribute type 10 has an invalid length. [ 1208.231469][T25162] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1208.260420][T25170] netlink: 140 bytes leftover after parsing attributes in process `syz.0.6510'. [ 1209.002613][T25199] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1210.790299][T25225] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6527'. [ 1211.660387][T25247] netlink: 'syz.1.6531': attribute type 2 has an invalid length. [ 1211.677992][T25236] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6528'. [ 1211.700684][T25247] netlink: 'syz.1.6531': attribute type 1 has an invalid length. [ 1211.750248][T25247] netlink: 152 bytes leftover after parsing attributes in process `syz.1.6531'. [ 1211.955373][T25251] netlink: 'syz.3.6534': attribute type 10 has an invalid length. [ 1212.965641][T25255] netlink: 'syz.3.6536': attribute type 10 has an invalid length. [ 1213.018637][T25255] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6536'. [ 1213.691571][T25260] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6538'. [ 1215.308827][T25298] netlink: 'syz.3.6552': attribute type 10 has an invalid length. [ 1215.411723][T25293] netlink: 'syz.2.6550': attribute type 10 has an invalid length. [ 1215.467385][T25293] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6550'. [ 1217.231984][T25331] netlink: 'syz.1.6564': attribute type 1 has an invalid length. [ 1217.246136][T25331] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.6564'. [ 1217.275246][T25313] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6559'. [ 1217.817103][T25348] netlink: 'syz.3.6571': attribute type 39 has an invalid length. [ 1219.480902][T25359] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6574'. [ 1219.582088][T25366] netlink: 'syz.2.6576': attribute type 10 has an invalid length. [ 1220.442279][T25389] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6585'. [ 1220.933785][T25416] netlink: 'syz.0.6595': attribute type 11 has an invalid length. [ 1220.962152][T25416] netlink: 140 bytes leftover after parsing attributes in process `syz.0.6595'. [ 1221.413544][T25431] FAULT_INJECTION: forcing a failure. [ 1221.413544][T25431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1221.451471][T25431] CPU: 1 PID: 25431 Comm: syz.1.6602 Not tainted syzkaller #0 [ 1221.459042][T25431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1221.469169][T25431] Call Trace: [ 1221.472509][T25431] [ 1221.475578][T25431] dump_stack_lvl+0x18c/0x250 [ 1221.480333][T25431] ? show_regs_print_info+0x20/0x20 [ 1221.485600][T25431] ? load_image+0x420/0x420 [ 1221.490192][T25431] ? __might_fault+0xaa/0x120 [ 1221.494942][T25431] ? __lock_acquire+0x7d80/0x7d80 [ 1221.500040][T25431] ? __virt_addr_valid+0x10c/0x380 [ 1221.500080][T25428] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.6601'. [ 1221.505201][T25431] should_fail_ex+0x394/0x4c0 [ 1221.505247][T25431] _copy_from_user+0x2f/0xe0 [ 1221.505279][T25431] btf_new_fd+0x366/0x9e0 [ 1221.505325][T25431] ? bpf_btf_show_fdinfo+0x80/0x80 [ 1221.505362][T25431] ? capable+0x88/0xe0 [ 1221.505402][T25431] __sys_bpf+0x670/0x890 [ 1221.505434][T25431] ? bpf_link_show_fdinfo+0x390/0x390 [ 1221.505484][T25431] ? lock_chain_count+0x20/0x20 [ 1221.505527][T25431] __x64_sys_bpf+0x7c/0x90 [ 1221.505556][T25431] do_syscall_64+0x55/0xb0 [ 1221.505584][T25431] ? clear_bhb_loop+0x40/0x90 [ 1221.505613][T25431] ? clear_bhb_loop+0x40/0x90 [ 1221.505644][T25431] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1221.505670][T25431] RIP: 0033:0x7f8e6cf9e0d9 [ 1221.505702][T25431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1221.505723][T25431] RSP: 002b:00007f8e6b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1221.505752][T25431] RAX: ffffffffffffffda RBX: 00007f8e6d225fa0 RCX: 00007f8e6cf9e0d9 [ 1221.505771][T25431] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000012 [ 1221.505787][T25431] RBP: 00007f8e6b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1221.505804][T25431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1221.505820][T25431] R13: 00007f8e6d226038 R14: 00007f8e6d225fa0 R15: 00007fff30eb5fa8 [ 1221.505859][T25431] [ 1221.648516][T25433] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6601'. [ 1221.652415][T25433] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1222.188782][T25437] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6598'. [ 1222.253625][T25435] mac80211_hwsim hwsim36 wlan0: entered promiscuous mode [ 1222.277464][T25435] mac80211_hwsim hwsim36 wlan0: entered allmulticast mode [ 1222.888653][T25454] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1222.895980][T25454] IPv6: NLM_F_CREATE should be set when creating new route [ 1222.903380][T25454] IPv6: NLM_F_CREATE should be set when creating new route [ 1222.910714][T25454] IPv6: NLM_F_CREATE should be set when creating new route [ 1223.009679][T25457] netlink: 'syz.2.6607': attribute type 9 has an invalid length. [ 1223.067586][T25457] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.6607'. [ 1223.984992][T25467] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6615'. [ 1224.396843][T25496] netlink: 'syz.1.6626': attribute type 10 has an invalid length. [ 1225.062168][T25504] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6630'. [ 1225.650700][T25529] netlink: 'syz.3.6640': attribute type 10 has an invalid length. [ 1225.691176][T25529] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1225.786490][T25529] bond0: (slave netdevsim0): Releasing backup interface [ 1227.154634][T25545] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6645'. [ 1227.229362][T25565] netlink: 'syz.0.6653': attribute type 39 has an invalid length. [ 1227.381252][T25567] netlink: 'syz.1.6654': attribute type 3 has an invalid length. [ 1227.399753][T25567] netlink: 201372 bytes leftover after parsing attributes in process `syz.1.6654'. [ 1228.898359][T25606] netlink: 61211 bytes leftover after parsing attributes in process `syz.3.6668'. [ 1229.624713][T25620] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6675'. [ 1229.883060][T25633] syzkaller0: entered promiscuous mode [ 1229.896393][T25633] syzkaller0: entered allmulticast mode [ 1232.381545][T25644] netlink: 'syz.2.6683': attribute type 11 has an invalid length. [ 1232.389608][T25644] netlink: 140 bytes leftover after parsing attributes in process `syz.2.6683'. [ 1232.696473][T25654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1233.170108][T25662] netlink: 'syz.1.6690': attribute type 12 has an invalid length. [ 1233.179132][T25662] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6690'. [ 1233.381020][T25664] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6691'. [ 1233.501196][T25670] netlink: 'syz.1.6693': attribute type 10 has an invalid length. [ 1233.671013][T25676] netlink: 'syz.1.6696': attribute type 9 has an invalid length. [ 1233.689253][T25676] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.6696'. [ 1234.369031][T25695] netlink: 'syz.0.6711': attribute type 39 has an invalid length. [ 1234.595522][T25695] hsr_slave_1 (unregistering): left promiscuous mode [ 1234.674205][T25698] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6704'. [ 1234.684484][T25691] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6703'. [ 1234.893190][T25705] mac80211_hwsim hwsim50 .3ãc¤±: renamed from wlan1 (while UP) [ 1235.486237][T25722] netlink: 'syz.2.6715': attribute type 17 has an invalid length. [ 1235.510610][T25722] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 1236.036266][T25736] lo: entered promiscuous mode [ 1236.203944][T25731] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6719'. [ 1237.092086][T25777] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1237.368286][T25784] netlink: 'syz.3.6741': attribute type 10 has an invalid length. [ 1237.436737][T25782] netlink: 'syz.1.6740': attribute type 2 has an invalid length. [ 1237.445057][T25782] netlink: 'syz.1.6740': attribute type 8 has an invalid length. [ 1237.458160][T25782] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6740'. [ 1237.489522][T25782] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6740'. [ 1238.025734][T25812] netlink: 'syz.3.6752': attribute type 10 has an invalid length. [ 1238.063712][T25813] netlink: 'syz.3.6752': attribute type 10 has an invalid length. [ 1238.352977][T25818] netlink: 'syz.1.6754': attribute type 2 has an invalid length. [ 1238.369964][T25818] netlink: 'syz.1.6754': attribute type 8 has an invalid length. [ 1238.393594][T25818] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6754'. [ 1238.433051][T25827] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6754'. [ 1239.047177][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 1239.053684][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.474993][T25855] netlink: 'syz.2.6767': attribute type 2 has an invalid length. [ 1239.500846][T25855] netlink: 'syz.2.6767': attribute type 8 has an invalid length. [ 1239.547283][T25855] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6767'. [ 1239.662627][T25865] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6767'. [ 1239.842008][T25863] netlink: 'syz.0.6771': attribute type 10 has an invalid length. [ 1239.873148][T25863] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6771'. [ 1239.945455][T25863] batman_adv: batadv0: Adding interface: veth1_virt_wifi [ 1240.068707][T25863] batman_adv: batadv0: The MTU of interface veth1_virt_wifi is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1240.147691][T25863] batman_adv: batadv0: Interface activated: veth1_virt_wifi [ 1240.408354][T25883] netlink: 'syz.2.6777': attribute type 21 has an invalid length. [ 1240.426730][T25883] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6777'. [ 1240.582662][T25892] netlink: 140 bytes leftover after parsing attributes in process `syz.0.6780'. [ 1240.651979][T25894] netlink: 128 bytes leftover after parsing attributes in process `syz.2.6781'. [ 1240.681380][T25894] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1240.789067][T25899] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1241.033518][T25902] netlink: 156 bytes leftover after parsing attributes in process `syz.0.6784'. [ 1241.769392][T25905] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6785'. [ 1241.913227][T25904] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6785'. [ 1242.205755][T25912] syzkaller0: entered promiscuous mode [ 1242.247223][T25912] syzkaller0: entered allmulticast mode [ 1245.055764][T25967] FAULT_INJECTION: forcing a failure. [ 1245.055764][T25967] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1245.070829][T25967] CPU: 0 PID: 25967 Comm: syz.1.6810 Not tainted syzkaller #0 [ 1245.078354][T25967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1245.088454][T25967] Call Trace: [ 1245.091775][T25967] [ 1245.094742][T25967] dump_stack_lvl+0x18c/0x250 [ 1245.099486][T25967] ? show_regs_print_info+0x20/0x20 [ 1245.104734][T25967] ? load_image+0x420/0x420 [ 1245.109287][T25967] ? __might_fault+0xaa/0x120 [ 1245.113994][T25967] ? __lock_acquire+0x7d80/0x7d80 [ 1245.119049][T25967] should_fail_ex+0x394/0x4c0 [ 1245.123847][T25967] _copy_to_user+0x2f/0xa0 [ 1245.128294][T25967] finalize_log+0xe4/0x160 [ 1245.132744][T25967] ? btf_parse_struct_metas+0xde0/0xde0 [ 1245.138323][T25967] ? btf_check_type_tags+0x674/0x680 [ 1245.143645][T25967] btf_new_fd+0x757/0x9e0 [ 1245.148009][T25967] ? bpf_btf_show_fdinfo+0x80/0x80 [ 1245.153149][T25967] ? capable+0x88/0xe0 [ 1245.157249][T25967] __sys_bpf+0x670/0x890 [ 1245.161522][T25967] ? bpf_link_show_fdinfo+0x390/0x390 [ 1245.166934][T25967] ? lock_chain_count+0x20/0x20 [ 1245.171829][T25967] __x64_sys_bpf+0x7c/0x90 [ 1245.176273][T25967] do_syscall_64+0x55/0xb0 [ 1245.180715][T25967] ? clear_bhb_loop+0x40/0x90 [ 1245.185428][T25967] ? clear_bhb_loop+0x40/0x90 [ 1245.190136][T25967] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1245.196052][T25967] RIP: 0033:0x7f8e6cf9e0d9 [ 1245.200502][T25967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1245.220135][T25967] RSP: 002b:00007f8e6b1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1245.228596][T25967] RAX: ffffffffffffffda RBX: 00007f8e6d225fa0 RCX: 00007f8e6cf9e0d9 [ 1245.236614][T25967] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000012 [ 1245.244623][T25967] RBP: 00007f8e6b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1245.252620][T25967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1245.260614][T25967] R13: 00007f8e6d226038 R14: 00007f8e6d225fa0 R15: 00007fff30eb5fa8 [ 1245.268625][T25967] [ 1245.650489][T25983] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1247.253709][T26037] validate_nla: 5 callbacks suppressed [ 1247.253800][T26037] netlink: 'syz.1.6835': attribute type 10 has an invalid length. [ 1247.284235][T26037] netlink: 2 bytes leftover after parsing attributes in process `syz.1.6835'. [ 1247.301812][T26037] hsr0: entered promiscuous mode [ 1247.317582][T26037] bridge0: port 3(hsr0) entered blocking state [ 1247.325081][T26045] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6839'. [ 1247.335591][T26037] bridge0: port 3(hsr0) entered disabled state [ 1247.345486][T26037] hsr0: entered allmulticast mode [ 1247.351976][T26037] hsr_slave_0: entered allmulticast mode [ 1247.374301][T26037] hsr_slave_1: entered allmulticast mode [ 1247.467436][T26045] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6839'. [ 1247.494704][T26046] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6839'. [ 1248.609447][T26067] netlink: 148 bytes leftover after parsing attributes in process `syz.3.6846'. [ 1249.628153][T26090] FAULT_INJECTION: forcing a failure. [ 1249.628153][T26090] name failslab, interval 1, probability 0, space 0, times 0 [ 1249.641393][T26090] CPU: 0 PID: 26090 Comm: syz.2.6854 Not tainted syzkaller #0 [ 1249.648911][T26090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1249.659026][T26090] Call Trace: [ 1249.662356][T26090] [ 1249.665326][T26090] dump_stack_lvl+0x18c/0x250 [ 1249.670062][T26090] ? show_regs_print_info+0x20/0x20 [ 1249.675313][T26090] ? load_image+0x420/0x420 [ 1249.679877][T26090] ? mark_lock+0x94/0x320 [ 1249.684261][T26090] ? __lock_acquire+0x1336/0x7d80 [ 1249.689353][T26090] should_fail_ex+0x394/0x4c0 [ 1249.694131][T26090] should_failslab+0x9/0x20 [ 1249.698697][T26090] slab_pre_alloc_hook+0x59/0x300 [ 1249.703803][T26090] kmem_cache_alloc+0x5a/0x2c0 [ 1249.708661][T26090] ? radix_tree_node_alloc+0x7e/0x3a0 [ 1249.714101][T26090] radix_tree_node_alloc+0x7e/0x3a0 [ 1249.719376][T26090] idr_get_free+0x28f/0xa10 [ 1249.723949][T26090] idr_alloc_cyclic+0x28a/0x610 [ 1249.728872][T26090] ? idr_alloc+0x2e0/0x2e0 [ 1249.733350][T26090] ? do_raw_spin_lock+0x11f/0x2b0 [ 1249.738444][T26090] ? __radix_tree_preload+0x82/0x880 [ 1249.743797][T26090] ? btf_alloc_id+0x30/0x2d0 [ 1249.748453][T26090] btf_alloc_id+0x4f/0x2d0 [ 1249.752936][T26090] btf_new_fd+0x80a/0x9e0 [ 1249.757341][T26090] ? bpf_btf_show_fdinfo+0x80/0x80 [ 1249.762521][T26090] ? capable+0x88/0xe0 [ 1249.766658][T26090] __sys_bpf+0x670/0x890 [ 1249.770962][T26090] ? bpf_link_show_fdinfo+0x390/0x390 [ 1249.776416][T26090] ? lock_chain_count+0x20/0x20 [ 1249.781332][T26090] __x64_sys_bpf+0x7c/0x90 [ 1249.785807][T26090] do_syscall_64+0x55/0xb0 [ 1249.790280][T26090] ? clear_bhb_loop+0x40/0x90 [ 1249.795020][T26090] ? clear_bhb_loop+0x40/0x90 [ 1249.799934][T26090] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1249.805885][T26090] RIP: 0033:0x7f4db239e0d9 [ 1249.810355][T26090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1249.830276][T26090] RSP: 002b:00007f4db32b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1249.838758][T26090] RAX: ffffffffffffffda RBX: 00007f4db2625fa0 RCX: 00007f4db239e0d9 [ 1249.846782][T26090] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000012 [ 1249.854810][T26090] RBP: 00007f4db32b5090 R08: 0000000000000000 R09: 0000000000000000 [ 1249.862928][T26090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1249.870963][T26090] R13: 00007f4db2626038 R14: 00007f4db2625fa0 R15: 00007fffffb45708 [ 1249.879033][T26090] [ 1250.802311][T26106] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1251.575412][T26107] syzkaller0: entered promiscuous mode [ 1251.610232][T26107] syzkaller0: entered allmulticast mode [ 1251.615288][T26118] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.6864'. [ 1251.987060][T26118] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.6864'. [ 1255.964197][T26110] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.6864'. [ 1255.973731][T26125] netlink: 'syz.0.6866': attribute type 2 has an invalid length. [ 1255.982410][T26125] netlink: 'syz.0.6866': attribute type 8 has an invalid length. [ 1255.992438][T26125] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6866'. [ 1256.002216][T26131] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6866'. [ 1256.479857][ T5792] Bluetooth: hci2: command 0x0406 tx timeout [ 1257.066032][T26162] netlink: 'syz.1.6880': attribute type 2 has an invalid length. [ 1257.087249][T26162] netlink: 'syz.1.6880': attribute type 8 has an invalid length. [ 1257.095335][T26162] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6880'. [ 1257.140394][T26162] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6880'. [ 1257.802974][T26172] syzkaller0: entered promiscuous mode [ 1257.808912][T26172] syzkaller0: entered allmulticast mode [ 1257.825324][T26183] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1260.269500][T26186] netlink: 'syz.0.6889': attribute type 2 has an invalid length. [ 1260.278604][T26186] netlink: 'syz.0.6889': attribute type 8 has an invalid length. [ 1260.286395][T26186] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6889'. [ 1260.302599][T26195] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6889'. [ 1261.248067][ T5792] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1261.278567][ T5792] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1261.297156][ T5792] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1261.313069][ T5792] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1261.328446][ T5792] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1261.336114][ T5792] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1261.865393][T26222] chnl_net:caif_netlink_parms(): no params data found [ 1262.012855][T23108] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.054484][T26234] netlink: 'syz.0.6905': attribute type 2 has an invalid length. [ 1262.069694][T26234] netlink: 'syz.0.6905': attribute type 8 has an invalid length. [ 1262.095414][T26234] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6905'. [ 1262.122404][T26240] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6905'. [ 1262.156412][T23108] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.272205][T23108] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.307470][T26222] bridge0: port 1(bridge_slave_0) entered blocking state [ 1262.314699][T26222] bridge0: port 1(bridge_slave_0) entered disabled state [ 1262.327463][T26222] bridge_slave_0: entered allmulticast mode [ 1262.335044][T26222] bridge_slave_0: entered promiscuous mode [ 1262.358765][T26222] bridge0: port 2(bridge_slave_1) entered blocking state [ 1262.376333][T26222] bridge0: port 2(bridge_slave_1) entered disabled state [ 1262.385248][T26222] bridge_slave_1: entered allmulticast mode [ 1262.402241][T26222] bridge_slave_1: entered promiscuous mode [ 1262.454893][T23108] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.526418][T26222] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1262.539945][T26222] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1262.589431][T26222] team0: Port device team_slave_0 added [ 1262.600924][T26222] team0: Port device team_slave_1 added [ 1262.688712][T26222] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1262.695986][T26222] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1262.766384][T26222] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1262.790355][T26222] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1262.807067][T26222] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1262.846682][T26222] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1262.902580][T26268] netlink: 149044 bytes leftover after parsing attributes in process `syz.1.6917'. [ 1263.010420][T26222] hsr_slave_0: entered promiscuous mode [ 1263.029617][T26222] hsr_slave_1: entered promiscuous mode [ 1263.036432][T26222] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1263.046348][T26222] Cannot create hsr debugfs directory [ 1263.076684][T26273] netlink: 'syz.2.6918': attribute type 11 has an invalid length. [ 1263.088812][T26273] netlink: 140 bytes leftover after parsing attributes in process `syz.2.6918'. [ 1263.369708][T20782] Bluetooth: hci4: command tx timeout [ 1263.472401][T26285] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1263.699634][T26275] netlink: 'syz.0.6919': attribute type 2 has an invalid length. [ 1263.717103][T26275] netlink: 'syz.0.6919': attribute type 8 has an invalid length. [ 1263.737359][T26275] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6919'. [ 1263.765230][T26299] netlink: 'syz.2.6924': attribute type 10 has an invalid length. [ 1263.773604][T26283] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6919'. [ 1264.202977][T26309] netlink: 'syz.0.6926': attribute type 19 has an invalid length. [ 1264.233554][T26309] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6926'. [ 1265.437349][T20782] Bluetooth: hci4: command tx timeout [ 1265.959310][T26335] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6932'. [ 1266.542176][T26340] netlink: 'syz.2.6933': attribute type 2 has an invalid length. [ 1266.567196][T26340] netlink: 'syz.2.6933': attribute type 8 has an invalid length. [ 1266.607129][T26340] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6933'. [ 1266.648805][T26344] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6933'. [ 1267.001854][T26353] tap0: tun_chr_ioctl cmd 1074025692 [ 1267.282881][T26222] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1267.336541][T26222] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1267.417037][T26222] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1267.464567][T26370] netlink: 'syz.1.6940': attribute type 11 has an invalid length. [ 1267.476740][T26370] netlink: 184116 bytes leftover after parsing attributes in process `syz.1.6940'. [ 1267.486794][T26222] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1267.517022][T20782] Bluetooth: hci4: command tx timeout [ 1267.520294][T26367] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.6940'. [ 1267.555756][T26367] netlink: 6320 bytes leftover after parsing attributes in process `syz.1.6940'. [ 1267.587042][T26367] netlink: 6 bytes leftover after parsing attributes in process `syz.1.6940'. [ 1267.596356][T26367] tc_dump_action: action bad kind [ 1267.664371][T23108] bond0: (slave wlan1): Releasing backup interface [ 1268.196136][T23108] hsr_slave_0: left promiscuous mode [ 1268.237866][T23108] hsr_slave_1: left promiscuous mode [ 1268.245428][T23108] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1268.266547][T23108] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1268.298058][T23108] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1268.311052][T23108] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1268.423214][T23108] veth1_macvtap: left promiscuous mode [ 1268.437192][T23108] veth0_macvtap: left promiscuous mode [ 1268.442944][T23108] veth1_vlan: left promiscuous mode [ 1268.457354][T23108] veth0_vlan: left promiscuous mode [ 1269.597255][T20782] Bluetooth: hci4: command tx timeout [ 1270.488484][T23108] team0 (unregistering): Port device geneve1 removed [ 1271.009662][T23108] team0 (unregistering): Port device team_slave_1 removed [ 1271.076620][T23108] team0 (unregistering): Port device team_slave_0 removed [ 1271.134084][T23108] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1271.195021][T23108] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1271.248079][T23108] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1271.593663][T23108] bond0 (unregistering): Released all slaves [ 1271.652350][T26394] netlink: 'syz.1.6945': attribute type 10 has an invalid length. [ 1271.683296][T26399] netlink: 'syz.0.6946': attribute type 2 has an invalid length. [ 1271.707354][T26399] netlink: 'syz.0.6946': attribute type 8 has an invalid length. [ 1271.715176][T26399] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6946'. [ 1271.745226][T26405] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6946'. [ 1272.006673][T26222] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1272.120688][T26410] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6949'. [ 1272.179692][T26222] 8021q: adding VLAN 0 to HW filter on device team0 [ 1272.220038][T26410] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6949'. [ 1272.259713][T23143] bridge0: port 1(bridge_slave_0) entered blocking state [ 1272.267007][T23143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1272.296810][T26414] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6949'. [ 1272.343318][T23143] bridge0: port 2(bridge_slave_1) entered blocking state [ 1272.350733][T23143] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1272.399518][T26410] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6949'. [ 1272.681434][T26422] tap0: tun_chr_ioctl cmd 1074025692 [ 1273.263853][T26222] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1273.455832][T26222] veth0_vlan: entered promiscuous mode [ 1273.540460][T26222] veth1_vlan: entered promiscuous mode [ 1273.714965][T26222] veth0_macvtap: entered promiscuous mode [ 1273.783850][T26222] veth1_macvtap: entered promiscuous mode [ 1273.821692][T26442] netlink: 'syz.2.6956': attribute type 2 has an invalid length. [ 1273.842118][T26442] netlink: 'syz.2.6956': attribute type 8 has an invalid length. [ 1273.867261][T26442] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6956'. [ 1273.894579][T26448] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6956'. [ 1273.989972][T26222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1274.027120][T26222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.053101][T26222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1274.076646][T26222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.109345][T26222] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1274.124043][T26222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1274.135632][T26222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.147909][T26222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1274.159488][T26222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1274.178967][T26222] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1274.221490][T26222] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1274.251802][T26222] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1274.273261][T26457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1274.284319][T26222] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1274.293681][T26222] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1274.480098][T23143] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1274.538770][T23143] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1274.720318][T26461] netlink: 'syz.1.6970': attribute type 39 has an invalid length. [ 1274.775708][T23130] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1274.786209][T23130] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1274.847908][T26467] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6963'. [ 1274.887187][T26467] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6963'. [ 1274.902868][T26467] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6963'. [ 1274.913832][T26467] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6963'. [ 1274.932786][T26472] netlink: 'syz.0.6965': attribute type 3 has an invalid length. [ 1274.942315][T26472] netlink: 'syz.0.6965': attribute type 275 has an invalid length. [ 1275.026224][T26475] netlink: 'syz.1.6966': attribute type 26 has an invalid length. [ 1275.034593][T26475] netlink: 62827 bytes leftover after parsing attributes in process `syz.1.6966'. [ 1275.158809][T26482] netlink: 'syz.1.6969': attribute type 9 has an invalid length. [ 1275.190059][T26482] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.6969'. [ 1275.296726][T26479] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6968'. [ 1275.340209][T26479] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6968'. [ 1278.769700][T26517] FAULT_INJECTION: forcing a failure. [ 1278.769700][T26517] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1278.796597][T26517] CPU: 1 PID: 26517 Comm: syz.2.6987 Not tainted syzkaller #0 [ 1278.804154][T26517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1278.814262][T26517] Call Trace: [ 1278.817592][T26517] [ 1278.820566][T26517] dump_stack_lvl+0x18c/0x250 [ 1278.825313][T26517] ? show_regs_print_info+0x20/0x20 [ 1278.830599][T26517] ? load_image+0x420/0x420 [ 1278.835189][T26517] ? __lock_acquire+0x7d80/0x7d80 [ 1278.840269][T26517] ? snprintf+0xe9/0x140 [ 1278.844571][T26517] should_fail_ex+0x394/0x4c0 [ 1278.849309][T26517] _copy_to_user+0x2f/0xa0 [ 1278.853778][T26517] simple_read_from_buffer+0xe7/0x150 [ 1278.859206][T26517] proc_fail_nth_read+0x1e8/0x260 [ 1278.864294][T26517] ? proc_fault_inject_write+0x360/0x360 [ 1278.869996][T26517] ? fsnotify_perm+0x271/0x5e0 [ 1278.874859][T26517] ? proc_fault_inject_write+0x360/0x360 [ 1278.880562][T26517] vfs_read+0x298/0x990 [ 1278.884782][T26517] ? kernel_read+0x1e0/0x1e0 [ 1278.889426][T26517] ? __fget_files+0x28/0x460 [ 1278.894073][T26517] ? __fget_files+0x3fc/0x460 [ 1278.898819][T26517] ? __fdget_pos+0x2a3/0x330 [ 1278.903468][T26517] ? ksys_read+0x74/0x260 [ 1278.907869][T26517] ksys_read+0x151/0x260 [ 1278.912182][T26517] ? vfs_write+0x9a0/0x9a0 [ 1278.916661][T26517] ? lockdep_hardirqs_on+0x98/0x150 [ 1278.921922][T26517] do_syscall_64+0x55/0xb0 [ 1278.926393][T26517] ? clear_bhb_loop+0x40/0x90 [ 1278.931121][T26517] ? clear_bhb_loop+0x40/0x90 [ 1278.935862][T26517] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1278.941896][T26517] RIP: 0033:0x7f4db235e90e [ 1278.946361][T26517] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1278.966029][T26517] RSP: 002b:00007f4db32b4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1278.974533][T26517] RAX: ffffffffffffffda RBX: 00007f4db32b56c0 RCX: 00007f4db235e90e [ 1278.982558][T26517] RDX: 000000000000000f RSI: 00007f4db32b50a0 RDI: 0000000000000003 [ 1278.990580][T26517] RBP: 00007f4db32b5090 R08: 0000000000000000 R09: 0000000000000000 [ 1278.998607][T26517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1279.006638][T26517] R13: 00007f4db2626038 R14: 00007f4db2625fa0 R15: 00007fffffb45708 [ 1279.014711][T26517] [ 1279.223044][T26514] validate_nla: 2 callbacks suppressed [ 1279.223119][T26514] netlink: 'syz.3.6984': attribute type 2 has an invalid length. [ 1279.261716][T26514] netlink: 'syz.3.6984': attribute type 8 has an invalid length. [ 1279.280169][T26514] __nla_validate_parse: 4 callbacks suppressed [ 1279.280204][T26514] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6984'. [ 1279.329357][T26523] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6984'. [ 1279.469571][T26533] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1279.930746][T26554] netlink: 'syz.3.6998': attribute type 10 has an invalid length. [ 1280.221947][T26558] netlink: 'syz.2.7000': attribute type 2 has an invalid length. [ 1280.231599][T26558] netlink: 'syz.2.7000': attribute type 8 has an invalid length. [ 1280.244096][T26558] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7000'. [ 1280.278560][T26565] netlink: 'syz.1.7002': attribute type 9 has an invalid length. [ 1280.286404][T26565] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.7002'. [ 1281.075469][T26587] netlink: 'syz.1.7010': attribute type 9 has an invalid length. [ 1281.097089][T26587] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.7010'. [ 1281.840260][T26594] bridge0: port 2(bridge_slave_1) entered disabled state [ 1281.848088][T26594] bridge0: port 1(bridge_slave_0) entered disabled state [ 1281.867457][T26594] bridge0: entered allmulticast mode [ 1282.289969][T26599] netlink: 'syz.1.7015': attribute type 2 has an invalid length. [ 1282.307149][T26599] netlink: 'syz.1.7015': attribute type 8 has an invalid length. [ 1282.315284][T26599] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7015'. [ 1282.746097][T26612] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1282.758294][T26616] netlink: 'syz.2.7022': attribute type 21 has an invalid length. [ 1282.816999][T26616] netlink: 16166 bytes leftover after parsing attributes in process `syz.2.7022'. [ 1283.333183][T26628] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7026'. [ 1283.417203][T26635] sctp: [Deprecated]: syz.2.7030 (pid 26635) Use of int in max_burst socket option deprecated. [ 1283.417203][T26635] Use struct sctp_assoc_value instead [ 1283.889397][T26638] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7028'. [ 1284.510024][T26652] netlink: 61211 bytes leftover after parsing attributes in process `syz.1.7035'. [ 1285.060810][T26668] validate_nla: 3 callbacks suppressed [ 1285.060830][T26668] netlink: 'syz.0.7038': attribute type 10 has an invalid length. [ 1285.141622][T26668] team0: Port device netdevsim0 added [ 1285.510400][T26680] netlink: 'syz.1.7043': attribute type 2 has an invalid length. [ 1285.521973][T26680] netlink: 'syz.1.7043': attribute type 8 has an invalid length. [ 1285.548551][T26680] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7043'. [ 1288.490571][T26695] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.7049'. [ 1288.640447][T26703] netlink: 128 bytes leftover after parsing attributes in process `syz.3.7051'. [ 1288.653627][T26703] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1290.379235][T26726] netlink: 'syz.0.7059': attribute type 21 has an invalid length. [ 1290.407321][T26726] netlink: 14548 bytes leftover after parsing attributes in process `syz.0.7059'. [ 1291.390096][T26755] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1292.158380][T26767] netlink: 'syz.1.7072': attribute type 2 has an invalid length. [ 1292.183552][T26767] netlink: 'syz.1.7072': attribute type 8 has an invalid length. [ 1292.201346][T26767] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7072'. [ 1292.231579][T26780] netlink: 'syz.2.7076': attribute type 4 has an invalid length. [ 1292.263528][T26780] netlink: 152 bytes leftover after parsing attributes in process `syz.2.7076'. [ 1292.345302][T26780] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 1293.956591][T26809] netlink: 'syz.0.7086': attribute type 2 has an invalid length. [ 1293.975254][T26809] netlink: 'syz.0.7086': attribute type 8 has an invalid length. [ 1293.984694][T26809] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7086'. [ 1294.786255][T26848] netlink: 'syz.2.7103': attribute type 10 has an invalid length. [ 1294.822069][T26842] netlink: 'syz.1.7099': attribute type 2 has an invalid length. [ 1294.830723][T26842] netlink: 'syz.1.7099': attribute type 8 has an invalid length. [ 1294.839790][T26842] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7099'. [ 1295.146425][T26867] netlink: 'syz.1.7110': attribute type 10 has an invalid length. [ 1295.177328][T26867] netlink: 55 bytes leftover after parsing attributes in process `syz.1.7110'. [ 1296.049604][T26900] netlink: 'syz.0.7119': attribute type 1 has an invalid length. [ 1296.440455][T26900] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.7119'. [ 1297.524700][T26933] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.7134'. [ 1297.670809][T26944] netlink: 22 bytes leftover after parsing attributes in process `syz.2.7137'. [ 1297.755184][T26949] netlink: 'syz.3.7139': attribute type 11 has an invalid length. [ 1297.777125][T26949] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7139'. [ 1297.994867][T26959] netlink: 'syz.3.7143': attribute type 49 has an invalid length. [ 1298.042551][T26959] netlink: set zone limit has 8 unknown bytes [ 1300.480941][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.497043][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.420932][T26980] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.7151'. [ 1301.470118][T26980] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 1302.133935][T27009] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7163'. [ 1302.263280][T27006] netlink: 65055 bytes leftover after parsing attributes in process `syz.0.7162'. [ 1302.416634][T27015] netlink: 'syz.0.7167': attribute type 1 has an invalid length. [ 1302.425125][T27015] netlink: 60387 bytes leftover after parsing attributes in process `syz.0.7167'. [ 1302.616404][T27020] netlink: 15743 bytes leftover after parsing attributes in process `syz.0.7169'. [ 1303.637425][T27040] netlink: 'syz.3.7176': attribute type 9 has an invalid length. [ 1303.645357][T27040] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.7176'. [ 1306.021068][T27076] -1: renamed from syzkaller0 [ 1306.580757][T27091] netlink: 9275 bytes leftover after parsing attributes in process `syz.2.7193'. [ 1306.862162][T27100] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1306.873516][T27100] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1306.884609][T27100] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1306.899367][T27100] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1306.907600][T27100] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1306.915079][T27100] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1306.921903][T23130] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1306.944511][T27098] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1307.170380][T23130] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1307.373805][T27114] netlink: 'syz.0.7199': attribute type 25 has an invalid length. [ 1307.381948][T27114] netlink: 'syz.0.7199': attribute type 3 has an invalid length. [ 1307.413865][T27114] netlink: 'syz.0.7199': attribute type 10 has an invalid length. [ 1307.451218][T27114] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7199'. [ 1307.478978][T27114] batman_adv: batadv0: Adding interface: virt_wifi0 [ 1307.497086][T27114] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1307.532349][T27114] batman_adv: batadv0: Interface activated: virt_wifi0 [ 1307.595374][T23130] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1307.738016][T23130] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1307.805909][T27122] veth1_to_bond: entered allmulticast mode [ 1307.888994][T27125] -1: renamed from syzkaller0 [ 1307.903028][T27130] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7203'. [ 1307.928064][T27130] : renamed from caif0 [ 1307.936168][T27130] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 1308.135515][T27096] chnl_net:caif_netlink_parms(): no params data found [ 1308.286037][T20782] Bluetooth: hci4: unexpected event 0x05 length: 151 > 4 [ 1308.365985][T27137] netlink: 188 bytes leftover after parsing attributes in process `syz.3.7206'. [ 1308.410688][T27141] netlink: 763 bytes leftover after parsing attributes in process `syz.3.7206'. [ 1308.601733][T27149] netlink: 'syz.2.7208': attribute type 11 has an invalid length. [ 1308.615578][T27149] netlink: 140 bytes leftover after parsing attributes in process `syz.2.7208'. [ 1308.745788][T27096] bridge0: port 1(bridge_slave_0) entered blocking state [ 1308.754345][T27096] bridge0: port 1(bridge_slave_0) entered disabled state [ 1308.776787][T27096] bridge_slave_0: entered allmulticast mode [ 1308.798713][T27096] bridge_slave_0: entered promiscuous mode [ 1308.815234][T27151] netlink: 'syz.3.7209': attribute type 2 has an invalid length. [ 1308.827099][T27151] netlink: 'syz.3.7209': attribute type 8 has an invalid length. [ 1308.848305][T27151] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7209'. [ 1308.925241][T27096] bridge0: port 2(bridge_slave_1) entered blocking state [ 1308.934905][T27096] bridge0: port 2(bridge_slave_1) entered disabled state [ 1308.973401][T27096] bridge_slave_1: entered allmulticast mode [ 1309.005298][T27096] bridge_slave_1: entered promiscuous mode [ 1309.037245][T20782] Bluetooth: hci0: command tx timeout [ 1309.237753][T27096] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1309.279317][T27096] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1309.733279][T27096] team0: Port device team_slave_0 added [ 1309.759205][T27096] team0: Port device team_slave_1 added [ 1309.908751][T27096] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1309.915821][T27096] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1309.946071][T27096] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1309.985440][T27096] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1309.995338][T27096] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1310.038852][T27182] netlink: 143432 bytes leftover after parsing attributes in process `syz.0.7219'. [ 1310.080949][T27096] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1310.524816][T27096] hsr_slave_0: entered promiscuous mode [ 1310.565959][T27096] hsr_slave_1: entered promiscuous mode [ 1310.588762][T27096] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1310.596423][T27096] Cannot create hsr debugfs directory [ 1310.707804][T27201] netlink: 'syz.0.7223': attribute type 10 has an invalid length. [ 1311.129393][T20782] Bluetooth: hci0: command tx timeout [ 1311.370486][T27219] netlink: 'syz.3.7227': attribute type 10 has an invalid length. [ 1311.424085][T27219] veth0_macvtap: left promiscuous mode [ 1313.254621][T20782] Bluetooth: hci0: command tx timeout [ 1313.423786][T27251] syzkaller0: entered promiscuous mode [ 1313.435133][T27251] syzkaller0: entered allmulticast mode [ 1314.000389][T23130] hsr_slave_0: left promiscuous mode [ 1314.017213][T23130] hsr_slave_1: left promiscuous mode [ 1314.039226][T23130] hsr0: left allmulticast mode [ 1314.044428][T23130] bridge0: port 3(hsr0) entered disabled state [ 1314.065659][T23130] bridge_slave_1: left allmulticast mode [ 1314.072333][T23130] bridge_slave_1: left promiscuous mode [ 1314.087611][T23130] bridge0: port 2(bridge_slave_1) entered disabled state [ 1314.100038][T27275] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7237'. [ 1314.123362][T23130] bridge_slave_0: left allmulticast mode [ 1314.129508][T23130] bridge_slave_0: left promiscuous mode [ 1314.145532][T23130] bridge0: port 1(bridge_slave_0) entered disabled state [ 1314.195743][T23130] veth1_macvtap: left promiscuous mode [ 1314.206039][T23130] veth0_macvtap: left promiscuous mode [ 1314.222852][T23130] veth1_vlan: left allmulticast mode [ 1314.229162][T23130] veth1_vlan: left promiscuous mode [ 1314.234586][T23130] veth0_vlan: left promiscuous mode [ 1315.045904][T23130] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 1315.288552][T20782] Bluetooth: hci0: command tx timeout [ 1315.730542][T23130] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1315.786203][T23130] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1316.295613][T23130] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1316.305595][T23130] bond0 (unregistering): (slave bridge0): last VLAN challenged slave left bond - VLAN blocking is removed [ 1316.320027][T23130] bond0 (unregistering): Released all slaves [ 1316.595963][T27096] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1316.648636][T27096] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1316.697615][T27096] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1316.748617][T27096] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1317.421636][T27096] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1317.489587][T27096] 8021q: adding VLAN 0 to HW filter on device team0 [ 1317.540178][T23113] bridge0: port 1(bridge_slave_0) entered blocking state [ 1317.547437][T23113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1317.591068][T23113] bridge0: port 2(bridge_slave_1) entered blocking state [ 1317.598400][T23113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1318.020266][T27338] netlink: 140 bytes leftover after parsing attributes in process `syz.0.7252'. [ 1318.070410][T27338] netlink: 10 bytes leftover after parsing attributes in process `syz.0.7252'. [ 1318.130187][T27338] bond0: (slave bond_slave_0): Releasing backup interface [ 1318.165283][T27338] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1318.620522][T27096] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1318.747796][T27096] veth0_vlan: entered promiscuous mode [ 1318.789247][T27096] veth1_vlan: entered promiscuous mode [ 1318.967935][T27096] veth0_macvtap: entered promiscuous mode [ 1319.021845][T27096] veth1_macvtap: entered promiscuous mode [ 1319.157725][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1319.193303][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1319.210718][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1319.238224][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1319.259238][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1319.282605][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1319.308670][T27096] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1319.349296][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1319.369498][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1319.389855][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1319.424751][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1319.445228][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1319.467658][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1319.501331][T27096] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1319.526725][T27096] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1319.568879][T27096] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1319.587175][T27096] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1319.596058][T27096] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1319.889738][T23148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1319.928668][T23148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1320.028747][T23115] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1320.043004][T23115] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1320.383051][T23113] tipc: Subscription rejected, illegal request [ 1321.113298][T27423] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1321.276412][T27415] netlink: 'syz.1.7188': attribute type 10 has an invalid length. [ 1321.348261][T27415] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7188'. [ 1321.424579][T27415] batman_adv: batadv0: Adding interface: virt_wifi0 [ 1321.496383][T27415] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1321.527172][T27415] batman_adv: batadv0: Interface activated: virt_wifi0 [ 1323.287959][T27466] netlink: 'syz.1.7287': attribute type 11 has an invalid length. [ 1323.304090][T27466] netlink: 140 bytes leftover after parsing attributes in process `syz.1.7287'. [ 1323.539281][T27471] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7289'. [ 1323.559216][T27474] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7289'. [ 1324.402968][T27500] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1325.117381][T27513] netlink: 'syz.3.7306': attribute type 10 has an invalid length. [ 1325.164518][T27513] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1325.616476][T27535] netlink: 'syz.1.7316': attribute type 10 has an invalid length. [ 1325.781007][T27537] netlink: 14 bytes leftover after parsing attributes in process `syz.0.7317'. [ 1325.820580][T27537] hsr_slave_0: left promiscuous mode [ 1326.111037][T27546] netlink: 144 bytes leftover after parsing attributes in process `syz.3.7321'. [ 1326.361221][T27546] team0: Port device team_slave_0 removed [ 1326.377852][T27546] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1326.838074][T27574] netlink: 'syz.0.7325': attribute type 39 has an invalid length. [ 1328.223381][T27596] netlink: 'syz.2.7338': attribute type 9 has an invalid length. [ 1328.250318][T27596] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.7338'. [ 1328.653785][T27599] netlink: 'syz.2.7339': attribute type 21 has an invalid length. [ 1328.677084][T27599] netlink: 14548 bytes leftover after parsing attributes in process `syz.2.7339'. [ 1328.794204][T27602] netlink: 'syz.0.7341': attribute type 3 has an invalid length. [ 1328.829967][T27602] netlink: 'syz.0.7341': attribute type 1 has an invalid length. [ 1328.858705][T27602] netlink: 181400 bytes leftover after parsing attributes in process `syz.0.7341'. [ 1329.483174][T27627] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7348'. [ 1329.493900][T27627] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7348'. [ 1329.516562][T27627] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7348'. [ 1329.539837][T27627] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7348'. [ 1329.580841][T27627] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.7348'. [ 1329.590726][T27627] openvswitch: netlink: Tunnel attr 0 has unexpected len 201 expected 8 [ 1330.019712][T27637] netlink: 'syz.2.7352': attribute type 2 has an invalid length. [ 1330.041076][T27637] netlink: 'syz.2.7352': attribute type 8 has an invalid length. [ 1330.067118][T27637] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7352'. [ 1331.103635][T27663] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1331.258715][T27660] netlink: 144 bytes leftover after parsing attributes in process `syz.0.7360'. [ 1331.400196][T27671] netlink: 'syz.2.7362': attribute type 29 has an invalid length. [ 1331.434469][T27660] team0: Port device team_slave_0 removed [ 1331.452128][T27660] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1331.493394][T27671] netlink: 'syz.2.7362': attribute type 29 has an invalid length. [ 1331.519973][T27676] netlink: 'syz.2.7362': attribute type 29 has an invalid length. [ 1332.016549][T27685] validate_nla: 1 callbacks suppressed [ 1332.016637][T27685] netlink: 'syz.1.7367': attribute type 9 has an invalid length. [ 1332.465382][T27699] netlink: 'syz.1.7372': attribute type 21 has an invalid length. [ 1333.280677][T27716] __nla_validate_parse: 4 callbacks suppressed [ 1333.280700][T27716] netlink: 207496 bytes leftover after parsing attributes in process `syz.1.7379'. [ 1333.325437][T27720] netlink: 'syz.2.7380': attribute type 11 has an invalid length. [ 1333.333451][T27720] netlink: 140 bytes leftover after parsing attributes in process `syz.2.7380'. [ 1333.781681][T27730] syzkaller0: entered promiscuous mode [ 1333.797303][T27730] syzkaller0: entered allmulticast mode [ 1334.105308][T27738] netlink: 'syz.3.7388': attribute type 21 has an invalid length. [ 1334.116490][T27738] netlink: 14548 bytes leftover after parsing attributes in process `syz.3.7388'. [ 1334.146749][T27728] netlink: 'syz.0.7384': attribute type 2 has an invalid length. [ 1334.155657][T27728] netlink: 'syz.0.7384': attribute type 8 has an invalid length. [ 1334.170976][T27728] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7384'. [ 1337.725693][T27819] syzkaller0: entered promiscuous mode [ 1337.731706][T27819] syzkaller0: entered allmulticast mode [ 1339.510413][T27830] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1340.260686][T27821] netlink: 'syz.0.7419': attribute type 2 has an invalid length. [ 1340.268963][T27821] netlink: 'syz.0.7419': attribute type 8 has an invalid length. [ 1340.276731][T27821] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7419'. [ 1340.287373][T27825] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7419'. [ 1341.542796][T27870] netlink: 'syz.1.7434': attribute type 2 has an invalid length. [ 1341.567138][T27870] netlink: 'syz.1.7434': attribute type 8 has an invalid length. [ 1341.575230][T27870] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7434'. [ 1341.678811][T27883] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7434'. [ 1341.867619][T27888] netlink: 'syz.0.7439': attribute type 10 has an invalid length. [ 1342.148057][T27903] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7444'. [ 1342.311613][T27907] netlink: 'syz.2.7448': attribute type 11 has an invalid length. [ 1342.320207][T27907] netlink: 140 bytes leftover after parsing attributes in process `syz.2.7448'. [ 1342.681855][T27913] netlink: 'syz.1.7449': attribute type 2 has an invalid length. [ 1342.697063][T27913] netlink: 'syz.1.7449': attribute type 8 has an invalid length. [ 1342.705172][T27913] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7449'. [ 1342.780192][T27913] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7449'. [ 1345.625211][T27985] netlink: 'syz.3.7475': attribute type 10 has an invalid length. [ 1345.819780][T27988] netlink: 'syz.3.7477': attribute type 9 has an invalid length. [ 1345.869531][T27988] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.7477'. [ 1345.900712][T27994] netlink: 'syz.1.7479': attribute type 11 has an invalid length. [ 1345.915252][T27994] netlink: 140 bytes leftover after parsing attributes in process `syz.1.7479'. [ 1345.930010][T27995] netlink: 'syz.2.7480': attribute type 2 has an invalid length. [ 1345.947385][T27995] netlink: 'syz.2.7480': attribute type 3 has an invalid length. [ 1345.967504][T27995] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7480'. [ 1346.132355][T28001] netlink: 14 bytes leftover after parsing attributes in process `syz.2.7483'. [ 1346.517113][T28005] FAULT_INJECTION: forcing a failure. [ 1346.517113][T28005] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1346.552095][T28005] CPU: 1 PID: 28005 Comm: syz.1.7485 Not tainted syzkaller #0 [ 1346.559673][T28005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1346.569789][T28005] Call Trace: [ 1346.573116][T28005] [ 1346.576096][T28005] dump_stack_lvl+0x18c/0x250 [ 1346.580847][T28005] ? show_regs_print_info+0x20/0x20 [ 1346.586106][T28005] ? load_image+0x420/0x420 [ 1346.590681][T28005] ? __lock_acquire+0x7d80/0x7d80 [ 1346.595768][T28005] ? snprintf+0xe9/0x140 [ 1346.600081][T28005] should_fail_ex+0x394/0x4c0 [ 1346.604838][T28005] _copy_to_user+0x2f/0xa0 [ 1346.609316][T28005] simple_read_from_buffer+0xe7/0x150 [ 1346.614755][T28005] proc_fail_nth_read+0x1e8/0x260 [ 1346.619845][T28005] ? proc_fault_inject_write+0x360/0x360 [ 1346.625546][T28005] ? fsnotify_perm+0x271/0x5e0 [ 1346.630371][T28005] ? proc_fault_inject_write+0x360/0x360 [ 1346.636073][T28005] vfs_read+0x298/0x990 [ 1346.640313][T28005] ? kernel_read+0x1e0/0x1e0 [ 1346.644970][T28005] ? __fget_files+0x28/0x460 [ 1346.649629][T28005] ? __fget_files+0x3fc/0x460 [ 1346.654384][T28005] ? __fdget_pos+0x2a3/0x330 [ 1346.659040][T28005] ? ksys_read+0x74/0x260 [ 1346.663442][T28005] ksys_read+0x151/0x260 [ 1346.667747][T28005] ? vfs_write+0x9a0/0x9a0 [ 1346.672228][T28005] ? lockdep_hardirqs_on+0x98/0x150 [ 1346.677487][T28005] do_syscall_64+0x55/0xb0 [ 1346.681981][T28005] ? clear_bhb_loop+0x40/0x90 [ 1346.686712][T28005] ? clear_bhb_loop+0x40/0x90 [ 1346.691453][T28005] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1346.697400][T28005] RIP: 0033:0x7f79ded5e90e [ 1346.701865][T28005] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1346.721531][T28005] RSP: 002b:00007f79dfc39fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1346.730006][T28005] RAX: ffffffffffffffda RBX: 00007f79dfc3a6c0 RCX: 00007f79ded5e90e [ 1346.738027][T28005] RDX: 000000000000000f RSI: 00007f79dfc3a0a0 RDI: 0000000000000008 [ 1346.746078][T28005] RBP: 00007f79dfc3a090 R08: 0000000000000000 R09: 0000000000000000 [ 1346.754107][T28005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1346.762143][T28005] R13: 00007f79df026038 R14: 00007f79df025fa0 R15: 00007ffd4fd6ab88 [ 1346.770192][T28005] [ 1346.899697][T28001] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1347.060933][T28001] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1347.184171][T28001] bond0 (unregistering): (slave .3ãc¤±): Releasing backup interface [ 1347.204655][T28025] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1347.339361][T28001] bond0 (unregistering): Released all slaves [ 1347.444739][T28017] netlink: 'syz.3.7486': attribute type 2 has an invalid length. [ 1347.462260][T28017] netlink: 'syz.3.7486': attribute type 8 has an invalid length. [ 1347.517555][T28017] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7486'. [ 1347.532887][T28022] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7486'. [ 1347.554273][T28030] netlink: 40227 bytes leftover after parsing attributes in process `syz.0.7488'. [ 1348.453771][T28052] syzkaller0: entered promiscuous mode [ 1348.536253][T28052] syzkaller0: entered allmulticast mode [ 1352.484559][T28100] netlink: 'syz.2.7515': attribute type 10 has an invalid length. [ 1352.811276][T28107] netlink: 'syz.0.7518': attribute type 11 has an invalid length. [ 1352.847152][T28107] netlink: 140 bytes leftover after parsing attributes in process `syz.0.7518'. [ 1353.910613][T28123] netlink: 'syz.1.7526': attribute type 2 has an invalid length. [ 1353.919180][T28123] netlink: 'syz.1.7526': attribute type 8 has an invalid length. [ 1353.946328][T28123] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7526'. [ 1355.074299][T28143] veth1_to_bond: entered allmulticast mode [ 1355.126244][T27100] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1355.136701][T27100] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1355.154723][T27100] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1355.167712][T27100] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1355.192766][T27100] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1355.200931][T27100] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1355.792545][T23148] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1355.824442][T28147] chnl_net:caif_netlink_parms(): no params data found [ 1355.840219][T28166] netlink: 'syz.1.7539': attribute type 21 has an invalid length. [ 1355.848583][T28166] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7539'. [ 1355.909348][T23148] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1356.015384][T23148] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1356.031125][T28147] bridge0: port 1(bridge_slave_0) entered blocking state [ 1356.040627][T28147] bridge0: port 1(bridge_slave_0) entered disabled state [ 1356.048507][T28147] bridge_slave_0: entered allmulticast mode [ 1356.056486][T28147] bridge_slave_0: entered promiscuous mode [ 1356.066552][T28147] bridge0: port 2(bridge_slave_1) entered blocking state [ 1356.079603][T28147] bridge0: port 2(bridge_slave_1) entered disabled state [ 1356.087019][T28147] bridge_slave_1: entered allmulticast mode [ 1356.094634][T28147] bridge_slave_1: entered promiscuous mode [ 1356.133002][T23148] team0: Port device netdevsim0 removed [ 1356.142450][T23148] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1356.247673][T28147] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1356.282803][T28147] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1356.367791][T28147] team0: Port device team_slave_0 added [ 1356.431573][T28147] team0: Port device team_slave_1 added [ 1356.585261][T28147] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1356.603530][T28147] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1356.644574][T28147] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1356.657237][T28184] netlink: 14 bytes leftover after parsing attributes in process `syz.3.7543'. [ 1356.928091][T28147] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1356.949655][T28147] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1357.013787][T28147] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1357.069796][T28189] netlink: 'syz.1.7544': attribute type 2 has an invalid length. [ 1357.079197][T28189] netlink: 'syz.1.7544': attribute type 8 has an invalid length. [ 1357.100230][T28189] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7544'. [ 1357.257244][T28195] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7544'. [ 1357.277816][T27100] Bluetooth: hci3: command tx timeout [ 1357.330488][T28197] netlink: 16399 bytes leftover after parsing attributes in process `syz.3.7547'. [ 1357.473561][T27100] Bluetooth: hci2: unexpected event 0x06 length: 15 > 3 [ 1357.563467][T28147] hsr_slave_0: entered promiscuous mode [ 1357.641151][T28147] hsr_slave_1: entered promiscuous mode [ 1357.705583][T28199] netlink: 'syz.2.7548': attribute type 21 has an invalid length. [ 1358.488681][T28217] netlink: 'syz.3.7554': attribute type 2 has an invalid length. [ 1358.502821][T28217] netlink: 'syz.3.7554': attribute type 8 has an invalid length. [ 1358.513046][T28217] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7554'. [ 1358.597101][T28228] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7554'. [ 1358.945200][T23148] bond0: (slave wlan1): Releasing backup interface [ 1359.288208][T27100] Bluetooth: hci4: unexpected event 0x06 length: 15 > 3 [ 1359.344665][T23148] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1359.360762][T27100] Bluetooth: hci3: command tx timeout [ 1359.418992][T23148] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1359.468072][T23148] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1359.475677][T23148] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1359.499225][T23148] batman_adv: batadv0: Interface deactivated: veth1_virt_wifi [ 1359.526967][T23148] batman_adv: batadv0: Removing interface: veth1_virt_wifi [ 1359.549996][T23148] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 1359.557763][T23148] batman_adv: batadv0: Removing interface: virt_wifi0 [ 1359.566007][T23148] bridge_slave_1: left allmulticast mode [ 1359.573522][T23148] bridge_slave_1: left promiscuous mode [ 1359.580060][T23148] bridge0: port 2(bridge_slave_1) entered disabled state [ 1359.590347][T23148] bridge_slave_0: left allmulticast mode [ 1359.596213][T23148] bridge_slave_0: left promiscuous mode [ 1359.603287][T23148] bridge0: port 1(bridge_slave_0) entered disabled state [ 1359.642850][T23148] veth1_macvtap: left promiscuous mode [ 1359.651615][T23148] veth0_macvtap: left promiscuous mode [ 1360.278750][T23148] team0 (unregistering): Port device team_slave_1 removed [ 1360.376277][T23148] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1360.799824][T23148] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1360.810118][T23148] bond0 (unregistering): Released all slaves [ 1360.963431][T28248] netlink: 'syz.3.7560': attribute type 21 has an invalid length. [ 1361.230414][T28270] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7566'. [ 1361.256289][T28269] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7566'. [ 1361.340491][T28271] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.7565'. [ 1361.447459][T27100] Bluetooth: hci3: command tx timeout [ 1361.636326][T28147] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1361.700817][T28147] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1361.785756][T28147] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1361.874874][T28147] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1362.007871][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 1362.018573][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.186123][T28280] netlink: 'syz.1.7568': attribute type 11 has an invalid length. [ 1362.210324][T28280] netlink: 140 bytes leftover after parsing attributes in process `syz.1.7568'. [ 1362.330001][T28147] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1362.361342][T28147] 8021q: adding VLAN 0 to HW filter on device team0 [ 1362.419564][T23107] bridge0: port 1(bridge_slave_0) entered blocking state [ 1362.426955][T23107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1362.469081][T23107] bridge0: port 2(bridge_slave_1) entered blocking state [ 1362.476330][T23107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1362.609586][T28295] netlink: 'syz.3.7572': attribute type 21 has an invalid length. [ 1362.620553][T28295] netlink: 164 bytes leftover after parsing attributes in process `syz.3.7572'. [ 1362.740134][T28286] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7570'. [ 1362.948285][T27100] Bluetooth: hci0: unexpected event 0x06 length: 15 > 3 [ 1363.102271][T28303] netlink: 'syz.1.7573': attribute type 21 has an invalid length. [ 1363.263466][T28147] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1363.459255][T28147] veth0_vlan: entered promiscuous mode [ 1363.512819][T28147] veth1_vlan: entered promiscuous mode [ 1363.527802][T27100] Bluetooth: hci3: command tx timeout [ 1363.762873][T28147] veth0_macvtap: entered promiscuous mode [ 1363.800935][T28147] veth1_macvtap: entered promiscuous mode [ 1363.902663][T28147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1363.949300][T28147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1363.978715][T28147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1363.999789][T28147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1364.023356][T28147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1364.044926][T28147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1364.086545][T28147] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1364.152488][T28147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1364.184855][T28147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1364.205494][T28147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1364.240223][T28147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1364.269943][T28147] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1364.335268][T28147] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1364.394152][T28147] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1364.468376][T28147] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1364.492951][T28147] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1364.503170][T28147] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1364.516360][T28147] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1364.571620][T28337] netlink: 'syz.3.7581': attribute type 10 has an invalid length. [ 1364.592253][T28337] macvlan0: entered promiscuous mode [ 1364.653262][T28337] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 1364.890361][T23143] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1364.948366][T23143] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1365.033408][T24606] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1365.048554][T24606] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1365.462421][T28351] netlink: 'syz.3.7583': attribute type 9 has an invalid length. [ 1365.548867][T28351] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.7583'. [ 1366.628251][T28378] netlink: 'syz.3.7592': attribute type 11 has an invalid length. [ 1366.642060][T28378] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7592'. [ 1366.747539][T28377] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7591'. [ 1366.766961][T28377] tc_dump_action: action bad kind [ 1368.159185][T28410] netlink: 180 bytes leftover after parsing attributes in process `syz.0.7602'. [ 1368.303996][T28410] netlink: 'syz.0.7602': attribute type 10 has an invalid length. [ 1368.521082][T28410] team0 (unregistering): Port device team_slave_0 removed [ 1368.568108][T28410] team0 (unregistering): Port device team_slave_1 removed [ 1368.635868][T28418] netlink: 'syz.3.7605': attribute type 6 has an invalid length. [ 1368.652703][T28418] netlink: 168 bytes leftover after parsing attributes in process `syz.3.7605'. [ 1371.436099][T28468] netlink: 'syz.3.7625': attribute type 11 has an invalid length. [ 1371.448155][T28468] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7625'. [ 1371.939786][T28469] syzkaller0: entered promiscuous mode [ 1372.013452][T28469] syzkaller0: entered allmulticast mode [ 1376.490785][T28496] netlink: 'syz.0.7634': attribute type 2 has an invalid length. [ 1376.498864][T28496] netlink: 'syz.0.7634': attribute type 8 has an invalid length. [ 1376.506786][T28496] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7634'. [ 1376.522281][T28502] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7634'. [ 1376.852449][T28541] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.7648'. [ 1380.484285][T28621] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1380.605262][T28612] syzkaller0: entered promiscuous mode [ 1380.611533][T28612] syzkaller0: entered allmulticast mode [ 1383.032911][T28623] C: renamed from team_slave_0 [ 1383.039919][T28623] netlink: 'syz.0.7675': attribute type 1 has an invalid length. [ 1383.050899][T28623] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7675'. [ 1383.062761][T28623] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1383.532935][T28660] netlink: 'syz.2.7688': attribute type 11 has an invalid length. [ 1383.546947][T28660] netlink: 140 bytes leftover after parsing attributes in process `syz.2.7688'. [ 1384.477054][T20782] Bluetooth: hci4: command 0x0406 tx timeout [ 1385.093882][T28691] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1385.407718][T28687] netlink: 'syz.0.7699': attribute type 2 has an invalid length. [ 1385.417580][T28687] netlink: 'syz.0.7699': attribute type 8 has an invalid length. [ 1385.425673][T28687] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7699'. [ 1385.447554][T28701] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7703'. [ 1385.481037][T28687] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7699'. [ 1385.505522][T28701] netlink: 10 bytes leftover after parsing attributes in process `syz.2.7703'. [ 1386.046268][T28719] netlink: 202920 bytes leftover after parsing attributes in process `syz.1.7708'. [ 1387.280486][T28744] netlink: 'syz.1.7719': attribute type 11 has an invalid length. [ 1387.313652][T28744] netlink: 140 bytes leftover after parsing attributes in process `syz.1.7719'. [ 1387.891821][T28768] netlink: 'syz.0.7728': attribute type 3 has an invalid length. [ 1387.908925][T28768] netlink: 152 bytes leftover after parsing attributes in process `syz.0.7728'. [ 1387.939215][T28768] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1388.258112][T28777] netlink: 'syz.0.7731': attribute type 21 has an invalid length. [ 1388.266036][T28777] IPv6: NLM_F_CREATE should be specified when creating new route [ 1388.290790][T28777] IPv6: Can't replace route, no match found [ 1388.401446][T28778] netlink: 'syz.0.7731': attribute type 10 has an invalid length. [ 1391.142848][T28784] netlink: 'syz.1.7733': attribute type 2 has an invalid length. [ 1391.152003][T28784] netlink: 'syz.1.7733': attribute type 8 has an invalid length. [ 1391.160749][T28784] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7733'. [ 1391.201910][T28784] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7733'. [ 1391.318320][T28792] veth1_to_bond: entered allmulticast mode [ 1391.596602][T28802] netlink: 'syz.0.7740': attribute type 22 has an invalid length. [ 1391.636965][T28802] netlink: 14380 bytes leftover after parsing attributes in process `syz.0.7740'. [ 1393.491699][T28848] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1393.627275][T28850] can: request_module (can-proto-0) failed. [ 1393.735252][T28858] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7756'. [ 1394.118778][T28862] netlink: 180 bytes leftover after parsing attributes in process `syz.2.7760'. [ 1394.153365][T28868] netlink: 'syz.0.7761': attribute type 10 has an invalid length. [ 1394.432514][T28874] netlink: 'syz.2.7764': attribute type 21 has an invalid length. [ 1394.447151][T28874] IPv6: NLM_F_CREATE should be specified when creating new route [ 1394.455532][T28874] IPv6: Can't replace route, no match found [ 1394.511614][T28874] netlink: 'syz.2.7764': attribute type 10 has an invalid length. [ 1394.574820][T28874] team0: Device wg1 is of different type [ 1395.503921][T28887] netlink: 'syz.1.7768': attribute type 2 has an invalid length. [ 1395.521066][T28887] netlink: 'syz.1.7768': attribute type 8 has an invalid length. [ 1395.557396][T28887] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7768'. [ 1395.641173][T28887] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7768'. [ 1397.811315][T28969] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7796'. [ 1397.974180][T28979] netlink: 'syz.3.7800': attribute type 9 has an invalid length. [ 1397.989567][T28979] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7800'. [ 1399.846152][T28980] netlink: 'syz.3.7800': attribute type 9 has an invalid length. [ 1399.878364][T28980] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7800'. [ 1400.151100][T28992] netlink: 1010 bytes leftover after parsing attributes in process `syz.0.7803'. [ 1400.180707][T28992] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 1400.523083][T29001] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.7807'. [ 1401.051899][T29007] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1401.111640][T29012] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1401.119860][T29012] IPv6: NLM_F_CREATE should be set when creating new route [ 1401.223974][T29015] netlink: 'syz.3.7812': attribute type 10 has an invalid length. [ 1401.819107][T29044] netlink: 'syz.0.7823': attribute type 2 has an invalid length. [ 1402.124131][T29058] netlink: 40227 bytes leftover after parsing attributes in process `syz.0.7830'. [ 1402.297290][T29066] netlink: 'syz.1.7831': attribute type 11 has an invalid length. [ 1402.305195][T29066] netlink: 140 bytes leftover after parsing attributes in process `syz.1.7831'. [ 1402.759096][T29082] netlink: 'syz.1.7837': attribute type 2 has an invalid length. [ 1402.847113][T29082] netlink: 'syz.1.7837': attribute type 8 has an invalid length. [ 1402.865129][T29082] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7837'. [ 1402.905769][T29085] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7837'. [ 1403.698825][T29084] bond0: (slave macvlan0): Releasing backup interface [ 1404.555633][T29108] netlink: 'syz.2.7848': attribute type 10 has an invalid length. [ 1404.585101][T29108] team0: Port device .3ãc¤± added [ 1404.902528][T29117] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1404.910513][T29117] IPv6: NLM_F_CREATE should be set when creating new route [ 1404.918535][T29117] IPv6: NLM_F_CREATE should be set when creating new route [ 1404.926359][T29117] IPv6: NLM_F_CREATE should be set when creating new route [ 1406.496961][T29149] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.7866'. [ 1406.548270][T29149] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.7866'. [ 1406.616502][T29151] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1406.624681][T29151] IPv6: NLM_F_CREATE should be set when creating new route [ 1406.633294][T29151] IPv6: NLM_F_CREATE should be set when creating new route [ 1406.641423][T29151] IPv6: NLM_F_CREATE should be set when creating new route [ 1406.758396][T29156] netlink: 'syz.0.7869': attribute type 11 has an invalid length. [ 1406.769672][T29156] netlink: 140 bytes leftover after parsing attributes in process `syz.0.7869'. [ 1407.941333][T29187] netlink: 'syz.0.7883': attribute type 2 has an invalid length. [ 1408.149447][T29187] netlink: 'syz.0.7883': attribute type 8 has an invalid length. [ 1408.160300][T29187] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7883'. [ 1408.275246][T29187] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7883'. [ 1409.014605][T29223] netlink: 'syz.3.7896': attribute type 2 has an invalid length. [ 1409.048289][T29223] netlink: 'syz.3.7896': attribute type 1 has an invalid length. [ 1409.073531][T29223] netlink: 198036 bytes leftover after parsing attributes in process `syz.3.7896'. [ 1409.540079][T29234] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1410.518132][T29249] netlink: 140 bytes leftover after parsing attributes in process `syz.1.7905'. [ 1410.540962][T29249] netlink: 10 bytes leftover after parsing attributes in process `syz.1.7905'. [ 1410.673161][T29249] bond0: (slave bond_slave_0): Releasing backup interface [ 1410.832164][T29249] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1411.295924][T29280] netlink: 'syz.1.7917': attribute type 21 has an invalid length. [ 1411.304541][T29280] netlink: 156 bytes leftover after parsing attributes in process `syz.1.7917'. [ 1411.879251][T29291] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7922'. [ 1411.930190][T29291] netlink: 10 bytes leftover after parsing attributes in process `syz.3.7922'. [ 1411.970910][T29291] bond0: (slave bond_slave_0): Releasing backup interface [ 1412.112220][T29291] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1412.213711][T29305] netlink: 14 bytes leftover after parsing attributes in process `syz.2.7928'. [ 1412.390878][T29313] netlink: 'syz.3.7930': attribute type 11 has an invalid length. [ 1412.427664][T29313] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7930'. [ 1413.211418][T29327] netlink: 'syz.2.7936': attribute type 10 has an invalid length. [ 1413.254934][T29327] bridge0: port 2(bridge_slave_1) entered disabled state [ 1413.262524][T29327] bridge0: port 1(bridge_slave_0) entered disabled state [ 1413.304113][T29327] bridge0: port 2(bridge_slave_1) entered blocking state [ 1413.311765][T29327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1413.320846][T29327] bridge0: port 1(bridge_slave_0) entered blocking state [ 1413.328232][T29327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1413.385045][T29327] team0: Port device bridge0 added [ 1413.849740][T29346] __nla_validate_parse: 1 callbacks suppressed [ 1413.849764][T29346] netlink: 140 bytes leftover after parsing attributes in process `syz.2.7939'. [ 1414.388285][T29343] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7943'. [ 1415.703892][T29366] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.7947'. [ 1415.774527][T29366] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 1416.325034][T29385] netlink: 140 bytes leftover after parsing attributes in process `syz.0.7953'. [ 1416.345512][T29385] netlink: 10 bytes leftover after parsing attributes in process `syz.0.7953'. [ 1416.558247][T29385] bond0: (slave bond_slave_0): Releasing backup interface [ 1416.662922][T29396] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.7957'. [ 1416.737637][T29385] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1417.017031][T29400] netlink: 'syz.0.7960': attribute type 10 has an invalid length. [ 1417.040066][T29400] bridge0: port 2(bridge_slave_1) entered disabled state [ 1417.047909][T29400] bridge0: port 1(bridge_slave_0) entered disabled state [ 1417.695243][T29417] netlink: 'syz.1.7973': attribute type 10 has an invalid length. [ 1417.714718][T29417] bridge0: port 2(bridge_slave_1) entered disabled state [ 1417.722706][T29417] bridge0: port 1(bridge_slave_0) entered disabled state [ 1417.799340][T29417] bridge0: port 2(bridge_slave_1) entered blocking state [ 1417.807032][T29417] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1417.815795][T29417] bridge0: port 1(bridge_slave_0) entered blocking state [ 1417.823205][T29417] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1417.921431][T29417] team0: Port device bridge0 added [ 1418.229184][T29418] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.7965'. [ 1418.388479][T29418] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 1418.434346][T29418] CPU: 1 PID: 29418 Comm: syz.3.7965 Not tainted syzkaller #0 [ 1418.441921][T29418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1418.452038][T29418] Call Trace: [ 1418.455367][T29418] [ 1418.458355][T29418] dump_stack_lvl+0x18c/0x250 [ 1418.463103][T29418] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1418.469343][T29418] ? show_regs_print_info+0x20/0x20 [ 1418.474601][T29418] ? _printk+0x11d/0x130 [ 1418.478913][T29418] sysfs_warn_dup+0x8e/0xa0 [ 1418.483477][T29418] sysfs_do_create_link_sd+0xc0/0x110 [ 1418.488962][T29418] device_add_class_symlinks+0x1cf/0x240 [ 1418.494712][T29418] device_add+0x4f9/0xc40 [ 1418.499103][T29418] wiphy_register+0x1d99/0x2ac0 [ 1418.504175][T29418] ? cfg80211_event_work+0x40/0x40 [ 1418.509346][T29418] ? minstrel_ht_alloc+0x88a/0x990 [ 1418.514638][T29418] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1418.520799][T29418] ieee80211_register_hw+0x2dd8/0x3b30 [ 1418.526352][T29418] ? ieee80211_register_hw+0xfb1/0x3b30 [ 1418.531944][T29418] ? ieee80211_tasklet_handler+0x20/0x20 [ 1418.537619][T29418] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1418.543629][T29418] ? __debug_object_init+0xec/0x450 [ 1418.548880][T29418] ? __asan_memset+0x22/0x40 [ 1418.553510][T29418] ? __hrtimer_init+0x189/0x270 [ 1418.558416][T29418] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 1418.564222][T29418] ? mac80211_hwsim_free+0x220/0x220 [ 1418.569538][T29418] ? rcu_is_watching+0x15/0xb0 [ 1418.574336][T29418] ? kstrndup+0xbd/0x140 [ 1418.578632][T29418] hwsim_new_radio_nl+0xdad/0x1a70 [ 1418.583872][T29418] ? __nla_validate+0x50/0x50 [ 1418.588604][T29418] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1418.595020][T29418] ? __nla_parse+0x40/0x50 [ 1418.599491][T29418] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1418.605858][T29418] genl_family_rcv_msg_doit+0x21a/0x310 [ 1418.611453][T29418] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1418.617399][T29418] ? bpf_lsm_capable+0x9/0x10 [ 1418.622113][T29418] ? security_capable+0x89/0xb0 [ 1418.627004][T29418] genl_rcv_msg+0x611/0x7a0 [ 1418.631547][T29418] ? genl_bind+0x360/0x360 [ 1418.636015][T29418] ? perf_trace_lock+0xfc/0x3b0 [ 1418.640902][T29418] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1418.647268][T29418] ? perf_trace_lock+0xfc/0x3b0 [ 1418.652164][T29418] netlink_rcv_skb+0x235/0x4c0 [ 1418.656963][T29418] ? genl_bind+0x360/0x360 [ 1418.661411][T29418] ? netlink_ack+0x1160/0x1160 [ 1418.666253][T29418] ? __lock_acquire+0x7d80/0x7d80 [ 1418.671315][T29418] ? net_generic+0x1e/0x240 [ 1418.675968][T29418] ? down_read+0x1ac/0x2e0 [ 1418.680458][T29418] genl_rcv+0x28/0x40 [ 1418.684494][T29418] netlink_unicast+0x7b1/0x930 [ 1418.689401][T29418] netlink_sendmsg+0x8d0/0xbf0 [ 1418.694203][T29418] ? netlink_getsockopt+0x590/0x590 [ 1418.699437][T29418] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1418.705018][T29418] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1418.710361][T29418] ? security_socket_sendmsg+0x80/0xa0 [ 1418.715856][T29418] ? netlink_getsockopt+0x590/0x590 [ 1418.721091][T29418] ____sys_sendmsg+0x61b/0x980 [ 1418.725898][T29418] ? __asan_memset+0x22/0x40 [ 1418.730554][T29418] ? __sys_sendmsg_sock+0x30/0x30 [ 1418.735610][T29418] ? __import_iovec+0x5f2/0x850 [ 1418.740508][T29418] ? import_iovec+0x73/0xa0 [ 1418.745056][T29418] ___sys_sendmsg+0x2a6/0x360 [ 1418.749798][T29418] ? __sys_sendmsg+0x2b0/0x2b0 [ 1418.754615][T29418] ? ktime_get+0x7f/0x280 [ 1418.759004][T29418] __se_sys_sendmsg+0x1d0/0x2c0 [ 1418.763882][T29418] ? perf_trace_preemptirq_template+0x269/0x330 [ 1418.770165][T29418] ? __x64_sys_sendmsg+0x80/0x80 [ 1418.775145][T29418] ? lockdep_hardirqs_on+0x98/0x150 [ 1418.780390][T29418] do_syscall_64+0x55/0xb0 [ 1418.784839][T29418] ? clear_bhb_loop+0x40/0x90 [ 1418.789548][T29418] ? clear_bhb_loop+0x40/0x90 [ 1418.794263][T29418] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1418.800187][T29418] RIP: 0033:0x7f34b619e0d9 [ 1418.804624][T29418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1418.824778][T29418] RSP: 002b:00007f34b712a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1418.833229][T29418] RAX: ffffffffffffffda RBX: 00007f34b6425fa0 RCX: 00007f34b619e0d9 [ 1418.841232][T29418] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000c [ 1418.849411][T29418] RBP: 00007f34b6235024 R08: 0000000000000000 R09: 0000000000000000 [ 1418.857418][T29418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1418.865419][T29418] R13: 00007f34b6426038 R14: 00007f34b6425fa0 R15: 00007fff4c8be448 [ 1418.873535][T29418] [ 1419.849061][T29448] netlink: 'syz.2.7977': attribute type 10 has an invalid length. [ 1419.868283][T29448] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7977'. [ 1419.941173][T29448] batman_adv: batadv0: Adding interface: virt_wifi0 [ 1419.957908][T29448] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1420.031097][T29448] batman_adv: batadv0: Interface activated: virt_wifi0 [ 1420.642930][T29472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1420.779966][T29467] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.7982'. [ 1420.865448][T29467] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 1421.153572][T29489] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7995'. [ 1421.178141][T29489] netlink: 'syz.3.7995': attribute type 1 has an invalid length. [ 1421.191311][T29489] netlink: 6 bytes leftover after parsing attributes in process `syz.3.7995'. [ 1421.469683][T29505] netlink: 'syz.1.7998': attribute type 10 has an invalid length. [ 1421.487093][T29503] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1421.512058][T29505] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7998'. [ 1421.540850][T29505] bridge0: port 3(bond0) entered blocking state [ 1421.587203][T29505] bridge0: port 3(bond0) entered disabled state [ 1421.593764][T29505] bond0: entered allmulticast mode [ 1421.612432][T29505] bond_slave_1: entered allmulticast mode [ 1421.624566][T29505] bond0: entered promiscuous mode [ 1421.630654][T29505] bond_slave_1: entered promiscuous mode [ 1421.660713][T29505] bridge0: port 3(bond0) entered blocking state [ 1421.667231][T29505] bridge0: port 3(bond0) entered forwarding state [ 1421.737899][T29513] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.8004'. [ 1422.096158][T29513] netlink: 128 bytes leftover after parsing attributes in process `syz.2.8004'. [ 1422.155957][T29513] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1422.408558][T29527] netlink: 'syz.3.8009': attribute type 11 has an invalid length. [ 1422.427296][T29527] netlink: 140 bytes leftover after parsing attributes in process `syz.3.8009'. [ 1423.285197][T29551] : renamed from veth1 (while UP) [ 1423.445662][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.457374][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.850699][T29561] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1424.244657][T29582] netlink: 'syz.2.8032': attribute type 11 has an invalid length. [ 1424.259075][T29585] netlink: 'syz.1.8029': attribute type 21 has an invalid length. [ 1424.268932][T29582] netlink: 'syz.2.8032': attribute type 1 has an invalid length. [ 1424.276754][T29582] netlink: 198112 bytes leftover after parsing attributes in process `syz.2.8032'. [ 1425.408637][T29600] netlink: 'syz.0.8038': attribute type 21 has an invalid length. [ 1427.068695][T29589] netlink: 'syz.2.8034': attribute type 2 has an invalid length. [ 1427.087245][T29589] netlink: 'syz.2.8034': attribute type 8 has an invalid length. [ 1427.095495][T29589] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8034'. [ 1427.107138][T29602] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8034'. [ 1427.368816][T29614] netlink: 'syz.0.8043': attribute type 11 has an invalid length. [ 1427.376696][T29614] netlink: 140 bytes leftover after parsing attributes in process `syz.0.8043'. [ 1430.412820][T29642] syzkaller0: entered promiscuous mode [ 1430.418549][T29642] syzkaller0: entered allmulticast mode [ 1430.557173][T20782] Bluetooth: hci0: command 0x0406 tx timeout [ 1431.482348][T29655] sit0: entered allmulticast mode [ 1431.515664][T29656] sit0: entered promiscuous mode [ 1434.785065][T29675] netlink: 21 bytes leftover after parsing attributes in process `syz.1.8062'. [ 1434.817135][T29675] ksmbd: Unknown IPC event: 0, ignore. [ 1435.459554][T29704] netlink: 'syz.2.8073': attribute type 11 has an invalid length. [ 1435.472096][T29704] netlink: 140 bytes leftover after parsing attributes in process `syz.2.8073'. [ 1435.877946][T29714] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1438.456463][T29779] netlink: 'syz.3.8101': attribute type 11 has an invalid length. [ 1438.475001][T29779] netlink: 140 bytes leftover after parsing attributes in process `syz.3.8101'. [ 1438.595403][T29783] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.8102'. [ 1438.857479][T29791] netlink: 'syz.1.8105': attribute type 2 has an invalid length. [ 1438.887614][T29791] netlink: 'syz.1.8105': attribute type 8 has an invalid length. [ 1438.895632][T29791] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8105'. [ 1438.959581][T29791] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8105'. [ 1439.093010][T29802] netlink: 'syz.0.8107': attribute type 27 has an invalid length. [ 1439.159314][T29802] netlink: 2418 bytes leftover after parsing attributes in process `syz.0.8107'. [ 1439.211643][T29800] delete_channel: no stack [ 1440.643460][T29840] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8124'. [ 1440.658861][T29840] : renamed from caif0 [ 1440.684381][T29840] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 1441.399707][T29863] netlink: 'syz.1.8134': attribute type 11 has an invalid length. [ 1441.438844][T29863] netlink: 140 bytes leftover after parsing attributes in process `syz.1.8134'. [ 1442.083187][T29889] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1442.108454][T29882] netlink: 'syz.2.8142': attribute type 2 has an invalid length. [ 1442.116307][T29882] netlink: 'syz.2.8142': attribute type 8 has an invalid length. [ 1442.157377][T29882] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8142'. [ 1442.211305][T29893] netlink: 'syz.3.8146': attribute type 3 has an invalid length. [ 1442.219550][T29886] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8142'. [ 1442.235965][T29893] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.8146'. [ 1442.608805][T29910] sit0: entered allmulticast mode [ 1442.676201][T29912] netlink: 'syz.1.8153': attribute type 27 has an invalid length. [ 1442.688393][T29911] sit0: entered promiscuous mode [ 1442.707388][T29912] netlink: 2418 bytes leftover after parsing attributes in process `syz.1.8153'. [ 1442.751878][T29909] delete_channel: no stack [ 1445.282531][T29963] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8171'. [ 1445.292836][T29963] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8171'. [ 1445.317480][T29963] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8171'. [ 1445.349934][T29963] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8171'. [ 1445.423905][T29957] netlink: 'syz.3.8170': attribute type 2 has an invalid length. [ 1445.434348][T29957] netlink: 'syz.3.8170': attribute type 8 has an invalid length. [ 1445.716046][T29972] tap0: tun_chr_ioctl cmd 1074025677 [ 1445.721836][T29972] tap0: linktype set to 780 [ 1446.200911][T29997] netlink: 'syz.0.8186': attribute type 11 has an invalid length. [ 1446.217095][T29997] __nla_validate_parse: 2 callbacks suppressed [ 1446.217115][T29997] netlink: 140 bytes leftover after parsing attributes in process `syz.0.8186'. [ 1447.083484][T30019] netlink: 'syz.2.8194': attribute type 11 has an invalid length. [ 1447.091913][T30019] netlink: 'syz.2.8194': attribute type 1 has an invalid length. [ 1447.108453][T30019] netlink: 'syz.2.8194': attribute type 1 has an invalid length. [ 1447.121907][T30019] netlink: 'syz.2.8194': attribute type 2 has an invalid length. [ 1447.131747][T30019] netlink: 198100 bytes leftover after parsing attributes in process `syz.2.8194'. [ 1448.356008][T30032] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1449.221492][T30040] netlink: 'syz.3.8202': attribute type 2 has an invalid length. [ 1449.234445][T30040] netlink: 'syz.3.8202': attribute type 8 has an invalid length. [ 1449.247316][T30040] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8202'. [ 1449.295364][T30040] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8202'. [ 1449.787719][T30065] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8212'. [ 1450.793693][T30099] netlink: 'syz.2.8224': attribute type 3 has an invalid length. [ 1450.813074][T30099] netlink: 'syz.2.8224': attribute type 1 has an invalid length. [ 1450.828888][T30099] netlink: 181400 bytes leftover after parsing attributes in process `syz.2.8224'. [ 1454.188848][T30133] netlink: 'syz.0.8236': attribute type 2 has an invalid length. [ 1454.217029][T30133] netlink: 'syz.0.8236': attribute type 8 has an invalid length. [ 1454.225322][T30133] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8236'. [ 1454.314455][T30138] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8236'. [ 1458.447439][T30164] netlink: 188 bytes leftover after parsing attributes in process `syz.3.8246'. [ 1458.749275][T30171] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.8250'. [ 1461.345597][T30211] netlink: 'syz.0.8265': attribute type 22 has an invalid length. [ 1461.376933][T30211] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8265'. [ 1461.402738][T30216] netlink: 'syz.0.8265': attribute type 10 has an invalid length. [ 1461.416745][T30216] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8265'. [ 1461.445854][T30216] netlink: 'syz.0.8265': attribute type 10 has an invalid length. [ 1461.459217][T30216] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8265'. [ 1461.500164][T30222] netlink: 18187 bytes leftover after parsing attributes in process `syz.3.8269'. [ 1461.828509][T30225] netlink: 128 bytes leftover after parsing attributes in process `syz.2.8267'. [ 1461.837891][T30225] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1462.749270][T30252] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.8279'. [ 1462.766070][T30254] netlink: 'syz.3.8281': attribute type 22 has an invalid length. [ 1462.779081][T30254] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8281'. [ 1462.804978][T30252] netlink: 8442 bytes leftover after parsing attributes in process `syz.2.8279'. [ 1462.824665][T30251] netlink: 'syz.1.8280': attribute type 11 has an invalid length. [ 1462.850040][T30251] netlink: 140 bytes leftover after parsing attributes in process `syz.1.8280'. [ 1462.870047][T30254] netlink: 'syz.3.8281': attribute type 10 has an invalid length. [ 1462.882999][T30254] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8281'. [ 1462.892753][T30254] netlink: 'syz.3.8281': attribute type 10 has an invalid length. [ 1463.355472][T30271] netlink: 'syz.3.8289': attribute type 10 has an invalid length. [ 1463.401396][T30269] netlink: 'syz.0.8288': attribute type 21 has an invalid length. [ 1463.574625][T30275] netlink: 'syz.0.8291': attribute type 21 has an invalid length. [ 1464.024723][T30291] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1466.558761][T30345] __nla_validate_parse: 7 callbacks suppressed [ 1466.558784][T30345] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.8318'. [ 1466.604741][T30345] validate_nla: 5 callbacks suppressed [ 1466.604863][T30345] netlink: 'syz.3.8318': attribute type 21 has an invalid length. [ 1466.735984][T30355] netlink: 'syz.1.8322': attribute type 11 has an invalid length. [ 1466.755163][T30355] netlink: 140 bytes leftover after parsing attributes in process `syz.1.8322'. [ 1467.112983][T30370] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1467.129140][T30368] netlink: 'syz.1.8329': attribute type 6 has an invalid length. [ 1467.144241][T30368] netlink: 164 bytes leftover after parsing attributes in process `syz.1.8329'. [ 1468.309051][T30401] netlink: 'syz.3.8343': attribute type 1 has an invalid length. [ 1468.324182][T30402] netlink: 'syz.3.8343': attribute type 1 has an invalid length. [ 1468.393297][T30402] netlink: 146340 bytes leftover after parsing attributes in process `syz.3.8343'. [ 1468.412292][T30401] netlink: 146340 bytes leftover after parsing attributes in process `syz.3.8343'. [ 1469.251728][T30442] netlink: 'syz.0.8359': attribute type 11 has an invalid length. [ 1469.269260][T30442] netlink: 140 bytes leftover after parsing attributes in process `syz.0.8359'. [ 1469.495072][T30446] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.8361'. [ 1469.538681][T30446] openvswitch: netlink: Tunnel attr 0 has unexpected len 145 expected 8 [ 1469.896879][T30463] netlink: 3076 bytes leftover after parsing attributes in process `syz.3.8367'. [ 1469.934837][T30463] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.8367'. [ 1469.951831][T30462] netlink: 35840 bytes leftover after parsing attributes in process `syz.2.8368'. [ 1470.283908][T30472] netlink: 'syz.0.8372': attribute type 10 has an invalid length. [ 1470.680371][T30477] netlink: 'syz.0.8372': attribute type 10 has an invalid length. [ 1470.700294][T30477] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1470.933847][T30481] openvswitch: netlink: Tunnel attr 0 has unexpected len 145 expected 8 [ 1471.877688][T30505] __nla_validate_parse: 1 callbacks suppressed [ 1471.877712][T30505] netlink: 830 bytes leftover after parsing attributes in process `syz.3.8382'. [ 1472.189779][T30524] netlink: 'syz.0.8390': attribute type 5 has an invalid length. [ 1472.229269][T30524] netlink: 'syz.0.8390': attribute type 1 has an invalid length. [ 1472.267078][T30524] netlink: 199820 bytes leftover after parsing attributes in process `syz.0.8390'. [ 1472.271826][T30529] netlink: 'syz.0.8390': attribute type 10 has an invalid length. [ 1472.303907][T30529] netlink: 212412 bytes leftover after parsing attributes in process `syz.0.8390'. [ 1472.313885][T30526] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.8389'. [ 1472.315510][T30529] openvswitch: netlink: Flow key attr not present in new flow. [ 1472.359531][T30526] openvswitch: netlink: Tunnel attr 0 has unexpected len 145 expected 8 [ 1472.885957][T30547] netlink: 'syz.3.8399': attribute type 10 has an invalid length. [ 1473.004537][T30541] netlink: 'syz.2.8396': attribute type 10 has an invalid length. [ 1473.037890][T30541] netlink: 55 bytes leftover after parsing attributes in process `syz.2.8396'. [ 1473.238432][T30544] netlink: 830 bytes leftover after parsing attributes in process `syz.1.8398'. [ 1474.058537][T30568] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.8406'. [ 1474.071122][T30568] openvswitch: netlink: Tunnel attr 0 has unexpected len 145 expected 8 [ 1474.193715][T30570] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.8407'. [ 1474.708044][T30585] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1475.285210][T30590] netlink: 830 bytes leftover after parsing attributes in process `syz.0.8414'. [ 1477.179044][T30639] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.8433'. [ 1481.760157][T20782] Bluetooth: hci3: command 0x0406 tx timeout [ 1482.564926][T30714] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8462'. [ 1484.800458][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.807276][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1487.419289][T30714] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8462'. [ 1488.236370][T30775] netlink: 'syz.2.8486': attribute type 29 has an invalid length. [ 1488.262571][T30775] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8486'. [ 1488.286373][T30775] netlink: 'syz.2.8486': attribute type 29 has an invalid length. [ 1488.305247][T30775] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8486'. [ 1488.658467][T27100] Bluetooth: hci4: ACL packet for unknown connection handle 0 [ 1488.742049][T30798] netlink: 'syz.1.8499': attribute type 29 has an invalid length. [ 1488.750458][T30798] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8499'. [ 1488.760074][T30798] netlink: 'syz.1.8499': attribute type 29 has an invalid length. [ 1488.769436][T30798] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8499'. [ 1488.997852][T30806] netlink: 'syz.2.8498': attribute type 10 has an invalid length. [ 1489.005913][T30806] netlink: 65015 bytes leftover after parsing attributes in process `syz.2.8498'. [ 1489.067539][T27100] Bluetooth: hci0: unexpected subevent 0x01 length: 150 > 18 [ 1489.096229][T20782] Bluetooth: Frame is too long (len 149, expected len 4) [ 1489.428434][T30822] syzkaller0: entered promiscuous mode [ 1489.434004][T30822] syzkaller0: entered allmulticast mode [ 1489.869129][T30833] netlink: 'syz.3.8509': attribute type 29 has an invalid length. [ 1489.877596][T30833] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8509'. [ 1489.887458][T30833] netlink: 'syz.3.8509': attribute type 29 has an invalid length. [ 1489.895888][T30833] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8509'. [ 1491.117129][T20782] Bluetooth: hci0: command 0x0406 tx timeout [ 1495.425206][T30903] ================================================================== [ 1495.433426][T30903] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6c7/0x900 [ 1495.441308][T30903] Write of size 48 at addr ffff888030afd210 by task syz.0.8537/30903 [ 1495.449429][T30903] [ 1495.451797][T30903] CPU: 1 PID: 30903 Comm: syz.0.8537 Not tainted syzkaller #0 [ 1495.459296][T30903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1495.469384][T30903] Call Trace: [ 1495.472685][T30903] [ 1495.475628][T30903] dump_stack_lvl+0x18c/0x250 [ 1495.480337][T30903] ? read_lock_is_recursive+0x20/0x20 [ 1495.485740][T30903] ? show_regs_print_info+0x20/0x20 [ 1495.490963][T30903] ? load_image+0x420/0x420 [ 1495.495512][T30903] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 1495.501024][T30903] ? __virt_addr_valid+0x10c/0x380 [ 1495.506157][T30903] ? __virt_addr_valid+0x10c/0x380 [ 1495.511292][T30903] ? __virt_addr_valid+0x10c/0x380 [ 1495.516428][T30903] print_report+0xa8/0x210 [ 1495.520859][T30903] ? __bpf_get_stackid+0x6c7/0x900 [ 1495.525990][T30903] kasan_report+0x117/0x150 [ 1495.530517][T30903] ? __bpf_get_stackid+0x6c7/0x900 [ 1495.535676][T30903] kasan_check_range+0x241/0x290 [ 1495.540675][T30903] ? __bpf_get_stackid+0x6c7/0x900 [ 1495.545841][T30903] __asan_memcpy+0x40/0x70 [ 1495.550303][T30903] __bpf_get_stackid+0x6c7/0x900 [ 1495.555282][T30903] bpf_get_stackid_pe+0x343/0x410 [ 1495.560355][T30903] bpf_prog_282a5593b1ef8d13+0x29/0x3e [ 1495.565848][T30903] bpf_overflow_handler+0x1fc/0x510 [ 1495.571089][T30903] ? bpf_overflow_handler+0xde/0x510 [ 1495.576452][T30903] ? tp_perf_event_destroy+0x20/0x20 [ 1495.581779][T30903] ? __perf_event_account_interrupt+0x187/0x280 [ 1495.588069][T30903] __perf_event_overflow+0x461/0x660 [ 1495.593386][T30903] perf_swevent_event+0x319/0x570 [ 1495.598438][T30903] ? perf_tp_event+0x1550/0x1550 [ 1495.603426][T30903] ? __lock_acquire+0x1336/0x7d80 [ 1495.608480][T30903] ___perf_sw_event+0x4ab/0x730 [ 1495.613409][T30903] ? ___perf_sw_event+0x19e/0x730 [ 1495.618469][T30903] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 1495.624927][T30903] ? __lock_acquire+0x1336/0x7d80 [ 1495.629973][T30903] ? __put_user_4+0x11/0x20 [ 1495.634504][T30903] ? perf_unpin_context+0x70/0x70 [ 1495.639549][T30903] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1495.645548][T30903] ? lock_chain_count+0x20/0x20 [ 1495.650462][T30903] __perf_sw_event+0x139/0x270 [ 1495.655269][T30903] do_user_addr_fault+0x1242/0x12d0 [ 1495.660497][T30903] ? rcu_is_watching+0x15/0xb0 [ 1495.665287][T30903] exc_page_fault+0x64/0x100 [ 1495.669903][T30903] asm_exc_page_fault+0x26/0x30 [ 1495.674773][T30903] RIP: 0010:__put_user_4+0x11/0x20 [ 1495.679910][T30903] Code: 01 ca c3 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 90 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb [ 1495.699746][T30903] RSP: 0018:ffffc900031e7c58 EFLAGS: 00050246 [ 1495.705863][T30903] RAX: 0000000000000285 RBX: 0000000000000000 RCX: 0000000000000000 [ 1495.713880][T30903] RDX: 0000000000000000 RSI: ffffffff8acadd60 RDI: ffffffff8b1d0ca0 [ 1495.721920][T30903] RBP: ffffc900031e7d90 R08: ffffffff8e8c7aef R09: 1ffffffff1d18f5d [ 1495.729934][T30903] R10: dffffc0000000000 R11: fffffbfff1d18f5e R12: 1ffff9200063cf94 [ 1495.738018][T30903] R13: dffffc0000000000 R14: 0000000000126400 R15: 0000000000000285 [ 1495.746037][T30903] kernel_clone+0x36c/0x8a0 [ 1495.750664][T30903] ? create_io_thread+0x190/0x190 [ 1495.755741][T30903] ? do_futex+0x2ff/0x3e0 [ 1495.760100][T30903] __x64_sys_clone+0x1b7/0x230 [ 1495.764969][T30903] ? __ia32_sys_vfork+0x140/0x140 [ 1495.770039][T30903] ? lock_chain_count+0x20/0x20 [ 1495.774916][T30903] ? lockdep_hardirqs_on+0x98/0x150 [ 1495.780140][T30903] do_syscall_64+0x55/0xb0 [ 1495.784573][T30903] ? clear_bhb_loop+0x40/0x90 [ 1495.789266][T30903] ? clear_bhb_loop+0x40/0x90 [ 1495.793979][T30903] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1495.799916][T30903] RIP: 0033:0x7ff0ad39e0d9 [ 1495.804363][T30903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1495.823983][T30903] RSP: 002b:00007ff0ae2bffd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1495.832424][T30903] RAX: ffffffffffffffda RBX: 00007ff0ad625fa0 RCX: 00007ff0ad39e0d9 [ 1495.840410][T30903] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000126400 [ 1495.848411][T30903] RBP: 00007ff0ad435024 R08: 0000000000000000 R09: 0000000000000000 [ 1495.856425][T30903] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1495.864432][T30903] R13: 00007ff0ad626038 R14: 00007ff0ad625fa0 R15: 00007ffc2132afc8 [ 1495.872422][T30903] [ 1495.875450][T30903] [ 1495.877776][T30903] Allocated by task 30903: [ 1495.882237][T30903] kasan_set_track+0x4e/0x70 [ 1495.886877][T30903] __kasan_kmalloc+0x8f/0xa0 [ 1495.891507][T30903] __kmalloc_node+0xb6/0x240 [ 1495.896120][T30903] bpf_map_area_alloc+0x5e/0x110 [ 1495.901079][T30903] prealloc_elems_and_freelist+0x86/0x1c0 [ 1495.906833][T30903] stack_map_alloc+0x32b/0x4b0 [ 1495.911671][T30903] map_create+0x877/0x12f0 [ 1495.916150][T30903] __sys_bpf+0x651/0x890 [ 1495.920404][T30903] __x64_sys_bpf+0x7c/0x90 [ 1495.924921][T30903] do_syscall_64+0x55/0xb0 [ 1495.929368][T30903] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1495.935284][T30903] [ 1495.937621][T30903] Last potentially related work creation: [ 1495.943361][T30903] kasan_save_stack+0x3e/0x60 [ 1495.948119][T30903] __kasan_record_aux_stack+0xaf/0xc0 [ 1495.953532][T30903] call_rcu+0x153/0x900 [ 1495.957714][T30903] __nf_register_net_hook+0x787/0x910 [ 1495.963210][T30903] nf_register_net_hook+0xb2/0x190 [ 1495.968346][T30903] nf_register_net_hooks+0x44/0x1b0 [ 1495.973573][T30903] ebt_register_table+0xd12/0x10e0 [ 1495.978846][T30903] find_inlist_lock_noload+0x16a/0x250 [ 1495.984358][T30903] do_ebt_get_ctl+0x2d6/0x1d30 [ 1495.989173][T30903] nf_getsockopt+0x262/0x280 [ 1495.993954][T30903] ip_getsockopt+0x19f/0x230 [ 1495.998563][T30903] do_sock_getsockopt+0x379/0x450 [ 1496.003615][T30903] __x64_sys_getsockopt+0x1d6/0x280 [ 1496.008825][T30903] do_syscall_64+0x55/0xb0 [ 1496.013254][T30903] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1496.019174][T30903] [ 1496.021519][T30903] The buggy address belongs to the object at ffff888030afd200 [ 1496.021519][T30903] which belongs to the cache kmalloc-cg-64 of size 64 [ 1496.035866][T30903] The buggy address is located 16 bytes inside of [ 1496.035866][T30903] allocated 40-byte region [ffff888030afd200, ffff888030afd228) [ 1496.049891][T30903] [ 1496.052224][T30903] The buggy address belongs to the physical page: [ 1496.058711][T30903] page:ffffea0000c2bf40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x30afd [ 1496.068872][T30903] memcg:ffff88807e48ee01 [ 1496.073137][T30903] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 1496.080695][T30903] page_type: 0xffffffff() [ 1496.085050][T30903] raw: 00fff00000000800 ffff888017c4da00 ffffea0000cea440 dead000000000002 [ 1496.093673][T30903] raw: 0000000000000000 0000000080200020 00000001ffffffff ffff88807e48ee01 [ 1496.102292][T30903] page dumped because: kasan: bad access detected [ 1496.108724][T30903] page_owner tracks the page as allocated [ 1496.114470][T30903] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 12525, tgid 12525 (syz-executor), ts 717889905373, free_ts 717815423708 [ 1496.133063][T30903] post_alloc_hook+0x1c1/0x200 [ 1496.137854][T30903] get_page_from_freelist+0x2181/0x22a0 [ 1496.143424][T30903] __alloc_pages+0x1f0/0x460 [ 1496.148069][T30903] alloc_slab_page+0x5d/0x180 [ 1496.152756][T30903] new_slab+0x87/0x2d0 [ 1496.156849][T30903] ___slab_alloc+0xc5c/0x12f0 [ 1496.161581][T30903] __kmem_cache_alloc_node+0x11f/0x250 [ 1496.167079][T30903] kmalloc_trace+0x2a/0xe0 [ 1496.171528][T30903] alloc_fdtable+0xca/0x2c0 [ 1496.176048][T30903] dup_fd+0x747/0xa20 [ 1496.180055][T30903] copy_files+0xaf/0x110 [ 1496.184311][T30903] copy_process+0x157d/0x3da0 [ 1496.189009][T30903] kernel_clone+0x24b/0x8a0 [ 1496.193525][T30903] __x64_sys_clone+0x1b7/0x230 [ 1496.198323][T30903] do_syscall_64+0x55/0xb0 [ 1496.202765][T30903] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1496.208678][T30903] page last free stack trace: [ 1496.213354][T30903] free_unref_page_prepare+0x7d7/0x8f0 [ 1496.218855][T30903] free_unref_page+0x32/0x2e0 [ 1496.223543][T30903] tlb_finish_mmu+0x13e/0x220 [ 1496.228237][T30903] exit_mmap+0x428/0xb90 [ 1496.232498][T30903] __mmput+0x118/0x3a0 [ 1496.236593][T30903] exit_mm+0x23f/0x340 [ 1496.240693][T30903] do_exit+0x909/0x2530 [ 1496.244874][T30903] do_group_exit+0x22d/0x2f0 [ 1496.249513][T30903] __x64_sys_exit_group+0x3f/0x40 [ 1496.254598][T30903] do_syscall_64+0x55/0xb0 [ 1496.259062][T30903] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1496.264985][T30903] [ 1496.267331][T30903] Memory state around the buggy address: [ 1496.272997][T30903] ffff888030afd100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1496.281079][T30903] ffff888030afd180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1496.289169][T30903] >ffff888030afd200: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 1496.297291][T30903] ^ [ 1496.302697][T30903] ffff888030afd280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1496.310794][T30903] ffff888030afd300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1496.318869][T30903] ================================================================== [ 1496.326976][T30903] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1496.334203][T30903] CPU: 1 PID: 30903 Comm: syz.0.8537 Not tainted syzkaller #0 [ 1496.341709][T30903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1496.351817][T30903] Call Trace: [ 1496.355124][T30903] [ 1496.358077][T30903] dump_stack_lvl+0x18c/0x250 [ 1496.362812][T30903] ? show_regs_print_info+0x20/0x20 [ 1496.368140][T30903] ? load_image+0x420/0x420 [ 1496.372814][T30903] panic+0x2ca/0x720 [ 1496.376783][T30903] ? __lock_acquire+0x7d80/0x7d80 [ 1496.381897][T30903] ? bpf_jit_dump+0xd0/0xd0 [ 1496.386453][T30903] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1496.392376][T30903] ? _raw_spin_unlock+0x40/0x40 [ 1496.397259][T30903] ? __bpf_get_stackid+0x6c7/0x900 [ 1496.402402][T30903] check_panic_on_warn+0x84/0xa0 [ 1496.407369][T30903] ? __bpf_get_stackid+0x6c7/0x900 [ 1496.412513][T30903] end_report+0x6f/0x130 [ 1496.416825][T30903] kasan_report+0x128/0x150 [ 1496.421359][T30903] ? __bpf_get_stackid+0x6c7/0x900 [ 1496.426592][T30903] kasan_check_range+0x241/0x290 [ 1496.431603][T30903] ? __bpf_get_stackid+0x6c7/0x900 [ 1496.436742][T30903] __asan_memcpy+0x40/0x70 [ 1496.441234][T30903] __bpf_get_stackid+0x6c7/0x900 [ 1496.446213][T30903] bpf_get_stackid_pe+0x343/0x410 [ 1496.451289][T30903] bpf_prog_282a5593b1ef8d13+0x29/0x3e [ 1496.456779][T30903] bpf_overflow_handler+0x1fc/0x510 [ 1496.462072][T30903] ? bpf_overflow_handler+0xde/0x510 [ 1496.467410][T30903] ? tp_perf_event_destroy+0x20/0x20 [ 1496.472740][T30903] ? __perf_event_account_interrupt+0x187/0x280 [ 1496.479030][T30903] __perf_event_overflow+0x461/0x660 [ 1496.484372][T30903] perf_swevent_event+0x319/0x570 [ 1496.489447][T30903] ? perf_tp_event+0x1550/0x1550 [ 1496.494422][T30903] ? __lock_acquire+0x1336/0x7d80 [ 1496.499492][T30903] ___perf_sw_event+0x4ab/0x730 [ 1496.504387][T30903] ? ___perf_sw_event+0x19e/0x730 [ 1496.509437][T30903] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 1496.515872][T30903] ? __lock_acquire+0x1336/0x7d80 [ 1496.520929][T30903] ? __put_user_4+0x11/0x20 [ 1496.525484][T30903] ? perf_unpin_context+0x70/0x70 [ 1496.530544][T30903] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1496.536598][T30903] ? lock_chain_count+0x20/0x20 [ 1496.541479][T30903] __perf_sw_event+0x139/0x270 [ 1496.546286][T30903] do_user_addr_fault+0x1242/0x12d0 [ 1496.551561][T30903] ? rcu_is_watching+0x15/0xb0 [ 1496.556366][T30903] exc_page_fault+0x64/0x100 [ 1496.561039][T30903] asm_exc_page_fault+0x26/0x30 [ 1496.565943][T30903] RIP: 0010:__put_user_4+0x11/0x20 [ 1496.571092][T30903] Code: 01 ca c3 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 90 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb [ 1496.590727][T30903] RSP: 0018:ffffc900031e7c58 EFLAGS: 00050246 [ 1496.596820][T30903] RAX: 0000000000000285 RBX: 0000000000000000 RCX: 0000000000000000 [ 1496.604835][T30903] RDX: 0000000000000000 RSI: ffffffff8acadd60 RDI: ffffffff8b1d0ca0 [ 1496.612863][T30903] RBP: ffffc900031e7d90 R08: ffffffff8e8c7aef R09: 1ffffffff1d18f5d [ 1496.620865][T30903] R10: dffffc0000000000 R11: fffffbfff1d18f5e R12: 1ffff9200063cf94 [ 1496.628874][T30903] R13: dffffc0000000000 R14: 0000000000126400 R15: 0000000000000285 [ 1496.636899][T30903] kernel_clone+0x36c/0x8a0 [ 1496.641469][T30903] ? create_io_thread+0x190/0x190 [ 1496.646532][T30903] ? do_futex+0x2ff/0x3e0 [ 1496.650878][T30903] __x64_sys_clone+0x1b7/0x230 [ 1496.655664][T30903] ? __ia32_sys_vfork+0x140/0x140 [ 1496.660732][T30903] ? lock_chain_count+0x20/0x20 [ 1496.665739][T30903] ? lockdep_hardirqs_on+0x98/0x150 [ 1496.670989][T30903] do_syscall_64+0x55/0xb0 [ 1496.675436][T30903] ? clear_bhb_loop+0x40/0x90 [ 1496.680174][T30903] ? clear_bhb_loop+0x40/0x90 [ 1496.684917][T30903] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1496.690853][T30903] RIP: 0033:0x7ff0ad39e0d9 [ 1496.695316][T30903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1496.714938][T30903] RSP: 002b:00007ff0ae2bffd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1496.723367][T30903] RAX: ffffffffffffffda RBX: 00007ff0ad625fa0 RCX: 00007ff0ad39e0d9 [ 1496.731363][T30903] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000126400 [ 1496.739371][T30903] RBP: 00007ff0ad435024 R08: 0000000000000000 R09: 0000000000000000 [ 1496.747383][T30903] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1496.755369][T30903] R13: 00007ff0ad626038 R14: 00007ff0ad625fa0 R15: 00007ffc2132afc8 [ 1496.763364][T30903] [ 1496.766997][T30903] Kernel Offset: disabled [ 1496.771335][T30903] Rebooting in 86400 seconds..