last executing test programs: 3.784029992s ago: executing program 0 (id=4568): openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x40000, 0x0) ioctl$TUNSETIFF(r1, 0x5452, &(0x7f0000000180)={'syzkaller0\x00'}) r2 = socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1d, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xad08}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$kcm(r2, &(0x7f0000000340)={&(0x7f00000000c0)=@in6={0xa, 0x4e22, 0xffffffff, @dev={0xfe, 0x80, '\x00', 0xc}, 0x7}, 0x80, 0x0}, 0x200ce0c0) write$cgroup_subtree(r0, &(0x7f0000000300)=ANY=[], 0xfe33) sendmsg$inet(r2, &(0x7f0000002b00)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[], 0x58}, 0x40448d4) write$cgroup_pid(r0, 0x0, 0x0) 3.592107437s ago: executing program 0 (id=4569): socket$kcm(0x2, 0x200000000000001, 0x106) (async) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x3, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async, rerun: 64) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) (rerun: 64) perf_event_open(&(0x7f0000000800)={0x2, 0x80, 0xca, 0x0, 0x1, 0x49, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4, @perf_config_ext={0x7, 0x4}, 0x283ab9bb45922541, 0x0, 0x0, 0x1, 0x0, 0x2}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) (async) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) (async) r0 = perf_event_open(&(0x7f0000000580)={0x5, 0x80, 0xea, 0x7, 0x40, 0xe5, 0x0, 0x0, 0xd000, 0x6, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5, 0x2, @perf_bp={0x0, 0x2}, 0x9c7, 0xfc, 0x4, 0x0, 0x81, 0x9, 0x5, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x1, 0xffffffffffffffff, 0x0) (async) r1 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r1, &(0x7f00000031c0)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x0, 0x4}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000f00)="9eb8a2c0e241fb0402ac67d48d04ecbc724648d79b443d283855fdba1e1dc6283591a8a07eb1436788b6b641ed5ea90be62fc7499c9b017d2e73973395411b7efb244a226ba0ae7657c57101711c5aa138abd03dec1e0899824e678aced03a92fec128f69d27d84ee2ff2e4ad3a3db73f406c4aec4ba5a715bf5abce312346bb7d7345e8df1fc10fa733c98030cb193341700961aa2ccb9f0f029190", 0x9c}, {&(0x7f0000001cc0)="b5640aae1e407af01eecff9e22e152a958b96c15ffd051d17c6c712f21a8abb26b561e7af56b164829c35642692c102092e1f43782559cb76acaa20f83d5e807ad43b8e153ccdf10b894d755e849d01bc937c19203d32e33610f090c9d9e0d5972ac64142f8f4b71f27cc89c43c9697697b53fee3e5f94497031ff2e460d2c011d0db5a289bde09ac884de124e62b5b6921c326a85bc8791473d2828d1e28b5f20e286b061c4dadef878b72e6095841189db4da6e671677ca72a3c1b69c2ec25d3ce00000000000000006494e8109c9ac6ab28db3c65c78c067856bdd51479d9a70cb70f61d174fb23c65e8b46b913796911739a545339ad546ffb3cc017cc0135c0ff04fd8b89a4c69a2abd4303faa480f4ec59a17bb07a8da9a7b7ce1a2bf5388aadce36071bff945c281d03e8d41338d5cbbd80ab84a726f5d1c395e67c74f8261cb83b9aac0fee3f9ac8bce811a4331264a8773fc1f7c9aa246295027d248754b80a2923d35e8016ea876a3b080cd7441d1b76cd566988ff0d4ad44e7de64de907165af57a2e0a7fb80394960bffb935", 0x192}, {0x0}, {&(0x7f00000009c0)="a484d15488fb016289fa4e2b0b25648e7abf5a74ab5e75516b79103a9b0711dd70d5a141294998c249dda70370b7f076f3ec132111d4866784da73cd0f18993549e7b185584053fb7b48d2b271af8a14858473eb1edd82f3f4cd1150bee83bf4f624d8f873ec45fe60bb431221e35526a58313e39813e83be21f2834bbf6fc621f6d9894eb03b4c8690635c5ce509de10000000000000004d8d8550dc3763f779ad276b6f32236b8534ab6701184dac56e1af78c6013715d94", 0xb9}], 0x4}, 0x8080) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x2, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x5a0}], 0x1, 0x0, 0x0, 0x900}, 0x0) (async) perf_event_open(&(0x7f0000000540)={0x2, 0x80, 0xd2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22160, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x91, 0x7, 0x0, 0x3, 0x10000000}, 0x0, 0x1, r0, 0xb) (async, rerun: 32) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (rerun: 32) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000000c0)={'veth1_to_team\x00'}) (async) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8922, &(0x7f0000000080)) (async) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r4, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) (async) perf_event_open$cgroup(&(0x7f0000000280)={0x2, 0x80, 0x2, 0x9, 0xd5, 0x6, 0x0, 0x1ff, 0x14000, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfffffff9, 0x2, @perf_config_ext={0x78e, 0x100}, 0x2, 0x1, 0x5, 0x6, 0x7, 0x4, 0x10, 0x0, 0x0, 0x0, 0x8}, r4, 0xa, r0, 0x8) (async) sendmsg$inet(r3, &(0x7f0000000b40)={&(0x7f0000000080)={0x2, 0x4e22, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@ip_pktinfo={{0x1c, 0x0, 0x7, {0x0, @dev, @loopback}}}], 0x20}, 0x48110) 3.361321321s ago: executing program 0 (id=4571): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x8, &(0x7f00000000c0)=[{0x8, 0x6, 0x0, 0x7}, {0x1, 0x3, 0xb, 0x81}, {0x81a9, 0xa4, 0x7, 0x1}, {0x9, 0x1, 0x6, 0xfffffff7}, {0xdec6, 0x8, 0x3, 0xc2}, {0x5, 0x1, 0xa2, 0x4}, {0x403b, 0x2, 0x9, 0x8}, {0x2, 0xe2, 0x4, 0x2}]}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x2a, &(0x7f0000001500)}, 0x24008811) r2 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x3, 0x2, 0x0, 0x8}, {0x202, 0x0, 0xfffffffc, 0x8}], 0x10, 0xffffffff}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x10}}], 0x10}, 0x23) setsockopt$sock_attach_bpf(r2, 0x84, 0x10, &(0x7f0000000000), 0xc) close(r1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYRES32=r5], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r6, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r7}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0feffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000801000085000000a500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000001340)=@hci={0x1f, 0x4788, 0x37}, 0x80, 0x0}, 0x4000080) close(r8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0xe, &(0x7f00000004c0)=@framed={{}, [@cb_func={0x18, 0x0, 0x4, 0x0, 0x4}, @exit, @exit, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x9}, @tail_call]}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94) r9 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r9, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socketpair(0x29, 0x8, 0x2, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000090000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r11}, &(0x7f0000000040), &(0x7f0000000140)=r10}, 0x20) 3.229575342s ago: executing program 2 (id=4572): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0000e80000ffeabfda20383a00"/26, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) (async) r2 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r2, &(0x7f00000010c0)={&(0x7f0000000140)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000480)='\\', 0x1}], 0x1}, 0x4000040) (async) sendmsg$inet(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000180)="84", 0x1}], 0x1}, 0x8040) (async) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20006, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r3 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r3, 0x0, 0xfe33) (async) recvmsg(r3, 0x0, 0x10100) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000240)={0x3, 0x80, 0x57, 0x0, 0xd, 0x36, 0x0, 0x5, 0x101, 0x4, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x7, 0x1, @perf_bp={&(0x7f0000000200), 0xb}, 0x100000, 0x3, 0x6d3, 0x1, 0x9, 0x2, 0x4, 0x0, 0x1}) (async) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000001c0), 0x4) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8000, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x5}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="12000000020000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, &(0x7f0000000040), &(0x7f0000000100)}, 0xfffffea3) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r4}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)}, 0x20) (async) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r4, &(0x7f0000000040)}, 0x20) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x80800, 0x0) (async) r6 = socket$kcm(0x2, 0x3, 0x84) write$cgroup_subtree(r6, 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x45, 0x1, 0x3, 0x80000000}, {0x60, 0x8, 0x0, 0x9}, {0x0, 0x0, 0x1}, {0x2}, {0x6, 0x0, 0x0, 0x10000000}]}) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x80800, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb01001800000000001a000c0000000c00000006000000040000000000000c05000000002e2e2e3000"], 0x0, 0x2a, 0x0, 0x0, 0x3, 0x10000}, 0x28) 3.128198646s ago: executing program 0 (id=4574): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8922, &(0x7f0000000080)) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) r1 = perf_event_open(&(0x7f00000002c0)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x2, 0x510, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffeffffe, 0x0, @perf_config_ext={0x1, 0x7ff}, 0x0, 0x7fffffffffffffff, 0xde4, 0x5, 0x1, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000004c0)={0x5, 0x80, 0xa, 0x0, 0x0, 0xa, 0x0, 0x5, 0x44, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x8}, 0x80, 0xa7, 0x2, 0x5, 0xa5, 0x9b9b, 0x7000, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000004c0)={0x5, 0x80, 0xa, 0x0, 0x0, 0x2, 0x0, 0x5, 0x44, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x8}, 0x0, 0xa7, 0x2, 0x5, 0xa5, 0x9b9b, 0x7000, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffdfffffffffffff, 0xffffffffffffffff, 0x1) r2 = socket$kcm(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x6, 0x13, &(0x7f0000000200)=r4, 0x4) perf_event_open$cgroup(&(0x7f00000000c0)={0x1, 0x80, 0x7, 0x9, 0xb7, 0x6, 0x0, 0x8, 0x88202, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, @perf_bp={&(0x7f0000000040), 0x2}, 0x114000, 0x3, 0x8d3, 0x3, 0xfbc, 0xa2, 0x7, 0x0, 0x7b4, 0x0, 0x3}, r4, 0x5, r1, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0xba}, [@ldst={0x4}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) 2.984421749s ago: executing program 1 (id=4576): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x9b, 0x1, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf3a, 0x0, @perf_bp={0x0, 0x8}, 0x9196d2e0eb6107cb, 0x1, 0x24000, 0x8, 0x7, 0x8000040}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2, 0x400, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x180090, 0xca, 0x400, 0x6, 0x8000000, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="0c0000000988"}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x87}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50) close(0x3) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r5}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r6}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0a000000020000000200000004"], 0x2d) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0xc000000, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000180)="1400000017000b63d25a80648c2594f94aa3c92b", 0x14}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r8}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) write$cgroup_subtree(r2, &(0x7f00000002c0)=ANY=[@ANYRES8=r1, @ANYRESDEC], 0x12) 2.844127952s ago: executing program 2 (id=4578): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)=ANY=[@ANYRESDEC=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x8, &(0x7f0000001340)=ANY=[@ANYBLOB="beaa000000000000791008000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000bf03000000000000850000000c000000b70000000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9c, 0x1, 0x0, 0x0, 0x0, 0x200000, 0x62030, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) recvmsg$unix(r0, &(0x7f0000004140)={&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000004080)=[{&(0x7f00000007c0)=""/100, 0x64}, {&(0x7f0000001d80)=""/4096, 0x1000}, {&(0x7f0000002d80)=""/47, 0x2f}, {&(0x7f0000002dc0)=""/36, 0x24}, {&(0x7f0000002e00)=""/105, 0x69}, {&(0x7f0000002e80)=""/4096, 0x1000}, {&(0x7f0000003e80)=""/213, 0xd5}, {&(0x7f0000003f80)=""/228, 0xe4}], 0x8, &(0x7f0000004100)=[@cred={{0x1c}}], 0x20}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @multicast1}, 0x2}}, 0x80, 0x0}, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0xffffffff, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef8020ab070011000523a608463a3f"], 0xfe33) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x5}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bridge0\x00', 0x100}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[], 0x48) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f0, &(0x7f0000000080)) socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6493790710000000000080000b2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249f21c6eee84309e7a23c19a394830f2539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bfb1c0e6b1244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbb888b0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f94479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b844139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323478a9968100000005"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0x9, 0x10, 0x0, 0xb}, 0x94) 2.782345347s ago: executing program 1 (id=4579): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x13, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff}, [@map_fd={0x18, 0xd, 0x1, 0x0, r0}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) gettid() r1 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r1, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@timestamp_addr={0x44, 0xc, 0x7, 0x1, 0x7, [{@dev={0xac, 0x14, 0x14, 0x1d}, 0x5}]}]}}}], 0x40}, 0x200040c4) socket$kcm(0x10, 0x7, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) openat$cgroup_ro(r2, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) openat$cgroup_ro(r2, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) r9 = openat$cgroup_procs(r6, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r9, &(0x7f0000000080)=r5, 0x12) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2.266727168s ago: executing program 3 (id=4580): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0e0000000400000004000000030000000000", @ANYRES32=0x0], 0x50) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2, @perf_config_ext={0x100, 0xffffffff}, 0x80, 0xfffffffffffffffc, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x13, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9, 0x0, 0x0, 0xffffffff}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x5, 0x0, 0xd, 0x0}, {0x18, 0x2, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x5, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$cgroup_int(r0, &(0x7f0000000080)='cgroup.clone_children\x00', 0x2, 0x0) write$cgroup_int(r3, &(0x7f0000000300), 0x12) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000230000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a800000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) 2.088152139s ago: executing program 0 (id=4581): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000000018000095000a0000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000001c0)={0x100, 0x1}, 0x8}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1c, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000101000000000000fcffffff95"], &(0x7f0000000180)='GPL\x00', 0x9, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r1, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000f80)={0x0, 0x0, 0x0}, 0x0) sendmsg$inet(r3, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x80) recvmsg(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000600)=""/203, 0xcb}], 0x1}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000000018000095000a0000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000001c0)={0x100, 0x1}, 0x8}, 0x94) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1c, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000101000000000000fcffffff95"], &(0x7f0000000180)='GPL\x00', 0x9, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r1, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)) (async) sendmsg$inet(r3, &(0x7f0000000f80)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$inet(r3, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x80) (async) recvmsg(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000600)=""/203, 0xcb}], 0x1}, 0x0) (async) 1.975776426s ago: executing program 3 (id=4582): socket$kcm(0x10, 0x400000002, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x5, 0xfffffffffffffc54, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x4, @perf_bp={&(0x7f0000000100), 0x2}, 0x0, 0x0, 0x0, 0x5, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xd, 0xffffffffffffffff, 0xb) (async) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x101, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fd, 0x0, @perf_config_ext, 0x0, 0x201, 0x0, 0x7, 0x2}, 0x0, 0x1, 0xffffffffffffffff, 0x2) (async) socket$kcm(0x10, 0x400000002, 0x0) (async) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) (async) recvmsg$kcm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000500)=""/4096, 0x1000}], 0x1}, 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef8020ab070011000523a608463a", @ANYRES16=r2], 0xfe33) (async) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001a"], 0xfe33) 1.888632546s ago: executing program 2 (id=4583): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x8, 0x5, 0x7, 0x8, 0x0, 0x80000001, 0x100, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x3, 0x1, @perf_config_ext={0x8000000000000000, 0x3}, 0x4, 0x1, 0x9, 0x2, 0x10000, 0xc, 0x9, 0x0, 0x7f, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f782db44b90402000000e8fe55a1180015000600142603600e1209000a0000000401a80016000a0013", 0x33}], 0x1}, 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x960, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) (async) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe3a6, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) r4 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r4, 0x0, 0x27, 0x0, 0xc) (async) ioctl$TUNSETOFFLOAD(r3, 0x400454c9, 0xba98575a95aeb70d) (async) ioctl$TUNSETLINK(r3, 0x400454cd, 0x337) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, 0x0, 0x0, 0x0, 0x18}, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000200)={0x1, 0x0, [0x0]}) (async) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="043900002000ef029dd2b97576b11d210a"], 0x33fe0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="d800000081064e81f782db4cb904021d0800067c7c09e8fe0ba1bc0008000600007c03600e120800110002000401a8000600200e02400400027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0100000000000000ee5de6ccd40dd6e4edef3d93452a92954b70370e9703920712f9a941160787159fd008e81961c6618e2a05ee4aba825fc011f00ef4176ad07afc24d1f0616a00"/263, 0x107}], 0x1}, 0x4001) 1.776119003s ago: executing program 3 (id=4584): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.idle_time\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x2a, &(0x7f0000000100)=r1, 0x4) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000180)={r1}, 0x8) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1802000001000000000000000000000085000000130000001801001020786c2500000000002020207b1af84117000000bfa100000000000007010000f8ffffffb702000008000000b703000f79000000850000e5160000001858708e94a7bfd4f1969ea2a4ccd76e6bb52e0401cec5df0be03076509c7502d451e132504676fcee9e2eb583a155440df829eb4caf96de3560023586655aece4a96a2c13e2907dc09cd2c340b5434aa418271e86e44441e5aa3b7e43c281142cd94eec2a7860af11c56a9826"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffdb8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0xfffffdb0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r3, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x1, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0], 0x0, 0x2b, &(0x7f0000000340)=[{}], 0x8, 0x10, &(0x7f0000000380), &(0x7f00000003c0), 0x8, 0x76, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0xb, &(0x7f0000000000)=@raw=[@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_idx={0x18, 0x8, 0x5, 0x0, 0xc}], &(0x7f00000000c0)='GPL\x00', 0x81, 0x4, &(0x7f00000001c0)=""/4, 0x41000, 0x10, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0x1, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) bpf$LINK_DETACH(0x22, &(0x7f0000000440)=r2, 0x4) 1.742845371s ago: executing program 1 (id=4585): perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x55, 0x1, 0x0, 0x0, 0x0, 0x5, 0x62020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000400000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x9, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x9060, 0xdf2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33a2d912}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) bpf$LINK_DETACH(0x22, &(0x7f00000002c0)=r2, 0x4) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) recvmsg(r3, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x40) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="1400000016000b63d25a8064000000000724fc60", 0x14}], 0x1}, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x5, 0x80, 0xb3, 0x3, 0x10, 0x49, 0x0, 0x2, 0x2001, 0x2, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x7, 0x0, @perf_config_ext={0x8, 0x1}, 0x1618, 0x401, 0xffff7fff, 0x5, 0x1b, 0xffff0001, 0x2, 0x0, 0x4, 0x0, 0x727}, 0xffffffffffffffff, 0x5, 0xffffffffffffffff, 0xc) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x10001, 0x7ff, 0x40000000, 0x6, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/31], &(0x7f0000000280)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8948, &(0x7f0000000000)='lo:\x96o8\x14d\xa1\xe3\xd7\\b}\x1f\xa1Y\xad4\x00 \'Y\x17]\x15c\xcaR\xdd\x98OGK\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\xf5\a\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xbaUn\x04\'5\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\x06\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf1\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\r\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc5\xdcZ\xb9\xd7Z\x88\x9b\xdff[\x90\xfa\x9a{b\xf4Dq') r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1200000008000000020000000400000000810000", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000020000000100"/20, @ANYRES32=r2, @ANYBLOB="008bd93e3400"/20], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000180), 0x1003, r5}, 0x38) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000b80)={r5, &(0x7f00000014c0), &(0x7f0000000b40)=""/31}, 0x20) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8916, &(0x7f0000000000)={'wlan1\x00', @random="0200ff7fffff"}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x20800, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x1f, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x100}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffa921}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @map_val={0x18, 0x9, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x1}, @printk={@lli}, @alu={0x4, 0x0, 0xd, 0x2, 0x3, 0x30, 0x1c}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x6}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, &(0x7f00000003c0), 0x40f00, 0x10, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f0000000400)={0xa, 0x5}, 0x8, 0x10, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000004c0)=[{0x0, 0x1, 0x4, 0x8}, {0x3, 0x2, 0x20000, 0x6}, {0x3, 0x5, 0xf, 0xb}, {0x5, 0x5, 0xa, 0x9}], 0x10, 0xbf8}, 0x94) socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETLINK(r7, 0x400454cd, 0x336) close(r7) 1.645618894s ago: executing program 3 (id=4586): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async, rerun: 64) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) (rerun: 64) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="0000000000fdff9500"/33], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x48, '\x00', r1, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r3 = socket$kcm(0x11, 0x200000000000002, 0x300) (async) perf_event_open(&(0x7f00000007c0)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x374, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1, @perf_bp={0x0, 0xe}, 0x8200, 0x0, 0xfffffffc, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0xa) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r4}, 0x8) ioctl$SIOCSIFHWADDR(r5, 0x541b, &(0x7f0000000180)={'ip_vti0\x00'}) (async) socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r3, 0x1, 0x8, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) (async) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x13, 0x5, &(0x7f0000000000)=@framed={{}, [@map_fd={0x18, 0xd, 0x1, 0x0, r6}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) gettid() (async, rerun: 64) r7 = socket$kcm(0x2, 0x3, 0x2) (rerun: 64) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000540)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@func_proto, @enum64={0x2, 0x1, 0x0, 0x13, 0x0, 0x1, [{0x2, 0x7f, 0x8}]}]}, {0x0, [0x0, 0x41]}}, &(0x7f0000000400)=""/188, 0x40, 0xbc, 0x1}, 0x28) (async) sendmsg$inet(r7, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1c000000000100fc7f00000005000000", @ANYRES32=0x0, @ANYBLOB="ac141411e00000010000000024000000000000000000000007000000441407716401010100000000ac14141d0000000500000000"], 0x48}, 0x200040c4) (async, rerun: 64) openat$ppp(0xffffffffffffff9c, &(0x7f0000000440), 0x400000, 0x0) (async, rerun: 64) r8 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001d008104e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) 1.523868182s ago: executing program 2 (id=4587): r0 = syz_clone(0x8000f000, &(0x7f00000000c0)="bacb3933e0e91e13faef9c29c239bd982480b8fa37474e500e529aefe43aa89ae959724abe31843f3a54f930f860866bc71fb2ec61feccde1b59dd37efc3205782395ecf180158ede02ce29a73a3237d79b632152c67baa965dec6f60c033d8a32c826313f34c1bfedfce134c2e96bf33d88e8ddbd6bd41873ba4c075a5fd08eb426f7a4fdd08cceb2780ade8d389646a548a69b", 0x94, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="0c4ba7df4bed0a7c3992e06ff0e093778fdaac97815bc43904783c2bbed9c9a7c82ba275d8c5a0b542e86e058438a1f3ff2007864313a09989bdd28017f94d022557bdb4e6c305f4334f924632dc6e3ae5c2ed6cdf2e") r1 = perf_event_open$cgroup(&(0x7f0000000280)={0x4, 0x80, 0xf, 0x2, 0x3e, 0x8b, 0x0, 0x2, 0x2, 0x8, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x5, 0x2, @perf_config_ext={0x2, 0x2}, 0x100000, 0x8, 0x0, 0x6, 0x200040000000, 0x8, 0x9, 0x0, 0x5, 0x0, 0x3}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x30, 0x6, 0x99, 0x8, 0x0, 0x0, 0x2048, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x6, 0x2, @perf_bp={&(0x7f0000000000), 0xb}, 0x480, 0x9, 0x7, 0x9, 0x4, 0x2d7, 0x4, 0x0, 0x20000000, 0x0, 0x3}, r0, 0xf, r1, 0x2) r3 = perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x1, 0xa, 0x1, 0x4, 0x0, 0x4, 0x41000, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0xe8, 0x2, @perf_bp={&(0x7f0000000300), 0x9}, 0x10, 0x5000000000, 0x7, 0x2, 0x577d, 0x3, 0x4, 0x0, 0x3, 0x0, 0x8}, r0, 0x4, r1, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f00000003c0)) close(r1) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x40082404, &(0x7f0000000400)=0xffffffffffffffc0) r4 = perf_event_open(&(0x7f0000000500)={0x4, 0x80, 0x1, 0x7, 0x2, 0x9, 0x0, 0x7, 0x0, 0x6, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x7, 0x7}, 0x8000, 0x9, 0x0, 0x6, 0x6e, 0x2e75, 0x3, 0x0, 0x7fffffff, 0x0, 0x7}, r0, 0x2, r3, 0x3) r5 = perf_event_open(&(0x7f0000000480)={0x2, 0x80, 0x81, 0x9e, 0x4c, 0x81, 0x0, 0x6, 0x2800, 0x2, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x251d, 0x4, @perf_bp={&(0x7f0000000440), 0xb}, 0x144, 0xfffffffffffff3ea, 0x5, 0x1, 0x1, 0x401, 0x3, 0x0, 0xffffffff, 0x0, 0x2}, 0x0, 0x6, r4, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000680)={@map=0x1, 0x33, 0x1, 0xfffffff8, &(0x7f0000000580)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f00000005c0)=[0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) r7 = openat$cgroup(r6, &(0x7f00000006c0)='syz1\x00', 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000700)='blkio.throttle.io_service_bytes\x00', 0x0, 0x0) sendmsg$kcm(r8, &(0x7f0000001a00)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000740)="eeaf551e62225a10c824ad64e3860ad734e490294cad2aa2d52b55d107ec3c84702cbc92343628ad45ccdaa7aac492da38cebd5df951b06ff4511f1c21ceeaa7d5581ca7a4c910d53870e016338a230bb7ba1233c2d2987f45301d35ec5818aaaf846851ff880af8a18de5c4ae4df9c7563afd9fcae35b30d969f049452c91a9bb50bbcb114e2ea3c44395ea34ae93bd6907387ca631310b71231b62b3966b2222d05915b944fbba7e0ca452eccd95b31709557a4b35c83db67ce48e24d7936c952e0d4d71a241d959a683d812d06be5cf32998ee2", 0xd5}], 0x1, &(0x7f0000000880)=[{0x90, 0x118, 0x6, "0f90b59bf1d4294d507c9cec94a040eea29b13a6922cf7eb2d97f97219c9504729e6da48ca156fe9c735ba35c5c0696178bcc0ef7bebe64c5879baabe7874ab7482ba5aa581771cfae0919bd7dea8a5c48b27cd0faa178ba077b42852a0d049025ae555b350dfe162ae36c2526c0bb82b6bff1de3d58c94c2faee9172e"}, {0x20, 0x0, 0x400, "db8b553c183383b37a42c18f9ac9da7f"}, {0x1010, 0x0, 0x3, "cd200ff93d40fe94e5a083013c72a5097953d956d5b0b0bb820378f8478b1b4a25d5c1fc9e7b34910ca9e43f6587ea568d9221ee8f43dafa12a6cbf37eefc99c941af06d76dd6381201b81b9d04ff3d2ccfef873721265a094e06151450d4ad194121b92b8d6197c074fa0a044812ba62b86388abb09347a89034566b283c4c1e5705b720441631ea9631f5762d4f738be6d603ce8b9957576ed9a78e93e63c219a989dda7d56c68b7398a55e05b140c970d535776c7ad4ded56bb120d00c1d706d69e6e466d63f261568f7006768ece1b5efc3a46ed191dfbfa156f10a118e24cee057c77b01235f3ee62717b8a74981a0a96e2190317c7c8d9ad45f016e7b16b6ed466a381299b81e216bc99a843a64d3c1461195a62cc7f8c76db1de3166f1a4e8b4a37ece43bdf8dba330a7a4eeee3a51bf219d4678daab65968a7b78673618534afd454f227f4d9fc05f01ebaadf8c5f45a5ec0238f12c9d7d2749b6042006fc33b085d46143452496889c2b37b029f843fad1b8aafe8297270f95a3b6fa2e505442e0ef502103c1b4fbc2dcffa892327d85692663bb215f94d64af459a7a98c606c0c1cb65e05cbccd117821a6223b65f23872781d4cbc9d08657110b0fe6b36a1a7f36399e28e96aab4a813686a32cd8a9bde67d50b2ba7d699ec50d69831cee5017ba84ee3bb6376e8cc61085d38d452d5f16abd1c7a381abaa6301ff1317c6691231dd544b263098da292b7ab0ce78f6e1fc4afc68ee7a7e248fe9fdc5a3a2b8bfdc787f33f47f891ddd4f4ad7217d879e6d5fb6a6b781b5af66ab6af9b6a4d02f460bdcac3eadc1b22f94703fb4e0e2fab42fa06e2b5484f45bb87cd08be329a5c54083096ca13441aa5d995dac698ecb918c917ac4b90f4a40dd951c49c22bae2ad9659cc68d7f7e4b0c802c3d49488090908a8db2f993e85ca64157a909eb5ba14865633cfc99c58811298720b39182662604542ae02db5c49b5b93dcd1ec951ef7f6cec5ce28a90173c3637f5f1aadc6dec9c27f4492d796af9d9c5a5d2ccfffc10392b8209ab91250f43f96db79e97f01f3b7d344db54b8f7ab1e7167c27415921f7a7d01975ceb3c72c4588f22d3e710a2b00c5710a4f7a998e4a7a2efdd111250555feed1e701719fdd8958019a41ac28208ae5899aac021e3b3ef8f888b1bc9eacddcf3a6cf8f85c1467e83511abc28967809daf202d364b6d862f2905846c4dc1d9f4ff193ec09c3e269d78dfd29d395a672e8f65b8abf272124fe84d0f5f757d2df560b4393f07f6cb7b5f7226f584db235108f7e58114e3773a8e87a31fde1a5e120b8f832c22909d4ef5ed94926502e054464fd9a82815bae14965e3a96b28eab37c58fd74c553d7d7b3a5301d7a9df5d563cc500ba223c7c24ff9fde7e28b777b076fd73f31c009efb65323aae263278e6b8f12b9fa70aff2d7869fcd07cf84b46c6d6f2b1b617d94eeea05ea5dd95b0358a867eb13363e630e591d75399c1aa7a191eb7e4cc5cd4160c64a71d50ac2c98da6f47b04acbbe97fcc1f3fe7ee67f9625fab31d59b805c480f248384423e7979ad6ef80b63dad0fa76eef01dbfa81977d84ba7f719d67d01154070c52c4c48198f032c864fe0ef4d554841d12dc9e04c6cb4f37323ff99de45acc6063cfee3a4c75f9438be9b9b9aa57df3a1c388e513289c55b0d9d45a2532b7437e097ee3066737f00cae83c6e4bb3e17abc1b414a5f0ad6305d48f49aceaf285243fd1f9fdcd2692811f260385de7ea5aa411b7553aed8e027ef6d1042e08a887595851b5354161886dad9f53b579b991e2f5fb153f3a03c311b2441854daca41132afa26a2108cacef8336a2a0dd20cb923a773ac6a2c3b5e92954910c537e747b8d0ad8f3831791a9712fa0150974e048d2b6d729ff7e8ba9b8825d2eede02e7bb23334e2b47565056f342d06da1440e0143c5d654d9e1cc63f30db4d18791a02a06b8ce6f71e49c9ebcb64a2237a0d6251b1e3f2af0930a1f97f2799f0170725c13538ae86ed33ea22ce8128ff23b62d3fc3940adbfabb89096d0bd4677f76b22513805306ee7b336f90d5fb99ef515480e6dfc4527c43e333c0c96b758676212f0338a5e9c9fe518146796bc3a67f2423532ae26fc2e895c8a8575bcd40370dda2246d393fedd39f19eba7f5f06892c3a790aae68038b92429cfe2cff9f0abfe7396013d9bd851fbfc7db778e717cd0be61bfb5795de2e96cff70f6a1b5c9aaef90b300c65ce5f2654e5431ebd1a72cf23d81d567773492476c94d34fb79b13c1b96fc8549e2595a9e6fbc72bbe5c26c6f8fa0bd5662b7ddfbe23cd6580f1d5904ac6e3e4ffd27fad6f156c256b12dcac1a85aa9edbeaa69e01d8c84941caba8ee98c52396054fb5f907ce98cee95eda5585a3262a447ebf0e74f74713867d914d75d6afa5cb1f937191479c3685a7134bc90050e865f199b3fa22a03a6421519027fcff61be042f128951ef0929953c033ca04f521fc3d4b1e2bd43723094e125e9fa0dcb24ed14f8253af3a075c6f9b2b54d098ef0b7b7f93f1e5f396e7211b6bdf7d2e69ce73cfb0e8b10e7a5c250131986ae90a1acd145a958a9fe1b479f05d3d921fa26ed449a55c58e0fc5adb6144cba18fc9dbdbc36a7c5dd9722bff7ea873c237f0e5e2319b220d8de19a900fd7f8aacb18b0d8dac13ad6916cd18720ed9a0a978155afb3825e01ee30122b4ccb1068a699e8fbd43e7c68ea99e79fe7850e09c22f855bd53e17e13d2a8a9d7166138bd0c5090d7ebdbf69caba6a4721d93b0ea8c7a9b7201ded2a88b2197c15713caa091622f02912662cf2de6afbddc0a28823574f4be5ffe1c5a4110894c7fdf42fd927bddac219c18535f7b85b88f8e150f1280b1e0ccd472bf7ee514911a7687a9b973c583f5a57ba2fb1b981831c7e5bbf14237b0b558e8bd545eb6807fb3032fa724c0134991c5d37849b8b2939d78234e85b9b148ec559301e06d7cc1b40ad540737377ca1002998170934fda8175e9f6c03cc797de9dc64629f66788857dcc6c382277f2fc821ad97a081ca6fead2675037709fb539c9470d3d8fe8e0a31467796bc2ae247800b7b7db02bc00cbd7c58b8b4e4a296f673a91c6dadd685b7680f6c1cdc869126799d83e4b56e02e6729f55ab2f37a84ea2727e1303f1be41175d344897543eb52aa7a87a9c6dc5521a9db96cf603e7e8c9804ba1716626a41640dfdee4dbdc72b066fcb977e534f2e8f2e231d6b3e024d73cae55db4e22b44f43813fc055c41b9635fc866206e1263d64c91737153d31a238923ee3d14218de21f2dbebaad809132185b056a87cb264edbb43d2ac9b70defd1d85cbef33ecca33025a7ba3f62fd7d3a6d18366cbb1c5fa3d987bacf503b31f487a55f5279b04dabe782606b63dd734c83bad258068545943751d867e0d69b0abda1b363dad4dc821e4cca353fd8aafc872eed2672c2b6d64db4670a7c58fc11923d4687a15aa0a0674fb8c68648d965914482512b926666d9f369ea779f4833694d234f8afa80d9cd35742e511557f8ae021eda257c93ca83f80bd445d983bca6d474d744fcba92d76a0ddda7692680a4a19c246b2c70e969d22d649e0556900d3dfe91de1ff3983ba1da2aa7cd08dd120636eff1d30b9eef3419f386ca6b7cdbddd75d191b79f83dba86d780c6f98e8500aee09c44e5326a12bd9c7324a33aac22025eb6a44d0bb67757eb4eed05a72d6055a0442ff4af4f3274026a59ecce847ec09ee656b49cfb18e1118a7fecea760bc1deae38c47127f3d8eff739235eb48bb5028b00f891966beaf4c5185b3796e6db8be60ebc381e32da908e70f7b0d454492dd4c7caee0eca5567341570064690e55ee641c6a36de0cca2a3ebab79cc0accd92df156e88e5823310c2437e8b533bd0e21f24bb8496deaadf79923958797e2c1ee8df5fe8c311c84d4fc915ebe62d440ae098746e121937c44e2fbec5a810af89bec2332b7313c3fcb37dd94dc641d2cf908154e4b2e1c5e15cff4e90e51211b0066a75027657804463145f326a1ba2d7ec3f60fc89df8056419cab4a69b6318210152e320b8cf85c77a946ed22a76518d46d3702821b55a39c2b8ea05e14380e5386808ab558fb5bcceb9b434a5edd202bda3460f6c6cb52cad0910d9b41fe26b9057f22fe1a0588129517e641e138129d9dcadcfc034a202b5ea349455da1957893fe2dfd9723c8e0bab64c90ac0054a336aa375c899a5a2650af8aca5e25e0f34edae26cd4c308016372f339e63d25f73868d3a66c00408a72ff48a699797e2fe74690414a22a86a295aac375be5584a46343b2f43c99dcd10e239c05ea769a4eaaee959ae81ac51e478c30dcd3358a0153fc25201cb3df146b46e200b3a82779e2e383bf5c6d746cc7a2eb2d2c479893312a493339bddec9edebc79b79fe293955cd7ad57ba06e8a996f5643c0cf4492ebbcb64d1c6e8a1e0ba1acd0bc557181df0e12024c5d27419fcaf03cd03554f0d7583cc5481680284b94920c0306ed7bb6e0009644ed7b263b8e118794bb2751c2c204ec7d147d2464fda1667dca2677e4922426ac838f075d1794e9f61e494c398f1554dbdd967ada2fe389a9a75cffcf66bc56da23258f5080036d849096d4a514a1ffbc4369a374ebbbe9a0eed358051cf8255b861c64dfc5db66f47da69f36939cdfa5319a7d5269fe0da2921d4e93710d085b70af4dd854b38164d0b861f217cf623c8b0571981496fdb60127e1eae154495228d817fd207a9f0ed59b72322c506e6c540697014f39ceee1ad48e91bd5b66b70dba6f28ac4e9cdb2708b18036ef0d52bf826976f4f1603b5bbc67c4a2eef28ce8a668b2e705c9fdb55e87cf2a3c2f61612d1b2bae1c1157d19bfb41ffbdb4ca8e47c51b71364c3981c9e38b7e7ef99ba80646dae22a749fb6bd7a34e27ad472458e1193362818b80a10f9e70db4da80e54547f162f8d869db56b254e4e4a40998ab4f2e0ed5d15bab650045dfd2280c06d12e9f29342250f020eec6d4f642573e6dba22d80ace6bc9c7b005d5dd2dc75d3b0798731bb57f4c07e682166c0f1c333c46e21c74bf13edc588f2083aa7adfed5b94584fa96e07404a51019e51c93bda13ca0ccb2f9d01674ad6e2447154d5bd0080b88891236f1d310db3641f298f2f69c42c5c4f82473bf37d144b1970094dfc992c4b238137575b39f16d0d72818decaf6a7d1c496c65c0f64eac30aa66cfd11af94e8b972242f406a53e9999dd5cdf4bd17db4858ef65cc268a32f772a85835b1e30caf4b63bb1fb10654f9990a32a0b53025ea43e448a837ea2f9742fc6499b33f07e46d298bf007fa100038a726e512e19ec90dbecc2e0a91aa2dbb8ac0f6e4c01bd8d749271be045761716872d0dbdb0b0c9de7841e2b0cac17456d462d1b8c33f87999140ac432afb89b05765991e2d5c11d3c9984076976a48ecb2ae1775c5a61d6770ed95eeae5f14cad38d253949f27e267748a9bab118a260fc6016285cb552e8a46e7aca6649a29b6ac0afcde6ee7e90dd900aa37816e6233370480641d3678a42c152a9df4c0d08afe1b71e46461708cbd768ca6f790d622d8976de8da588c5bea747f0b93316327e83fa312934f68e0d97616dbac256eda46dcf44f7e5ca622d7df78a81f0ea052d1780e1ff7fe7d654143b56a014a6b91b73a894a6916045004c0d4a25ddbc80e8651781b809059acbb15b1a442a716165c352932ef3f69ba9b90e2dc84674bc024fdb681b0d5559a12db29a5e3f"}, {0x88, 0x29, 0x3, "c52a9f33bae4e6f608e1dbf792aa8a28b9f7047c6ef69e56fb1705c6ed2a7ced255b3c74e09802dc264a9602c8cc703375c1d76b1b9b012d4e6e6c436e47650e7db0f46fe0cdb782ef322b211caf54744fa7941100d7715823e99c6eca97c4122110873219607953657a00e65550cab35be386fa0b"}], 0x1148}, 0x4048050) r9 = perf_event_open(&(0x7f0000001a40)={0x2, 0x80, 0x1, 0x5, 0x81, 0x7, 0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x8, 0x1, @perf_config_ext={0x7, 0x6}, 0x100000, 0x3, 0x2, 0x5, 0x0, 0x1000, 0x1, 0x0, 0x6d1f, 0x0, 0x3a8b2922}, 0xffffffffffffffff, 0xa, 0xffffffffffffffff, 0xa) recvmsg$unix(r8, &(0x7f0000001f80)={&(0x7f0000001ac0), 0x6e, &(0x7f0000001ec0)=[{&(0x7f0000001b40)=""/95, 0x5f}, {&(0x7f0000001bc0)=""/193, 0xc1}, {&(0x7f0000001cc0)=""/214, 0xd6}, {&(0x7f0000001dc0)=""/204, 0xcc}], 0x4, &(0x7f0000001f00)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0x0}}}], 0x58}, 0x1) ioctl$PERF_EVENT_IOC_SET_BPF(r10, 0x40042408, r8) r13 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002380)={&(0x7f0000002200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4c, 0x4c, 0x5, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0x4, 0x5}, {0xd, 0x3}, {0xc, 0x3}]}, @type_tag={0x6, 0x0, 0x0, 0x12, 0x1}, @int={0x7, 0x0, 0x0, 0x1, 0x0, 0x18, 0x0, 0x14}, @typedef={0x7, 0x0, 0x0, 0x8, 0x2}]}, {0x0, [0x0, 0x2e, 0x2e]}}, &(0x7f0000002280)=""/222, 0x69, 0xde, 0x0, 0x3}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000002500)={r8, 0x20, &(0x7f00000024c0)={&(0x7f0000002400)=""/108, 0x6c, 0x0, &(0x7f0000002480)=""/2, 0x2}}, 0x10) r15 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000002540)={0x2, 0x4, 0x8, 0x1, 0x80, r8, 0x2, '\x00', 0x0, r8, 0x5, 0x1, 0x4}, 0x50) r16 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000002600)=@o_path={&(0x7f00000025c0)='./file0\x00', 0x0, 0x4000, r8}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000002680)={0xa, 0x1e, &(0x7f0000001fc0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_fd={0x18, 0xb, 0x1, 0x0, r10}, @map_val={0x18, 0xa, 0x2, 0x0, r10, 0x0, 0x0, 0x0, 0x9}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x400}}, @map_val={0x18, 0x7, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000020c0)='syzkaller\x00', 0x0, 0xe8, &(0x7f0000002100)=""/232, 0x40f00, 0x58, '\x00', 0x0, @fallback=0x23, r13, 0x8, 0x0, 0x0, 0x10, &(0x7f00000023c0)={0x0, 0x4, 0x9, 0xffffffff}, 0x10, r14, r10, 0x0, &(0x7f0000002640)=[r6, r8, r10, r15, r6, r16, r6, 0x1], 0x0, 0x10, 0xa6}, 0x94) bpf$OBJ_GET_PROG(0x7, &(0x7f0000002780)=@generic={&(0x7f0000002740)='./file0\x00'}, 0x18) r17 = openat$cgroup_freezer_state(r10, &(0x7f00000027c0), 0x2, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000002c00)={{r10, 0xffffffffffffffff}, &(0x7f0000002b80), &(0x7f0000002bc0)='%pK \x00'}, 0x20) r19 = openat$cgroup_netprio_ifpriomap(r8, &(0x7f0000002c40), 0x2, 0x0) r20 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002c80)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffe, '\x00', 0x0, r8, 0x5, 0x2, 0x3}, 0x50) r21 = openat$cgroup_ro(r10, &(0x7f0000002d00)='pids.events\x00', 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000002d40)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r10, &(0x7f0000002e80)={&(0x7f0000002800)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000002b40)=[{&(0x7f0000002880)="01559bc49b14808136859be2a0182ff2dc743280ea30d46594ed494f7ac96eaf1ce2e7d729071985a725196c532190d60556b929c29545253732ac17adcd77801ae4bea5", 0x44}, {&(0x7f0000002900)="83d51c86982098045b0a6a7a8a951162d74d5693d2ec76da2ed1f3a0c7a644ec31daae2e35a8a0ff0fdcdc655935e4e00779af0083165ecde409e39096c418ad9037fd1d939e9e211ecab739dd1c1a62f3af1b4831d6abbb8d6d7f0b4c4db1fff41fb554bcd779cc1e54ef38d942d90655a1d8022ca9653a0cf41c24676fd4eee4f254ee1cc34b24a9a14c5d3893546a88626b6fb54449dfadbe273edf983fdd9c24b21f209d1890c7010ad908554371b1460e0af5704b322f2d4bfbb1d4a558474bc133d7610c0f25eb3619c34867b8302d9a18434bfa8f2ad090a870fc", 0xde}, {&(0x7f0000002a00)="4272c8f7884c845d639e8424ce325cc260a111d1ff45bc4b4f372456a9826e05e9e01414da680da1a2090e785a0c9d66803e6e65ee9810808d29ca61991472bb089c91009fefc56cff294f12cf375c77f81e37dbad15257f3ab661495c9086deb43e1db99a82a638edd88c701ca405e2a6f0f1241b3d6ac312058607fbfa", 0x7e}, {&(0x7f0000002a80)="7e5d278ff4040caa856e53a074cc5d8aae5aa50400a783936dacaada1a277caed2cd3aad1e319787fb3d7475c5042f95de66465546628be4e88277627b1be13259920c109defe85d8f3bc9caa090cc9fd0ac27e670699cccfebfa9dcf1239babad06552e5ed1cd4fb6ab07c4773b22602a729ff7a6a0d0f452568d7f9ec2170d21ed135c2fa10599bd7465f79a7f23", 0x8f}], 0x4, &(0x7f0000002d80)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, r17, r9, r18]}}, @cred={{0x1c, 0x1, 0x2, {r11, 0xffffffffffffffff, r12}}}, @rights={{0x34, 0x1, 0x1, [r5, 0xffffffffffffffff, r10, r19, r20, r10, r7, r3, r21]}}, @rights={{0x38, 0x1, 0x1, [r17, r5, r8, r1, r3, r3, r22, r6, r17, r6]}}, @rights={{0x18, 0x1, 0x1, [r2, r8]}}], 0xc8, 0x44}, 0x8800) bpf$PROG_LOAD(0x5, &(0x7f0000003500)={0x3, 0x1f, &(0x7f0000002f00)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r21}}, {}, [@ringbuf_query, @initr0={0x18, 0x0, 0x0, 0x0, 0xffffff70, 0x0, 0x0, 0x0, 0x8}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x2}, @generic={0xff, 0xb, 0x2, 0x6, 0xfffffffb}, @ldst={0x1, 0x0, 0x7f556bd85340e56f, 0x8, 0x3, 0xffffffffffffff8f, 0xffffffffffffffff}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r20}}, @map_fd={0x18, 0xb, 0x1, 0x0, r20}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000003000)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41100, 0x1e, '\x00', 0x0, @sched_cls=0x2f, r10, 0x8, &(0x7f0000003100)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000003140)={0x0, 0x8, 0xffffffff, 0x1000}, 0x10, r14, 0xffffffffffffffff, 0x0, &(0x7f00000034c0)=[r10, r8], 0x0, 0x10, 0x8}, 0x94) 1.441290971s ago: executing program 1 (id=4588): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x1}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000040)='GPL\x00', 0x2, 0x1000, &(0x7f0000014000)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback, r0, 0x14, &(0x7f00000000c0)={0x0, 0x11}, 0x1, 0x10, &(0x7f0000000000), 0xa, 0x0, 0xffffffffffffffff, 0x4c}, 0x70) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) close(r2) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000040)=@framed={{0x18, 0x5, 0x0, 0x0, 0x63, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000200)="29247c97c08fc96f46d6364727c28d80a54b31e68210abe3f81c", 0x1a}, {&(0x7f0000000300)="f883b77cbedbe2e69cdebd52020d48a57afeeb71fcfe9f9118f735c506d427693cf515f0dda6a4fe6b94609618278da86aba7f6e2ea1d684c211d2d1b94480a110c27ed3c9f318ba763d5948ade7b150e6443407cdf8fadd32f97e759375f7abdf9844a6fa1d274483a869d8ab1f80ed15b857b70812c042eff20eb3ccbf770d39d367a00e262065f837085f1bc637855c8ca6e76231496fbea3c56b8d5c59070b4e1c6f324ead11f1eb1e7f0e7f854db2763829146fa371c39848611811f55e383b2d2f9cc92aad7651a532ef7877df890737", 0xd3}, {&(0x7f0000000580)="8824a9217f13763960a686212bee88397b57da03120b340018b17e8544044d8c16bfd1f58eb44f3310eb7a4348e7ff0b11b967a3a2f29126e8202e74", 0x3c}, {&(0x7f0000000780)="231db05bbcf89dbac68928f5eefc4fc4044d73d62f6f5c37f822135f1c5e3860142a5cf46013d419335cb06b48de3650f8129ca12bfd5a0cc1f90af865261e59d14fe8afe1fab1696241bd6fde116d3b18c72e1be0ef30f61b9cee89a345ea7cb8f2cc4a919783d6633f0dbdeb7e935f792677b7d57cfcb79ae8a7f9e63e232d372675d220f0c2d3837218b2b5a4159c38bb2c79cced7021336df231ab3cdd70160d92e323f3f875b0b13141e7eeab825839644c4d4a38a0510fa77e32032876589b51e0859d9a20b2464f440f88fcd00473331b07078f4c2793ce1f5df7", 0xde}, {&(0x7f0000000880)="a529bd99b241b07e92bb76f9b54a89cb10cff34d6760bb970f7aec52a7676b0314c3ffbab0fe967f576edf04c86fb009dcf9aeb59ecbd5bdfce83c635c34813acad154ad5fbc1965bfece87a4583b5f8d5b92564a6e90a605b1e3debee2a67377b224884241a808395f18eb0e1e5f93bb7ecc76c34fcbeb207bbbc5a500d6cdaaae02550a6f6051e85d9e39e94229021b65d60ab27afab630baac73d5aad3536fde8888aa63641", 0xa7}], 0x5, &(0x7f00000009c0)=[{0xb0, 0x10b, 0x1ff, "a985d4595ce6bd710d9716ee25f84281e619de4c8b765236fa975a903a4dfc9f17f59dc7e9989ef6be439a28565a0116f8175e497be5d2114e96bd9489e8e4b8605837a3dbebf6ea2d197432d6e17294eca52f9e1d3ccc2ac7c9b99614dc19c1c135cb4431af23c9ba2d3cd4683caf7f71b0f648b51981443095b18a14a5ed9f770d5fe17517d37aac382d861b2ec91404356383096852e46efc92a4d466"}, {0xe0, 0x29, 0x3ff, "b8a6afb418f51c1b4cd66285d3ed3579f1e3c6ea76b64068a4c466bb4fc00817ec13a8bf0aeec347dafda9b8aa1412b94d810f95acdeef2731e4f542d7f537ba7dabbd748041e3081477f2a673aaa647d29f1486e5b3f73a42345e909613d8672ea17eaddcd201eb4243376e54f88ad5c631ce1529399d830768f0d060cfeeed64a522d2d1d20357025bb3682cfe6fe4ba52fed357b8b1e1bf5830b908ff49740c90b47aaab83cd370e95880009323e846eeffc45194c85998604a59193d40d55b9dba08d48e7173670d2c"}, {0x88, 0x84, 0x3, "4fd08157747ab841f79ccce79210b23f0d51bd5ca4f0fe13a37f206b498e23bd153c980483e001e26e8c13264f3e87a869124fed8d382777075d219bacf41614d48c2c9538280aed3ef14a3cf09d76e90c3698d684c82e2affc9e5109ac8478be0abc030176106ec2b4edc8ba22e6f51c644ae1319"}, {0x78, 0x118, 0x4, "5d8ba23f275263e1d0dbe2216a1a2339a065368d2bd0e540768f4e9053f50eb2aa9b8408a6fe9d877cc0d335b5ec82750c2e57225dea0684f3f1f0a54bc5514a827d360e01ca980d1661346dcd42dda50998f0eed929d0e9c020453b11bfbb1d18543e10"}], 0x290}, 0x4000811) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x10, &(0x7f0000000000), 0x4) r5 = getpid() r6 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r7) recvmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000440)=""/180, 0xb4}], 0x1}, 0x40000100) sendmsg$unix(r2, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000240)='c', 0x1}], 0x1, &(0x7f0000000100)=[@cred={{0x1c, 0x1, 0x2, {r5, 0x0, 0xee01}}}], 0x20, 0x4000}, 0x80) write$cgroup_pid(r2, &(0x7f0000000400), 0x12) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNGETFILTER(r8, 0xc0189436, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x8040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xfffff7ffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x6, &(0x7f00000001c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x41}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r10 = socket$kcm(0x2, 0x922000000001, 0x106) syz_open_procfs$namespace(r5, &(0x7f00000005c0)='ns/time\x00') setsockopt$sock_attach_bpf(r10, 0x1, 0x2b, 0x0, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x0, 0xe, 0x0, &(0x7f0000000680)="548852ac5b4eba7aeaccd2c62b2b", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8}, 0x50) sendmsg$kcm(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000740)="2e0000006a0081040000000000005ef40502e0dfffff0e000a120e0000000224ec4dc2cc0114664568a71802cd0b", 0x2e}], 0x1}, 0x804) 1.316669501s ago: executing program 3 (id=4589): perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_bp={0x0}, 0x20, 0x10000, 0x9e6, 0x7, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$kcm(0x11, 0x2, 0x0) close(r0) r1 = socket$kcm(0x11, 0x2, 0x0) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r2, 0x107, 0x12, &(0x7f00000000c0)=r1, 0x8) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2381, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x886d, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x50}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x2, 0x300) r3 = socket$kcm(0x2, 0x0, 0x0) sendmsg$inet(r3, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000001bc0)=[{0x0, 0x80}], 0x1, &(0x7f0000001b40)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xf}, @local}}}], 0x20}, 0x4004) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x7, 0x10, &(0x7f0000000300)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0xab}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}]}, &(0x7f0000000480)='GPL\x00'}, 0x94) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0xf, &(0x7f00000002c0), 0x4) sendmsg$inet(r5, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x44, &(0x7f0000000640), 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0xa, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa6, &(0x7f00000002c0)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xf2, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xa, 0xb, 0x42, 0x3e, 0x42}, 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x6, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000002000000000000000100008018150000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000450000001801000020756c2500000000002020207b1a00ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000095"], &(0x7f00000006c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0) close(r9) r10 = syz_clone(0x808a3000, 0x0, 0x0, &(0x7f0000000440), 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r10, r9, 0x0, 0xfffffffffffffe59, &(0x7f00000023c0)}, 0x30) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) r12 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r12, 0x1, 0x3e, &(0x7f00000002c0)=r11, 0x161) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x4, &(0x7f0000000000)=@raw=[@map_fd={0x18, 0x3, 0x1, 0x0, r4}, @initr0={0x18, 0x0, 0x0, 0x0, 0xb05, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000100)='GPL\x00', 0x4, 0x1d, &(0x7f0000000140)=""/29, 0x41100, 0x18, '\x00', r6, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0x9, 0x9, 0xff}, 0x10, 0x0, 0x0, 0x3, &(0x7f00000005c0)=[0x1, r7, r8, r9, r11], &(0x7f0000000600)=[{0x1, 0x4, 0xe, 0x9}, {0x5, 0x1, 0xf, 0x6}, {0x5, 0x2, 0x1, 0xc}], 0x10, 0x4}, 0x94) 891.90669ms ago: executing program 0 (id=4590): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000080)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x9, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2c, &(0x7f0000000300)=[{}], 0x8, 0x10, &(0x7f0000000340), &(0x7f0000000380), 0x8, 0x77, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0xf, 0x4cb, 0xfffffff7, 0x1, 0x70, 0xffffffffffffffff, 0x2, '\x00', r0, 0xffffffffffffffff, 0x0, 0x5, 0x1}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="00fcffffff180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000009000000850000006c00000095000000000000009eeb8d5bc612804014892b758e2c6b2dbdecbe2829e780185136e986866edaa4a2144290136cca75c38b18dd7e3977076364187887317f54c7d0ed5fb54ca33621e75c1432a4d743c356c7088c10a829d1aeec473abf72365aacec401e92531f438424071f8b000a811e07a75acd1e65dc2fb44d9b10bc75a304ac54d2e086879a88622dca31fc46167ff8cceba4d8cad90776fa3f73a4b5a70982695afdbb3d3f123bdc9b8d937faf8277a55258c58ee832ed916fda6ed1e4b666b0267343d43e9a445c3372cfa60fcffc04099b145270310e8c8a"], &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a7}, 0x94) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440), 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r4, 0x80}, 0x50) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x1, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x7fffffffffffffff}, 0x0, 0xca, 0xffffffff, 0x2, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x2) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x3, 0x8, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000009000001000000001a9e0000850000002700000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000000)='GPL\x00', 0xa}, 0x94) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) (async, rerun: 64) recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9b, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40280, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3ff, 0x7fff}, 0x0, 0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)={0xffffffffffffffff}) (async, rerun: 32) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) (async, rerun: 32) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=ANY=[@ANYRES32=r12, @ANYRESDEC=r9, @ANYRES64=r4, @ANYRESOCT=r3, @ANYRESOCT=r11, @ANYRES8=r10, @ANYRESDEC], 0x128}, 0x84) recvmsg$unix(r12, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/user\x00') (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) r13 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r8, &(0x7f0000000200)=ANY=[@ANYRES8=r6, @ANYRES8=r13], 0x12) bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB="000000001d4000367a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) 439.987646ms ago: executing program 3 (id=4591): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)=ANY=[@ANYRESDEC=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x8, &(0x7f0000001340)=ANY=[@ANYBLOB="beaa000000000000791008000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000bf03000000000000850000000c000000b70000000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9c, 0x1, 0x0, 0x0, 0x0, 0x200000, 0x62030, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) recvmsg$unix(r0, &(0x7f0000004140)={&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000004080)=[{&(0x7f00000007c0)=""/100, 0x64}, {&(0x7f0000001d80)=""/4096, 0x1000}, {&(0x7f0000002d80)=""/47, 0x2f}, {&(0x7f0000002dc0)=""/36, 0x24}, {&(0x7f0000002e00)=""/105, 0x69}, {&(0x7f0000002e80)=""/4096, 0x1000}, {&(0x7f0000003e80)=""/213, 0xd5}, {&(0x7f0000003f80)=""/228, 0xe4}], 0x8, &(0x7f0000004100)=[@cred={{0x1c}}], 0x20}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @multicast1}, 0x2}}, 0x80, 0x0}, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0xffffffff, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef8020ab070011000523a608463a3f"], 0xfe33) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x5}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bridge0\x00', 0x100}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[], 0x48) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f0, &(0x7f0000000080)) socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6493790710000000000080000b2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249f21c6eee84309e7a23c19a394830f2539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bfb1c0e6b1244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbb888b0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f94479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b844139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323478a9968100000005"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0x9, 0x10, 0x0, 0xb}, 0x94) 416.565222ms ago: executing program 2 (id=4592): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x12, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008fdf39da2cb1e44a634e1200135858e79e7bfb3f5a27734b71446f77000000c8982c2c06", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000700008500000086000000bf0900000000000055090100000000009500000000000000bdba06000000000018000000060000000000000009000000bf91000000000000b702000003000000850000002a000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x3, 0x1011, &(0x7f0000000800)=""/4113, 0x40f00, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x62}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="180100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000500)={@ifindex, 0x13, 0x1, 0x46cb, 0x0, 0x0, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300), 0x0}, 0x40) r4 = socket$kcm(0x29, 0x5, 0x0) sendmsg$inet(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000400)=[{}], 0x1}, 0x48014) sendmsg(r4, 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)={0x6, 0x0}, 0x8) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000540)={@fallback=r4, r1, 0x22, 0x2b, r2, @void, @void, @void, @value=r5, r3}, 0x20) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_freezer_state(r6, &(0x7f0000000140), 0x2, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={@cgroup=r6, r0, 0x38, 0x8, 0x0, @void, @value=r0, @void, @void, r3}, 0x20) r7 = socket$kcm(0x2, 0x200000000000001, 0x106) ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x89e2, &(0x7f0000000000)={r7}) setsockopt$sock_attach_bpf(r7, 0x6, 0xd, 0x0, 0xc7) 240.366083ms ago: executing program 1 (id=4593): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="12000000040000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f00000001c0), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000180)={r1, &(0x7f0000000040), 0x0}, 0x20) r2 = socket$kcm(0x10, 0x2, 0x4) close(r2) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006b7d373be35c6e17aa31046b876c1d0000007ea60864160af36508001dc0c30002000c0031009ee517d34460bc24eab556a705251e618294ff0051f60a84c9f472736f67c5e73bb9e5c446fa30be62cbd4938037e786", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 158.482672ms ago: executing program 2 (id=4594): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x13, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff}, [@map_fd={0x18, 0xd, 0x1, 0x0, r0}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) gettid() r1 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r1, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@timestamp_addr={0x44, 0xc, 0x7, 0x1, 0x7, [{@dev={0xac, 0x14, 0x14, 0x1d}, 0x5}]}]}}}], 0x40}, 0x200040c4) socket$kcm(0x10, 0x7, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000280), 0x9) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) openat$cgroup_ro(r2, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) openat$cgroup_ro(r2, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x0, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) r9 = openat$cgroup_procs(r6, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r9, &(0x7f0000000080)=r5, 0x12) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=4595): r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xb, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x3f}]}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000ec0)=ANY=[@ANYBLOB="0200000004000000", @ANYRES64=r0, @ANYRES32, @ANYBLOB, @ANYRES8=r0], 0x50) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x6, 0x5, &(0x7f0000000840)=ANY=[@ANYBLOB="180000000effd0010000000004"], 0x0, 0x3, 0xfa, &(0x7f0000000a00)=""/250}, 0x94) socket$kcm(0x10, 0x2, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x9) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_bp={&(0x7f0000000c40)}, 0x0, 0x3, 0x0, 0x3, 0x100000, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYRES64=r1, @ANYRES64, @ANYRES32=0x0, @ANYRES32, @ANYRES32=r0], 0x50) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r4, 0x0, 0x0}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x6, 0x4, 0x2004, 0x9, 0x0, 0x1, 0xfffffffe}, 0x50) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000000340)={r5, 0x0, 0x20000000}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="3211a72152495810ffffff7f000000000000000000", @ANYRES32, @ANYRES32=r0, @ANYBLOB="00000000020000000300"/27], 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f00000008c0)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xf121, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_config_ext={0xffffffffffffffff, 0x2b4}, 0x1d10c, 0x10000, 0x100, 0x7, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x1ffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair(0x21, 0x6, 0x3, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="d8000000140081054e81f782db44b904021f08020a000000040000a118000200e00000e4ffff0d1208000f0100810401880016ea1f0006400303000803600cfab94dcf5c0461c1d67f6f94007134cf6ee080005c8400f45312b3429fa0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a0000", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r7 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r7, 0x29, 0x1a, 0x0, 0x0) syz_clone(0x2c9a4080, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) socket$kcm(0x10, 0x2, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x18, 0x60, &(0x7f0000000d00)=ANY=[], &(0x7f0000000740)='GPL\x00', 0xa, 0x4c, &(0x7f0000000780)=""/76, 0x40f00, 0x72, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000000800)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000840)={0x1, 0x1, 0xffff, 0x7f}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000008c0)=[r1, r1, 0xffffffffffffffff, r8, 0xffffffffffffffff], 0x0, 0x10, 0x9}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x4, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000f0ffff0000007347000000850000002700000300000000d0000000950000000014f800"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) kernel console output (not intermixed with test programs): s `syz.2.3065'. [ 711.936361][T18004] netlink: 10 bytes leftover after parsing attributes in process `syz.1.3070'. [ 711.941162][T17997] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.3069'. [ 711.971112][T18003] netlink: 10 bytes leftover after parsing attributes in process `syz.1.3070'. [ 712.030930][T18004] netlink: 'syz.1.3070': attribute type 9 has an invalid length. [ 712.874998][T18027] ªªªªªª: renamed from vlan0 (while UP) [ 713.800328][T18039] netlink: 'syz.3.3071': attribute type 19 has an invalid length. [ 713.811555][T18039] __nla_validate_parse: 3 callbacks suppressed [ 713.811571][T18039] netlink: 172 bytes leftover after parsing attributes in process `syz.3.3071'. [ 714.118158][T18023] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3071'. [ 714.165233][T18023] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 715.683729][T18088] syzkaller0: entered promiscuous mode [ 715.689583][T18088] syzkaller0: entered allmulticast mode [ 717.410266][T18102] netlink: 'syz.1.3088': attribute type 19 has an invalid length. [ 717.419131][T18102] netlink: 172 bytes leftover after parsing attributes in process `syz.1.3088'. [ 717.444221][T18102] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3088'. [ 717.462723][T18102] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 718.439930][T18128] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 719.154672][T18144] netlink: 4091 bytes leftover after parsing attributes in process `syz.3.3099'. [ 719.176968][T18145] netlink: 192436 bytes leftover after parsing attributes in process `syz.1.3100'. [ 719.224881][T18145] openvswitch: netlink: Key type 8208 is out of range max 32 [ 719.881148][T18150] netlink: 'syz.3.3101': attribute type 19 has an invalid length. [ 719.925033][T18150] netlink: 172 bytes leftover after parsing attributes in process `syz.3.3101'. [ 720.008038][T18150] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3101'. [ 720.032181][T18150] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 720.102139][T18169] netlink: 'syz.0.3106': attribute type 10 has an invalid length. [ 720.120935][T18169] netlink: 168 bytes leftover after parsing attributes in process `syz.0.3106'. [ 720.652579][T18180] netlink: 'syz.0.3110': attribute type 10 has an invalid length. [ 720.756634][T18180] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 721.383093][T18199] netlink: 15999 bytes leftover after parsing attributes in process `syz.1.3114'. [ 721.590354][T18210] netlink: 'syz.1.3117': attribute type 9 has an invalid length. [ 721.600772][T18210] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.3117'. [ 721.693298][T18212] mac80211_hwsim hwsim53 wlan1: entered promiscuous mode [ 721.749763][T18212] mac80211_hwsim hwsim53 wlan1: entered allmulticast mode [ 721.899435][T18220] netlink: 'syz.0.3120': attribute type 6 has an invalid length. [ 721.909361][T18220] netlink: 168 bytes leftover after parsing attributes in process `syz.0.3120'. [ 722.046597][T18228] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3122'. [ 722.067444][T18228] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 722.205931][T18240] netlink: 'syz.3.3123': attribute type 29 has an invalid length. [ 722.290097][T18233] netlink: 'syz.1.3121': attribute type 16 has an invalid length. [ 722.299082][T18242] netlink: 'syz.3.3123': attribute type 29 has an invalid length. [ 722.307337][T18233] netlink: 2 bytes leftover after parsing attributes in process `syz.1.3121'. [ 722.318399][T18240] netlink: 'syz.3.3123': attribute type 29 has an invalid length. [ 723.272610][T18254] netlink: 'syz.3.3126': attribute type 10 has an invalid length. [ 723.365326][T18254] team0: Port device dummy0 added [ 723.467138][T18259] bridge0: port 1(bridge_slave_0) entered disabled state [ 723.549505][T18260] bridge0: port 1(bridge_slave_0) entered blocking state [ 723.557550][T18260] bridge0: port 1(bridge_slave_0) entered forwarding state [ 724.227314][T18280] netlink: 'syz.0.3135': attribute type 41 has an invalid length. [ 724.610679][ T5778] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 724.625499][T18286] delete_channel: no stack [ 725.141710][T18298] __nla_validate_parse: 1 callbacks suppressed [ 725.141728][T18298] netlink: 14601 bytes leftover after parsing attributes in process `syz.1.3140'. [ 725.193996][T18300] netlink: 14601 bytes leftover after parsing attributes in process `syz.1.3140'. [ 727.235557][T18315] netlink: 'syz.1.3147': attribute type 1 has an invalid length. [ 727.285663][T18315] netlink: 'syz.1.3147': attribute type 2 has an invalid length. [ 727.334970][T18315] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3147'. [ 727.463193][T18324] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.3142'. [ 727.476229][T18324] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.3142'. [ 727.513451][T18324] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.3142'. [ 727.548467][T18297] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.3142'. [ 727.708295][T18297] netlink: 'syz.0.3142': attribute type 10 has an invalid length. [ 727.746841][T18297] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3142'. [ 727.839415][T18328] netlink: 'syz.3.3150': attribute type 5 has an invalid length. [ 729.158065][T18350] syz.0.3156[18350] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 729.158498][T18350] syz.0.3156[18350] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 729.269935][T18326] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3149'. [ 729.382031][T18349] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3156'. [ 729.722960][T18326] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 729.938926][T18349] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 730.430454][T18372] netlink: 'syz.2.3161': attribute type 29 has an invalid length. [ 730.574900][T18372] netlink: 'syz.2.3161': attribute type 3 has an invalid length. [ 730.602533][T18372] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3161'. [ 730.633417][T18373] netlink: 'syz.0.3162': attribute type 1 has an invalid length. [ 730.680885][T18373] netlink: 'syz.0.3162': attribute type 2 has an invalid length. [ 730.697737][T18373] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3162'. [ 731.226650][T18389] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3165'. [ 732.722336][T18404] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3170'. [ 732.768215][T18404] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 733.141132][T18430] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3174'. [ 733.365839][ T6712] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 734.578642][T18446] netlink: 'syz.2.3178': attribute type 1 has an invalid length. [ 734.594825][T18446] netlink: 'syz.2.3178': attribute type 2 has an invalid length. [ 734.615957][T18446] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3178'. [ 734.835230][ T5778] Bluetooth: hci0: unexpected subevent 0x01 length: 150 > 18 [ 734.842872][ T5778] Bluetooth: hci0: Invalid handle: 0x5393 > 0x0eff [ 734.913826][ T5778] Bluetooth: hci0: unexpected subevent 0x01 length: 150 > 18 [ 735.490972][T18484] syz.2.3187[18484] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 735.491115][T18484] syz.2.3187[18484] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 735.714725][T18488] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3188'. [ 735.844796][T18487] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3188'. [ 736.014019][T18488] netlink: 'syz.0.3188': attribute type 10 has an invalid length. [ 736.094574][T18488] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3188'. [ 736.124398][T18469] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3183'. [ 736.174731][T18469] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 736.212283][T18494] can: request_module (can-proto-0) failed. [ 736.397753][T18499] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.3190'. [ 736.911019][T18525] netlink: 'syz.0.3194': attribute type 3 has an invalid length. [ 736.934498][T18525] netlink: 201372 bytes leftover after parsing attributes in process `syz.0.3194'. [ 736.969572][ T5783] Bluetooth: hci0: command 0x0406 tx timeout [ 737.461738][T18527] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3195'. [ 737.524544][T18533] netlink: 'syz.3.3196': attribute type 10 has an invalid length. [ 737.561588][T18533] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3196'. [ 737.646753][T18533] batman_adv: : Adding interface: virt_wifi0 [ 737.674517][T18533] batman_adv: : The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 737.742918][T18533] batman_adv: : Interface activated: virt_wifi0 [ 738.022041][T18548] syzkaller0: entered promiscuous mode [ 738.064399][T18548] syzkaller0: entered allmulticast mode [ 738.215883][T18554] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.3201'. [ 738.305744][T18554] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.3201'. [ 741.667110][T18637] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 741.674674][T18637] IPv6: NLM_F_CREATE should be set when creating new route [ 741.682209][T18637] IPv6: NLM_F_CREATE should be set when creating new route [ 741.689896][T18637] IPv6: NLM_F_CREATE should be set when creating new route [ 741.710708][T18637] netlink: 'syz.1.3218': attribute type 9 has an invalid length. [ 741.719302][T18637] __nla_validate_parse: 65 callbacks suppressed [ 741.719333][T18637] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.3218'. [ 742.447740][T18657] netlink: 1039 bytes leftover after parsing attributes in process `syz.2.3225'. [ 742.710661][T18678] netlink: 212912 bytes leftover after parsing attributes in process `syz.2.3227'. [ 742.750278][T18678] openvswitch: netlink: Key type 4112 is out of range max 32 [ 742.759241][T18679] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3226'. [ 742.788015][T18679] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 742.889498][T18679] tap0: tun_chr_ioctl cmd 1074025676 [ 742.895928][T18679] tap0: owner set to 776 [ 743.077426][T18687] netlink: 'syz.3.3228': attribute type 1 has an invalid length. [ 743.188851][T18691] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 744.222121][T18709] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3240'. [ 744.288317][T18709] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 744.379485][T18709] tap0: tun_chr_ioctl cmd 1074025676 [ 744.394536][T18709] tap0: owner set to 776 [ 744.792033][T18722] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.3239'. [ 744.825606][T18722] netlink: 'syz.0.3239': attribute type 21 has an invalid length. [ 745.729207][T18751] netlink: 'syz.0.3249': attribute type 13 has an invalid length. [ 745.749940][T18751] netlink: 'syz.0.3249': attribute type 58 has an invalid length. [ 745.761498][T18751] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3249'. [ 745.970665][T18758] syzkaller0: entered promiscuous mode [ 745.979532][T18758] syzkaller0: entered allmulticast mode [ 747.453137][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.464428][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.092925][T18769] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3252'. [ 748.107218][T18769] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 748.134777][T18780] tap0: tun_chr_ioctl cmd 1074025676 [ 748.143734][T18780] tap0: owner set to 776 [ 749.560027][ T5778] Bluetooth: hci1: command 0x0406 tx timeout [ 754.151426][T18825] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3262'. [ 754.919981][T18861] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3267'. [ 754.945214][T18861] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 754.981379][T18861] tap0: tun_chr_ioctl cmd 1074025676 [ 754.992493][T18861] tap0: owner set to 776 [ 759.422609][T18898] netlink: 'syz.3.3277': attribute type 5 has an invalid length. [ 759.430784][T18899] netlink: 'syz.3.3277': attribute type 15 has an invalid length. [ 759.439337][T18899] netlink: 'syz.3.3277': attribute type 7 has an invalid length. [ 759.448210][T18902] netlink: 'syz.3.3277': attribute type 5 has an invalid length. [ 759.456407][T18903] netlink: 'syz.3.3277': attribute type 15 has an invalid length. [ 759.466598][T18903] netlink: 'syz.3.3277': attribute type 7 has an invalid length. [ 759.625295][T18914] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.3279'. [ 759.770955][T18920] netlink: 'syz.0.3282': attribute type 39 has an invalid length. [ 760.133672][T18935] netlink: 'syz.0.3286': attribute type 2 has an invalid length. [ 760.215062][T18933] sit0: entered allmulticast mode [ 760.752626][T18969] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3293'. [ 760.790583][T18969] netlink: 'syz.1.3293': attribute type 21 has an invalid length. [ 760.804510][T18969] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3293'. [ 760.813979][T18969] netlink: 'syz.1.3293': attribute type 1 has an invalid length. [ 760.943082][T18971] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.3294'. [ 761.155288][T18974] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3295'. [ 761.553875][T18984] mac80211_hwsim hwsim40 ..ãc¤±: renamed from wlan1 [ 761.628051][T18977] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3296'. [ 761.724072][T18980] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.3297'. [ 761.753814][T18980] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.3297'. [ 761.809666][T18980] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.3297'. [ 761.829316][T18980] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.3297'. [ 763.378519][T19044] geneve0: entered promiscuous mode [ 763.553532][T19044] : (slave geneve0): Enslaving as an active interface with an up link [ 763.805449][T19056] syzkaller0: entered promiscuous mode [ 763.811322][T19056] syzkaller0: entered allmulticast mode [ 763.856307][T19060] veth1_vlan: entered allmulticast mode [ 763.968024][T19060] team0: Device veth1_vlan failed to register rx_handler [ 764.559989][T19075] validate_nla: 41 callbacks suppressed [ 764.560008][T19075] netlink: 'syz.0.3322': attribute type 9 has an invalid length. [ 765.365708][ T9457] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 766.403849][T19069] netlink: 'syz.3.3320': attribute type 10 has an invalid length. [ 766.412082][T19069] __nla_validate_parse: 31 callbacks suppressed [ 766.412090][T19069] netlink: 55 bytes leftover after parsing attributes in process `syz.3.3320'. [ 766.427931][T19069] batman_adv: : Interface deactivated: veth0_vlan [ 766.590862][T19069] batman_adv: : Removing interface: veth0_vlan [ 766.652810][T19069] bond0: (slave macvlan0): Releasing backup interface [ 766.688816][T19068] netlink: 'syz.3.3320': attribute type 10 has an invalid length. [ 766.696867][T19068] netlink: 55 bytes leftover after parsing attributes in process `syz.3.3320'. [ 766.709702][T19074] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 766.717128][T19074] IPv6: NLM_F_CREATE should be set when creating new route [ 766.724566][T19074] IPv6: NLM_F_CREATE should be set when creating new route [ 766.731795][T19074] IPv6: NLM_F_CREATE should be set when creating new route [ 766.740244][T19077] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 766.798636][T19078] netlink: 'syz.1.3323': attribute type 9 has an invalid length. [ 766.824823][T19078] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.3323'. [ 766.874126][T19079] netlink: 'syz.0.3322': attribute type 9 has an invalid length. [ 766.893856][T19079] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.3322'. [ 766.925963][T19090] netlink: 18187 bytes leftover after parsing attributes in process `syz.2.3326'. [ 767.016778][T19083] netlink: 'syz.1.3323': attribute type 9 has an invalid length. [ 767.046003][T19083] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.3323'. [ 767.112368][T19097] netlink: 14546 bytes leftover after parsing attributes in process `syz.0.3328'. [ 767.238885][T19103] netlink: 'syz.3.3330': attribute type 13 has an invalid length. [ 767.252111][T19103] netlink: 24643 bytes leftover after parsing attributes in process `syz.3.3330'. [ 767.280594][T19095] -1: renamed from syzkaller0 [ 768.476078][T19131] netlink: 'syz.0.3336': attribute type 10 has an invalid length. [ 768.595596][T19131] bridge0: port 2(bridge_slave_1) entered disabled state [ 768.950082][T19131] bridge_slave_1: left allmulticast mode [ 768.969057][T19131] bridge_slave_1: left promiscuous mode [ 768.987865][T19131] bridge0: port 2(bridge_slave_1) entered disabled state [ 769.365896][T19131] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 769.635999][T19157] netlink: 'syz.2.3341': attribute type 9 has an invalid length. [ 769.643832][T19157] netlink: 61951 bytes leftover after parsing attributes in process `syz.2.3341'. [ 770.001825][T19167] netlink: 'syz.3.3343': attribute type 10 has an invalid length. [ 770.023661][T19167] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3343'. [ 770.039448][T19167] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 770.274793][T19175] sock: sock_timestamping_bind_phc: sock not bind to device [ 770.589894][T19181] netlink: 'syz.1.3348': attribute type 29 has an invalid length. [ 770.598203][T19181] netlink: 'syz.1.3348': attribute type 29 has an invalid length. [ 770.611457][T19181] netlink: 'syz.1.3348': attribute type 29 has an invalid length. [ 770.625775][T19181] netlink: 'syz.1.3348': attribute type 21 has an invalid length. [ 770.642084][T19184] netlink: 'syz.1.3348': attribute type 29 has an invalid length. [ 770.672191][T19188] netlink: 'syz.1.3348': attribute type 21 has an invalid length. [ 770.724783][T19187] netlink: 'syz.1.3348': attribute type 29 has an invalid length. [ 770.752880][T19179] netlink: 'syz.2.3347': attribute type 10 has an invalid length. [ 770.764022][T19197] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 771.841725][T19221] syzkaller0: entered promiscuous mode [ 771.850761][T19221] syzkaller0: entered allmulticast mode [ 772.190806][T19227] sock: sock_timestamping_bind_phc: sock not bind to device [ 777.461559][T19227] __nla_validate_parse: 2 callbacks suppressed [ 777.461570][T19227] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3357'. [ 777.524915][T19227] bridge0: port 1(bridge_slave_0) entered disabled state [ 777.616381][T19227] bridge_slave_0 (unregistering): left allmulticast mode [ 777.623482][T19227] bridge_slave_0 (unregistering): left promiscuous mode [ 777.630703][T19227] bridge0: port 1(bridge_slave_0) entered disabled state [ 777.978210][T19243] netlink: 'syz.3.3361': attribute type 10 has an invalid length. [ 777.998336][T19243] netlink: 2 bytes leftover after parsing attributes in process `syz.3.3361'. [ 778.024469][T19243] hsr0: entered promiscuous mode [ 778.046307][T19243] bridge0: port 1(hsr0) entered blocking state [ 778.083119][T19243] bridge0: port 1(hsr0) entered disabled state [ 778.123230][T19243] hsr0: entered allmulticast mode [ 778.168358][T19243] hsr_slave_0: entered allmulticast mode [ 778.279346][T19243] hsr_slave_1: entered allmulticast mode [ 778.326236][T19243] bridge0: port 1(hsr0) entered blocking state [ 778.332573][T19243] bridge0: port 1(hsr0) entered forwarding state [ 778.443183][T19252] netlink: 'syz.2.3365': attribute type 2 has an invalid length. [ 778.473290][T19252] netlink: 'syz.2.3365': attribute type 8 has an invalid length. [ 778.486779][T19252] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3365'. [ 778.505079][T19254] caif0: entered allmulticast mode [ 782.192596][T19278] netlink: 763 bytes leftover after parsing attributes in process `syz.2.3370'. [ 782.527704][T19294] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 782.635956][T19295] sock: sock_timestamping_bind_phc: sock not bind to device [ 782.644145][T19297] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 782.663496][T19297] syzkaller1: linktype set to 825 [ 782.693562][T19295] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3373'. [ 782.744462][T19295] bridge0: port 1(bridge_slave_0) entered disabled state [ 782.900856][T19295] bridge0: port 1(bridge_slave_0) entered disabled state [ 783.253419][T19303] netlink: 'syz.0.3378': attribute type 10 has an invalid length. [ 783.266062][T19303] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3378'. [ 783.277182][T19303] hsr0: entered promiscuous mode [ 783.282937][T19303] bridge0: port 1(hsr0) entered blocking state [ 783.301646][T19303] bridge0: port 1(hsr0) entered disabled state [ 783.311890][T19303] hsr0: entered allmulticast mode [ 783.321834][T19303] hsr_slave_0: entered allmulticast mode [ 783.331093][T19303] bridge0: port 1(hsr0) entered blocking state [ 783.337492][T19303] bridge0: port 1(hsr0) entered forwarding state [ 783.730408][T19317] netlink: 3076 bytes leftover after parsing attributes in process `syz.0.3389'. [ 783.740286][T19317] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.3389'. [ 784.481529][T19332] netlink: 'syz.3.3384': attribute type 1 has an invalid length. [ 784.499415][T19332] netlink: 60387 bytes leftover after parsing attributes in process `syz.3.3384'. [ 787.863615][T19333] netlink: 'syz.3.3384': attribute type 10 has an invalid length. [ 787.886258][T19333] bridge0: port 1(hsr0) entered disabled state [ 787.899970][T19333] hsr0: left allmulticast mode [ 787.904945][T19333] hsr_slave_0: left allmulticast mode [ 787.910319][T19333] hsr_slave_1: left allmulticast mode [ 787.916300][T19333] bridge0: port 1(hsr0) entered disabled state [ 787.930434][T19333] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 787.950145][T19333] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 787.961441][T19333] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 787.973915][T19333] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 788.132221][T19349] netlink: 'syz.3.3390': attribute type 4 has an invalid length. [ 788.220649][T19346] sock: sock_timestamping_bind_phc: sock not bind to device [ 788.240208][T19346] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3387'. [ 788.338287][T19356] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3391'. [ 788.390955][T19346] bridge0: port 1(bridge_slave_0) entered disabled state [ 788.739762][T19346] bridge_slave_0 (unregistering): left allmulticast mode [ 788.754182][T19346] bridge_slave_0 (unregistering): left promiscuous mode [ 788.763173][T19346] bridge0: port 1(bridge_slave_0) entered disabled state [ 791.185676][T19356] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3391'. [ 791.277029][T19362] netlink: 'syz.3.3394': attribute type 29 has an invalid length. [ 791.303757][T19362] netlink: 'syz.3.3394': attribute type 29 has an invalid length. [ 791.315791][T19362] netlink: 'syz.3.3394': attribute type 29 has an invalid length. [ 791.319376][T19370] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.3397'. [ 791.333349][T19369] netlink: 'syz.3.3394': attribute type 29 has an invalid length. [ 791.342086][T19370] netlink: zone id is out of range [ 791.351610][T19370] netlink: zone id is out of range [ 791.357309][T19370] netlink: zone id is out of range [ 791.362459][T19370] netlink: zone id is out of range [ 791.380494][T19370] netlink: zone id is out of range [ 791.394827][T19370] netlink: zone id is out of range [ 791.406524][T19370] netlink: zone id is out of range [ 791.411686][T19370] netlink: zone id is out of range [ 791.427012][T19371] netlink: 'syz.1.3397': attribute type 29 has an invalid length. [ 791.445216][T19370] netlink: zone id is out of range [ 791.450552][T19370] netlink: zone id is out of range [ 791.457750][T19371] netlink: 'syz.1.3397': attribute type 29 has an invalid length. [ 791.468119][T19370] netlink: 'syz.1.3397': attribute type 29 has an invalid length. [ 791.475940][T19375] netlink: 11562 bytes leftover after parsing attributes in process `syz.3.3398'. [ 791.902091][T19389] netlink: 'syz.1.3401': attribute type 10 has an invalid length. [ 792.114404][T19389] bridge0: port 2(bridge_slave_1) entered disabled state [ 792.136711][T19389] bridge_slave_1: left allmulticast mode [ 792.143124][T19389] bridge_slave_1: left promiscuous mode [ 792.162295][T19389] bridge0: port 2(bridge_slave_1) entered disabled state [ 792.314778][T19389] bridge_slave_1: entered promiscuous mode [ 792.368492][T19389] : (slave bridge_slave_1): Enslaving as an active interface with an up link [ 792.540723][T19398] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3402'. [ 793.005992][T19421] netlink: 'syz.1.3408': attribute type 4 has an invalid length. [ 793.048574][T19421] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3408'. [ 794.064954][T19438] netlink: 16399 bytes leftover after parsing attributes in process `syz.2.3412'. [ 795.232110][T19462] netlink: 'syz.1.3419': attribute type 3 has an invalid length. [ 795.260193][T19462] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3419'. [ 796.151011][T19475] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3423'. [ 797.365572][ T6721] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 797.500592][T19485] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.3428'. [ 797.532888][T19487] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.3428'. [ 797.778877][T19486] net_ratelimit: 240 callbacks suppressed [ 797.778895][T19486] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 797.904337][T19491] validate_nla: 1 callbacks suppressed [ 797.932574][T19491] netlink: 'syz.1.3430': attribute type 2 has an invalid length. [ 797.954711][T19491] netlink: 184 bytes leftover after parsing attributes in process `syz.1.3430'. [ 798.134991][T19497] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3439'. [ 798.169536][T19497] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3439'. [ 798.280393][T19497] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3439'. [ 801.592618][T19528] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3436'. [ 801.741619][T19528] team0: Port device C removed [ 801.758832][T19528] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 802.091780][T19568] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3441'. [ 802.158059][T19569] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3442'. [ 803.353638][T19602] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 803.371686][T19606] netlink: 'syz.1.3452': attribute type 10 has an invalid length. [ 803.386241][T19602] netlink: 'syz.0.3458': attribute type 9 has an invalid length. [ 803.403319][T19602] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.3458'. [ 804.053712][T19614] tap0: tun_chr_ioctl cmd 1074025677 [ 804.063076][T19614] tap0: linktype set to 778 [ 806.554680][T19630] netlink: 'syz.1.3457': attribute type 10 has an invalid length. [ 806.760584][T19639] netlink: 'syz.3.3462': attribute type 1 has an invalid length. [ 806.779804][T19639] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3462'. [ 806.961525][T19645] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3464'. [ 807.082470][T19645] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 807.239467][T19652] netlink: 'syz.2.3467': attribute type 10 has an invalid length. [ 807.593932][T19664] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3470'. [ 807.821173][T19669] netlink: 'syz.1.3472': attribute type 21 has an invalid length. [ 807.834543][T19669] netlink: 'syz.1.3472': attribute type 19 has an invalid length. [ 807.849366][T19669] netlink: 14536 bytes leftover after parsing attributes in process `syz.1.3472'. [ 808.311049][T19685] netlink: 'syz.2.3477': attribute type 10 has an invalid length. [ 808.324053][T19685] netlink: 'syz.2.3477': attribute type 10 has an invalid length. [ 808.377894][T19685] : (slave netdevsim0): Enslaving as an active interface with an up link [ 808.392370][T19693] netlink: 'syz.0.3478': attribute type 13 has an invalid length. [ 808.411160][T19693] netlink: 'syz.0.3478': attribute type 58 has an invalid length. [ 808.419645][T19693] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3478'. [ 808.492237][T19697] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3480'. [ 808.539909][T19697] team0: Port device  removed [ 808.565981][T19697]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 808.583312][T19697] bond_slave_0: left promiscuous mode [ 808.608295][T19697]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 808.630894][T19697] bond_slave_1: left promiscuous mode [ 808.667868][ T5783] Bluetooth: hci4: unexpected event 0x04 length: 15 > 10 [ 808.672105][T19697]  (unregistering): (slave syz_tun): Releasing backup interface [ 808.726823][T19697]  (unregistering): (slave geneve0): Releasing backup interface [ 808.760510][T19697]  (unregistering): (slave bridge_slave_1): Releasing backup interface [ 808.770883][T19697] bridge_slave_1: left promiscuous mode [ 808.780371][T19697]  (unregistering): Released all slaves [ 808.889447][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.896395][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.056141][T19706] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3484'. [ 809.067240][T19706] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3484'. [ 809.315164][T19713] netlink: 201392 bytes leftover after parsing attributes in process `syz.3.3485'. [ 809.393382][T19713] netlink: zone id is out of range [ 809.465158][T19713] netlink: zone id is out of range [ 809.496300][T19713] netlink: zone id is out of range [ 809.501495][T19713] netlink: zone id is out of range [ 809.537378][T19713] netlink: zone id is out of range [ 809.542566][T19713] netlink: zone id is out of range [ 809.599974][T19713] netlink: zone id is out of range [ 809.639357][T19713] netlink: zone id is out of range [ 809.658897][T19713] netlink: zone id is out of range [ 809.777568][T19722] netlink: 209340 bytes leftover after parsing attributes in process `syz.2.3488'. [ 809.896408][T19726] netlink: 'syz.3.3490': attribute type 19 has an invalid length. [ 809.987615][T19727] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 810.004484][T19727] CPU: 0 PID: 19727 Comm: syz.0.3489 Not tainted syzkaller #0 [ 810.012015][T19727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 810.022104][T19727] Call Trace: [ 810.025418][T19727] [ 810.028366][T19727] dump_stack_lvl+0x18c/0x250 [ 810.033098][T19727] ? show_regs_print_info+0x20/0x20 [ 810.038341][T19727] ? load_image+0x420/0x420 [ 810.042898][T19727] sysfs_warn_dup+0x8e/0xa0 [ 810.047428][T19727] sysfs_do_create_link_sd+0xc0/0x110 [ 810.052808][T19727] device_add_class_symlinks+0x1cf/0x240 [ 810.058457][T19727] device_add+0x4f9/0xc40 [ 810.062827][T19727] wiphy_register+0x1d99/0x2ac0 [ 810.067733][T19727] ? cfg80211_event_work+0x40/0x40 [ 810.072877][T19727] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 810.079072][T19727] ieee80211_register_hw+0x2dd8/0x3b30 [ 810.084586][T19727] ? ieee80211_register_hw+0xfb1/0x3b30 [ 810.090177][T19727] ? ieee80211_tasklet_handler+0x20/0x20 [ 810.095849][T19727] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 810.101770][T19727] ? __debug_object_init+0xec/0x450 [ 810.106993][T19727] ? __asan_memset+0x22/0x40 [ 810.111606][T19727] ? __hrtimer_init+0x189/0x270 [ 810.116469][T19727] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 810.122222][T19727] ? mac80211_hwsim_free+0x220/0x220 [ 810.127513][T19727] ? rcu_is_watching+0x15/0xb0 [ 810.132286][T19727] ? kstrndup+0xbd/0x140 [ 810.136551][T19727] hwsim_new_radio_nl+0xdad/0x1a70 [ 810.141671][T19727] ? __nla_validate+0x50/0x50 [ 810.146367][T19727] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 810.152704][T19727] ? __nla_parse+0x40/0x50 [ 810.157123][T19727] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 810.163457][T19727] genl_family_rcv_msg_doit+0x21a/0x310 [ 810.169012][T19727] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 810.174924][T19727] ? bpf_lsm_capable+0x9/0x10 [ 810.179687][T19727] ? security_capable+0x89/0xb0 [ 810.184578][T19727] genl_rcv_msg+0x611/0x7a0 [ 810.189091][T19727] ? genl_bind+0x360/0x360 [ 810.193512][T19727] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 810.199858][T19727] netlink_rcv_skb+0x235/0x4c0 [ 810.204627][T19727] ? genl_bind+0x360/0x360 [ 810.209046][T19727] ? netlink_ack+0x1160/0x1160 [ 810.213817][T19727] ? __lock_acquire+0x7d80/0x7d80 [ 810.218847][T19727] ? down_read+0x1ac/0x2e0 [ 810.223260][T19727] genl_rcv+0x28/0x40 [ 810.227245][T19727] netlink_unicast+0x7b1/0x930 [ 810.232030][T19727] netlink_sendmsg+0x8d0/0xbf0 [ 810.236804][T19727] ? netlink_getsockopt+0x590/0x590 [ 810.242005][T19727] ? apparmor_socket_sendmsg+0x8e/0x330 [ 810.247555][T19727] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 810.252842][T19727] ? security_socket_sendmsg+0x80/0xa0 [ 810.258302][T19727] ? netlink_getsockopt+0x590/0x590 [ 810.263507][T19727] ____sys_sendmsg+0x61b/0x980 [ 810.268294][T19727] ? __asan_memset+0x22/0x40 [ 810.272888][T19727] ? __sys_sendmsg_sock+0x30/0x30 [ 810.277916][T19727] ? __import_iovec+0x5f2/0x850 [ 810.282776][T19727] ? import_iovec+0x73/0xa0 [ 810.287283][T19727] ___sys_sendmsg+0x2a6/0x360 [ 810.291970][T19727] ? __sys_sendmsg+0x2b0/0x2b0 [ 810.296784][T19727] __se_sys_sendmsg+0x1d0/0x2c0 [ 810.301641][T19727] ? __x64_sys_sendmsg+0x80/0x80 [ 810.306596][T19727] ? syscall_enter_from_user_mode+0x2e/0x80 [ 810.312491][T19727] do_syscall_64+0x55/0xb0 [ 810.316915][T19727] ? clear_bhb_loop+0x40/0x90 [ 810.321596][T19727] ? clear_bhb_loop+0x40/0x90 [ 810.326278][T19727] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 810.332265][T19727] RIP: 0033:0x7fb9a279e159 [ 810.336680][T19727] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 810.356286][T19727] RSP: 002b:00007fb9a3690028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 810.364699][T19727] RAX: ffffffffffffffda RBX: 00007fb9a2a26090 RCX: 00007fb9a279e159 [ 810.372667][T19727] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 810.380640][T19727] RBP: 00007fb9a283506b R08: 0000000000000000 R09: 0000000000000000 [ 810.388612][T19727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 810.396585][T19727] R13: 00007fb9a2a26128 R14: 00007fb9a2a26090 R15: 00007ffe619c17f8 [ 810.404580][T19727] [ 810.660658][T19740] tun0: tun_chr_ioctl cmd 1074025675 [ 810.669121][T19740] tun0: persist enabled [ 810.700577][T19740] tun0: tun_chr_ioctl cmd 1074025675 [ 810.725242][ T5783] Bluetooth: hci4: command 0x0406 tx timeout [ 810.739676][T19740] tun0: persist disabled [ 810.842984][T19751] netlink: 'syz.1.3496': attribute type 3 has an invalid length. [ 810.854951][T19751] netlink: 'syz.1.3496': attribute type 1 has an invalid length. [ 813.492284][T19756] netlink: 'syz.3.3497': attribute type 2 has an invalid length. [ 813.540715][T19756] __nla_validate_parse: 3 callbacks suppressed [ 813.540763][T19756] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3497'. [ 814.243639][T19780] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3505'. [ 814.295898][T19778] netlink: 202920 bytes leftover after parsing attributes in process `syz.3.3504'. [ 814.870116][T19796] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3509'. [ 815.177495][T19803] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3510'. [ 815.325837][T19796] team0: Port device C removed [ 815.375118][T19796] net_ratelimit: 81 callbacks suppressed [ 815.375257][T19796] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 816.639921][T19823] netlink: 'syz.1.3515': attribute type 29 has an invalid length. [ 816.729568][T19823] netlink: 'syz.1.3515': attribute type 29 has an invalid length. [ 817.169440][T19829] netlink: 'syz.3.3517': attribute type 21 has an invalid length. [ 817.197648][T19829] netlink: 'syz.3.3517': attribute type 19 has an invalid length. [ 817.214613][T19829] netlink: 14536 bytes leftover after parsing attributes in process `syz.3.3517'. [ 817.265607][T19836] hsr0: left allmulticast mode [ 817.270543][T19836] hsr_slave_0: left allmulticast mode [ 817.282869][T19836] bridge0: port 1(hsr0) entered disabled state [ 817.776349][T19861] syzkaller0: entered promiscuous mode [ 817.787535][T19861] syzkaller0: entered allmulticast mode [ 817.959668][T19869] netlink: 703 bytes leftover after parsing attributes in process `syz.2.3526'. [ 817.975915][T19867] netlink: 'syz.2.3526': attribute type 9 has an invalid length. [ 817.983802][T19867] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.3526'. [ 818.539483][T19888] netlink: 'syz.2.3529': attribute type 1 has an invalid length. [ 818.592295][T19888] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.3529'. [ 820.123434][T19908] netlink: 'syz.0.3534': attribute type 2 has an invalid length. [ 820.137286][T19908] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3534'. [ 820.543852][T19930] netlink: 'syz.1.3540': attribute type 29 has an invalid length. [ 820.565388][T19930] netlink: 'syz.1.3540': attribute type 29 has an invalid length. [ 820.585332][T19930] netlink: 'syz.1.3540': attribute type 29 has an invalid length. [ 820.594754][T19930] netlink: 'syz.1.3540': attribute type 29 has an invalid length. [ 820.749403][T19935] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 820.768745][T19935] netlink: 'syz.0.3541': attribute type 9 has an invalid length. [ 820.777341][T19935] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.3541'. [ 821.338799][T19944] netlink: 'syz.2.3545': attribute type 39 has an invalid length. [ 821.975191][T19965] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.3550'. [ 822.281890][T19979] netlink: 'syz.1.3553': attribute type 2 has an invalid length. [ 822.302996][T19979] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3553'. [ 822.619838][T19997] netlink: 'syz.0.3557': attribute type 10 has an invalid length. [ 822.657149][T19997] geneve0: entered promiscuous mode [ 822.690015][T19997] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 823.832405][T20046] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 823.839795][T20046] IPv6: NLM_F_CREATE should be set when creating new route [ 823.880148][T20044] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 824.072885][T20052] validate_nla: 1 callbacks suppressed [ 824.072962][T20052] netlink: 'syz.1.3568': attribute type 10 has an invalid length. [ 824.585554][T20068] netlink: 830 bytes leftover after parsing attributes in process `syz.0.3571'. [ 825.871748][T20106] netlink: 'syz.0.3582': attribute type 39 has an invalid length. [ 826.381091][T20119] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3587'. [ 826.488499][T20119] team0: Port device team_slave_0 removed [ 826.503944][T20121] netlink: 'syz.2.3588': attribute type 3 has an invalid length. [ 826.511688][T20119] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 826.559987][T20121] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3588'. [ 826.790175][T20127] netlink: 'syz.3.3589': attribute type 1 has an invalid length. [ 826.835996][T20134] netlink: 'syz.0.3590': attribute type 21 has an invalid length. [ 826.839794][T20127] netlink: 'syz.3.3589': attribute type 3 has an invalid length. [ 826.889068][ T5783] Bluetooth: hci0: unexpected subevent 0x0a length: 150 > 30 [ 826.905276][T20127] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3589'. [ 826.939849][T20132] netlink: 'syz.1.3591': attribute type 4 has an invalid length. [ 826.945176][T20134] netlink: 'syz.0.3590': attribute type 25 has an invalid length. [ 826.951609][T20132] netlink: 128124 bytes leftover after parsing attributes in process `syz.1.3591'. [ 826.995404][T20134] netlink: 'syz.0.3590': attribute type 27 has an invalid length. [ 827.094574][T20134] netlink: 'syz.0.3590': attribute type 28 has an invalid length. [ 827.819260][T20141] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3592'. [ 828.665353][T20174] C: renamed from team_slave_0 [ 828.676079][T20174] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3602'. [ 828.707537][T20174] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 830.688819][T20234] dvmrp1: tun_chr_ioctl cmd 1074025675 [ 830.704406][T20234] dvmrp1: persist disabled [ 831.150336][T20237] validate_nla: 18 callbacks suppressed [ 831.150353][T20237] netlink: 'syz.0.3618': attribute type 1 has an invalid length. [ 831.191243][T20237] netlink: 'syz.0.3618': attribute type 3 has an invalid length. [ 831.726003][T20249] netlink: 'syz.3.3622': attribute type 39 has an invalid length. [ 832.254424][T20277] netlink: 'syz.3.3628': attribute type 16 has an invalid length. [ 832.310371][T20277] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3628'. [ 833.038796][T20311] netlink: 16182 bytes leftover after parsing attributes in process `syz.1.3634'. [ 833.484983][T20336] netlink: 'syz.2.3635': attribute type 10 has an invalid length. [ 833.530086][T20336] bridge0: port 4(dummy0) entered disabled state [ 833.574746][T20336] dummy0: left allmulticast mode [ 833.587891][T20336] dummy0: left promiscuous mode [ 833.598116][T20336] bridge0: port 4(dummy0) entered disabled state [ 833.731250][T20346] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.3640'. [ 833.756515][T20324] syzkaller0: entered promiscuous mode [ 833.762130][T20324] syzkaller0: entered allmulticast mode [ 833.809828][T20346] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.3640'. [ 833.833224][T20348] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.3640'. [ 834.934380][T20371] netlink: 'syz.1.3646': attribute type 2 has an invalid length. [ 834.942180][T20371] netlink: 17267 bytes leftover after parsing attributes in process `syz.1.3646'. [ 836.200178][T20366] netlink: 'syz.2.3645': attribute type 29 has an invalid length. [ 838.430510][T20386] netlink: 'syz.0.3649': attribute type 6 has an invalid length. [ 838.438985][T20386] netlink: 168 bytes leftover after parsing attributes in process `syz.0.3649'. [ 838.586959][T20398] netlink: 'syz.0.3653': attribute type 21 has an invalid length. [ 838.620397][T20400] netlink: 'syz.1.3654': attribute type 3 has an invalid length. [ 838.637222][T20400] netlink: 'syz.1.3654': attribute type 1 has an invalid length. [ 838.648059][T20400] netlink: 181400 bytes leftover after parsing attributes in process `syz.1.3654'. [ 839.139249][T20424] delete_channel: no stack [ 839.144085][T20424] delete_channel: no stack [ 839.403979][T20429] netlink: 'syz.1.3662': attribute type 11 has an invalid length. [ 839.422650][T20429] netlink: 140 bytes leftover after parsing attributes in process `syz.1.3662'. [ 839.595749][T20439] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.3665'. [ 839.734752][T20443] netlink: 197276 bytes leftover after parsing attributes in process `syz.3.3666'. [ 840.482719][T20480] netlink: 'syz.1.3673': attribute type 10 has an invalid length. [ 840.534710][T20480] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3673'. [ 840.575897][T20467] netlink: 'syz.0.3671': attribute type 39 has an invalid length. [ 841.306144][T20509] netlink: 'syz.1.3679': attribute type 33 has an invalid length. [ 841.324446][T20509] netlink: 'syz.1.3679': attribute type 3 has an invalid length. [ 841.332346][T20509] netlink: 153952 bytes leftover after parsing attributes in process `syz.1.3679'. [ 841.996799][T20521] netlink: 'syz.0.3683': attribute type 2 has an invalid length. [ 842.505568][T20534] netlink: set zone limit has 8 unknown bytes [ 842.798570][T20541] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.3689'. [ 842.824827][T20541] bridge_slave_1: default FDB implementation only supports local addresses [ 842.988411][T20552] netlink: 'syz.2.3692': attribute type 21 has an invalid length. [ 843.017163][T20552] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3692'. [ 843.149631][T20553] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.3691'. [ 843.164231][T20553] bridge_slave_1: default FDB implementation only supports local addresses [ 844.981345][T20585] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3702'. [ 845.006626][T20585] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 845.156737][T20584] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3702'. [ 845.219910][T20584] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 845.239156][T20584] CPU: 0 PID: 20584 Comm: syz.1.3702 Not tainted syzkaller #0 [ 845.246790][T20584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 845.256899][T20584] Call Trace: [ 845.260223][T20584] [ 845.263194][T20584] dump_stack_lvl+0x18c/0x250 [ 845.267943][T20584] ? show_regs_print_info+0x20/0x20 [ 845.273206][T20584] ? load_image+0x420/0x420 [ 845.277813][T20584] sysfs_warn_dup+0x8e/0xa0 [ 845.282372][T20584] sysfs_do_create_link_sd+0xc0/0x110 [ 845.287807][T20584] device_add_class_symlinks+0x1cf/0x240 [ 845.293582][T20584] device_add+0x4f9/0xc40 [ 845.297990][T20584] wiphy_register+0x1d99/0x2ac0 [ 845.302971][T20584] ? cfg80211_event_work+0x40/0x40 [ 845.308135][T20584] ? minstrel_ht_alloc+0x88a/0x990 [ 845.313333][T20584] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 845.319473][T20584] ieee80211_register_hw+0x2dd8/0x3b30 [ 845.325040][T20584] ? ieee80211_register_hw+0xfb1/0x3b30 [ 845.330760][T20584] ? ieee80211_tasklet_handler+0x20/0x20 [ 845.336451][T20584] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 845.342422][T20584] ? __debug_object_init+0xec/0x450 [ 845.347699][T20584] ? __asan_memset+0x22/0x40 [ 845.352357][T20584] ? __hrtimer_init+0x189/0x270 [ 845.357276][T20584] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 845.363144][T20584] ? mac80211_hwsim_free+0x220/0x220 [ 845.368493][T20584] ? rcu_is_watching+0x15/0xb0 [ 845.373323][T20584] ? kstrndup+0xbd/0x140 [ 845.377673][T20584] hwsim_new_radio_nl+0xdad/0x1a70 [ 845.382876][T20584] ? __nla_validate+0x50/0x50 [ 845.387671][T20584] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 845.394108][T20584] ? __nla_parse+0x40/0x50 [ 845.398612][T20584] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 845.405028][T20584] genl_family_rcv_msg_doit+0x21a/0x310 [ 845.410653][T20584] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 845.416634][T20584] ? bpf_lsm_capable+0x9/0x10 [ 845.421356][T20584] ? security_capable+0x89/0xb0 [ 845.426292][T20584] genl_rcv_msg+0x611/0x7a0 [ 845.430879][T20584] ? genl_bind+0x360/0x360 [ 845.435350][T20584] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 845.441736][T20584] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 845.448369][T20584] ? perf_trace_lock+0xfc/0x3b0 [ 845.453313][T20584] netlink_rcv_skb+0x235/0x4c0 [ 845.458141][T20584] ? genl_bind+0x360/0x360 [ 845.462623][T20584] ? netlink_ack+0x1160/0x1160 [ 845.467487][T20584] ? __lock_acquire+0x7d80/0x7d80 [ 845.472565][T20584] ? net_generic+0x1e/0x240 [ 845.477134][T20584] ? down_read+0x1ac/0x2e0 [ 845.481609][T20584] genl_rcv+0x28/0x40 [ 845.485646][T20584] netlink_unicast+0x7b1/0x930 [ 845.490501][T20584] netlink_sendmsg+0x8d0/0xbf0 [ 845.495349][T20584] ? netlink_getsockopt+0x590/0x590 [ 845.500615][T20584] ? apparmor_socket_sendmsg+0x8e/0x330 [ 845.506225][T20584] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 845.511654][T20584] ? security_socket_sendmsg+0x80/0xa0 [ 845.517160][T20584] ? netlink_getsockopt+0x590/0x590 [ 845.522421][T20584] ____sys_sendmsg+0x61b/0x980 [ 845.527279][T20584] ? __asan_memset+0x22/0x40 [ 845.531930][T20584] ? __sys_sendmsg_sock+0x30/0x30 [ 845.537009][T20584] ? __import_iovec+0x5f2/0x850 [ 845.541955][T20584] ? import_iovec+0x73/0xa0 [ 845.546543][T20584] ___sys_sendmsg+0x2a6/0x360 [ 845.551301][T20584] ? __sys_sendmsg+0x2b0/0x2b0 [ 845.556317][T20584] __se_sys_sendmsg+0x1d0/0x2c0 [ 845.561244][T20584] ? __x64_sys_sendmsg+0x80/0x80 [ 845.566305][T20584] ? lockdep_hardirqs_on+0x98/0x150 [ 845.571571][T20584] do_syscall_64+0x55/0xb0 [ 845.576040][T20584] ? clear_bhb_loop+0x40/0x90 [ 845.580767][T20584] ? clear_bhb_loop+0x40/0x90 [ 845.585505][T20584] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 845.591473][T20584] RIP: 0033:0x7f869299e159 [ 845.595951][T20584] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 845.615618][T20584] RSP: 002b:00007f86937f2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 845.624189][T20584] RAX: ffffffffffffffda RBX: 00007f8692c26090 RCX: 00007f869299e159 [ 845.632218][T20584] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000c [ 845.640243][T20584] RBP: 00007f8692a3506b R08: 0000000000000000 R09: 0000000000000000 [ 845.648273][T20584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 845.656303][T20584] R13: 00007f8692c26128 R14: 00007f8692c26090 R15: 00007ffc9f523b38 [ 845.664382][T20584] [ 845.770025][ T5778] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 845.965647][T20617] netlink: 830 bytes leftover after parsing attributes in process `syz.2.3707'. [ 846.038492][T20618] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3707'. [ 846.068787][T20617] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3707'. [ 846.131383][T20618] netlink: 14568 bytes leftover after parsing attributes in process `syz.2.3707'. [ 846.201138][T20618] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.3707'. [ 846.238519][T20626] netlink: 14568 bytes leftover after parsing attributes in process `syz.2.3707'. [ 846.320053][T20631] netlink: 'syz.3.3711': attribute type 1 has an invalid length. [ 846.347967][T20631] netlink: 'syz.3.3711': attribute type 2 has an invalid length. [ 846.360816][T20631] netlink: 119 bytes leftover after parsing attributes in process `syz.3.3711'. [ 846.785612][T20656] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3715'. [ 849.843908][T20680] delete_channel: no stack [ 850.200830][T20692] __nla_validate_parse: 4 callbacks suppressed [ 850.200847][T20692] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.3726'. [ 850.259651][T20697] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3727'. [ 852.271146][T20752] netlink: 'syz.2.3734': attribute type 17 has an invalid length. [ 852.288910][T20752] netlink: 'syz.2.3734': attribute type 16 has an invalid length. [ 852.304524][T20752] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3734'. [ 852.373240][T20715] netlink: 'syz.0.3732': attribute type 10 has an invalid length. [ 852.382709][T20715] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3732'. [ 852.420927][T20752] tap0: tun_chr_ioctl cmd 2147767520 [ 852.436707][T20752] tap0: tun_chr_ioctl cmd 1074025692 [ 852.481466][T20752] pimreg: tun_chr_ioctl cmd 1074025677 [ 852.494917][T20752] pimreg: linktype set to 774 [ 853.282144][T20776] netlink: 'syz.0.3741': attribute type 10 has an invalid length. [ 853.340260][T20776] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3741'. [ 853.396669][T20780] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3741'. [ 853.442859][T20780] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3741'. [ 853.454979][T20779] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3741'. [ 853.465882][T20775] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3741'. [ 853.635390][T20790] IPv6: NLM_F_CREATE should be specified when creating new route [ 853.659581][T20790] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3745'. [ 853.669429][ T5778] Bluetooth: hci4: unexpected event 0x10 length: 15 > 1 [ 853.670923][ T5778] Bluetooth: hci4: hardware error 0x00 [ 853.955383][T20798] netlink: 'syz.1.3748': attribute type 22 has an invalid length. [ 854.558195][T20806] wg2: entered promiscuous mode [ 854.563130][T20806] wg2: entered allmulticast mode [ 855.079532][T20817] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 855.135149][T20817] syzkaller0: linktype set to 768 [ 855.764549][ T5778] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 855.793028][T20826] mac80211_hwsim hwsim43 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 855.928019][T20835] __nla_validate_parse: 2 callbacks suppressed [ 855.928039][T20835] netlink: 201392 bytes leftover after parsing attributes in process `syz.3.3756'. [ 855.970568][T20835] netlink: 8446 bytes leftover after parsing attributes in process `syz.3.3756'. [ 856.437711][T20849] netlink: 'syz.2.3761': attribute type 10 has an invalid length. [ 856.553958][T20849] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 856.592894][T20849] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 856.622818][T20849] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 856.674810][T20849] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 857.023807][T20852] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3760'. [ 857.308934][T20855] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 857.324608][T20855] syzkaller0: linktype set to 768 [ 857.639715][T20871] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3768'. [ 857.896863][T20877] netlink: 'syz.3.3770': attribute type 21 has an invalid length. [ 857.941725][T20877] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3770'. [ 858.053024][T20887] sit0: entered allmulticast mode [ 858.575521][T20895] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 858.588180][T20895] syzkaller0: linktype set to 768 [ 858.655414][T20901] netlink: 'syz.0.3776': attribute type 5 has an invalid length. [ 858.669520][T20901] netlink: 176 bytes leftover after parsing attributes in process `syz.0.3776'. [ 858.869288][T20901] netlink: 12518 bytes leftover after parsing attributes in process `syz.0.3776'. [ 859.602299][T20938] netlink: 'syz.1.3785': attribute type 29 has an invalid length. [ 859.612614][T20938] netlink: 'syz.1.3785': attribute type 29 has an invalid length. [ 859.639883][T20938] netlink: 'syz.1.3785': attribute type 29 has an invalid length. [ 859.659483][T20938] netlink: 'syz.1.3785': attribute type 29 has an invalid length. [ 859.670803][T20938] netlink: 'syz.1.3785': attribute type 29 has an invalid length. [ 860.029569][T20959] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3788'. [ 860.050239][T20959] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 860.268377][T20963] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.3790'. [ 860.507257][T20973] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3793'. [ 860.798052][T20983] sctp: [Deprecated]: syz.0.3796 (pid 20983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 860.798052][T20983] Use struct sctp_sack_info instead [ 861.138279][T20983] sctp: [Deprecated]: syz.0.3796 (pid 20983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 861.138279][T20983] Use struct sctp_sack_info instead [ 861.294794][T20983] sctp: [Deprecated]: syz.0.3796 (pid 20983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 861.294794][T20983] Use struct sctp_sack_info instead [ 861.326151][T20983] sctp: [Deprecated]: syz.0.3796 (pid 20983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 861.326151][T20983] Use struct sctp_sack_info instead [ 861.387002][T20983] sctp: [Deprecated]: syz.0.3796 (pid 20983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 861.387002][T20983] Use struct sctp_sack_info instead [ 861.462076][T20983] sctp: [Deprecated]: syz.0.3796 (pid 20983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 861.462076][T20983] Use struct sctp_sack_info instead [ 861.512711][T21000] netlink: 'syz.3.3797': attribute type 21 has an invalid length. [ 865.611595][T21098] netlink: 9275 bytes leftover after parsing attributes in process `syz.0.3825'. [ 870.328943][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.339926][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 873.266989][T21108] sit0: entered allmulticast mode [ 873.306564][T21111] sit0: entered promiscuous mode [ 873.412285][T21134] netlink: 'syz.1.3832': attribute type 3 has an invalid length. [ 873.774238][T21140] netlink: 'syz.3.3835': attribute type 21 has an invalid length. [ 873.799722][T21148] mac80211_hwsim hwsim52 wlan0: entered promiscuous mode [ 873.817827][T21148] mac80211_hwsim hwsim52 wlan0: entered allmulticast mode [ 874.480686][T21144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 874.819820][T21163] netlink: 'syz.2.3841': attribute type 10 has an invalid length. [ 874.948101][T21163] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3841'. [ 875.319622][T21152] syz.1.3838 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 875.410270][T21152] CPU: 0 PID: 21152 Comm: syz.1.3838 Not tainted syzkaller #0 [ 875.417812][T21152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 875.427907][T21152] Call Trace: [ 875.431211][T21152] [ 875.434164][T21152] dump_stack_lvl+0x18c/0x250 [ 875.438912][T21152] ? show_regs_print_info+0x20/0x20 [ 875.444140][T21152] ? load_image+0x420/0x420 [ 875.448676][T21152] ? ___ratelimit+0x478/0x610 [ 875.453402][T21152] ? radix_tree_cpu_dead+0x160/0x160 [ 875.458728][T21152] dump_header+0xd8/0x820 [ 875.463097][T21152] oom_kill_process+0x390/0x580 [ 875.467984][T21152] out_of_memory+0xe0e/0x1200 [ 875.472698][T21152] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 875.478366][T21152] ? mutex_lock_nested+0x20/0x20 [ 875.483342][T21152] ? unregister_oom_notifier+0x20/0x20 [ 875.488856][T21152] mem_cgroup_out_of_memory+0x2c2/0x390 [ 875.494437][T21152] ? try_charge_memcg+0xc91/0x17c0 [ 875.499590][T21152] ? drain_local_stock+0x630/0x630 [ 875.504755][T21152] ? do_raw_spin_unlock+0x121/0x230 [ 875.509978][T21152] try_charge_memcg+0xca1/0x17c0 [ 875.514947][T21152] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 875.521551][T21152] ? folio_flags+0x120/0x120 [ 875.526172][T21152] ? percpu_ref_tryget+0x15/0x180 [ 875.531215][T21152] ? get_mem_cgroup_from_mm+0x38/0x290 [ 875.536692][T21152] charge_memcg+0x11b/0x3b0 [ 875.541221][T21152] ? __mem_cgroup_charge+0x80/0x80 [ 875.546343][T21152] ? get_mem_cgroup_from_mm+0x38/0x290 [ 875.551829][T21152] ? get_mem_cgroup_from_mm+0x38/0x290 [ 875.557319][T21152] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 875.562895][T21152] __mem_cgroup_charge+0x25/0x80 [ 875.567858][T21152] handle_mm_fault+0x1b00/0x4a50 [ 875.572826][T21152] ? handle_mm_fault+0xe6/0x4a50 [ 875.577805][T21152] ? lock_vma_under_rcu+0x52c/0x660 [ 875.583113][T21152] ? numa_migrate_prep+0x350/0x350 [ 875.588226][T21152] ? lock_vma_under_rcu+0xe5/0x660 [ 875.593366][T21152] ? do_user_addr_fault+0x1cb/0x12d0 [ 875.598675][T21152] do_user_addr_fault+0xad2/0x12d0 [ 875.603809][T21152] ? rcu_is_watching+0x15/0xb0 [ 875.608618][T21152] exc_page_fault+0x64/0x100 [ 875.613210][T21152] ? clear_bhb_loop+0x40/0x90 [ 875.617894][T21152] asm_exc_page_fault+0x26/0x30 [ 875.622749][T21152] RIP: 0033:0x7f8692867702 [ 875.627260][T21152] Code: 30 48 8b 14 24 48 85 d2 74 17 8b 44 24 10 0f c8 89 c0 48 89 44 24 10 48 83 fa 01 0f 85 aa 02 00 00 48 8b 44 24 18 8b 74 24 10 <89> 30 e9 1e fe ff ff 48 8b 44 24 18 8b 10 48 8b 04 24 48 85 c0 0f [ 875.646904][T21152] RSP: 002b:00007ffc9f523c60 EFLAGS: 00010246 [ 875.653024][T21152] RAX: 00002000000054c0 RBX: 0000000000000004 RCX: 0000000000000000 [ 875.660999][T21152] RDX: 0000000000000000 RSI: 000000000000001a RDI: 00005555636f63d8 [ 875.668973][T21152] RBP: 00007ffc9f523d80 R08: 0000000000000000 R09: 0000000000000000 [ 875.676968][T21152] R10: 000000000000001a R11: 0000000000000000 R12: 00007ffc9f523dc0 [ 875.684938][T21152] R13: 00007f8692c25fac R14: 00000000000d5819 R15: 00007f8692c25fa0 [ 875.692944][T21152] [ 875.699258][T21152] memory: usage 307200kB, limit 307200kB, failcnt 16727 [ 875.707975][T21152] memory+swap: usage 432196kB, limit 9007199254740988kB, failcnt 0 [ 875.719752][T21152] kmem: usage 6008kB, limit 9007199254740988kB, failcnt 0 [ 875.734714][T21152] Memory cgroup stats for /syz1: [ 875.735133][T21152] cache 307908608 [ 875.756798][T21152] rss 512000 [ 875.763439][T21152] rss_huge 0 [ 875.770325][T21152] shmem 307785728 [ 875.780448][T21152] mapped_file 122880 [ 875.784515][T21152] dirty 122880 [ 875.787970][T21152] writeback 0 [ 875.791391][T21152] workingset_refault_anon 0 [ 875.796061][T21152] workingset_refault_file 133 [ 875.800790][T21152] swap 127995904 [ 875.809831][T21152] pgpgin 463939 [ 875.813435][T21152] pgpgout 388641 [ 875.820501][T21152] pgfault 195646 [ 875.824167][T21152] pgmajfault 10 [ 875.833155][T21152] inactive_anon 177549312 [ 875.837665][T21152] active_anon 130748416 [ 875.841957][T21152] inactive_file 0 [ 875.858244][T21152] active_file 122880 [ 875.864364][T21152] unevictable 0 [ 875.867870][T21152] hierarchical_memory_limit 314572800 [ 875.880686][T21152] hierarchical_memsw_limit 9223372036854771712 [ 875.922870][T21152] total_cache 307908608 [ 875.947326][T21152] total_rss 512000 [ 875.951171][T21152] total_rss_huge 0 [ 875.954992][T21152] total_shmem 307785728 [ 875.959173][T21152] total_mapped_file 122880 [ 875.994496][T21152] total_dirty 122880 [ 875.998455][T21152] total_writeback 0 [ 876.002607][T21152] total_workingset_refault_anon 0 [ 876.007731][T21152] total_workingset_refault_file 133 [ 876.013009][T21152] total_swap 127995904 [ 876.017592][T21152] total_pgpgin 463939 [ 876.021597][T21152] total_pgpgout 388641 [ 876.025916][T21152] total_pgfault 195647 [ 876.030004][T21152] total_pgmajfault 10 [ 876.034001][T21152] total_inactive_anon 177549312 [ 876.044354][T21152] total_active_anon 130748416 [ 876.049233][T21152] total_inactive_file 0 [ 876.057226][T21152] total_active_file 122880 [ 876.061869][T21152] total_unevictable 0 [ 876.066102][T21152] anon_cost 0 [ 876.069416][T21152] file_cost 0 [ 876.072895][T21152] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.3830,pid=21128,uid=0 [ 876.102502][T21152] Memory cgroup out of memory: Killed process 21128 (syz.1.3830) total-vm:98932kB, anon-rss:1392kB, file-rss:53632kB, shmem-rss:0kB, UID:0 pgtables:200kB oom_score_adj:1000 [ 876.619495][T21119] syz.1.3830 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 876.647664][T21119] CPU: 1 PID: 21119 Comm: syz.1.3830 Not tainted syzkaller #0 [ 876.655208][T21119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 876.665299][T21119] Call Trace: [ 876.668602][T21119] [ 876.671553][T21119] dump_stack_lvl+0x18c/0x250 [ 876.676271][T21119] ? show_regs_print_info+0x20/0x20 [ 876.681505][T21119] ? load_image+0x420/0x420 [ 876.686033][T21119] ? ___ratelimit+0x478/0x610 [ 876.690752][T21119] ? radix_tree_cpu_dead+0x160/0x160 [ 876.696071][T21119] dump_header+0xd8/0x820 [ 876.700410][T21119] oom_kill_process+0x390/0x580 [ 876.705269][T21119] out_of_memory+0xe0e/0x1200 [ 876.709952][T21119] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 876.715591][T21119] ? mutex_lock_nested+0x20/0x20 [ 876.720526][T21119] ? unregister_oom_notifier+0x20/0x20 [ 876.726022][T21119] mem_cgroup_out_of_memory+0x2c2/0x390 [ 876.731568][T21119] ? try_charge_memcg+0xc91/0x17c0 [ 876.736679][T21119] ? drain_local_stock+0x630/0x630 [ 876.741794][T21119] ? do_raw_spin_unlock+0x121/0x230 [ 876.746994][T21119] try_charge_memcg+0xca1/0x17c0 [ 876.751942][T21119] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 876.758541][T21119] ? folio_flags+0x120/0x120 [ 876.763134][T21119] ? shmem_alloc_folio+0x1f4/0x2a0 [ 876.768279][T21119] ? percpu_ref_tryget+0x15/0x180 [ 876.773306][T21119] ? get_mem_cgroup_from_mm+0x38/0x290 [ 876.778768][T21119] charge_memcg+0x11b/0x3b0 [ 876.783289][T21119] ? __mem_cgroup_charge+0x80/0x80 [ 876.788396][T21119] ? get_mem_cgroup_from_mm+0x38/0x290 [ 876.793848][T21119] ? get_mem_cgroup_from_mm+0x38/0x290 [ 876.799301][T21119] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 876.804847][T21119] __mem_cgroup_charge+0x25/0x80 [ 876.809786][T21119] shmem_add_to_page_cache+0x8d3/0x1b80 [ 876.815330][T21119] ? xas_load+0x12b/0x140 [ 876.819667][T21119] ? shmem_alloc_folio+0x2a0/0x2a0 [ 876.824788][T21119] shmem_get_folio_gfp+0x1037/0x2b40 [ 876.830100][T21119] shmem_write_begin+0xf2/0x430 [ 876.834967][T21119] generic_perform_write+0x2fe/0x5c0 [ 876.840307][T21119] ? generic_file_direct_write+0x3e0/0x3e0 [ 876.846126][T21119] ? down_write+0x16e/0x200 [ 876.850646][T21119] ? file_update_time+0x98/0x1a0 [ 876.855593][T21119] shmem_file_write_iter+0xfb/0x120 [ 876.860801][T21119] __kernel_write_iter+0x29f/0x6d0 [ 876.865924][T21119] ? vfs_read+0x990/0x990 [ 876.870268][T21119] ? get_dump_page+0x156/0x200 [ 876.875039][T21119] ? __asan_memset+0x22/0x40 [ 876.879633][T21119] ? iov_iter_bvec+0xd4/0x1b0 [ 876.884315][T21119] dump_user_range+0x418/0x840 [ 876.889111][T21119] ? dump_skip+0x40/0x40 [ 876.893356][T21119] ? dump_emit+0x78/0xe0 [ 876.897629][T21119] ? dump_emit+0xa6/0xe0 [ 876.901865][T21119] ? elf_core_dump+0x2dbb/0x37c0 [ 876.906805][T21119] elf_core_dump+0x320e/0x37c0 [ 876.911609][T21119] ? load_elf_binary+0x2850/0x2850 [ 876.916744][T21119] ? verify_lock_unused+0x140/0x140 [ 876.921958][T21119] ? __lock_acquire+0x7d80/0x7d80 [ 876.926985][T21119] ? mas_next_slot+0x94c/0x980 [ 876.931781][T21119] ? rcu_read_lock_any_held+0xb4/0x140 [ 876.937251][T21119] ? 0xffffffffff600000 [ 876.941418][T21119] do_coredump+0x1791/0x24a0 [ 876.946027][T21119] ? nfs_stat_to_errno+0x170/0x170 [ 876.951152][T21119] ? lock_chain_count+0x20/0x20 [ 876.956007][T21119] ? _raw_spin_unlock_irq+0x23/0x50 [ 876.961205][T21119] ? lockdep_hardirqs_on+0x98/0x150 [ 876.966402][T21119] get_signal+0x10da/0x1390 [ 876.970922][T21119] arch_do_signal_or_restart+0xc2/0x7b0 [ 876.976475][T21119] ? get_sigframe_size+0x20/0x20 [ 876.981413][T21119] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 876.987406][T21119] ? exit_to_user_mode_loop+0x3b/0x110 [ 876.992867][T21119] exit_to_user_mode_loop+0x70/0x110 [ 876.998152][T21119] exit_to_user_mode_prepare+0xee/0x180 [ 877.003696][T21119] irqentry_exit_to_user_mode+0x9/0x30 [ 877.009148][T21119] exc_page_fault+0x8c/0x100 [ 877.013733][T21119] asm_exc_page_fault+0x26/0x30 [ 877.018586][T21119] RIP: 0033:0x7f869299e161 [ 877.023003][T21119] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 877.042604][T21119] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 877.048691][T21119] RAX: 0000000000000000 RBX: 00007f8692c26180 RCX: 00007f869299e159 [ 877.056674][T21119] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 877.064645][T21119] RBP: 00007f8692a3506b R08: 0000000000000000 R09: 0000000000000000 [ 877.072617][T21119] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 877.080590][T21119] R13: 00007f8692c26218 R14: 00007f8692c26180 R15: 00007ffc9f523b38 [ 877.088579][T21119] [ 877.150605][T21119] memory: usage 307200kB, limit 307200kB, failcnt 17188 [ 877.172345][T21119] memory+swap: usage 432196kB, limit 9007199254740988kB, failcnt 0 [ 877.184570][T21119] kmem: usage 5780kB, limit 9007199254740988kB, failcnt 0 [ 877.191726][T21119] Memory cgroup stats for /syz1: [ 877.192074][T21119] cache 308150272 [ 877.294361][T21119] rss 503808 [ 877.314410][T21119] rss_huge 0 [ 877.317664][T21119] shmem 308027392 [ 877.371322][T21119] mapped_file 122880 [ 877.385621][T21119] dirty 122880 [ 877.391577][T21119] writeback 0 [ 877.398975][T21119] workingset_refault_anon 0 [ 877.419165][T21119] workingset_refault_file 133 [ 877.448004][T21119] swap 127995904 [ 877.451624][T21119] pgpgin 463999 [ 877.476185][T21119] pgpgout 388644 [ 877.479791][T21119] pgfault 195647 [ 877.483341][T21119] pgmajfault 10 [ 877.522410][T21119] inactive_anon 299343872 [ 877.544306][T21119] active_anon 9187328 [ 877.548408][T21119] inactive_file 0 [ 877.572713][T21119] active_file 122880 [ 877.592240][T21119] unevictable 0 [ 877.612895][T21119] hierarchical_memory_limit 314572800 [ 877.638804][T21119] hierarchical_memsw_limit 9223372036854771712 [ 877.673964][T21119] total_cache 308150272 [ 877.719987][T21119] total_rss 503808 [ 877.726156][T21119] total_rss_huge 0 [ 877.759065][T21119] total_shmem 308027392 [ 877.793904][T21119] total_mapped_file 122880 [ 877.819986][T21119] total_dirty 122880 [ 877.837518][T21119] total_writeback 0 [ 877.860188][T21119] total_workingset_refault_anon 0 [ 877.891696][T21119] total_workingset_refault_file 133 [ 877.941779][T21119] total_swap 127995904 [ 877.975671][T21119] total_pgpgin 463999 [ 878.030706][T21119] total_pgpgout 388644 [ 878.054471][T21119] total_pgfault 195648 [ 878.058764][T21119] total_pgmajfault 10 [ 878.079122][T21119] total_inactive_anon 299343872 [ 878.084051][T21119] total_active_anon 9187328 [ 878.118357][T21119] total_inactive_file 0 [ 878.145347][T21119] total_active_file 122880 [ 878.149837][T21119] total_unevictable 0 [ 878.188692][T21119] anon_cost 0 [ 878.192067][T21119] file_cost 0 [ 878.228627][T21119] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.3830,pid=21127,uid=0 [ 878.364698][T21119] Memory cgroup out of memory: Killed process 21127 (syz.1.3830) total-vm:98932kB, anon-rss:1264kB, file-rss:53632kB, shmem-rss:0kB, UID:0 pgtables:200kB oom_score_adj:1000 [ 878.829332][T21125] syz.1.3830 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 878.879629][T21125] CPU: 0 PID: 21125 Comm: syz.1.3830 Not tainted syzkaller #0 [ 878.887164][T21125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 878.897251][T21125] Call Trace: [ 878.900554][T21125] [ 878.903525][T21125] dump_stack_lvl+0x18c/0x250 [ 878.908254][T21125] ? show_regs_print_info+0x20/0x20 [ 878.913495][T21125] ? load_image+0x420/0x420 [ 878.918023][T21125] ? ___ratelimit+0x478/0x610 [ 878.922736][T21125] ? radix_tree_cpu_dead+0x160/0x160 [ 878.928144][T21125] dump_header+0xd8/0x820 [ 878.932506][T21125] oom_kill_process+0x390/0x580 [ 878.937397][T21125] out_of_memory+0xe0e/0x1200 [ 878.942108][T21125] ? mem_cgroup_out_of_memory+0xc1/0x390 [ 878.947774][T21125] ? mutex_lock_nested+0x20/0x20 [ 878.952743][T21125] ? unregister_oom_notifier+0x20/0x20 [ 878.958246][T21125] mem_cgroup_out_of_memory+0x2c2/0x390 [ 878.963817][T21125] ? try_charge_memcg+0xc91/0x17c0 [ 878.968953][T21125] ? drain_local_stock+0x630/0x630 [ 878.974109][T21125] ? do_raw_spin_unlock+0x121/0x230 [ 878.979341][T21125] try_charge_memcg+0xca1/0x17c0 [ 878.984315][T21125] ? folio_prep_large_rmappable+0x9e/0x1b0 [ 878.990155][T21125] ? folio_flags+0x120/0x120 [ 878.994772][T21125] ? shmem_alloc_folio+0x1f4/0x2a0 [ 878.999920][T21125] ? percpu_ref_tryget+0x15/0x180 [ 879.004984][T21125] ? get_mem_cgroup_from_mm+0x38/0x290 [ 879.010474][T21125] charge_memcg+0x11b/0x3b0 [ 879.015017][T21125] ? __mem_cgroup_charge+0x80/0x80 [ 879.020145][T21125] ? get_mem_cgroup_from_mm+0x38/0x290 [ 879.025622][T21125] ? get_mem_cgroup_from_mm+0x38/0x290 [ 879.031106][T21125] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 879.036681][T21125] __mem_cgroup_charge+0x25/0x80 [ 879.041646][T21125] shmem_add_to_page_cache+0x8d3/0x1b80 [ 879.047219][T21125] ? xas_load+0x12b/0x140 [ 879.051593][T21125] ? shmem_alloc_folio+0x2a0/0x2a0 [ 879.056727][T21125] ? mark_lock+0x94/0x320 [ 879.061080][T21125] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 879.067082][T21125] ? __lock_acquire+0x7d80/0x7d80 [ 879.072135][T21125] ? lock_chain_count+0x20/0x20 [ 879.077014][T21125] shmem_get_folio_gfp+0x1037/0x2b40 [ 879.082353][T21125] shmem_write_begin+0xf2/0x430 [ 879.087238][T21125] generic_perform_write+0x2fe/0x5c0 [ 879.092571][T21125] ? generic_file_direct_write+0x3e0/0x3e0 [ 879.098421][T21125] ? file_update_time+0x192/0x1a0 [ 879.103479][T21125] shmem_file_write_iter+0xfb/0x120 [ 879.108711][T21125] __kernel_write_iter+0x29f/0x6d0 [ 879.113859][T21125] ? vfs_read+0x990/0x990 [ 879.118218][T21125] ? get_dump_page+0x156/0x200 [ 879.123041][T21125] ? __asan_memset+0x22/0x40 [ 879.127659][T21125] ? iov_iter_bvec+0xd4/0x1b0 [ 879.132362][T21125] dump_user_range+0x418/0x840 [ 879.137170][T21125] ? dump_skip+0x40/0x40 [ 879.141430][T21125] ? dump_emit+0x78/0xe0 [ 879.145713][T21125] ? dump_emit+0xa6/0xe0 [ 879.149983][T21125] ? elf_core_dump+0x2dbb/0x37c0 [ 879.154956][T21125] elf_core_dump+0x320e/0x37c0 [ 879.159838][T21125] ? load_elf_binary+0x2850/0x2850 [ 879.165018][T21125] ? verify_lock_unused+0x140/0x140 [ 879.170252][T21125] ? __lock_acquire+0x7d80/0x7d80 [ 879.175301][T21125] ? mas_next_slot+0x94c/0x980 [ 879.180125][T21125] ? rcu_read_lock_any_held+0xb4/0x140 [ 879.185605][T21125] ? 0xffffffffff600000 [ 879.189794][T21125] do_coredump+0x1791/0x24a0 [ 879.194427][T21125] ? nfs_stat_to_errno+0x170/0x170 [ 879.199583][T21125] ? lock_chain_count+0x20/0x20 [ 879.204463][T21125] ? _raw_spin_unlock_irq+0x23/0x50 [ 879.209678][T21125] ? lockdep_hardirqs_on+0x98/0x150 [ 879.214900][T21125] get_signal+0x10da/0x1390 [ 879.219444][T21125] arch_do_signal_or_restart+0xc2/0x7b0 [ 879.225027][T21125] ? get_sigframe_size+0x20/0x20 [ 879.229996][T21125] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 879.236017][T21125] ? exit_to_user_mode_loop+0x3b/0x110 [ 879.241504][T21125] exit_to_user_mode_loop+0x70/0x110 [ 879.246816][T21125] exit_to_user_mode_prepare+0xee/0x180 [ 879.252392][T21125] irqentry_exit_to_user_mode+0x9/0x30 [ 879.257881][T21125] exc_page_fault+0x8c/0x100 [ 879.262498][T21125] asm_exc_page_fault+0x26/0x30 [ 879.267377][T21125] RIP: 0033:0x7f869299e161 [ 879.271817][T21125] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 879.291455][T21125] RSP: 002b:fffffffffffffc70 EFLAGS: 00010217 [ 879.297555][T21125] RAX: 0000000000000000 RBX: 00007f8692c26180 RCX: 00007f869299e159 [ 879.305551][T21125] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 879.313554][T21125] RBP: 00007f8692a3506b R08: 0000000000000000 R09: 0000000000000000 [ 879.321543][T21125] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 879.329528][T21125] R13: 00007f8692c26218 R14: 00007f8692c26180 R15: 00007ffc9f523b38 [ 879.337543][T21125] [ 879.378200][T21178] netlink: 'syz.1.3845': attribute type 29 has an invalid length. [ 879.664420][T21125] memory: usage 296492kB, limit 307200kB, failcnt 17662 [ 879.704691][T21125] memory+swap: usage 420848kB, limit 9007199254740988kB, failcnt 0 [ 879.733379][T21125] kmem: usage 5724kB, limit 9007199254740988kB, failcnt 0 [ 879.764639][T21125] Memory cgroup stats for /syz1: [ 879.764813][T21125] cache 298303488 [ 879.829338][T21125] rss 225280 [ 879.832611][T21125] rss_huge 0 [ 879.854519][T21125] shmem 297922560 [ 879.858244][T21125] mapped_file 122880 [ 879.927134][T21125] dirty 122880 [ 879.943998][T21125] writeback 0 [ 879.969916][T21125] workingset_refault_anon 0 [ 880.004649][T21125] workingset_refault_file 196 [ 880.009684][T21125] swap 127995904 [ 880.013257][T21125] pgpgin 477771 [ 880.084622][T21125] pgpgout 404888 [ 880.098924][T21125] pgfault 195808 [ 880.102525][T21125] pgmajfault 10 [ 880.148917][T21125] inactive_anon 87515136 [ 880.153233][T21125] active_anon 210407424 [ 880.210709][T21125] inactive_file 0 [ 880.224394][T21125] active_file 380928 [ 880.228371][T21125] unevictable 0 [ 880.274093][T21125] hierarchical_memory_limit 314572800 [ 880.314560][T21125] hierarchical_memsw_limit 9223372036854771712 [ 880.320762][T21125] total_cache 298303488 [ 880.354470][T21125] total_rss 225280 [ 880.377074][T21125] total_rss_huge 0 [ 880.394376][T21125] total_shmem 297922560 [ 880.398593][T21125] total_mapped_file 122880 [ 880.422967][T21125] total_dirty 122880 [ 880.427339][T21125] total_writeback 0 [ 880.431217][T21125] total_workingset_refault_anon 0 [ 880.454483][T21125] total_workingset_refault_file 196 [ 880.465221][T21125] total_swap 127995904 [ 880.469343][T21125] total_pgpgin 477771 [ 880.484782][T21125] total_pgpgout 404888 [ 880.499912][T21125] total_pgfault 195809 [ 880.504039][T21125] total_pgmajfault 10 [ 880.576399][T21125] total_inactive_anon 87515136 [ 880.581230][T21125] total_active_anon 210407424 [ 880.604342][T21125] total_inactive_file 0 [ 880.608569][T21125] total_active_file 380928 [ 880.612994][T21125] total_unevictable 0 [ 880.664840][T21125] anon_cost 0 [ 880.668221][T21125] file_cost 0 [ 880.671524][T21125] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.3830,pid=21126,uid=0 [ 880.786408][T21125] Memory cgroup out of memory: Killed process 21126 (syz.1.3830) total-vm:98932kB, anon-rss:1264kB, file-rss:53504kB, shmem-rss:0kB, UID:0 pgtables:200kB oom_score_adj:1000 [ 884.023022][T21178] netlink: 'syz.1.3845': attribute type 29 has an invalid length. [ 884.147960][T21189] netlink: 'syz.2.3846': attribute type 10 has an invalid length. [ 884.434563][T21201] netlink: 'syz.1.3852': attribute type 21 has an invalid length. [ 887.676832][T21221] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3858'. [ 888.502856][T21221] : (slave bond_slave_0): Releasing backup interface [ 888.530778][T21221] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 888.600365][T21222] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3858'. [ 889.251871][T21257] netlink: 'syz.1.3865': attribute type 2 has an invalid length. [ 889.262389][T21257] netlink: 1045 bytes leftover after parsing attributes in process `syz.1.3865'. [ 889.617004][T21265] -: renamed from syzkaller0 [ 889.886284][T21280] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3871'. [ 889.900934][T21280] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3871'. [ 889.911848][T21279] netlink: 'syz.3.3873': attribute type 28 has an invalid length. [ 889.930807][T21279] netlink: 'syz.3.3873': attribute type 4 has an invalid length. [ 889.940508][T21275] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3871'. [ 889.949189][T21279] netlink: 136 bytes leftover after parsing attributes in process `syz.3.3873'. [ 891.420713][T21292] delete_channel: no stack [ 892.299283][T21314] syzkaller0: entered promiscuous mode [ 892.305064][T21314] syzkaller0: entered allmulticast mode [ 892.371468][T21324] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3886'. [ 894.249331][T21324] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3886'. [ 894.768287][T21354] netlink: 208052 bytes leftover after parsing attributes in process `syz.1.3895'. [ 894.794686][T21354] netlink: 'syz.1.3895': attribute type 1 has an invalid length. [ 894.803748][T21354] netlink: 'syz.1.3895': attribute type 2 has an invalid length. [ 894.825554][T21354] netlink: 'syz.1.3895': attribute type 3 has an invalid length. [ 894.833339][T21354] netlink: 'syz.1.3895': attribute type 4 has an invalid length. [ 898.396939][T21389] netlink: 'syz.3.3901': attribute type 11 has an invalid length. [ 898.439461][T21389] netlink: 'syz.3.3901': attribute type 1 has an invalid length. [ 898.472511][T21389] netlink: 198112 bytes leftover after parsing attributes in process `syz.3.3901'. [ 898.983403][T21406] netlink: 'syz.2.3910': attribute type 28 has an invalid length. [ 898.991448][T21406] netlink: 'syz.2.3910': attribute type 3 has an invalid length. [ 899.000038][T21406] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3910'. [ 899.078976][T21408] netlink: 'syz.0.3911': attribute type 3 has an invalid length. [ 899.088111][T21408] netlink: 'syz.0.3911': attribute type 6 has an invalid length. [ 899.097001][T21408] netlink: 144448 bytes leftover after parsing attributes in process `syz.0.3911'. [ 899.552503][T21429] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 900.961736][T21468] netlink: 'syz.0.3928': attribute type 12 has an invalid length. [ 900.980007][T21468] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3928'. [ 901.604482][T21475] netlink: 196 bytes leftover after parsing attributes in process `syz.3.3930'. [ 901.972465][T21477] mac80211_hwsim hwsim49 wlan0: entered promiscuous mode [ 901.992595][T21477] mac80211_hwsim hwsim49 wlan0: entered allmulticast mode [ 906.050156][T21528] netlink: 'syz.1.3944': attribute type 39 has an invalid length. [ 906.265849][T21533] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3946'. [ 906.298332][T21533] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3946'. [ 906.307695][T21533] netlink: 13 bytes leftover after parsing attributes in process `syz.3.3946'. [ 906.366313][T21542] netlink: 'syz.2.3947': attribute type 2 has an invalid length. [ 906.415204][T21542] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3947'. [ 906.551210][T21545] netlink: 'syz.2.3947': attribute type 17 has an invalid length. [ 906.560112][T21545] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3947'. [ 906.592464][T21545] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 906.634507][T21551] netlink: 16410 bytes leftover after parsing attributes in process `syz.1.3949'. [ 906.778627][T21559] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3952'. [ 907.135001][T21563] netlink: 6 bytes leftover after parsing attributes in process `syz.1.3954'. [ 907.146597][T21563] openvswitch: netlink: Flow actions attr not present in new flow. [ 908.315062][T21589] netlink: 'syz.1.3962': attribute type 1 has an invalid length. [ 908.322896][T21589] netlink: 'syz.1.3962': attribute type 4 has an invalid length. [ 908.379108][T21589] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.3962'. [ 908.390175][T21588] netlink: 394 bytes leftover after parsing attributes in process `syz.1.3962'. [ 908.770840][T21602] ref_ctr_offset mismatch. inode: 0x684 offset: 0x0 ref_ctr_offset(old): 0x8c ref_ctr_offset(new): 0x0 [ 910.410830][T21648] netlink: 'syz.2.3978': attribute type 10 has an invalid length. [ 910.432856][T21648] vcan0: entered promiscuous mode [ 910.451475][T21648] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check. [ 911.413023][T21672] netlink: 'syz.2.3981': attribute type 10 has an invalid length. [ 911.441352][T21672] __nla_validate_parse: 8 callbacks suppressed [ 911.441367][T21672] netlink: 168 bytes leftover after parsing attributes in process `syz.2.3981'. [ 911.762365][T21672] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3981'. [ 911.814892][T21672] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3981'. [ 911.987836][T21689] netlink: 'syz.3.3986': attribute type 5 has an invalid length. [ 912.171379][T21700] netlink: 16410 bytes leftover after parsing attributes in process `syz.3.3988'. [ 912.517074][T21703] netlink: 'syz.3.3989': attribute type 9 has an invalid length. [ 912.588631][T21703] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.3989'. [ 912.671558][T21704] netlink: 'syz.3.3989': attribute type 39 has an invalid length. [ 912.972270][T21702] netlink: 'syz.3.3989': attribute type 9 has an invalid length. [ 912.999324][T21702] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.3989'. [ 913.145231][ T5778] Bluetooth: Frame is too long (len 149, expected len 4) [ 914.078881][T21713] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3992'. [ 914.089083][T21713] openvswitch: netlink: Flow actions attr not present in new flow. [ 914.561573][T21730] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3995'. [ 914.605185][T21730] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 915.113710][T21752] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.4002'. [ 918.713605][T21783] netlink: 'syz.2.4009': attribute type 10 has an invalid length. [ 918.830498][T21787] sctp: [Deprecated]: syz.2.4009 (pid 21787) Use of int in maxseg socket option. [ 918.830498][T21787] Use struct sctp_assoc_value instead [ 918.903629][T21788] netlink: 'syz.0.4010': attribute type 21 has an invalid length. [ 918.927907][T21788] IPv6: Can't replace route, no match found [ 919.162860][T21799] IPv6: pim6reg1: Disabled Multicast RS [ 919.520804][T21811] netlink: 16399 bytes leftover after parsing attributes in process `syz.0.4018'. [ 919.541774][T21811] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4018'. [ 919.884186][T21819] syzkaller0: entered promiscuous mode [ 919.893193][T21819] syzkaller0: entered allmulticast mode [ 920.216251][T21840] sock: sock_timestamping_bind_phc: sock not bind to device [ 920.667765][T21843] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4025'. [ 920.689730][T21843] netlink: 'syz.1.4025': attribute type 9 has an invalid length. [ 920.698583][T21843] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.4025'. [ 922.402108][T21840] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4024'. [ 922.593930][T21863] sctp: [Deprecated]: syz.3.4030 (pid 21863) Use of struct sctp_assoc_value in delayed_ack socket option. [ 922.593930][T21863] Use struct sctp_sack_info instead [ 922.620478][T21864] netlink: 'syz.2.4029': attribute type 13 has an invalid length. [ 922.653181][T21864] netlink: 24859 bytes leftover after parsing attributes in process `syz.2.4029'. [ 923.404641][T21900] netlink: 'syz.0.4037': attribute type 21 has an invalid length. [ 923.461587][T21901] netlink: 'syz.0.4037': attribute type 21 has an invalid length. [ 924.349097][T21917] netlink: 105940 bytes leftover after parsing attributes in process `syz.2.4040'. [ 924.593992][T21931] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4044'. [ 924.746647][T21931] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 924.931144][T21945] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.4049'. [ 925.156611][T21952] sock: sock_timestamping_bind_phc: sock not bind to device [ 925.176139][T21952] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4051'. [ 925.265431][T21954] netlink: 'syz.0.4048': attribute type 10 has an invalid length. [ 925.321473][T21954] netlink: 168 bytes leftover after parsing attributes in process `syz.0.4048'. [ 925.428084][T21954] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4048'. [ 925.463374][T21954] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4048'. [ 925.750836][T21969] syzkaller0: create flow: hash 1978113397 index 1 [ 925.939428][ T9436] syzkaller0: tun_net_xmit 76 [ 925.954589][ T9436] syzkaller0: tun_net_xmit 48 [ 925.965483][T20739] syzkaller0: tun_net_xmit 76 [ 926.054899][T21968] syzkaller0: delete flow: hash 1978113397 index 1 [ 928.516773][T21997] netlink: 'syz.3.4061': attribute type 39 has an invalid length. [ 928.713100][T22002] sock: sock_timestamping_bind_phc: sock not bind to device [ 928.932544][T22002] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4062'. [ 929.155411][T22006] netlink: 10 bytes leftover after parsing attributes in process `syz.2.4063'. [ 930.796039][T22048] netlink: 144 bytes leftover after parsing attributes in process `syz.2.4072'. [ 930.971325][T22051] sock: sock_timestamping_bind_phc: sock not bind to device [ 930.996175][T22051] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4073'. [ 931.190395][T22063] netlink: 'syz.0.4077': attribute type 27 has an invalid length. [ 931.223886][T22063] netlink: 164 bytes leftover after parsing attributes in process `syz.0.4077'. [ 931.282426][T22073] netlink: 'syz.3.4078': attribute type 29 has an invalid length. [ 931.354569][T22071] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4079'. [ 931.775006][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.781386][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.936884][T22096] netlink: 'syz.2.4082': attribute type 10 has an invalid length. [ 931.992076][T22095] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 932.053551][ T5778] Bluetooth: hci0: unexpected event 0x31 length: 15 > 6 [ 932.412636][T22117] netlink: 'syz.3.4088': attribute type 21 has an invalid length. [ 932.474540][T22118] netlink: 'syz.3.4088': attribute type 21 has an invalid length. [ 933.404165][T22138] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4094'. [ 934.233665][T22147] netlink: 192 bytes leftover after parsing attributes in process `syz.1.4096'. [ 934.259627][T22147] netlink: 192 bytes leftover after parsing attributes in process `syz.1.4096'. [ 934.502764][T22150] syzkaller0: entered promiscuous mode [ 934.524617][T22150] syzkaller0: entered allmulticast mode [ 934.584642][T22159] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4100'. [ 939.980360][T22175] netlink: 'syz.2.4105': attribute type 16 has an invalid length. [ 939.988308][T22175] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4105'. [ 940.004393][T22196] netlink: 'syz.1.4109': attribute type 21 has an invalid length. [ 940.037705][T22205] netlink: 'syz.1.4109': attribute type 21 has an invalid length. [ 940.203866][T22213] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4110'. [ 940.241954][T22213] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4110'. [ 940.309310][ T5778] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 940.584960][T22231] netlink: 'syz.3.4116': attribute type 21 has an invalid length. [ 941.101140][T22254] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4119'. [ 941.132564][T22256] netlink: 'syz.2.4119': attribute type 10 has an invalid length. [ 941.150507][T22256] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4119'. [ 941.178324][T22254] netlink: 'syz.2.4119': attribute type 12 has an invalid length. [ 941.214667][T22254] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4119'. [ 944.231516][T22268] netlink: 121460 bytes leftover after parsing attributes in process `syz.1.4124'. [ 944.333803][T22268] netlink: 21068 bytes leftover after parsing attributes in process `syz.1.4124'. [ 944.349557][T22268] tipc: Started in network mode [ 944.365974][T22268] tipc: Node identity b, cluster identity 73 [ 944.372291][T22268] tipc: Node number set to 11 [ 944.392705][T22273] netlink: 1057 bytes leftover after parsing attributes in process `syz.2.4127'. [ 944.475809][T22282] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4128'. [ 944.507119][T22279] openvswitch: netlink: IP tunnel attribute has 20476 unknown bytes. [ 944.583735][T22282] netlink: 'syz.3.4128': attribute type 29 has an invalid length. [ 944.635823][T22282] netlink: 'syz.3.4128': attribute type 29 has an invalid length. [ 944.665130][T22279] netlink: 'syz.3.4128': attribute type 29 has an invalid length. [ 944.812402][T22294] netlink: 'syz.0.4133': attribute type 2 has an invalid length. [ 944.996359][T22305] validate_nla: 1 callbacks suppressed [ 944.996371][T22305] netlink: 'syz.3.4138': attribute type 29 has an invalid length. [ 945.026588][T22305] netlink: 'syz.3.4138': attribute type 29 has an invalid length. [ 945.044338][T22305] netlink: 'syz.3.4138': attribute type 29 has an invalid length. [ 945.053044][T22305] netlink: 'syz.3.4138': attribute type 29 has an invalid length. [ 945.497687][T22325] __nla_validate_parse: 3 callbacks suppressed [ 945.497704][T22325] netlink: 65055 bytes leftover after parsing attributes in process `syz.3.4142'. [ 946.081320][T22344] bridge0: entered allmulticast mode [ 946.184063][T22344] netlink: 'syz.1.4148': attribute type 4 has an invalid length. [ 946.648911][T22355] netlink: 144 bytes leftover after parsing attributes in process `syz.2.4149'. [ 946.680489][T22355] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 946.908844][T22351] syzkaller0: entered promiscuous mode [ 946.917651][T22351] syzkaller0: entered allmulticast mode [ 947.286963][T22370] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4155'. [ 949.933349][T22383] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4161'. [ 950.116955][T22405] netlink: 'syz.2.4164': attribute type 21 has an invalid length. [ 950.201871][T22409] netlink: 'syz.2.4164': attribute type 21 has an invalid length. [ 951.086744][T22439] netlink: 'syz.0.4180': attribute type 29 has an invalid length. [ 951.095622][T22439] netlink: 'syz.0.4180': attribute type 29 has an invalid length. [ 951.250553][T22440] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4172'. [ 951.413879][T22450] sctp: [Deprecated]: syz.0.4175 (pid 22450) Use of int in maxseg socket option. [ 951.413879][T22450] Use struct sctp_assoc_value instead [ 951.456648][T22459] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4177'. [ 951.500572][T22459] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 951.551868][T22464] netlink: 56863 bytes leftover after parsing attributes in process `syz.2.4178'. [ 951.682035][T22468] netlink: 'syz.2.4182': attribute type 10 has an invalid length. [ 951.690432][T22468] netlink: 55 bytes leftover after parsing attributes in process `syz.2.4182'. [ 951.700458][T22468] batman_adv: batadv0: Interface deactivated: veth1_virt_wifi [ 952.006309][T22468] batman_adv: batadv0: Removing interface: veth1_virt_wifi [ 952.383995][T22484] netlink: 6 bytes leftover after parsing attributes in process `syz.2.4184'. [ 952.393328][T22484] openvswitch: netlink: Flow actions attr not present in new flow. [ 952.442179][T22484] netlink: 47635 bytes leftover after parsing attributes in process `syz.2.4184'. [ 953.823365][T22503] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4188'. [ 953.946956][T22501] netlink: 'syz.0.4189': attribute type 8 has an invalid length. [ 953.978715][T22501] netlink: 'syz.0.4189': attribute type 1 has an invalid length. [ 954.062610][T22501] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.4189'. [ 954.413739][T22515] netlink: 'syz.0.4192': attribute type 21 has an invalid length. [ 954.427963][T22515] netlink: 168 bytes leftover after parsing attributes in process `syz.0.4192'. [ 954.464654][T22520] netlink: 'syz.3.4193': attribute type 3 has an invalid length. [ 954.475384][T22520] netlink: 152 bytes leftover after parsing attributes in process `syz.3.4193'. [ 955.982672][T20792] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 955.993455][T20792] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 956.003174][T20792] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 956.016643][T20792] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 956.026258][T20792] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 956.033918][T20792] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 956.500226][T22563] chnl_net:caif_netlink_parms(): no params data found [ 956.781264][ T9448] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.908772][T22563] bridge0: port 1(bridge_slave_0) entered blocking state [ 956.924572][T22563] bridge0: port 1(bridge_slave_0) entered disabled state [ 956.937022][T22563] bridge_slave_0: entered allmulticast mode [ 956.960685][T22563] bridge_slave_0: entered promiscuous mode [ 957.012833][ T9448] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.041078][T22563] bridge0: port 2(bridge_slave_1) entered blocking state [ 957.056004][T22563] bridge0: port 2(bridge_slave_1) entered disabled state [ 957.063466][T22563] bridge_slave_1: entered allmulticast mode [ 957.075279][T22563] bridge_slave_1: entered promiscuous mode [ 957.085560][T22598] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 957.157881][ T9448] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.285355][ T9448] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 957.332648][T22563] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 957.369194][T22563] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 957.455371][T22563] team0: Port device team_slave_0 added [ 957.487367][T22563] team0: Port device team_slave_1 added [ 957.632399][T22563] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 957.652089][T22563] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 957.764477][T22563] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 957.838207][T22563] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 957.859322][T22563] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 957.910133][T22563] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 958.084569][T20792] Bluetooth: hci0: command tx timeout [ 958.600873][T22563] hsr_slave_0: entered promiscuous mode [ 958.633564][T22563] hsr_slave_1: entered promiscuous mode [ 958.732938][ T9448] tipc: Left network mode [ 959.901505][T22666] netlink: 'syz.0.4222': attribute type 12 has an invalid length. [ 959.934968][T22666] __nla_validate_parse: 2 callbacks suppressed [ 959.934985][T22666] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4222'. [ 960.164583][T20792] Bluetooth: hci0: command tx timeout [ 960.343015][T22697] delete_channel: no stack [ 960.386937][T22697] delete_channel: no stack [ 960.820499][T22563] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 960.849321][T22563] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 960.917933][T22563] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 960.940928][T22563] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 961.453466][T22563] 8021q: adding VLAN 0 to HW filter on device bond0 [ 961.695969][T22563] 8021q: adding VLAN 0 to HW filter on device team0 [ 961.750534][ T9448] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 961.785345][ T9448] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 961.813489][ T9448] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 961.841805][ T9448] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 961.871455][ T9448] batman_adv: batadv0: Interface deactivated: veth1_virt_wifi [ 961.896054][ T9448] batman_adv: batadv0: Removing interface: veth1_virt_wifi [ 961.917462][ T9448] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 961.947760][ T9448] batman_adv: batadv0: Removing interface: virt_wifi0 [ 961.983053][ T9448] veth1_macvtap: left promiscuous mode [ 962.035843][ T9448] veth0_macvtap: left promiscuous mode [ 962.057427][ T9448] veth0_vlan: left promiscuous mode [ 962.244625][T20792] Bluetooth: hci0: command tx timeout [ 962.583438][ T9448] team0 (unregistering): Port device geneve1 removed [ 963.261941][ T9448] team0 (unregistering): Port device 76žÿ removed [ 963.709107][ T6725] bridge0: port 1(bridge_slave_0) entered blocking state [ 963.716327][ T6725] bridge0: port 1(bridge_slave_0) entered forwarding state [ 963.730412][T22748] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4234'. [ 963.756889][T22755] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.4235'. [ 963.813735][ T6725] bridge0: port 2(bridge_slave_1) entered blocking state [ 963.820977][ T6725] bridge0: port 2(bridge_slave_1) entered forwarding state [ 963.936782][T22766] netlink: 1010 bytes leftover after parsing attributes in process `syz.2.4236'. [ 963.999375][T22563] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 964.324668][T20792] Bluetooth: hci0: command tx timeout [ 964.551707][T22563] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 964.666238][T22563] veth0_vlan: entered promiscuous mode [ 964.690620][T22563] veth1_vlan: entered promiscuous mode [ 964.754769][T22563] veth0_macvtap: entered promiscuous mode [ 964.778229][T22563] veth1_macvtap: entered promiscuous mode [ 964.826538][T22563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 964.856514][T22563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 964.884555][T22563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 964.915898][T22563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 964.944294][T22563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 964.957273][T22563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 964.990577][T22563] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 965.014335][T22563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: €Â0 [ 965.038658][T22563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 965.049189][T22563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 965.064327][T22563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 965.087106][T22563] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 965.109480][T22563] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 965.135302][T22563] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 965.144085][T22563] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 965.165577][T22563] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 965.187690][T22799] netlink: 'syz.0.4240': attribute type 10 has an invalid length. [ 965.218893][T22799] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 965.264353][T22799] bond0: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 965.285898][T22799] bond0: (slave ipvlan0): Error -95 calling set_mac_address [ 967.585853][T17074] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 967.607992][T17074] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 967.661844][T22807] netlink: 'syz.2.4242': attribute type 15 has an invalid length. [ 967.684672][T22807] netlink: 156 bytes leftover after parsing attributes in process `syz.2.4242'. [ 967.719904][T17074] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 967.739131][T17074] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 971.054744][T22823] €Â0: renamed from batadv_slave_1 (while UP) [ 971.484597][T22838] netlink: 209592 bytes leftover after parsing attributes in process `syz.2.4252'. [ 971.728149][T22847] netlink: 'syz.1.4253': attribute type 2 has an invalid length. [ 971.746648][T22847] netlink: 'syz.1.4253': attribute type 5 has an invalid length. [ 971.774698][T22847] netlink: 'syz.1.4253': attribute type 2 has an invalid length. [ 971.811365][T22847] netlink: 'syz.1.4253': attribute type 5 has an invalid length. [ 971.975145][T22856] netlink: 144 bytes leftover after parsing attributes in process `syz.2.4254'. [ 972.018576][T22856] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 972.075282][T22847] netlink: 'syz.1.4253': attribute type 2 has an invalid length. [ 972.092511][T22847] netlink: 'syz.1.4253': attribute type 5 has an invalid length. [ 972.106690][T22847] netlink: 'syz.1.4253': attribute type 2 has an invalid length. [ 972.144735][T22847] netlink: 'syz.1.4253': attribute type 5 has an invalid length. [ 972.324160][T22847] netlink: 'syz.1.4253': attribute type 2 has an invalid length. [ 972.332675][T22847] netlink: 'syz.1.4253': attribute type 5 has an invalid length. [ 973.466402][T22892] netlink: 164 bytes leftover after parsing attributes in process `syz.0.4259'. [ 974.781408][T22922] netlink: 128 bytes leftover after parsing attributes in process `syz.1.4267'. [ 974.802315][T22922] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 975.868939][T22972] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.4277'. [ 976.014123][T22979] netdevsim netdevsim1 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 976.252923][T22992] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4283'. [ 976.284165][T22992] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 976.339736][T22995] netlink: 196452 bytes leftover after parsing attributes in process `syz.1.4282'. [ 976.356979][T22995] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.4282'. [ 976.600310][T23007] veth0_vlan: entered allmulticast mode [ 976.799916][T23007] veth0_vlan: left promiscuous mode [ 976.883241][T23007] veth0_vlan: entered promiscuous mode [ 976.968128][T23007] team0: Device veth0_vlan failed to register rx_handler [ 977.137479][T23010] validate_nla: 8 callbacks suppressed [ 977.137497][T23010] netlink: 'syz.1.4286': attribute type 29 has an invalid length. [ 977.160521][T23015] netlink: 830 bytes leftover after parsing attributes in process `syz.1.4286'. [ 977.171318][T23018] netlink: 'syz.0.4289': attribute type 29 has an invalid length. [ 978.623171][T23070] netlink: 'syz.3.4302': attribute type 3 has an invalid length. [ 978.646365][T23070] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.4302'. [ 978.672609][T23072] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4303'. [ 978.738840][T23072] netlink: 'syz.2.4303': attribute type 10 has an invalid length. [ 978.754542][T23072] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4303'. [ 978.765792][T23072] netlink: 'syz.2.4303': attribute type 12 has an invalid length. [ 978.773646][T23072] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4303'. [ 979.287304][T23091] netlink: 'syz.3.4307': attribute type 2 has an invalid length. [ 980.126125][T23090] syzkaller0: entered promiscuous mode [ 980.131761][T23090] syzkaller0: entered allmulticast mode [ 982.319450][T23115] netlink: 14 bytes leftover after parsing attributes in process `syz.3.4313'. [ 982.547881][T23129] -1: renamed from syzkaller0 [ 982.590845][T23136] netlink: 'syz.3.4317': attribute type 9 has an invalid length. [ 982.610327][T23136] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.4317'. [ 982.645181][T23144] netlink: 'syz.1.4319': attribute type 64 has an invalid length. [ 982.833273][T23154] netlink: 'syz.0.4320': attribute type 2 has an invalid length. [ 983.258455][T23170] netlink: 'syz.3.4325': attribute type 4 has an invalid length. [ 983.266644][T23170] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4325'. [ 983.286992][T23170] netlink: 'syz.3.4325': attribute type 29 has an invalid length. [ 983.305465][T23170] netlink: 'syz.3.4325': attribute type 29 has an invalid length. [ 984.326239][T23191] netlink: 'syz.2.4329': attribute type 3 has an invalid length. [ 984.334062][T23191] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.4329'. [ 984.888192][T23212] netlink: 'syz.3.4333': attribute type 41 has an invalid length. [ 985.428759][T23233] netlink: 'syz.0.4335': attribute type 2 has an invalid length. [ 986.302557][T23253] netlink: 'syz.0.4339': attribute type 27 has an invalid length. [ 986.314418][T23253] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4339'. [ 987.030197][T23275] netlink: set zone limit has 8 unknown bytes [ 987.064575][T23276] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4345'. [ 987.144845][T23276] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 987.226989][T23276] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 987.285941][T23276] bond0 (unregistering): (slave team0): Releasing backup interface [ 987.338494][T23276] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 987.362954][T23276] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 987.387045][T23276] bond0 (unregistering): (slave geneve0): Releasing backup interface [ 987.397253][T23276] bond0 (unregistering): Released all slaves [ 988.003583][T23312] batman_adv: : Interface deactivated: batadv_slave_0 [ 988.010998][T23312] batman_adv: : Removing interface: batadv_slave_0 [ 988.020177][T23312] batman_adv: : Interface deactivated: veth1_virt_wifi [ 988.027656][T23312] batman_adv: : Removing interface: veth1_virt_wifi [ 988.036453][T23312] batman_adv: : Interface deactivated: virt_wifi0 [ 988.043900][T23312] batman_adv: : Removing interface: virt_wifi0 [ 988.258717][T23310] validate_nla: 1 callbacks suppressed [ 988.258738][T23310] netlink: 'syz.3.4354': attribute type 10 has an invalid length. [ 988.322710][T23310] netlink: 55 bytes leftover after parsing attributes in process `syz.3.4354'. [ 988.594102][T23329] netlink: 'syz.1.4357': attribute type 2 has an invalid length. [ 989.126566][T23333] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4359'. [ 989.446558][T23341] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.4362'. [ 989.634904][T23348] netlink: 'syz.3.4364': attribute type 22 has an invalid length. [ 989.721365][T23347] netlink: 'syz.3.4364': attribute type 22 has an invalid length. [ 992.710794][T23371] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4369'. [ 992.988966][T23401] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4373'. [ 993.017657][T23401] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 993.038986][T23403] netlink: 'syz.2.4375': attribute type 39 has an invalid length. [ 993.091831][T23403] hsr_slave_1 (unregistering): left promiscuous mode [ 993.208934][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.215469][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.310836][T23406] delete_channel: no stack [ 993.600690][T23413] netlink: 'syz.0.4379': attribute type 21 has an invalid length. [ 997.281712][T23432] netlink: 192436 bytes leftover after parsing attributes in process `syz.0.4384'. [ 997.305148][T23432] openvswitch: netlink: Duplicate key (type 0). [ 997.526889][T23437] delete_channel: no stack [ 997.601748][T23446] netlink: 'syz.3.4389': attribute type 2 has an invalid length. [ 997.630041][T23446] netlink: 'syz.3.4389': attribute type 1 has an invalid length. [ 997.652249][T23446] netlink: 199820 bytes leftover after parsing attributes in process `syz.3.4389'. [ 997.750701][T23453] netlink: 'syz.2.4390': attribute type 10 has an invalid length. [ 997.767443][T23453] netlink: 55 bytes leftover after parsing attributes in process `syz.2.4390'. [ 998.925401][T23477] netlink: 14975 bytes leftover after parsing attributes in process `syz.1.4398'. [ 998.962231][T23478] delete_channel: no stack [ 999.111576][T23482] netlink: 'syz.2.4401': attribute type 10 has an invalid length. [ 999.575179][T23505] netlink: 'syz.2.4407': attribute type 3 has an invalid length. [ 999.583175][T23505] netlink: 'syz.2.4407': attribute type 6 has an invalid length. [ 999.614515][T23505] netlink: 144448 bytes leftover after parsing attributes in process `syz.2.4407'. [ 999.889189][T23517] netlink: 'syz.0.4411': attribute type 9 has an invalid length. [ 999.912391][T23517] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.4411'. [ 1000.211402][T23531] netlink: 'syz.3.4416': attribute type 10 has an invalid length. [ 1000.221280][T23531] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4416'. [ 1000.249663][T23531] bridge0: port 1(team0) entered blocking state [ 1000.262811][T23531] bridge0: port 1(team0) entered disabled state [ 1000.273408][T23531] team0: entered allmulticast mode [ 1000.287787][T23531] team_slave_1: entered allmulticast mode [ 1000.293864][T23531] geneve1: entered allmulticast mode [ 1000.316719][T23531] dummy0: entered allmulticast mode [ 1000.334721][T23531] team0: entered promiscuous mode [ 1000.340280][T23531] team_slave_1: entered promiscuous mode [ 1000.353824][T23531] geneve1: entered promiscuous mode [ 1000.362332][T23531] dummy0: entered promiscuous mode [ 1000.374122][T23531] bridge0: port 1(team0) entered blocking state [ 1000.381123][T23531] bridge0: port 1(team0) entered forwarding state [ 1000.513519][T23542] netlink: 'syz.1.4420': attribute type 10 has an invalid length. [ 1000.523443][T23542] macvlan0: entered promiscuous mode [ 1000.530738][T23542] macvlan0: entered allmulticast mode [ 1000.566920][T23542] veth1_vlan: entered allmulticast mode [ 1000.610893][T23542] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 1000.720162][T23550] delete_channel: no stack [ 1000.725612][T23550] delete_channel: no stack [ 1000.753849][T23549] __sock_release: fasync list not empty! [ 1000.776798][T23552] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4424'. [ 1001.803574][T23604] netlink: 192436 bytes leftover after parsing attributes in process `syz.1.4437'. [ 1001.880351][T23604] openvswitch: netlink: Key type 8208 is out of range max 32 [ 1003.477361][T23617] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1003.547515][T23617] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4441'. [ 1005.296613][T23630] netlink: 'syz.3.4444': attribute type 2 has an invalid length. [ 1005.376869][T23630] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4444'. [ 1005.666700][T23634] netlink: 'syz.2.4445': attribute type 2 has an invalid length. [ 1005.755282][T23634] netlink: 198112 bytes leftover after parsing attributes in process `syz.2.4445'. [ 1008.001430][T23642] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.4450'. [ 1008.213816][T23650] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4451'. [ 1008.473434][T23658] netlink: 'syz.3.4454': attribute type 7 has an invalid length. [ 1008.507759][T23658] netlink: 'syz.3.4454': attribute type 6 has an invalid length. [ 1008.951251][T23679] netlink: 'syz.1.4461': attribute type 10 has an invalid length. [ 1009.325924][T23687] netlink: 'syz.3.4463': attribute type 1 has an invalid length. [ 1009.337131][T23687] netlink: 161700 bytes leftover after parsing attributes in process `syz.3.4463'. [ 1009.858216][T23683] netlink: 15119 bytes leftover after parsing attributes in process `syz.2.4462'. [ 1009.997339][T23699] netlink: 'syz.2.4466': attribute type 10 has an invalid length. [ 1009.997489][T23701] netlink: 212912 bytes leftover after parsing attributes in process `syz.3.4467'. [ 1010.071113][T23708] netlink: 'syz.1.4468': attribute type 10 has an invalid length. [ 1010.553596][T23708] syz_tun: entered promiscuous mode [ 1010.593247][T23708] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1010.605940][T23703] netlink: 'syz.3.4467': attribute type 21 has an invalid length. [ 1010.624937][T23703] netlink: 'syz.3.4467': attribute type 3 has an invalid length. [ 1010.632945][T23703] netlink: 144 bytes leftover after parsing attributes in process `syz.3.4467'. [ 1010.655253][T23711] netlink: 'syz.1.4468': attribute type 10 has an invalid length. [ 1010.700961][T23711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1010.710492][T23711] team0: Port device bond0 added [ 1010.719576][T23711] netlink: 'syz.1.4468': attribute type 10 has an invalid length. [ 1011.755743][T23745] netlink: 'syz.3.4480': attribute type 5 has an invalid length. [ 1011.917797][T23744] netlink: 'syz.0.4479': attribute type 10 has an invalid length. [ 1012.003514][T23741] netlink: 134736 bytes leftover after parsing attributes in process `syz.1.4478'. [ 1012.256212][T23750] netlink: 65055 bytes leftover after parsing attributes in process `syz.0.4481'. [ 1012.488869][T23758] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.4483'. [ 1013.726831][T23773] dvmrp1: tun_chr_ioctl cmd 2148553947 [ 1013.831247][T23773] dvmrp1: tun_chr_ioctl cmd 21731 [ 1014.070386][T23789] netlink: 'syz.2.4489': attribute type 28 has an invalid length. [ 1014.089026][T23789] netlink: 'syz.2.4489': attribute type 4 has an invalid length. [ 1014.101695][T23789] netlink: 136 bytes leftover after parsing attributes in process `syz.2.4489'. [ 1014.112174][T23792] netlink: 'syz.3.4491': attribute type 10 has an invalid length. [ 1014.128539][T23792] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4491'. [ 1014.155089][T23792] bridge0: port 1(team0) entered disabled state [ 1014.203167][T23792] bridge0: port 1(team0) entered blocking state [ 1014.209682][T23792] bridge0: port 1(team0) entered forwarding state [ 1014.247627][T23792] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1014.503539][T23804] netlink: 'syz.3.4495': attribute type 29 has an invalid length. [ 1014.515573][T23807] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.4496'. [ 1014.608854][T23804] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.4495'. [ 1015.646296][T23832] syz.2.4501[23832] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1015.646633][T23832] syz.2.4501[23832] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1016.203895][T23847] validate_nla: 5 callbacks suppressed [ 1016.203915][T23847] netlink: 'syz.0.4504': attribute type 2 has an invalid length. [ 1016.237831][T23847] netlink: 198112 bytes leftover after parsing attributes in process `syz.0.4504'. [ 1019.051642][T23857] netlink: 'syz.2.4508': attribute type 39 has an invalid length. [ 1019.349922][T23865] netlink: 'syz.2.4511': attribute type 7 has an invalid length. [ 1019.565120][T23877] netlink: 'syz.0.4512': attribute type 7 has an invalid length. [ 1019.593497][T23877] netlink: 'syz.0.4512': attribute type 6 has an invalid length. [ 1020.351723][T23888] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.4513'. [ 1020.485078][T23896] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1020.520979][T23896] netlink: 'syz.0.4517': attribute type 9 has an invalid length. [ 1020.529003][T23896] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.4517'. [ 1020.583247][T23900] netlink: 'syz.0.4517': attribute type 9 has an invalid length. [ 1020.595670][T23900] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.4517'. [ 1020.884840][T23896] netlink: 'syz.0.4517': attribute type 39 has an invalid length. [ 1021.568925][T23910] netlink: 52711 bytes leftover after parsing attributes in process `syz.2.4520'. [ 1021.593333][T23910] netlink: 52711 bytes leftover after parsing attributes in process `syz.2.4520'. [ 1021.648360][T23910] netlink: 52711 bytes leftover after parsing attributes in process `syz.2.4520'. [ 1021.674796][T23915] netlink: 'syz.3.4522': attribute type 2 has an invalid length. [ 1021.691465][T23915] netlink: 'syz.3.4522': attribute type 1 has an invalid length. [ 1021.695251][T23910] netlink: 52711 bytes leftover after parsing attributes in process `syz.2.4520'. [ 1021.700709][T23915] netlink: 9 bytes leftover after parsing attributes in process `syz.3.4522'. [ 1021.823427][T23915] netlink: 'syz.3.4522': attribute type 10 has an invalid length. [ 1021.835194][T23915] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4522'. [ 1021.891576][T23916] netlink: 140 bytes leftover after parsing attributes in process `syz.2.4520'. [ 1023.284113][T23966] netlink: 'syz.3.4534': attribute type 2 has an invalid length. [ 1025.506730][T24024] netlink: 'syz.3.4548': attribute type 2 has an invalid length. [ 1026.556339][T24033] netlink: 'syz.1.4551': attribute type 10 has an invalid length. [ 1026.660182][T24035] netlink: 'syz.0.4550': attribute type 153 has an invalid length. [ 1026.675452][T24035] __nla_validate_parse: 2 callbacks suppressed [ 1026.675467][T24035] netlink: 128124 bytes leftover after parsing attributes in process `syz.0.4550'. [ 1027.800446][T24054] netlink: 'syz.1.4557': attribute type 9 has an invalid length. [ 1027.808750][T24054] netlink: 156008 bytes leftover after parsing attributes in process `syz.1.4557'. [ 1027.837652][T24058] netlink: 14 bytes leftover after parsing attributes in process `syz.2.4560'. [ 1028.025558][T24066] netlink: 'syz.3.4561': attribute type 2 has an invalid length. [ 1028.415822][T24075] sock: sock_set_timeout: `syz.2.4565' (pid 24075) tries to set negative timeout [ 1028.681204][T24083] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1029.088440][T24095] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4571'. [ 1029.465407][T20792] Bluetooth: hci0: unexpected event 0x31 length: 15 > 6 [ 1029.634859][T24122] netlink: 'syz.2.4578': attribute type 2 has an invalid length. [ 1030.449087][T24136] netlink: 'syz.3.4582': attribute type 30 has an invalid length. [ 1030.470359][T24135] netlink: 'syz.3.4582': attribute type 30 has an invalid length. [ 1030.581715][T24143] netlink: 'syz.2.4583': attribute type 10 has an invalid length. [ 1030.634534][T24143] netlink: 'syz.2.4583': attribute type 19 has an invalid length. [ 1030.654694][T24143] netlink: 14536 bytes leftover after parsing attributes in process `syz.2.4583'. [ 1030.922896][T24153] netlink: 830 bytes leftover after parsing attributes in process `syz.3.4586'. [ 1031.253134][T24167] netlink: 22 bytes leftover after parsing attributes in process `syz.1.4588'. [ 1032.196088][T24188] netlink: 'syz.1.4593': attribute type 49 has an invalid length. [ 1032.204014][T24188] netlink: 'syz.1.4593': attribute type 49 has an invalid length. [ 1032.268075][T24189] netlink: 'syz.3.4591': attribute type 2 has an invalid length. [ 1054.652170][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.658613][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.090675][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.097528][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1137.934183][ C1] rcu: INFO: rcu_preempt self-detected stall on CPU [ 1137.940837][ C1] rcu: 1-....: (1 GPs behind) idle=e49c/1/0x4000000000000000 softirq=101772/101773 fqs=2821 [ 1137.952146][ C1] rcu: hardirqs softirqs csw/system [ 1137.958592][ C1] rcu: number: 645968 0 0 [ 1137.965015][ C1] rcu: cputime: 7666 16081 19 ==> 23750(ms) [ 1137.973246][ C1] rcu: (t=10500 jiffies g=128941 q=803 ncpus=2) [ 1137.979568][ C1] CPU: 1 PID: 24195 Comm: syz.1.4595 Not tainted syzkaller #0 [ 1137.987022][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1137.997086][ C1] RIP: 0010:stack_trace_consume_entry+0x2c/0x270 [ 1138.003449][ C1] Code: 1e fa 55 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 ba 00 00 00 00 00 fc ff df 4c 8d 47 10 4c 89 c5 48 c1 ed 03 0f b6 44 15 00 <84> c0 0f 85 04 01 00 00 44 8b 4f 10 4c 8d 77 08 4d 89 f5 49 c1 ed [ 1138.023074][ C1] RSP: 0018:ffffc900001efef8 EFLAGS: 00000a02 [ 1138.029151][ C1] RAX: 0000000000000000 RBX: ffffc900001f0000 RCX: ffff888068a91e00 [ 1138.037127][ C1] RDX: dffffc0000000000 RSI: ffffffff81dff2ac RDI: ffffc900001f0000 [ 1138.045108][ C1] RBP: 1ffff9200003e002 R08: ffffc900001f0010 R09: 0000000000000003 [ 1138.053093][ C1] R10: 0000000000000004 R11: 0000000000000100 R12: ffffffff81dff2ac [ 1138.061062][ C1] R13: 00000000000000f0 R14: ffffffff81762710 R15: ffffc900001eff48 [ 1138.069036][ C1] FS: 00007fdc788c16c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 1138.077981][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1138.084580][ C1] CR2: 00007fdc788a0d58 CR3: 0000000077a36000 CR4: 00000000003506e0 [ 1138.092569][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000200000000300 [ 1138.100549][ C1] DR3: 0000200000000300 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1138.108522][ C1] Call Trace: [ 1138.111800][ C1] [ 1138.114647][ C1] ? __kasan_slab_alloc+0x6c/0x80 [ 1138.119673][ C1] ? stack_trace_save+0x100/0x100 [ 1138.124811][ C1] arch_stack_walk+0x138/0x190 [ 1138.129582][ C1] ? __kasan_slab_alloc+0x6c/0x80 [ 1138.134633][ C1] stack_trace_save+0xaa/0x100 [ 1138.139412][ C1] ? stack_trace_snprint+0xf0/0xf0 [ 1138.144545][ C1] kasan_set_track+0x4e/0x70 [ 1138.149131][ C1] ? kasan_set_track+0x4e/0x70 [ 1138.153938][ C1] __kasan_slab_alloc+0x6c/0x80 [ 1138.158835][ C1] slab_post_alloc_hook+0x6a/0x4d0 [ 1138.163953][ C1] kmem_cache_alloc+0x17e/0x2c0 [ 1138.168808][ C1] ? skb_clone+0x1eb/0x370 [ 1138.173232][ C1] skb_clone+0x1eb/0x370 [ 1138.177471][ C1] ? dev_queue_xmit_nit+0x227/0xba0 [ 1138.182670][ C1] dev_queue_xmit_nit+0x23f/0xba0 [ 1138.187781][ C1] ? dev_queue_xmit_nit+0x2d/0xba0 [ 1138.192984][ C1] dev_hard_start_xmit+0x150/0x790 [ 1138.198106][ C1] __dev_queue_xmit+0x1be8/0x37e0 [ 1138.203127][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 1138.208341][ C1] ? __dev_queue_xmit+0x272/0x37e0 [ 1138.213492][ C1] ? read_seqbegin+0x188/0x250 [ 1138.218268][ C1] ? read_seqbegin+0x1b6/0x250 [ 1138.223142][ C1] ? neigh_event_send+0x110/0x110 [ 1138.228187][ C1] ? netdev_core_pick_tx+0x370/0x370 [ 1138.233491][ C1] ? __asan_memcpy+0x40/0x70 [ 1138.238095][ C1] ? eth_header+0x11b/0x200 [ 1138.242610][ C1] ? llc_sysctl_exit+0x70/0x70 [ 1138.247398][ C1] ? neigh_resolve_output+0x5f5/0x710 [ 1138.252787][ C1] ip6_finish_output2+0xf7a/0x1690 [ 1138.257903][ C1] ? ip6_finish_output2+0x71a/0x1690 [ 1138.263191][ C1] ? nf_hook+0x390/0x390 [ 1138.267462][ C1] ? ip6_mtu+0x321/0x3f0 [ 1138.271707][ C1] ? ip6_finish_output+0x567/0x7f0 [ 1138.276830][ C1] ndisc_send_skb+0xbb9/0x1480 [ 1138.281592][ C1] ? ndisc_alloc_skb+0x18c/0x450 [ 1138.286529][ C1] ? ndisc_send_skb+0x201/0x1480 [ 1138.291473][ C1] ? ndisc_mc_map+0x680/0x680 [ 1138.296152][ C1] ? skb_dst+0xd0/0xd0 [ 1138.300241][ C1] addrconf_rs_timer+0x36b/0x640 [ 1138.305177][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1138.311332][ C1] ? addrconf_disable_policy_idev+0x480/0x480 [ 1138.317401][ C1] ? call_timer_fn+0x81/0x540 [ 1138.322089][ C1] call_timer_fn+0x189/0x540 [ 1138.326679][ C1] ? addrconf_disable_policy_idev+0x480/0x480 [ 1138.332750][ C1] ? call_timer_fn+0xd2/0x540 [ 1138.337428][ C1] ? __run_timers+0x810/0x810 [ 1138.342115][ C1] ? addrconf_disable_policy_idev+0x480/0x480 [ 1138.348182][ C1] __run_timers+0x570/0x810 [ 1138.352696][ C1] ? detach_timer+0x2b0/0x2b0 [ 1138.357471][ C1] run_timer_softirq+0x67/0xf0 [ 1138.362242][ C1] handle_softirqs+0x27d/0x820 [ 1138.367039][ C1] ? read_tsc+0x9/0x20 [ 1138.371103][ C1] ? ktime_get+0x24b/0x280 [ 1138.375522][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 1138.380282][ C1] ? do_softirq+0x1a0/0x1a0 [ 1138.384787][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 1138.389991][ C1] __irq_exit_rcu+0xd3/0x190 [ 1138.394602][ C1] ? irq_exit_rcu+0x20/0x20 [ 1138.399108][ C1] irq_exit_rcu+0x9/0x20 [ 1138.403343][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1138.408975][ C1] [ 1138.411901][ C1] [ 1138.414827][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1138.420831][ C1] RIP: 0010:finish_task_switch+0x267/0x8f0 [ 1138.426634][ C1] Code: 33 09 85 c0 0f 84 30 01 00 00 48 85 db 0f 85 4f 01 00 00 0f 1f 44 00 00 4c 89 e7 e8 53 28 3d 09 e8 0e 23 30 00 fb 4c 8b 65 b8 <49> 8d bc 24 00 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 1138.446240][ C1] RSP: 0018:ffffc90005517640 EFLAGS: 00000286 [ 1138.452309][ C1] RAX: 57e3fa1720a9ba00 RBX: 0000000000000000 RCX: 57e3fa1720a9ba00 [ 1138.460275][ C1] RDX: dffffc0000000000 RSI: ffffffff8acacce0 RDI: ffffffff8b1d3ba0 [ 1138.468248][ C1] RBP: ffffc90005517690 R08: ffffffff911eb52f R09: 1ffffffff223d6a5 [ 1138.476216][ C1] R10: dffffc0000000000 R11: fffffbfff223d6a6 R12: ffff888068a91e00 [ 1138.484185][ C1] R13: 1ffff110171e79a1 R14: dffffc0000000000 R15: ffff8880b8f3cd08 [ 1138.492177][ C1] __schedule+0x15b6/0x4660 [ 1138.496704][ C1] ? asan.module_dtor+0x20/0x20 [ 1138.501563][ C1] ? mark_lock+0x94/0x320 [ 1138.505895][ C1] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 1138.513090][ C1] ? lock_chain_count+0x20/0x20 [ 1138.517939][ C1] ? preempt_schedule+0xc0/0xd0 [ 1138.522789][ C1] preempt_schedule_common+0x82/0xc0 [ 1138.528073][ C1] preempt_schedule+0xc0/0xd0 [ 1138.532751][ C1] ? schedule_preempt_disabled+0x20/0x20 [ 1138.538385][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1138.544544][ C1] preempt_schedule_thunk+0x1a/0x30 [ 1138.549755][ C1] _raw_spin_unlock_irqrestore+0x111/0x120 [ 1138.555559][ C1] ? _raw_spin_unlock+0x40/0x40 [ 1138.560410][ C1] debug_check_no_obj_freed+0x47b/0x520 [ 1138.565966][ C1] free_unref_page_prepare+0x1ed/0x8f0 [ 1138.571426][ C1] free_unref_page+0x32/0x2e0 [ 1138.576105][ C1] __unfreeze_partials+0x1cf/0x210 [ 1138.581219][ C1] put_cpu_partial+0x17c/0x250 [ 1138.585980][ C1] ? put_cpu_partial+0x6e/0x250 [ 1138.590829][ C1] __slab_free+0x319/0x400 [ 1138.595242][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1138.601129][ C1] ? _raw_spin_unlock+0x40/0x40 [ 1138.605980][ C1] qlist_free_all+0x75/0xd0 [ 1138.610485][ C1] kasan_quarantine_reduce+0x143/0x160 [ 1138.615944][ C1] __kasan_slab_alloc+0x22/0x80 [ 1138.620877][ C1] slab_post_alloc_hook+0x6a/0x4d0 [ 1138.625990][ C1] ? slab_pre_alloc_hook+0xb1/0x300 [ 1138.631193][ C1] kmem_cache_alloc_lru+0x175/0x2b0 [ 1138.636400][ C1] ? sock_alloc_inode+0x28/0xc0 [ 1138.641255][ C1] sock_alloc_inode+0x28/0xc0 [ 1138.645930][ C1] ? sockfs_init_fs_context+0xb0/0xb0 [ 1138.651299][ C1] new_inode_pseudo+0x63/0x1d0 [ 1138.656064][ C1] __sock_create+0x12d/0x940 [ 1138.660649][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1138.666809][ C1] __sys_socket+0xd7/0x1b0 [ 1138.671229][ C1] __x64_sys_socket+0x7a/0x90 [ 1138.675905][ C1] do_syscall_64+0x55/0xb0 [ 1138.680317][ C1] ? clear_bhb_loop+0x40/0x90 [ 1138.685020][ C1] ? clear_bhb_loop+0x40/0x90 [ 1138.689699][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1138.695595][ C1] RIP: 0033:0x7fdc7799e159 [ 1138.700005][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1138.719613][ C1] RSP: 002b:00007fdc788c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1138.728027][ C1] RAX: ffffffffffffffda RBX: 00007fdc77c25fa0 RCX: 00007fdc7799e159 [ 1138.735994][ C1] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000010 [ 1138.743957][ C1] RBP: 00007fdc77a3506b R08: 0000000000000000 R09: 0000000000000000 [ 1138.751923][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1138.759893][ C1] R13: 00007fdc77c26038 R14: 00007fdc77c25fa0 R15: 00007ffc5ea58af8 [ 1138.767897][ C1] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1140.018209][T24205] syz-executor: vmalloc error: size 4194304, failed to allocated page array size 8192, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1140.114268][T24205] CPU: 1 PID: 24205 Comm: syz-executor Not tainted syzkaller #0 [ 1140.121973][T24205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1140.132056][T24205] Call Trace: [ 1140.135351][T24205] [ 1140.138299][T24205] dump_stack_lvl+0x18c/0x250 [ 1140.143008][T24205] ? show_regs_print_info+0x20/0x20 [ 1140.148229][T24205] ? load_image+0x420/0x420 [ 1140.152754][T24205] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1140.159190][T24205] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1140.165717][T24205] warn_alloc+0x246/0x340 [ 1140.170069][T24205] ? zone_watermark_ok_safe+0x230/0x230 [ 1140.175640][T24205] ? _raw_spin_unlock+0x28/0x40 [ 1140.180521][T24205] __vmalloc_node_range+0x661/0x1320 [ 1140.185827][T24205] ? __asan_memset+0x22/0x40 [ 1140.190463][T24205] ? free_vm_area+0x50/0x50 [ 1140.195011][T24205] ? perf_trace_preemptirq_template+0xac/0x330 [ 1140.201192][T24205] ? kcov_remote_reset+0xc0/0xc0 [ 1140.206148][T24205] vmalloc_user+0x74/0x80 [ 1140.210503][T24205] ? kcov_ioctl+0x58/0x610 [ 1140.214938][T24205] kcov_ioctl+0x58/0x610 [ 1140.219200][T24205] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1140.224152][T24205] ? security_file_ioctl+0x80/0xa0 [ 1140.229285][T24205] ? kcov_remote_reset+0xc0/0xc0 [ 1140.234240][T24205] __se_sys_ioctl+0xfd/0x170 [ 1140.238858][T24205] do_syscall_64+0x55/0xb0 [ 1140.243290][T24205] ? clear_bhb_loop+0x40/0x90 [ 1140.247989][T24205] ? clear_bhb_loop+0x40/0x90 [ 1140.252685][T24205] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1140.258603][T24205] RIP: 0033:0x7f958a39ddeb [ 1140.263033][T24205] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 1140.282672][T24205] RSP: 002b:00007ffce446e110 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1140.291129][T24205] RAX: ffffffffffffffda RBX: 0000000000080000 RCX: 00007f958a39ddeb [ 1140.299123][T24205] RDX: 0000000000080000 RSI: ffffffff80086301 RDI: 00000000000000dd [ 1140.307118][T24205] RBP: 00007f958a6264e8 R08: 0000000000000000 R09: 0000000000000000 [ 1140.315113][T24205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1140.323100][T24205] R13: 0000000000000003 R14: 00007ffce446e3c8 R15: 0000000000000000 [ 1140.331102][T24205] [ 1140.584257][T24205] Mem-Info: [ 1140.587465][T24205] active_anon:43734 inactive_anon:0 isolated_anon:0 [ 1140.587465][T24205] active_file:18552 inactive_file:40332 isolated_file:0 [ 1140.587465][T24205] unevictable:768 dirty:26 writeback:0 [ 1140.587465][T24205] slab_reclaimable:10870 slab_unreclaimable:102564 [ 1140.587465][T24205] mapped:21904 shmem:40512 pagetables:390 [ 1140.587465][T24205] sec_pagetables:0 bounce:0 [ 1140.587465][T24205] kernel_misc_reclaimable:0 [ 1140.587465][T24205] free:1292905 free_pcp:4746 free_cma:0 [ 1140.684291][T24205] Node 0 active_anon:174936kB inactive_anon:0kB active_file:74208kB inactive_file:161128kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:92916kB dirty:104kB writeback:0kB shmem:160512kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13248kB pagetables:1560kB sec_pagetables:0kB all_unreclaimable? no [ 1140.744236][T24205] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1140.814259][T24205] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1140.864225][T24205] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1140.870073][T24205] Node 0 DMA32 free:1220344kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:174900kB inactive_anon:0kB active_file:74208kB inactive_file:160296kB unevictable:1536kB writepending:104kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:12500kB local_pcp:12500kB free_cma:0kB [ 1140.944191][T24205] lowmem_reserve[]: 0 0 0 0 0 [ 1140.948984][T24205] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:832kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1141.014214][T24205] lowmem_reserve[]: 0 0 0 0 0 [ 1141.019008][T24205] Node 1 Normal free:3907940kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:6688kB local_pcp:1120kB free_cma:0kB [ 1141.083152][T24205] lowmem_reserve[]: 0 0 0 0 0 [ 1141.091769][T24205] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1141.112803][T24212] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1141.123384][T24212] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1141.132180][T24212] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1141.141851][T24212] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1141.149786][T24212] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1141.157229][T24212] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1141.187338][T24205] Node 0 DMA32: 1777*4kB (UME) 1570*8kB (UME) 742*16kB (ME) 1357*32kB (UME) 256*64kB (UME) 210*128kB (UME) 177*256kB (UME) 101*512kB (U) 52*1024kB (UM) 22*2048kB (UME) 218*4096kB (UM) = 1206484kB [ 1141.222002][T24205] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1141.255180][T24205] Node 1 Normal: 225*4kB (UME) 40*8kB (UME) 34*16kB (UME) 214*32kB (UME) 61*64kB (UME) 17*128kB (UME) 2*256kB (ME) 1*512kB (U) 1*1024kB (E) 2*2048kB (UE) 949*4096kB (M) = 3907940kB [ 1141.276870][T24205] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1141.286850][T24205] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1141.296517][T24205] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1141.306353][T24205] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1141.315998][T24205] 99397 total pagecache pages [ 1141.320685][T24205] 0 pages in swap cache [ 1141.325256][T24205] Free swap = 124712kB [ 1141.329423][T24205] Total swap = 124996kB [ 1141.334062][T24205] 2097051 pages RAM [ 1141.338485][T24205] 0 pages HighMem/MovableOnly [ 1141.343176][T24205] 416965 pages reserved [ 1141.348337][T24205] 0 pages cma reserved [ 1143.204318][ T5778] Bluetooth: hci2: command tx timeout [ 1145.396417][ T5778] Bluetooth: hci2: command tx timeout [ 1147.444434][ T5778] Bluetooth: hci2: command tx timeout