last executing test programs: 2m52.030607751s ago: executing program 2 (id=1072): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) write$cgroup_pid(r0, &(0x7f0000000980), 0x20000992) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000004c0), 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0x3, 0x0, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0, r1, 0x0, 0x1}, 0x18) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x58, 0x4, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x10}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb1, 0x2, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}, 0xc42a, 0x900000000000100, 0x7, 0x5, 0x0, 0x200000, 0x0, 0x0, 0x8000}, 0x0, 0x0, 0xffffffffffffffff, 0x8) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='fib_table_lookup\x00', r4}, 0x10) 2m51.263006943s ago: executing program 2 (id=1076): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000120000002400000008000000850000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000005c0)='sched_switch\x00', r1}, 0x18) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001bc0)={0x11, 0x0, 0x0, &(0x7f0000001380)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(r3) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x0, 0x0, 0x401}, 0x48) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000000)={0x0, 0x0}) close(r4) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f0000000180), 0x127) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e000000000000000000000001"], 0x48) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r6) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r10, 0x1, 0x32, &(0x7f0000000180)=r9, 0x4) sendmsg$inet(r11, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) setsockopt$sock_attach_bpf(r7, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d0000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2m50.739665495s ago: executing program 2 (id=1080): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xf, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000013c0)=ANY=[@ANYBLOB="0b00000005"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000010018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x5, 0xfffffffffffffe1e, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x20}, 0x90) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) 2m50.374562124s ago: executing program 2 (id=1084): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r0}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) 2m50.196238099s ago: executing program 2 (id=1086): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0xc48}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003480)={0x11, 0x2, &(0x7f00000001c0)=ANY=[@ANYBLOB="17010000a4fc0a000500feff"], &(0x7f0000000000)='GPL\x00', 0x6, 0x89, &(0x7f0000003300)=""/137, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x9}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) perf_event_open(0x0, 0x0, 0xafffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) 2m49.149482932s ago: executing program 2 (id=1094): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, r0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x58, 0x4, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xaf) r4 = gettid() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r3}, 0x10) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(r4, &(0x7f0000000280)='ns/user\x00') syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 2m33.842135274s ago: executing program 32 (id=1094): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, r0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x58, 0x4, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xaf) r4 = gettid() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r3}, 0x10) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(r4, &(0x7f0000000280)='ns/user\x00') syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 5.205267061s ago: executing program 3 (id=2245): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000080000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000680)='sched_switch\x00', r0}, 0x10) socketpair(0x15, 0x4, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x141141, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={0xffffffffffffffff, r3, 0x0, 0x20ffffffbc}, 0x10) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000f1661f070d00000000001e0000e1ffffff00000000000000"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r4, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000b40)={r4, &(0x7f0000000a80), 0x0}, 0x20) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x56, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x831, 0x7f}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xff}, 0x0, 0xfffdffdfffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000000)=r0, 0x4) socketpair(0x1e, 0xa, 0x8371632, &(0x7f0000000240)) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x96, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c"], 0x0, 0x37}, 0x28) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89a0, &(0x7f0000000080)) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb0100180000000c0000000200000005"], 0x0, 0x26, 0x0, 0x1}, 0x28) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89a2, &(0x7f0000000080)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfdef) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000080)) 4.056394834s ago: executing program 4 (id=2254): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89f2, 0x0) 3.963621981s ago: executing program 4 (id=2255): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001280)={0x11, 0x3, &(0x7f0000000940)=ANY=[], &(0x7f00000001c0)='GPL\x00'}, 0x94) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000a40)="47f7", 0x2}], 0x1}, 0x10049014) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x19, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_config_ext, 0x801, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x8000, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) 3.943813363s ago: executing program 1 (id=2256): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22667f2b00dbf6e97158cf474fec87891f6d76745b686158bbcfe8875afdef00010000000029"], 0x66) 2.005541419s ago: executing program 3 (id=2257): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000340)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000018", @ANYRES32], 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0xc220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40408, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0x6}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x21, 0x2, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000000000000000000000000000085100000010000009500000000000000180000000001000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0xa}, 0x94) socket$kcm(0x10, 0x400000002, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) r1 = socket$kcm(0xa, 0x3, 0x73) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f00000001c0)=@nl=@unspec, 0x80, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000) sendmsg$kcm(r2, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x23}}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000100000051d833483cc75d51900000000000000004000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) sendmsg(r0, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003140)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0xf, 0x200cc, 0x6, 0x5}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)='T', &(0x7f0000000240), 0x4af, r3}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000700)={0x0, &(0x7f0000000540)=""/245, &(0x7f00000000c0), &(0x7f0000000680), 0x2, r3}, 0x38) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xb, 0x0, &(0x7f0000000400)='GPL\x00', 0x1, 0xe0, &(0x7f0000000440)=""/224}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8923, &(0x7f00000000c0)={'virt_wifi0\x00', @multicast}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500"], 0x48) 1.877466929s ago: executing program 4 (id=2259): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{0xffffffffffffffff, 0xffffffffffffffff}, 0x0, 0x0}, 0x20) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, &(0x7f00000008c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$tipc(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4008000}, 0x0) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) close(r1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='kmem_cache_free\x00'}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1e00000008000000f2000000000001", @ANYRES32=r0, @ANYBLOB="36ad00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000004000000010000000400"/28], 0x50) close(r3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) socketpair(0x1, 0x2, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000000)={'veth0_vlan\x00', @random="010000201000"}) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f0000000540)=ANY=[@ANYBLOB="18000b00000000000000000100007b9f2882a85d3aada1000000000000", @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 1.812803935s ago: executing program 0 (id=2260): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x50) r0 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8916, &(0x7f0000000040)={'veth1_macvtap\x00', @random="0200ac7f7f00"}) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) 1.721664672s ago: executing program 1 (id=2261): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={r0, 0x2000002, 0xe, 0x0, &(0x7f0000000000)="0033c9f7b9a60000000100000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.562859485s ago: executing program 1 (id=2262): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r1}, 0x18) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1.324050024s ago: executing program 0 (id=2263): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x101c01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079d}) socketpair(0x1, 0x1, 0x1, &(0x7f00000002c0)) write$cgroup_devices(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="1e0328004d8c71ef2885634a8270121406"], 0xffdd) 942.324245ms ago: executing program 3 (id=2264): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000007d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x4, 0x80, 0x4, 0x8, 0x2c, 0x5, 0x0, 0x1, 0x200, 0x3, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_bp={0x0, 0xb}, 0xc0, 0x9, 0x9, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x7ff, 0x0, 0x9}, 0x0, 0x40003, 0xffffffffffffffff, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000200)='GPL\x00'}, 0x80) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bridge0\x00', 0x400}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f0, &(0x7f0000000080)) 838.774673ms ago: executing program 0 (id=2265): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) write$cgroup_int(r0, &(0x7f0000000200), 0x43451) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r1, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r3, &(0x7f0000000180), 0x40001) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8}, 0x48) 766.260918ms ago: executing program 1 (id=2266): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x2, 0x4e22, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="140000000000000000000000010000000000000000000000180000000000000000000000070000004404dc030100ff9711000000000000000000000007000000"], 0x60}, 0x0) 713.038583ms ago: executing program 4 (id=2267): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r1, &(0x7f0000000180), 0x40001) r2 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b00)={&(0x7f0000000ac0)='mm_page_free_batched\x00', r3}, 0x10) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0}, 0x0, 0x10003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40305829, &(0x7f0000000040)) 583.501524ms ago: executing program 1 (id=2268): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001280)={0x11, 0x3, &(0x7f0000000940)=ANY=[], &(0x7f00000001c0)='GPL\x00'}, 0x94) socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x19, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_config_ext, 0x801, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x8000, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) 568.369245ms ago: executing program 0 (id=2269): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000020000000a0000000000000a030000000800000000192a55b2da5a01530bfc0b00000b04"], 0x0, 0x4a, 0x0, 0x1, 0x800, 0x10000}, 0x28) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22667f2b00dbf6e97158cf474fec87891f6d76745b686158bbcfe8875afdef00010000000029"], 0x66) 507.81024ms ago: executing program 4 (id=2270): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={r0, 0x2000002, 0xe, 0x0, &(0x7f0000000000)="0033c9f7b9a60000000100000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 488.183381ms ago: executing program 3 (id=2271): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[], 0x50) r0 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8916, &(0x7f0000000040)={'veth1_macvtap\x00', @random="0200ac7f7f00"}) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) 400.915808ms ago: executing program 4 (id=2272): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x69, 0x8, 0x0, 0x0}}, 0x10) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0xc9d7, 0x9, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r0, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f00000002c0)='mm_page_alloc\x00', r2}, 0x63) syz_clone(0x46085300, 0x0, 0xfffffffffffffda0, 0x0, 0x0, 0x0) 400.208938ms ago: executing program 1 (id=2273): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000340)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000018", @ANYRES32], 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0xc220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40408, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0x6}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x21, 0x2, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000000000000000000000000000085100000010000009500000000000000180000000001000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0xa}, 0x94) socket$kcm(0x10, 0x400000002, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) r1 = socket$kcm(0xa, 0x3, 0x73) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f00000001c0)=@nl=@unspec, 0x80, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000) sendmsg$kcm(r2, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x23}}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000100000051d833483cc75d51900000000000000004000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) sendmsg(r0, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003140)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0xf, 0x200cc, 0x6, 0x5}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)='T', &(0x7f0000000240), 0x4af, r3}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000700)={0x0, &(0x7f0000000540)=""/245, &(0x7f00000000c0), &(0x7f0000000680), 0x2, r3}, 0x38) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xb, 0x0, &(0x7f0000000400)='GPL\x00', 0x1, 0xe0, &(0x7f0000000440)=""/224}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8923, &(0x7f00000000c0)={'virt_wifi0\x00', @multicast}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500"], 0x48) 300.431586ms ago: executing program 0 (id=2274): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x101c01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079d}) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) write$cgroup_devices(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="1e0328004d8c71ef2885634a8270121406"], 0xffdd) 210.267273ms ago: executing program 3 (id=2275): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000001880)={r1}, 0xc) 19.434679ms ago: executing program 3 (id=2276): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000340)={0x2, 0x4e22, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="140000000000000000000000010000000000000000000000180000000000000000000000070000004404dc030100ff97110000000000000000000000070000000100000000000000180000"], 0x60}, 0x0) 0s ago: executing program 0 (id=2277): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73f72cc9f0ba1f848350000005e120602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x4000850) kernel console output (not intermixed with test programs): ique to avoid problems! [ 71.608878][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.641676][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.653028][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.664083][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.726318][ T5785] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.735892][ T5785] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.744877][ T5785] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.753592][ T5785] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.787143][ T5787] veth0_vlan: entered promiscuous mode [ 71.804157][ T3478] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.818498][ T3478] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.854242][ T5787] veth1_vlan: entered promiscuous mode [ 71.888806][ T5786] veth0_vlan: entered promiscuous mode [ 71.942741][ T5786] veth1_vlan: entered promiscuous mode [ 71.944539][ T3478] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.962374][ T3478] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.970538][ T3547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.972269][ T5787] veth0_macvtap: entered promiscuous mode [ 71.984254][ T3547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.020848][ T5787] veth1_macvtap: entered promiscuous mode [ 72.038701][ T3478] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.047916][ T3478] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.079719][ T5786] veth0_macvtap: entered promiscuous mode [ 72.124303][ T5787] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.155444][ T5787] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.181506][ T5787] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.193146][ T5787] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.205925][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.216509][ T5786] veth1_macvtap: entered promiscuous mode [ 72.249726][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.266556][ T5878] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1'. [ 72.266622][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.266633][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.299014][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.312222][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.328187][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.343899][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.354390][ T5880] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4'. [ 72.367333][ T5787] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.379067][ T5787] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.389250][ T5787] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.399786][ T5787] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.416180][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.430343][ T5878] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1'. [ 72.451272][ T5880] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4'. [ 72.466578][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.484442][ C1] hrtimer: interrupt took 46092 ns [ 72.502146][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.539635][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.570500][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.611088][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.651146][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.690909][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.737597][ T5787] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.758955][ T5787] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.769237][ T5787] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.778463][ T5787] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.792026][ T5881] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1'. [ 72.801919][ T5883] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4'. [ 72.824235][ T5786] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.837653][ T5786] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.847322][ T5786] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.856254][ T5786] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.073289][ T3547] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.106524][ T3547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.216534][ T3524] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.250928][ T3524] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.293827][ T3524] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.303618][ T3524] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.336507][ T5890] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7'. [ 73.375282][ T5890] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7'. [ 73.393602][ T5889] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7'. [ 73.434701][ T3524] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.437544][ T5890] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7'. [ 73.449752][ T5892] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 73.475240][ T3524] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.545616][ T5789] Bluetooth: hci1: command tx timeout [ 73.580346][ T5892] netlink: 'syz.0.8': attribute type 10 has an invalid length. [ 73.625885][ T5789] Bluetooth: hci3: command tx timeout [ 73.630366][ T50] Bluetooth: hci2: command tx timeout [ 73.637895][ T5791] Bluetooth: hci0: command tx timeout [ 73.830205][ T5892] team0: Port device wlan1 added [ 73.928925][ T5892] syz.0.8 (5892) used greatest stack depth: 19432 bytes left [ 74.749136][ T5908] netlink: 'syz.3.11': attribute type 10 has an invalid length. [ 74.859741][ T5908] team0: Port device wlan1 added [ 74.869040][ T5910] netlink: 'syz.2.10': attribute type 10 has an invalid length. [ 75.040650][ T5910] team0: Port device wlan1 added [ 75.159334][ T5910] syz.2.10 (5910) used greatest stack depth: 19312 bytes left [ 75.380183][ T5926] syzkaller1: tun_chr_ioctl cmd 35108 [ 75.635765][ T5791] Bluetooth: hci1: command tx timeout [ 75.705172][ T50] Bluetooth: hci0: command tx timeout [ 75.705197][ T5789] Bluetooth: hci2: command tx timeout [ 75.710820][ T5791] Bluetooth: hci3: command tx timeout [ 76.002061][ T5941] netlink: 'syz.0.28': attribute type 12 has an invalid length. [ 76.852969][ T5974] netlink: 'syz.2.43': attribute type 10 has an invalid length. [ 77.891926][ T6006] sctp: [Deprecated]: syz.0.55 (pid 6006) Use of int in max_burst socket option deprecated. [ 77.891926][ T6006] Use struct sctp_assoc_value instead [ 77.923438][ T6006] syz.0.55: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 77.952134][ T6006] CPU: 1 PID: 6006 Comm: syz.0.55 Not tainted 6.6.102-syzkaller #0 [ 77.960086][ T6006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 77.970433][ T6006] Call Trace: [ 77.973739][ T6006] [ 77.976706][ T6006] dump_stack_lvl+0x16c/0x230 [ 77.981416][ T6006] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 77.987601][ T6006] ? show_regs_print_info+0x20/0x20 [ 77.992821][ T6006] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 77.999016][ T6006] warn_alloc+0x210/0x300 [ 78.003367][ T6006] ? stack_trace_save+0x9c/0xe0 [ 78.008238][ T6006] ? zone_watermark_ok_safe+0x230/0x230 [ 78.014082][ T6006] ? kasan_set_track+0x5f/0x70 [ 78.018860][ T6006] ? kasan_set_track+0x4e/0x70 [ 78.023633][ T6006] ? __kasan_kmalloc+0x8f/0xa0 [ 78.028420][ T6006] ? xsk_init_queue+0xb0/0x110 [ 78.033195][ T6006] ? xsk_setsockopt+0x4db/0x6f0 [ 78.038082][ T6006] ? do_sock_setsockopt+0x175/0x1a0 [ 78.043289][ T6006] ? __x64_sys_setsockopt+0x184/0x200 [ 78.048712][ T6006] __vmalloc_node_range+0x126/0x1320 [ 78.054105][ T6006] ? mark_lock+0x94/0x320 [ 78.058455][ T6006] ? lockdep_hardirqs_on_prepare+0x400/0x760 [ 78.064448][ T6006] ? lock_chain_count+0x20/0x20 [ 78.069316][ T6006] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 78.075496][ T6006] ? free_vm_area+0x50/0x50 [ 78.080014][ T6006] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 78.086193][ T6006] vmalloc_user+0x74/0x80 [ 78.090537][ T6006] ? xskq_create+0xbf/0x170 [ 78.095056][ T6006] xskq_create+0xbf/0x170 [ 78.099402][ T6006] xsk_init_queue+0xb0/0x110 [ 78.104016][ T6006] xsk_setsockopt+0x4db/0x6f0 [ 78.108728][ T6006] ? xsk_poll+0x670/0x670 [ 78.113080][ T6006] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 78.119340][ T6006] ? xsk_poll+0x670/0x670 [ 78.123686][ T6006] ? do_sock_setsockopt+0x15e/0x1a0 [ 78.128904][ T6006] ? xsk_poll+0x670/0x670 [ 78.133259][ T6006] do_sock_setsockopt+0x175/0x1a0 [ 78.138301][ T6006] ? __fdget+0x180/0x210 [ 78.142567][ T6006] __x64_sys_setsockopt+0x184/0x200 [ 78.147785][ T6006] do_syscall_64+0x55/0xb0 [ 78.152212][ T6006] ? clear_bhb_loop+0x40/0x90 [ 78.156909][ T6006] ? clear_bhb_loop+0x40/0x90 [ 78.161601][ T6006] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 78.167507][ T6006] RIP: 0033:0x7f1a4658ebe9 [ 78.171945][ T6006] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 78.191570][ T6006] RSP: 002b:00007f1a4749b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 78.200002][ T6006] RAX: ffffffffffffffda RBX: 00007f1a467b6090 RCX: 00007f1a4658ebe9 [ 78.207983][ T6006] RDX: 0000000000000002 RSI: 000000000000011b RDI: 000000000000000e [ 78.215957][ T6006] RBP: 00007f1a46611e19 R08: 0000000000000004 R09: 0000000000000000 [ 78.223942][ T6006] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 78.231931][ T6006] R13: 00007f1a467b6128 R14: 00007f1a467b6090 R15: 00007ffe23969cc8 [ 78.239933][ T6006] [ 78.293040][ T6011] net veth1_virt_wifi »»»»»»: renamed from virt_wifi0 [ 78.304998][ T6006] Mem-Info: [ 78.308609][ T6006] active_anon:5288 inactive_anon:0 isolated_anon:0 [ 78.308609][ T6006] active_file:949 inactive_file:39825 isolated_file:0 [ 78.308609][ T6006] unevictable:768 dirty:1429 writeback:0 [ 78.308609][ T6006] slab_reclaimable:9980 slab_unreclaimable:94070 [ 78.308609][ T6006] mapped:24934 shmem:1361 pagetables:572 [ 78.308609][ T6006] sec_pagetables:0 bounce:0 [ 78.308609][ T6006] kernel_misc_reclaimable:0 [ 78.308609][ T6006] free:1364146 free_pcp:11016 free_cma:0 [ 78.401873][ T6006] Node 0 active_anon:21052kB inactive_anon:0kB active_file:3796kB inactive_file:159096kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:99736kB dirty:5708kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11528kB pagetables:2188kB sec_pagetables:0kB all_unreclaimable? no [ 78.472178][ T6006] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:8kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 78.534753][ T6006] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 78.563574][ T6006] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 78.570685][ T6006] Node 0 DMA32 free:1543852kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:21108kB inactive_anon:0kB active_file:3796kB inactive_file:157776kB unevictable:1536kB writepending:5696kB present:3129332kB managed:2589596kB mlocked:0kB bounce:0kB free_pcp:22928kB local_pcp:8132kB free_cma:0kB [ 78.636373][ T6006] lowmem_reserve[]: 0 0 1 1 1 [ 78.641150][ T6006] Node 0 Normal free:8kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:12kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 78.697817][ T6006] lowmem_reserve[]: 0 0 0 0 0 [ 78.705878][ T6006] Node 1 Normal free:3896084kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:8kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:21136kB local_pcp:11728kB free_cma:0kB [ 78.735677][ T6006] lowmem_reserve[]: 0 0 0 0 0 [ 78.740444][ T6006] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 78.786692][ T6006] Node 0 DMA32: 1*4kB (E) 137*8kB (U) 158*16kB (UM) 6*32kB (M) 3*64kB (M) 6*128kB (ME) 6*256kB (ME) 3*512kB (UM) 2*1024kB (UM) 3*2048kB (UM) 373*4096kB (M) = 1543852kB [ 78.856023][ T6006] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 78.880689][ T6006] Node 1 Normal: 195*4kB (UME) 57*8kB (UME) 30*16kB (UME) 19*32kB (UM) 14*64kB (UE) 1*128kB (M) 2*256kB (UE) 2*512kB (UM) 2*1024kB (UE) 1*2048kB (E) 949*4096kB (M) = 3896084kB [ 78.954296][ T6006] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 78.973246][ T6006] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 78.993875][ T6006] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 79.011870][ T6006] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 79.044493][ T6006] 42485 total pagecache pages [ 79.049270][ T6006] 0 pages in swap cache [ 79.053421][ T6006] Free swap = 124996kB [ 79.065791][ T6006] Total swap = 124996kB [ 79.069985][ T6006] 2097051 pages RAM [ 79.106456][ T6006] 0 pages HighMem/MovableOnly [ 79.111273][ T6006] 416138 pages reserved [ 79.144283][ T6006] 0 pages cma reserved [ 79.181369][ T6033] __nla_validate_parse: 1 callbacks suppressed [ 79.181384][ T6033] netlink: 60 bytes leftover after parsing attributes in process `syz.2.65'. [ 79.208610][ T6033] netlink: 60 bytes leftover after parsing attributes in process `syz.2.65'. [ 79.222024][ T6031] netlink: 60 bytes leftover after parsing attributes in process `syz.2.65'. [ 79.293357][ T6031] netlink: 60 bytes leftover after parsing attributes in process `syz.2.65'. [ 80.074839][ T6052] netlink: 60 bytes leftover after parsing attributes in process `syz.2.72'. [ 80.094202][ T6052] netlink: 60 bytes leftover after parsing attributes in process `syz.2.72'. [ 80.112686][ T6049] netlink: 60 bytes leftover after parsing attributes in process `syz.2.72'. [ 80.358762][ T6061] netlink: 'syz.0.77': attribute type 2 has an invalid length. [ 80.380193][ T6061] netlink: 164 bytes leftover after parsing attributes in process `syz.0.77'. [ 80.553426][ T5791] Bluetooth: hci2: unexpected subevent 0x19 length: 150 > 28 [ 80.565450][ T5791] Bluetooth: hci2: Unable to find connection with handle 0x0000 [ 80.712336][ T6072] netlink: 'syz.2.83': attribute type 10 has an invalid length. [ 81.346225][ T6072] team0 (unregistering): Port device team_slave_0 removed [ 81.389773][ T6072] team0 (unregistering): Port device team_slave_1 removed [ 81.406685][ T6072] team0 (unregistering): Port device wlan1 removed [ 81.796704][ T3065] cfg80211: failed to load regulatory.db [ 81.808778][ T6105] netlink: 'syz.2.95': attribute type 19 has an invalid length. [ 81.818523][ T6105] netlink: 55 bytes leftover after parsing attributes in process `syz.2.95'. [ 81.854131][ T6106] netlink: 60 bytes leftover after parsing attributes in process `syz.3.93'. [ 82.516163][ T6126] warning: `syz.2.103' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 82.534751][ T6126] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 83.451103][ T6160] netlink: 'syz.0.118': attribute type 4 has an invalid length. [ 83.780022][ T6170] Dead loop on virtual device ip6_vti0, fix it urgently! [ 84.154327][ T6179] syzkaller0: entered promiscuous mode [ 84.188719][ T6179] syzkaller0: entered allmulticast mode [ 84.887336][ T6203] sctp: [Deprecated]: syz.3.136 (pid 6203) Use of int in max_burst socket option deprecated. [ 84.887336][ T6203] Use struct sctp_assoc_value instead [ 85.791251][ T6211] __nla_validate_parse: 7 callbacks suppressed [ 85.791267][ T6211] netlink: 132 bytes leftover after parsing attributes in process `syz.0.140'. [ 86.006196][ T6222] netlink: 60 bytes leftover after parsing attributes in process `syz.0.143'. [ 86.035286][ T6222] netlink: 60 bytes leftover after parsing attributes in process `syz.0.143'. [ 86.046192][ T6218] netlink: 60 bytes leftover after parsing attributes in process `syz.0.143'. [ 86.065243][ T6222] netlink: 60 bytes leftover after parsing attributes in process `syz.0.143'. [ 86.202320][ T6229] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.146'. [ 86.396424][ T6236] netlink: 'syz.0.151': attribute type 10 has an invalid length. [ 86.443110][ T6236] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 86.492717][ T6236] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 86.504820][ T6236] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 86.523064][ T6236] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 86.739487][ T6247] Zero length message leads to an empty skb [ 87.184252][ T6260] netlink: 210788 bytes leftover after parsing attributes in process `syz.0.157'. [ 87.575437][ T6270] net veth1_virt_wifi »»»»»»: renamed from virt_wifi0 [ 90.798325][ T6281] netlink: 'syz.3.165': attribute type 10 has an invalid length. [ 90.954113][ T6281] batman_adv: batadv0: Adding interface: team0 [ 90.974180][ T6281] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.008453][ T6281] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 92.553798][ T6286] netlink: 'syz.2.164': attribute type 2 has an invalid length. [ 92.561690][ T6286] netlink: 164 bytes leftover after parsing attributes in process `syz.2.164'. [ 92.571574][ T6292] netlink: 'syz.0.168': attribute type 2 has an invalid length. [ 92.591286][ T6292] netlink: 164 bytes leftover after parsing attributes in process `syz.0.168'. [ 93.346005][ T6316] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 93.585716][ T6323] netlink: 60 bytes leftover after parsing attributes in process `syz.0.177'. [ 93.612714][ T6323] netlink: 60 bytes leftover after parsing attributes in process `syz.0.177'. [ 93.643757][ T6320] netlink: 60 bytes leftover after parsing attributes in process `syz.0.177'. [ 93.665504][ T6324] netlink: 60 bytes leftover after parsing attributes in process `syz.0.177'. [ 93.722858][ T6322] netlink: 'syz.3.178': attribute type 10 has an invalid length. [ 93.731570][ T6322] veth1_vlan: entered allmulticast mode [ 93.753549][ T6322] team0: Device veth1_vlan failed to register rx_handler [ 94.272290][ T6339] syzkaller0: entered promiscuous mode [ 94.284512][ T6339] syzkaller0: entered allmulticast mode [ 94.633451][ T6351] sctp: [Deprecated]: syz.2.187 (pid 6351) Use of int in max_burst socket option deprecated. [ 94.633451][ T6351] Use struct sctp_assoc_value instead [ 94.856462][ T5791] Bluetooth: hci3: unexpected subevent 0x1a length: 150 > 6 [ 96.081159][ T6363] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 96.331345][ T6381] syz.3.199: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 96.362916][ T6381] CPU: 1 PID: 6381 Comm: syz.3.199 Not tainted 6.6.102-syzkaller #0 [ 96.370946][ T6381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 96.381010][ T6381] Call Trace: [ 96.384282][ T6381] [ 96.387303][ T6381] dump_stack_lvl+0x16c/0x230 [ 96.392083][ T6381] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 96.398259][ T6381] ? show_regs_print_info+0x20/0x20 [ 96.403451][ T6381] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 96.409621][ T6381] warn_alloc+0x210/0x300 [ 96.413971][ T6381] ? stack_trace_save+0x9c/0xe0 [ 96.418820][ T6381] ? zone_watermark_ok_safe+0x230/0x230 [ 96.424367][ T6381] ? kasan_set_track+0x5f/0x70 [ 96.429121][ T6381] ? kasan_set_track+0x4e/0x70 [ 96.433870][ T6381] ? __kasan_kmalloc+0x8f/0xa0 [ 96.438626][ T6381] ? xsk_init_queue+0xb0/0x110 [ 96.443388][ T6381] ? xsk_setsockopt+0x4db/0x6f0 [ 96.448233][ T6381] ? do_sock_setsockopt+0x175/0x1a0 [ 96.453421][ T6381] ? __x64_sys_setsockopt+0x184/0x200 [ 96.458792][ T6381] __vmalloc_node_range+0x126/0x1320 [ 96.464094][ T6381] ? free_vm_area+0x50/0x50 [ 96.468594][ T6381] vmalloc_user+0x74/0x80 [ 96.472913][ T6381] ? xskq_create+0xbf/0x170 [ 96.477404][ T6381] xskq_create+0xbf/0x170 [ 96.481724][ T6381] xsk_init_queue+0xb0/0x110 [ 96.486306][ T6381] xsk_setsockopt+0x4db/0x6f0 [ 96.490980][ T6381] ? xsk_poll+0x670/0x670 [ 96.495394][ T6381] ? __fget_files+0x28/0x4d0 [ 96.500068][ T6381] ? aa_sock_opt_perm+0x74/0x100 [ 96.505436][ T6381] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 96.510974][ T6381] ? security_socket_setsockopt+0x7e/0xa0 [ 96.516682][ T6381] ? xsk_poll+0x670/0x670 [ 96.521008][ T6381] do_sock_setsockopt+0x175/0x1a0 [ 96.526036][ T6381] ? __fdget+0x180/0x210 [ 96.530272][ T6381] __x64_sys_setsockopt+0x184/0x200 [ 96.535470][ T6381] do_syscall_64+0x55/0xb0 [ 96.539890][ T6381] ? clear_bhb_loop+0x40/0x90 [ 96.544566][ T6381] ? clear_bhb_loop+0x40/0x90 [ 96.549236][ T6381] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.555129][ T6381] RIP: 0033:0x7f78fc38ebe9 [ 96.559546][ T6381] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 96.579153][ T6381] RSP: 002b:00007f78fd118038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 96.587581][ T6381] RAX: ffffffffffffffda RBX: 00007f78fc5b6090 RCX: 00007f78fc38ebe9 [ 96.595551][ T6381] RDX: 0000000000000002 RSI: 000000000000011b RDI: 000000000000000f [ 96.603525][ T6381] RBP: 00007f78fc411e19 R08: 0000000000000004 R09: 0000000000000000 [ 96.611491][ T6381] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 96.619464][ T6381] R13: 00007f78fc5b6128 R14: 00007f78fc5b6090 R15: 00007ffcabffe9d8 [ 96.627441][ T6381] [ 96.666549][ T6381] Mem-Info: [ 96.671954][ T6381] active_anon:5211 inactive_anon:0 isolated_anon:0 [ 96.671954][ T6381] active_file:1078 inactive_file:39831 isolated_file:0 [ 96.671954][ T6381] unevictable:768 dirty:174 writeback:225 [ 96.671954][ T6381] slab_reclaimable:9771 slab_unreclaimable:96478 [ 96.671954][ T6381] mapped:23991 shmem:1361 pagetables:557 [ 96.671954][ T6381] sec_pagetables:0 bounce:0 [ 96.671954][ T6381] kernel_misc_reclaimable:0 [ 96.671954][ T6381] free:1360559 free_pcp:11253 free_cma:0 [ 96.826869][ T6381] Node 0 active_anon:20744kB inactive_anon:0kB active_file:4312kB inactive_file:159120kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:95664kB dirty:188kB writeback:300kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11380kB pagetables:2128kB sec_pagetables:0kB all_unreclaimable? no [ 96.982611][ T6381] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:8kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 97.026087][ T6381] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 97.058821][ T6381] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 97.079547][ T6381] Node 0 DMA32 free:1529748kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:20904kB inactive_anon:0kB active_file:4312kB inactive_file:157812kB unevictable:1536kB writepending:48kB present:3129332kB managed:2589596kB mlocked:0kB bounce:0kB free_pcp:24584kB local_pcp:5144kB free_cma:0kB [ 97.133763][ T6381] lowmem_reserve[]: 0 0 1 1 1 [ 97.142352][ T6381] Node 0 Normal free:8kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:0kB free_cma:0kB [ 97.178405][ T6381] lowmem_reserve[]: 0 0 0 0 0 [ 97.183333][ T6381] Node 1 Normal free:3896868kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:20640kB local_pcp:9536kB free_cma:0kB [ 97.220982][ T6381] lowmem_reserve[]: 0 0 0 0 0 [ 97.226263][ T6381] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 97.245489][ T6381] Node 0 DMA32: 3*4kB (UME) 1*8kB (M) 35*16kB (UM) 35*32kB (ME) 14*64kB (UME) 5*128kB (UME) 2*256kB (UM) 2*512kB (UM) 1*1024kB (M) 2*2048kB (M) 371*4096kB (UM) = 1529508kB [ 97.267777][ T6381] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 97.281639][ T6381] Node 1 Normal: 195*4kB (UME) 57*8kB (UME) 37*16kB (UME) 26*32kB (UME) 19*64kB (UE) 2*128kB (ME) 2*256kB (UE) 2*512kB (UM) 2*1024kB (UE) 1*2048kB (E) 949*4096kB (M) = 3896868kB [ 97.306359][ T6381] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 97.319723][ T6381] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 97.331237][ T6381] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 97.345088][ T6381] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 97.355148][ T6381] 42273 total pagecache pages [ 97.359992][ T6381] 0 pages in swap cache [ 97.364260][ T6381] Free swap = 124996kB [ 97.369288][ T6381] Total swap = 124996kB [ 97.373979][ T6381] 2097051 pages RAM [ 97.390995][ T6381] 0 pages HighMem/MovableOnly [ 97.405952][ T6381] 416138 pages reserved [ 97.422670][ T6381] 0 pages cma reserved [ 97.510438][ T6400] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.206'. [ 97.738238][ T6410] netlink: 'syz.3.211': attribute type 12 has an invalid length. [ 97.748564][ T6410] netlink: 132 bytes leftover after parsing attributes in process `syz.3.211'. [ 100.025628][ T11] wlan1: Trigger new scan to find an IBSS to join [ 102.997140][ T42] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 103.074915][ T6544] syz.0.269 uses obsolete (PF_INET,SOCK_PACKET) [ 103.324134][ T6554] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 103.446619][ T6560] netlink: 'syz.0.276': attribute type 10 has an invalid length. [ 103.510184][ T6560] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.524046][ T6560] bond0: (slave team0): Enslaving as an active interface with an up link [ 103.716242][ T6569] IPv6: Can't replace route, no match found [ 103.782925][ T6569] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 104.522315][ T6590] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.642187][ T6599] netlink: 'syz.0.291': attribute type 3 has an invalid length. [ 104.667123][ T6599] netlink: 132 bytes leftover after parsing attributes in process `syz.0.291'. [ 104.670782][ T6598] netlink: 'syz.2.292': attribute type 3 has an invalid length. [ 104.685639][ T6598] netlink: 'syz.2.292': attribute type 7 has an invalid length. [ 104.701144][ T6598] netlink: 'syz.2.292': attribute type 8 has an invalid length. [ 104.709853][ T6598] netlink: 'syz.2.292': attribute type 7 has an invalid length. [ 104.718416][ T6598] netlink: 198112 bytes leftover after parsing attributes in process `syz.2.292'. [ 105.065595][ T3524] wlan1: Trigger new scan to find an IBSS to join [ 105.236092][ T6624] netlink: 'syz.3.302': attribute type 10 has an invalid length. [ 105.283983][ T6625] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 105.314862][ T6625] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 105.339606][ T6625] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 105.361341][ T6625] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 105.620607][ T6638] netlink: 10 bytes leftover after parsing attributes in process `syz.3.308'. [ 106.008653][ T42] wlan1: Creating new IBSS network, BSSID 26:2a:e6:5f:9a:b6 [ 106.156590][ T6648] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 106.184934][ T6648] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode [ 106.218406][ T6650] netlink: 'syz.1.314': attribute type 10 has an invalid length. [ 106.282422][ T6650] team0: Device ipvlan1 failed to register rx_handler [ 106.398743][ T6652] netlink: 14 bytes leftover after parsing attributes in process `syz.0.315'. [ 106.652455][ T6661] netlink: 'syz.1.318': attribute type 29 has an invalid length. [ 106.714627][ T6652] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 106.747301][ T6652] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 106.771694][ T6652] bond0 (unregistering): (slave team0): Releasing backup interface [ 106.792825][ T6652] bond0 (unregistering): Released all slaves [ 106.845414][ T6661] netlink: 'syz.1.318': attribute type 29 has an invalid length. [ 107.219567][ T6675] team0: Device hsr_slave_0 failed to register rx_handler [ 108.289589][ T6719] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.342'. [ 108.415103][ T6725] sit0: entered allmulticast mode [ 108.468847][ T6725] sit0: entered promiscuous mode [ 109.475612][ T6736] validate_nla: 2 callbacks suppressed [ 109.475628][ T6736] netlink: 'syz.1.350': attribute type 10 has an invalid length. [ 109.633470][ T6739] mac80211_hwsim hwsim7 wlan0: entered allmulticast mode [ 109.662478][ T6742] mac80211_hwsim hwsim7 wlan0: entered promiscuous mode [ 109.676767][ T6744] netlink: 'syz.1.354': attribute type 10 has an invalid length. [ 109.687074][ T6744] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.695699][ T6744] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.724267][ T6744] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.731435][ T6744] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.738974][ T6744] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.746136][ T6744] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.765912][ T6744] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 110.590170][ T6765] delete_channel: no stack [ 110.677416][ T6778] mac80211_hwsim hwsim8 O3ãc¤±: renamed from wlan1 (while UP) [ 110.683685][ T6775] netlink: 'syz.0.368': attribute type 3 has an invalid length. [ 110.696136][ T6775] netlink: 201372 bytes leftover after parsing attributes in process `syz.0.368'. [ 110.942416][ T6786] sit0: entered allmulticast mode [ 110.978476][ T6786] sit0: entered promiscuous mode [ 111.659687][ T6796] netlink: 105120 bytes leftover after parsing attributes in process `syz.3.376'. [ 111.718293][ T6796] netlink: 16126 bytes leftover after parsing attributes in process `syz.3.376'. [ 111.787512][ T6792] netlink: 4 bytes leftover after parsing attributes in process `syz.2.375'. [ 112.954008][ T6834] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 113.058988][ T6838] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.396'. [ 113.206394][ T6840] syzkaller0: entered promiscuous mode [ 113.222254][ T6840] syzkaller0: entered allmulticast mode [ 117.763933][ T6904] mac80211_hwsim hwsim3 O3ãc¤±: renamed from wlan1 (while UP) [ 117.936234][ T6911] netlink: 199824 bytes leftover after parsing attributes in process `syz.3.419'. [ 118.075295][ T6915] netlink: 1 bytes leftover after parsing attributes in process `syz.0.422'. [ 118.302728][ T6929] veth0_vlan: entered allmulticast mode [ 118.762175][ T6944] netlink: 'syz.1.434': attribute type 10 has an invalid length. [ 118.790415][ T6944] 8021q: adding VLAN 0 to HW filter on device team0 [ 118.829978][ T6944] bond0: (slave team0): Enslaving as an active interface with an up link [ 119.574185][ T6974] delete_channel: no stack [ 119.579826][ T6974] delete_channel: no stack [ 120.084093][ T6985] netlink: 132 bytes leftover after parsing attributes in process `syz.2.452'. [ 120.287723][ T6987] netlink: 14601 bytes leftover after parsing attributes in process `syz.2.454'. [ 120.453292][ T6995] netlink: 'syz.2.457': attribute type 29 has an invalid length. [ 120.472307][ T6995] netlink: 'syz.2.457': attribute type 29 has an invalid length. [ 120.487761][ T6995] netlink: 'syz.2.457': attribute type 29 has an invalid length. [ 120.708110][ T7010] netlink: 136 bytes leftover after parsing attributes in process `syz.0.463'. [ 120.902446][ T7015] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 120.931930][ T7016] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.466'. [ 120.951336][ T7016] netlink: 'syz.0.466': attribute type 16 has an invalid length. [ 120.959653][ T7016] netlink: 48 bytes leftover after parsing attributes in process `syz.0.466'. [ 120.986610][ T7016] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.239259][ T7026] netlink: 'syz.0.471': attribute type 10 has an invalid length. [ 121.251381][ T7026] netlink: 40 bytes leftover after parsing attributes in process `syz.0.471'. [ 121.292704][ T7026] batman_adv: batadv0: Adding interface: virt_wifi0 [ 121.300164][ T7026] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 121.332707][ T7026] batman_adv: batadv0: Interface activated: virt_wifi0 [ 121.793689][ T7047] netlink: 'syz.2.479': attribute type 39 has an invalid length. [ 121.909434][ T7049] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.919697][ T7049] bridge0: entered allmulticast mode [ 121.950893][ T7049] bridge_slave_1: left allmulticast mode [ 121.959297][ T7049] bridge_slave_1: left promiscuous mode [ 121.966957][ T7049] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.980953][ T7049] bridge_slave_0: left promiscuous mode [ 121.987653][ T7049] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.158868][ T7077] netlink: 'syz.1.492': attribute type 2 has an invalid length. [ 123.169398][ T7077] netlink: 'syz.1.492': attribute type 8 has an invalid length. [ 123.177583][ T7077] netlink: 132 bytes leftover after parsing attributes in process `syz.1.492'. [ 124.723181][ T7086] netlink: 'syz.2.496': attribute type 1 has an invalid length. [ 124.731059][ T7086] netlink: 'syz.2.496': attribute type 4 has an invalid length. [ 124.739033][ T7086] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.496'. [ 125.213770][ T7119] sit0: left promiscuous mode [ 125.316557][ T7119] sit0: entered promiscuous mode [ 125.526084][ T7130] netlink: 14560 bytes leftover after parsing attributes in process `syz.2.514'. [ 128.793156][ T7152] netlink: 'syz.3.526': attribute type 10 has an invalid length. [ 128.816981][ T7152] netlink: 40 bytes leftover after parsing attributes in process `syz.3.526'. [ 128.847220][ T7152] team0: entered promiscuous mode [ 128.852298][ T7152] team_slave_0: entered promiscuous mode [ 128.875406][ T7152] team_slave_1: entered promiscuous mode [ 128.909153][ T7152] team0: entered allmulticast mode [ 128.914324][ T7152] team_slave_0: entered allmulticast mode [ 128.938512][ T7152] team_slave_1: entered allmulticast mode [ 128.965249][ T7152] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.972184][ T7152] batman_adv: batadv0: Interface activated: team0 [ 129.004590][ T7152] batman_adv: batadv0: Interface deactivated: team0 [ 129.011269][ T7152] batman_adv: batadv0: Removing interface: team0 [ 129.022145][ T7152] bridge0: port 3(team0) entered blocking state [ 129.028816][ T7152] bridge0: port 3(team0) entered disabled state [ 129.037787][ T7152] bridge0: port 3(team0) entered blocking state [ 129.044162][ T7152] bridge0: port 3(team0) entered listening state [ 129.109090][ T7164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.530'. [ 129.267929][ T7168] netlink: 202920 bytes leftover after parsing attributes in process `syz.3.531'. [ 129.657819][ T7187] netlink: 4 bytes leftover after parsing attributes in process `syz.2.538'. [ 129.891452][ T7193] syzkaller0: entered promiscuous mode [ 129.897963][ T7193] syzkaller0: entered allmulticast mode [ 129.915889][ T7199] syz.3.544: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 129.943224][ T7199] CPU: 1 PID: 7199 Comm: syz.3.544 Not tainted 6.6.102-syzkaller #0 [ 129.951246][ T7199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 129.961326][ T7199] Call Trace: [ 129.964629][ T7199] [ 129.967576][ T7199] dump_stack_lvl+0x16c/0x230 [ 129.972303][ T7199] ? show_regs_print_info+0x20/0x20 [ 129.977508][ T7199] ? load_image+0x3b0/0x3b0 [ 129.982019][ T7199] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 129.988435][ T7199] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 129.994932][ T7199] warn_alloc+0x210/0x300 [ 129.999270][ T7199] ? stack_trace_save+0x9c/0xe0 [ 130.004112][ T7199] ? zone_watermark_ok_safe+0x230/0x230 [ 130.009688][ T7199] ? kasan_set_track+0x5f/0x70 [ 130.014445][ T7199] ? kasan_set_track+0x4e/0x70 [ 130.019206][ T7199] ? __kasan_kmalloc+0x8f/0xa0 [ 130.023960][ T7199] ? xsk_init_queue+0xb0/0x110 [ 130.028710][ T7199] ? xsk_setsockopt+0x4db/0x6f0 [ 130.033640][ T7199] ? do_sock_setsockopt+0x175/0x1a0 [ 130.038829][ T7199] ? __x64_sys_setsockopt+0x184/0x200 [ 130.044297][ T7199] __vmalloc_node_range+0x126/0x1320 [ 130.049595][ T7199] ? free_vm_area+0x50/0x50 [ 130.054099][ T7199] vmalloc_user+0x74/0x80 [ 130.058420][ T7199] ? xskq_create+0xbf/0x170 [ 130.062910][ T7199] xskq_create+0xbf/0x170 [ 130.067232][ T7199] xsk_init_queue+0xb0/0x110 [ 130.071828][ T7199] xsk_setsockopt+0x4db/0x6f0 [ 130.076499][ T7199] ? xsk_poll+0x670/0x670 [ 130.080824][ T7199] ? __fget_files+0x28/0x4d0 [ 130.085403][ T7199] ? aa_sock_opt_perm+0x74/0x100 [ 130.090332][ T7199] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 130.095872][ T7199] ? security_socket_setsockopt+0x7e/0xa0 [ 130.101575][ T7199] ? xsk_poll+0x670/0x670 [ 130.105906][ T7199] do_sock_setsockopt+0x175/0x1a0 [ 130.110927][ T7199] ? __fdget+0x180/0x210 [ 130.115165][ T7199] __x64_sys_setsockopt+0x184/0x200 [ 130.120560][ T7199] do_syscall_64+0x55/0xb0 [ 130.124965][ T7199] ? clear_bhb_loop+0x40/0x90 [ 130.129629][ T7199] ? clear_bhb_loop+0x40/0x90 [ 130.134293][ T7199] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 130.140195][ T7199] RIP: 0033:0x7f78fc38ebe9 [ 130.144631][ T7199] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 130.164248][ T7199] RSP: 002b:00007f78fd139038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 130.172655][ T7199] RAX: ffffffffffffffda RBX: 00007f78fc5b5fa0 RCX: 00007f78fc38ebe9 [ 130.180625][ T7199] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000006 [ 130.188592][ T7199] RBP: 00007f78fc411e19 R08: 0000000000000004 R09: 0000000000000000 [ 130.196581][ T7199] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 130.204546][ T7199] R13: 00007f78fc5b6038 R14: 00007f78fc5b5fa0 R15: 00007ffcabffe9d8 [ 130.212518][ T7199] [ 130.223922][ T7199] Mem-Info: [ 130.227567][ T7199] active_anon:5200 inactive_anon:0 isolated_anon:0 [ 130.227567][ T7199] active_file:10756 inactive_file:39846 isolated_file:0 [ 130.227567][ T7199] unevictable:768 dirty:66 writeback:0 [ 130.227567][ T7199] slab_reclaimable:9961 slab_unreclaimable:97149 [ 130.227567][ T7199] mapped:23979 shmem:1361 pagetables:567 [ 130.227567][ T7199] sec_pagetables:0 bounce:0 [ 130.227567][ T7199] kernel_misc_reclaimable:0 [ 130.227567][ T7199] free:1354495 free_pcp:6493 free_cma:0 [ 130.275483][ T7199] Node 0 active_anon:20884kB inactive_anon:0kB active_file:43024kB inactive_file:159180kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:95972kB dirty:268kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11344kB pagetables:2304kB sec_pagetables:0kB all_unreclaimable? no [ 130.308745][ T7199] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 130.351899][ T7199] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 130.382890][ T7199] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 130.389014][ T7199] Node 0 DMA32 free:1504728kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:20840kB inactive_anon:0kB active_file:43024kB inactive_file:157860kB unevictable:1536kB writepending:268kB present:3129332kB managed:2589596kB mlocked:0kB bounce:0kB free_pcp:5524kB local_pcp:2416kB free_cma:0kB [ 130.425310][ T7199] lowmem_reserve[]: 0 0 1 1 1 [ 130.430417][ T7199] Node 0 Normal free:8kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 130.463855][ T7199] lowmem_reserve[]: 0 0 0 0 0 [ 130.469358][ T7199] Node 1 Normal free:3897636kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:20096kB local_pcp:10944kB free_cma:0kB [ 130.503025][ T7199] lowmem_reserve[]: 0 0 0 0 0 [ 130.512628][ T7199] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 130.530076][ T7199] Node 0 DMA32: 224*4kB (UM) 847*8kB (UME) 344*16kB (UME) 589*32kB (UME) 340*64kB (UME) 90*128kB (UME) 23*256kB (UM) 9*512kB (UM) 7*1024kB (UM) 6*2048kB (UM) 344*4096kB (UM) = 1504280kB [ 130.552390][ T7199] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 130.571061][ T7199] Node 1 Normal: 195*4kB (UME) 57*8kB (UME) 37*16kB (UME) 36*32kB (UME) 22*64kB (UE) 2*128kB (ME) 3*256kB (UE) 2*512kB (UM) 2*1024kB (UE) 1*2048kB (E) 949*4096kB (M) = 3897636kB [ 130.590052][ T7199] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 130.600658][ T7199] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 130.610785][ T7199] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 130.624611][ T7199] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 130.634066][ T7199] 51963 total pagecache pages [ 130.640328][ T7199] 0 pages in swap cache [ 130.644579][ T7199] Free swap = 124996kB [ 130.648750][ T7199] Total swap = 124996kB [ 130.653131][ T7199] 2097051 pages RAM [ 130.657067][ T7199] 0 pages HighMem/MovableOnly [ 130.664515][ T7199] 416138 pages reserved [ 130.669269][ T7199] 0 pages cma reserved [ 131.767995][ T7203] netlink: 'syz.2.543': attribute type 11 has an invalid length. [ 131.776604][ T7206] netlink: 'syz.2.543': attribute type 10 has an invalid length. [ 132.075795][ T7224] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.553'. [ 132.370662][ T7233] syz.2.556 (7233) used obsolete PPPIOCDETACH ioctl [ 132.993732][ T1272] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.000124][ T1272] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.193610][ T7260] netlink: 132 bytes leftover after parsing attributes in process `syz.1.567'. [ 133.358066][ T7264] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 133.616978][ T7275] netlink: 'syz.3.575': attribute type 10 has an invalid length. [ 133.905871][ T7287] netlink: 'syz.1.580': attribute type 10 has an invalid length. [ 133.935795][ T7287] netlink: 'syz.1.580': attribute type 10 has an invalid length. [ 134.771953][ T7324] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.596'. [ 134.795500][ T7324] netlink: zone id is out of range [ 134.801005][ T7324] netlink: zone id is out of range [ 134.814514][ T7324] netlink: zone id is out of range [ 134.819659][ T7324] netlink: zone id is out of range [ 134.829485][ T7324] netlink: zone id is out of range [ 134.836817][ T7324] netlink: zone id is out of range [ 134.842083][ T7324] netlink: zone id is out of range [ 134.857704][ T7324] netlink: zone id is out of range [ 134.868437][ T7324] netlink: zone id is out of range [ 135.539342][ T7352] netlink: 'syz.0.609': attribute type 10 has an invalid length. [ 135.568862][ T7352] netlink: 2 bytes leftover after parsing attributes in process `syz.0.609'. [ 135.938688][ T7366] netlink: 'syz.2.616': attribute type 10 has an invalid length. [ 136.029534][ T42] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 137.568044][ T7414] netlink: 'syz.0.636': attribute type 1 has an invalid length. [ 137.588564][ T7414] netlink: 'syz.0.636': attribute type 4 has an invalid length. [ 137.602685][ T7414] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.636'. [ 137.742093][ T7420] netlink: 'syz.0.639': attribute type 10 has an invalid length. [ 137.750252][ T7420] netlink: 40 bytes leftover after parsing attributes in process `syz.0.639'. [ 137.761603][ T7420] batadv0: entered promiscuous mode [ 137.768102][ T7420] batadv0: entered allmulticast mode [ 138.255184][ T7442] netlink: 63503 bytes leftover after parsing attributes in process `syz.1.645'. [ 138.515375][ T7449] netlink: 98936 bytes leftover after parsing attributes in process `syz.1.650'. [ 138.540402][ T7449] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 138.647899][ T7449] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 138.725506][ T7459] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 139.199352][ T7472] netlink: 'syz.2.660': attribute type 29 has an invalid length. [ 139.211793][ T7472] netlink: 'syz.2.660': attribute type 29 has an invalid length. [ 139.226364][ T7472] netlink: 'syz.2.660': attribute type 29 has an invalid length. [ 139.469352][ T7483] netlink: 16410 bytes leftover after parsing attributes in process `syz.3.664'. [ 139.593432][ T7491] netlink: 'syz.3.668': attribute type 10 has an invalid length. [ 139.627441][ T7491] geneve1: entered promiscuous mode [ 139.633060][ T7491] geneve1: entered allmulticast mode [ 139.666220][ T7491] team0: Port device geneve1 added [ 139.799805][ T7497] netlink: 'syz.2.669': attribute type 39 has an invalid length. [ 139.916165][ T7501] mac80211_hwsim hwsim7 wlan0: left promiscuous mode [ 139.935002][ T7501] mac80211_hwsim hwsim7 wlan0: entered promiscuous mode [ 139.945960][ T7499] ÿÿÿÿÿÿ: renamed from vlan1 [ 140.026205][ T7504] netlink: 'syz.2.672': attribute type 29 has an invalid length. [ 140.034178][ T7504] netlink: 'syz.2.672': attribute type 29 has an invalid length. [ 140.091184][ T7508] netlink: 830 bytes leftover after parsing attributes in process `syz.2.674'. [ 140.101217][ T7508] bond_slave_0: entered promiscuous mode [ 140.107202][ T7508] bond_slave_1: entered promiscuous mode [ 140.991568][ T7535] netlink: 14560 bytes leftover after parsing attributes in process `syz.1.686'. [ 141.105156][ T7541] netlink: 132 bytes leftover after parsing attributes in process `syz.2.688'. [ 141.128066][ T7543] syz.3.689[7543] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 141.129195][ T7543] syz.3.689[7543] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 141.161171][ T7546] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.690'. [ 141.214839][ T7543] netlink: 65055 bytes leftover after parsing attributes in process `syz.3.689'. [ 141.495602][ T7555] syzkaller0: entered promiscuous mode [ 141.517423][ T7555] syzkaller0: entered allmulticast mode [ 143.789753][ T7573] syzkaller0: entered promiscuous mode [ 143.796425][ T7573] syzkaller0: entered allmulticast mode [ 144.523219][ C0] bridge0: port 3(team0) entered learning state [ 151.602059][ T7706] sit0: entered allmulticast mode [ 151.626629][ T7706] sit0: entered promiscuous mode [ 152.236002][ T7716] syz.3.753[7716] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 152.236129][ T7716] syz.3.753[7716] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 152.274884][ T7716] wg2: entered promiscuous mode [ 152.294003][ T7716] wg2: entered allmulticast mode [ 155.937927][ T7744] pim6reg1: entered promiscuous mode [ 155.945330][ T7744] pim6reg1: entered allmulticast mode [ 158.149786][ T7770] syzkaller0: entered promiscuous mode [ 159.571772][ T7784] syzkaller0: entered promiscuous mode [ 159.577375][ T7784] syzkaller0: entered allmulticast mode [ 159.874836][ C0] bridge0: port 3(team0) entered forwarding state [ 159.882735][ C0] bridge0: topology change detected, propagating [ 162.268943][ T7809] pim6reg1: entered promiscuous mode [ 162.274297][ T7809] pim6reg1: entered allmulticast mode [ 167.130750][ T7864] pim6reg1: entered promiscuous mode [ 167.146107][ T7864] pim6reg1: entered allmulticast mode [ 168.737486][ T7903] syzkaller0: entered promiscuous mode [ 168.744510][ T7903] syzkaller0: entered allmulticast mode [ 169.466931][ T2919] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 173.390235][ T7946] pim6reg1: entered promiscuous mode [ 173.395937][ T7946] pim6reg1: entered allmulticast mode [ 176.021588][ T7960] syz.0.834[7960] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 176.021712][ T7960] syz.0.834[7960] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 176.871789][ T7960] veth0_vlan: entered allmulticast mode [ 177.051999][ T7961] veth0_vlan: left promiscuous mode [ 177.059033][ T7961] veth0_vlan: entered promiscuous mode [ 178.095723][ T7966] pim6reg1: entered promiscuous mode [ 178.101064][ T7966] pim6reg1: entered allmulticast mode [ 188.599826][ T8102] syzkaller0: entered promiscuous mode [ 188.621434][ T8102] syzkaller0: entered allmulticast mode [ 190.628781][ T8130] syz.2.889[8130] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 190.629013][ T8130] syz.2.889[8130] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 190.813521][ T8136] macsec0: entered promiscuous mode [ 190.840110][ T8136] macsec0: entered allmulticast mode [ 190.846306][ T8136] veth1_macvtap: entered allmulticast mode [ 191.073201][ T8140] wg2: entered promiscuous mode [ 191.105032][ T8140] wg2: entered allmulticast mode [ 191.389981][ T5797] Bluetooth: hci0: command 0x0406 tx timeout [ 191.389985][ T5106] Bluetooth: hci1: command 0x0406 tx timeout [ 191.404900][ T5797] Bluetooth: hci2: command 0x0406 tx timeout [ 191.404918][ T5106] Bluetooth: hci3: command 0x0406 tx timeout [ 191.722142][ T8161] syz.1.903[8161] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 191.722305][ T8161] syz.1.903[8161] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 192.035130][ T8139] syzkaller0: entered promiscuous mode [ 192.057039][ T8139] syzkaller0: entered allmulticast mode [ 194.043055][ T8174] syzkaller0: entered promiscuous mode [ 194.075088][ T8174] syzkaller0: entered allmulticast mode [ 194.440911][ T1272] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.453518][ T1272] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.752919][ T8190] pim6reg1: entered promiscuous mode [ 195.766639][ T8190] pim6reg1: entered allmulticast mode [ 196.761985][ T8210] syzkaller0: entered promiscuous mode [ 196.781893][ T8210] syzkaller0: entered allmulticast mode [ 196.799793][ T8215] net_ratelimit: 173 callbacks suppressed [ 196.799808][ T8215] lo: mtu less than device minimum [ 201.473918][ T42] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 201.532692][ T8292] syz.0.949[8292] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 201.532817][ T8292] syz.0.949[8292] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 203.316892][ T8313] GPL: port 1(erspan0) entered blocking state [ 203.359601][ T8313] GPL: port 1(erspan0) entered disabled state [ 203.370507][ T8313] erspan0: entered allmulticast mode [ 203.387234][ T8313] erspan0: entered promiscuous mode [ 203.414640][ T8319] GPL: port 1(erspan0) entered blocking state [ 203.420916][ T8319] GPL: port 1(erspan0) entered forwarding state [ 205.596481][ T8348] wg2: entered promiscuous mode [ 205.601405][ T8348] wg2: entered allmulticast mode [ 205.841212][ T8365] sit0: left promiscuous mode [ 207.245341][ T8395] ±ÿ: renamed from bond_slave_0 [ 209.182074][ T8430] pim6reg1: entered promiscuous mode [ 209.190558][ T8430] pim6reg1: entered allmulticast mode [ 209.913851][ T8459] veth1_macvtap: left promiscuous mode [ 209.979538][ T8459] veth1_macvtap: entered promiscuous mode [ 210.000339][ T8459] macsec0: entered promiscuous mode [ 210.013699][ T8459] macsec0: entered allmulticast mode [ 210.022726][ T8459] veth1_macvtap: entered allmulticast mode [ 212.476699][ T8503] sit0: entered allmulticast mode [ 212.519483][ T8503] sit0: entered promiscuous mode [ 213.372934][ T8540] pim6reg1: entered promiscuous mode [ 213.387073][ T8540] pim6reg1: entered allmulticast mode [ 214.020512][ T8555] validate_nla: 2 callbacks suppressed [ 214.020528][ T8555] netlink: 'syz.1.1048': attribute type 10 has an invalid length. [ 214.495058][ T8571] net veth1_virt_wifi »»»»»»: renamed from virt_wifi0 (while UP) [ 216.351061][ T8608] sctp: [Deprecated]: syz.3.1066 (pid 8608) Use of int in max_burst socket option deprecated. [ 216.351061][ T8608] Use struct sctp_assoc_value instead [ 216.397275][ T8608] syz.3.1066: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 216.428911][ T8608] CPU: 0 PID: 8608 Comm: syz.3.1066 Not tainted 6.6.102-syzkaller #0 [ 216.437074][ T8608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 216.447151][ T8608] Call Trace: [ 216.450535][ T8608] [ 216.453484][ T8608] dump_stack_lvl+0x16c/0x230 [ 216.458188][ T8608] ? show_regs_print_info+0x20/0x20 [ 216.463410][ T8608] ? dump_stack+0x9/0x20 [ 216.467677][ T8608] ? dump_stack_lvl+0x10/0x230 [ 216.472470][ T8608] warn_alloc+0x210/0x300 [ 216.476825][ T8608] ? stack_trace_save+0x9c/0xe0 [ 216.481704][ T8608] ? zone_watermark_ok_safe+0x230/0x230 [ 216.487373][ T8608] ? kasan_set_track+0x5f/0x70 [ 216.492247][ T8608] ? kasan_set_track+0x4e/0x70 [ 216.497028][ T8608] ? __kasan_kmalloc+0x8f/0xa0 [ 216.501812][ T8608] ? xsk_init_queue+0xb0/0x110 [ 216.506592][ T8608] ? xsk_setsockopt+0x4db/0x6f0 [ 216.511467][ T8608] ? do_sock_setsockopt+0x175/0x1a0 [ 216.516692][ T8608] ? __x64_sys_setsockopt+0x184/0x200 [ 216.522094][ T8608] __vmalloc_node_range+0x126/0x1320 [ 216.527430][ T8608] ? free_vm_area+0x50/0x50 [ 216.531974][ T8608] vmalloc_user+0x74/0x80 [ 216.536330][ T8608] ? xskq_create+0xbf/0x170 [ 216.540849][ T8608] xskq_create+0xbf/0x170 [ 216.545198][ T8608] xsk_init_queue+0xb0/0x110 [ 216.549805][ T8608] xsk_setsockopt+0x4db/0x6f0 [ 216.554505][ T8608] ? xsk_poll+0x670/0x670 [ 216.558857][ T8608] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 216.565037][ T8608] ? xsk_poll+0x670/0x670 [ 216.569396][ T8608] ? xsk_poll+0x670/0x670 [ 216.573745][ T8608] do_sock_setsockopt+0x175/0x1a0 [ 216.578814][ T8608] ? __fdget+0x180/0x210 [ 216.583081][ T8608] __x64_sys_setsockopt+0x184/0x200 [ 216.588307][ T8608] do_syscall_64+0x55/0xb0 [ 216.592738][ T8608] ? clear_bhb_loop+0x40/0x90 [ 216.597427][ T8608] ? clear_bhb_loop+0x40/0x90 [ 216.602121][ T8608] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 216.608037][ T8608] RIP: 0033:0x7f78fc38ebe9 [ 216.612462][ T8608] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.632090][ T8608] RSP: 002b:00007f78fd118038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 216.640529][ T8608] RAX: ffffffffffffffda RBX: 00007f78fc5b6090 RCX: 00007f78fc38ebe9 [ 216.648525][ T8608] RDX: 0000000000000002 RSI: 000000000000011b RDI: 000000000000000e [ 216.656516][ T8608] RBP: 00007f78fc411e19 R08: 0000000000000004 R09: 0000000000000000 [ 216.664501][ T8608] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 216.672487][ T8608] R13: 00007f78fc5b6128 R14: 00007f78fc5b6090 R15: 00007ffcabffe9d8 [ 216.680496][ T8608] [ 216.712333][ T8608] Mem-Info: [ 216.715883][ T8608] active_anon:17816 inactive_anon:0 isolated_anon:0 [ 216.715883][ T8608] active_file:12717 inactive_file:39878 isolated_file:0 [ 216.715883][ T8608] unevictable:768 dirty:87 writeback:0 [ 216.715883][ T8608] slab_reclaimable:9924 slab_unreclaimable:97149 [ 216.715883][ T8608] mapped:34808 shmem:13949 pagetables:628 [ 216.715883][ T8608] sec_pagetables:0 bounce:0 [ 216.715883][ T8608] kernel_misc_reclaimable:0 [ 216.715883][ T8608] free:1337197 free_pcp:8465 free_cma:0 [ 216.781951][ T8608] Node 0 active_anon:73764kB inactive_anon:0kB active_file:50868kB inactive_file:159308kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:139232kB dirty:348kB writeback:0kB shmem:56860kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11484kB pagetables:2512kB sec_pagetables:0kB all_unreclaimable? no [ 216.825365][ T8608] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 216.857122][ T8608] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 216.892106][ T8608] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 216.899635][ T8608] Node 0 DMA32 free:1427708kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:78420kB inactive_anon:0kB active_file:50868kB inactive_file:157988kB unevictable:1536kB writepending:348kB present:3129332kB managed:2589596kB mlocked:0kB bounce:0kB free_pcp:16508kB local_pcp:2684kB free_cma:0kB [ 216.935777][ T8608] lowmem_reserve[]: 0 0 1 1 1 [ 216.940976][ T8608] Node 0 Normal free:8kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 216.969876][ T8608] lowmem_reserve[]: 0 0 0 0 0 [ 216.977375][ T8608] Node 1 Normal free:3898404kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:19584kB local_pcp:10688kB free_cma:0kB [ 217.010216][ T8608] lowmem_reserve[]: 0 0 0 0 0 [ 217.015881][ T8608] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 217.031431][ T8608] Node 0 DMA32: 1*4kB (E) 652*8kB (U) 670*16kB (UE) 317*32kB (U) 56*64kB (UME) 7*128kB (UME) 4*256kB (UM) 2*512kB (ME) 2*1024kB (ME) 3*2048kB (UME) 337*4096kB (M) = 1421156kB [ 217.051865][ T8608] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 217.067535][ T8608] Node 1 Normal: 195*4kB (UME) 57*8kB (UME) 37*16kB (UME) 46*32kB (UME) 27*64kB (UE) 3*128kB (UME) 3*256kB (UE) 2*512kB (UM) 2*1024kB (UE) 1*2048kB (E) 949*4096kB (M) = 3898404kB [ 217.087424][ T8608] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 217.098123][ T8608] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 217.124698][ T8608] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 217.144785][ T8608] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 217.157386][ T8608] 70863 total pagecache pages [ 217.162126][ T8608] 0 pages in swap cache [ 217.166875][ T8608] Free swap = 124996kB [ 217.171111][ T8608] Total swap = 124996kB [ 217.177459][ T8608] 2097051 pages RAM [ 217.181315][ T8608] 0 pages HighMem/MovableOnly [ 217.186454][ T8608] 416138 pages reserved [ 217.190799][ T8608] 0 pages cma reserved [ 219.162579][ T8618] pim6reg1: entered promiscuous mode [ 219.168096][ T8618] pim6reg1: entered allmulticast mode [ 219.445340][ T8631] wg2: left promiscuous mode [ 219.454540][ T8631] wg2: left allmulticast mode [ 219.565538][ T8631] wg2: entered promiscuous mode [ 219.577963][ T8631] wg2: entered allmulticast mode [ 219.636797][ T8632] veth0_vlan: left promiscuous mode [ 219.721114][ T8632] veth0_vlan: entered promiscuous mode [ 220.703311][ T8644] netlink: 'syz.3.1078': attribute type 2 has an invalid length. [ 220.724200][ T8644] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1078'. [ 220.780468][ T8649] GPL: port 1(erspan0) entered disabled state [ 222.247234][ T8682] netlink: 'syz.1.1093': attribute type 10 has an invalid length. [ 222.959266][ T8682] bond0: (slave team0): Releasing backup interface [ 222.998521][ T8682] team0 (unregistering): Port device team_slave_0 removed [ 223.032728][ T8682] team0 (unregistering): Port device team_slave_1 removed [ 223.362487][ T8703] pim6reg1: entered promiscuous mode [ 223.391652][ T8703] pim6reg1: entered allmulticast mode [ 223.494904][ T8699] syzkaller0: entered promiscuous mode [ 223.512800][ T8699] syzkaller0: entered allmulticast mode [ 230.390098][ T8781] wg2: left promiscuous mode [ 230.398126][ T8781] wg2: left allmulticast mode [ 231.285435][ T8781] wg2: entered promiscuous mode [ 231.290670][ T8781] wg2: entered allmulticast mode [ 231.937203][ T8799] sit0: left promiscuous mode [ 232.521940][ T8806] sit0: entered promiscuous mode [ 232.611680][ T8813] syzkaller0: entered promiscuous mode [ 232.619402][ T8813] syzkaller0: entered allmulticast mode [ 233.487693][ T3502] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 236.421313][ T8831] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1141'. [ 237.458448][ T8845] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1146'. [ 237.571385][ T8845] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1146'. [ 237.713793][ T8844] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1146'. [ 237.759638][ T8846] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1146'. [ 237.937268][ T8849] can: request_module (can-proto-4) failed. [ 238.286183][ T8861] syz.3.1153[8861] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 238.286408][ T8861] syz.3.1153[8861] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 238.378307][ T5789] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 238.411112][ T5789] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 238.430131][ T5789] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 238.438442][ T5789] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 238.464674][ T5789] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 238.474643][ T5789] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 238.692117][ T8875] pim6reg1: entered promiscuous mode [ 238.698846][ T8875] pim6reg1: entered allmulticast mode [ 238.808815][ T8864] chnl_net:caif_netlink_parms(): no params data found [ 238.976572][ T8864] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.983885][ T8864] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.992567][ T8864] bridge_slave_0: entered allmulticast mode [ 239.000074][ T8864] bridge_slave_0: entered promiscuous mode [ 239.012091][ T8864] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.019488][ T8864] bridge0: port 2(bridge_slave_1) entered disabled state [ 239.026843][ T8864] bridge_slave_1: entered allmulticast mode [ 239.035812][ T8864] bridge_slave_1: entered promiscuous mode [ 239.087574][ T8864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 239.104759][ T8864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 239.150712][ T8864] team0: Port device team_slave_0 added [ 239.169914][ T8864] team0: Port device team_slave_1 added [ 239.279324][ T8864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 239.298608][ T8864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 239.334304][ T8864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 239.481104][ T8864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 239.513483][ T8864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 239.557926][ T8864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 239.607870][ T3502] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.650417][ T8896] wg2: left promiscuous mode [ 239.655877][ T8896] wg2: left allmulticast mode [ 239.703720][ T8864] hsr_slave_0: entered promiscuous mode [ 239.725793][ T8864] hsr_slave_1: entered promiscuous mode [ 239.733576][ T8864] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 239.771810][ T8864] Cannot create hsr debugfs directory [ 239.910935][ T3502] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.936807][ T8897] wg2: entered promiscuous mode [ 239.941700][ T8897] wg2: entered allmulticast mode [ 240.102220][ T3502] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.250567][ T3502] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.587245][ T5789] Bluetooth: hci4: command tx timeout [ 242.665447][ T5789] Bluetooth: hci4: command tx timeout [ 244.095979][ T8864] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 244.122768][ T8864] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 244.192274][ T8864] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 244.231973][ T8864] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 244.745365][ T5789] Bluetooth: hci4: command tx timeout [ 244.773097][ T3502] erspan0 (unregistering): left allmulticast mode [ 244.780096][ T3502] erspan0 (unregistering): left promiscuous mode [ 244.790178][ T3502] GPL: port 1(erspan0) entered disabled state [ 244.830966][ T8864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 244.908491][ T8965] netlink: 'syz.1.1181': attribute type 10 has an invalid length. [ 244.946294][ T8965] veth1_vlan: entered allmulticast mode [ 245.103406][ T8864] 8021q: adding VLAN 0 to HW filter on device team0 [ 245.134192][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 245.141391][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 245.287177][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.294443][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 246.164208][ T3502] hsr_slave_0: left promiscuous mode [ 246.170580][ T3502] hsr_slave_1: left promiscuous mode [ 246.184921][ T3502] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 246.192423][ T3502] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 246.305861][ T3502] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 246.350503][ T3502] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 246.407506][ T3502] bridge_slave_1: left allmulticast mode [ 246.433956][ T3502] bridge_slave_1: left promiscuous mode [ 246.502484][ T3502] bridge0: port 2(bridge_slave_1) entered disabled state [ 246.721565][ T3502] bridge_slave_0: left allmulticast mode [ 246.743686][ T3502] bridge_slave_0: left promiscuous mode [ 246.751868][ T3502] bridge0: port 1(bridge_slave_0) entered disabled state [ 246.824962][ T5789] Bluetooth: hci4: command tx timeout [ 246.840297][ T3502] veth1_vlan: left promiscuous mode [ 246.846579][ T3502] veth0_vlan: left promiscuous mode [ 247.863183][ T3502] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 247.902227][ T3502] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 248.188668][ T3502] bond0 (unregistering): Released all slaves [ 248.441246][ T9036] ±ÿ: renamed from bond_slave_0 (while UP) [ 248.603386][ T8864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 248.834576][ T9049] pim6reg1: entered promiscuous mode [ 248.840007][ T9049] pim6reg1: entered allmulticast mode [ 249.126520][ T9056] veth0_vlan: left promiscuous mode [ 249.140564][ T9056] veth0_vlan: entered promiscuous mode [ 249.499349][ T8864] veth0_vlan: entered promiscuous mode [ 249.528468][ T8864] veth1_vlan: entered promiscuous mode [ 249.653510][ T8864] veth0_macvtap: entered promiscuous mode [ 249.727761][ T8864] veth1_macvtap: entered promiscuous mode [ 249.831049][ T8864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 249.860319][ T8864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 249.888741][ T8864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 249.919513][ T8864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 249.942273][ T8864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 250.001280][ T8864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.068449][ T8864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.078722][ T8864] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 250.115685][ T8864] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 250.172191][ T8864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 250.195820][ T9084] pim6reg1: entered promiscuous mode [ 250.202230][ T9084] pim6reg1: entered allmulticast mode [ 251.054147][ T8864] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.098984][ T8864] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.135107][ T8864] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.143841][ T8864] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.706127][ T3547] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.753557][ T3547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 251.820219][ T3547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 251.908633][ T3547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 253.756626][ T9165] Ÿë: port 1(erspan0) entered blocking state [ 253.767954][ T9165] Ÿë: port 1(erspan0) entered disabled state [ 253.778204][ T9165] erspan0: entered allmulticast mode [ 253.877404][ T9165] erspan0: entered promiscuous mode [ 254.124775][ T9166] Ÿë: port 1(erspan0) entered blocking state [ 254.131049][ T9166] Ÿë: port 1(erspan0) entered forwarding state [ 255.870056][ T1272] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.879865][ T1272] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.191269][ T9252] can: request_module (can-proto-0) failed. [ 257.851339][ T9276] syzkaller0: entered promiscuous mode [ 257.868491][ T9276] syzkaller0: entered allmulticast mode [ 260.852514][ T9316] syzkaller0: entered promiscuous mode [ 260.861216][ T9316] syzkaller0: entered allmulticast mode [ 260.876006][ T9326] can: request_module (can-proto-0) failed. [ 263.464108][ T9332] veth1_macvtap: left allmulticast mode [ 263.470186][ T9332] veth1_macvtap: left promiscuous mode [ 263.476343][ T9332] macsec0: left promiscuous mode [ 263.481323][ T9332] macsec0: left allmulticast mode [ 263.492673][ T9336] veth1_macvtap: entered promiscuous mode [ 263.498831][ T9336] macsec0: entered promiscuous mode [ 263.504188][ T9336] macsec0: entered allmulticast mode [ 263.509535][ T9336] veth1_macvtap: entered allmulticast mode [ 263.845270][ T9360] syz.1.1282[9360] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 263.845392][ T9360] syz.1.1282[9360] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 264.459312][ T9371] pim6reg1: entered promiscuous mode [ 264.490237][ T9371] pim6reg1: entered allmulticast mode [ 265.469080][ T48] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 265.858126][ T9417] netlink: 'syz.4.1302': attribute type 3 has an invalid length. [ 265.868406][ T9417] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1302'. [ 266.824078][ T9443] sit0: left promiscuous mode [ 266.984873][ T9446] sit0: entered promiscuous mode [ 268.532476][ T9475] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 268.545075][ T9475] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 268.571090][ T9475] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 268.585103][ T9475] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 269.803352][ T9535] netlink: 'syz.0.1338': attribute type 10 has an invalid length. [ 269.916812][ T9535] team0: Device hsr_slave_0 failed to register rx_handler [ 271.208741][ T9559] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 271.254862][ T9559] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 271.305941][ T9559] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 271.339434][ T9559] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 271.798166][ T9574] syzkaller0: entered promiscuous mode [ 271.803670][ T9574] syzkaller0: entered allmulticast mode [ 274.003073][ T9587] netlink: 'syz.4.1349': attribute type 10 has an invalid length. [ 274.017258][ T9587] team0: Device hsr_slave_0 failed to register rx_handler [ 274.524312][ T9605] netlink: 'syz.4.1356': attribute type 9 has an invalid length. [ 274.561374][ T9605] netlink: 209836 bytes leftover after parsing attributes in process `syz.4.1356'. [ 274.725167][ T9610] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 274.733074][ T9610] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 274.758319][ T9610] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 274.768246][ T9610] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 274.792542][ T9610] batman_adv: batadv0: Interface deactivated: »»»»»» [ 274.815434][ T9610] batman_adv: batadv0: Removing interface: »»»»»» [ 274.990807][ T9616] netlink: 'syz.3.1360': attribute type 10 has an invalid length. [ 275.105576][ T9616] team0: Device hsr_slave_0 failed to register rx_handler [ 275.597336][ T9628] netlink: 'syz.0.1365': attribute type 10 has an invalid length. [ 276.049882][ T9648] netlink: 'syz.1.1368': attribute type 9 has an invalid length. [ 276.070054][ T9648] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.1368'. [ 276.880894][ T9677] netlink: 'syz.3.1376': attribute type 10 has an invalid length. [ 276.891627][ T9677] bridge0: port 3(team0) entered disabled state [ 276.898390][ T9677] bridge0: port 2(bridge_slave_1) entered disabled state [ 276.906177][ T9677] bridge0: port 1(bridge_slave_0) entered disabled state [ 276.936822][ T9677] bridge0: port 3(team0) entered blocking state [ 276.943250][ T9677] bridge0: port 3(team0) entered listening state [ 276.949899][ T9677] bridge0: port 2(bridge_slave_1) entered blocking state [ 276.957212][ T9677] bridge0: port 2(bridge_slave_1) entered listening state [ 276.964730][ T9677] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.971927][ T9677] bridge0: port 1(bridge_slave_0) entered listening state [ 276.989648][ T9677] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 279.210201][ T9732] netlink: 'syz.0.1381': attribute type 9 has an invalid length. [ 279.239532][ T9732] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.1381'. [ 279.577381][ T9747] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1388'. [ 279.878610][ T9754] netlink: 'syz.4.1389': attribute type 10 has an invalid length. [ 279.897070][ T9754] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.904808][ T9754] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.969396][ T9754] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.976631][ T9754] bridge0: port 2(bridge_slave_1) entered forwarding state [ 279.984140][ T9754] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.991332][ T9754] bridge0: port 1(bridge_slave_0) entered forwarding state [ 280.091163][ T9754] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 282.586484][ T9790] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1402'. [ 284.104889][ T9801] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1414'. [ 284.125820][ T9804] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.1407'. [ 285.249892][ T9813] ªªªªªª: renamed from vlan0 (while UP) [ 287.386286][ T9836] netlink: 9286 bytes leftover after parsing attributes in process `syz.1.1418'. [ 288.854293][ T9857] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1434'. [ 290.779455][ T9873] netlink: 9286 bytes leftover after parsing attributes in process `syz.4.1432'. [ 290.959055][ T9883] mac80211_hwsim hwsim12 O3ãc¤±: renamed from wlan1 (while UP) [ 292.345409][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 292.352688][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 292.360009][ C1] bridge0: port 3(team0) entered learning state [ 292.771719][ T9897] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1440'. [ 292.883954][ T9899] veth0_vlan: entered allmulticast mode [ 293.279365][ T9915] netlink: 'syz.0.1449': attribute type 10 has an invalid length. [ 293.347124][ T9918] mac80211_hwsim hwsim5 O3ãc¤±: renamed from wlan1 [ 293.416868][ T9917] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1456'. [ 295.645976][ T9948] veth0_vlan: entered allmulticast mode [ 295.849786][ T9955] netlink: 'syz.4.1461': attribute type 10 has an invalid length. [ 295.930741][ T9955] 8021q: adding VLAN 0 to HW filter on device team0 [ 295.967253][ T9955] bond0: (slave team0): Enslaving as an active interface with an up link [ 296.876015][ T9974] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1474'. [ 297.382577][ T9978] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.1476'. [ 297.425518][ T9978] netlink: 'syz.4.1476': attribute type 16 has an invalid length. [ 297.440729][ T9978] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1476'. [ 297.462527][ T9978] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.470983][ T3547] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 297.640823][ T9987] netlink: 'syz.3.1479': attribute type 10 has an invalid length. [ 297.698848][ T9987] bridge0: port 3(team0) entered disabled state [ 297.713375][ T9987] team0: left allmulticast mode [ 297.723009][ T9987] team_slave_0: left allmulticast mode [ 297.729541][ T9987] team_slave_1: left allmulticast mode [ 297.736432][ T9987] mac80211_hwsim hwsim5 O3ãc¤±: left allmulticast mode [ 297.743692][ T9987] geneve1: left allmulticast mode [ 297.750121][ T9987] team0: left promiscuous mode [ 297.755562][ T9987] team_slave_0: left promiscuous mode [ 297.762196][ T9987] team_slave_1: left promiscuous mode [ 297.768909][ T9987] mac80211_hwsim hwsim5 O3ãc¤±: left promiscuous mode [ 297.777245][ T9987] geneve1: left promiscuous mode [ 297.784032][ T9987] bridge0: port 3(team0) entered disabled state [ 297.834030][ T9987] 8021q: adding VLAN 0 to HW filter on device team0 [ 297.870314][ T9987] bond0: (slave team0): Enslaving as an active interface with an up link [ 298.241275][ T9994] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.249196][ T9994] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.258639][ T9994] bridge0: entered allmulticast mode [ 298.299998][ T9994] bridge_slave_1: left allmulticast mode [ 298.306558][ T9994] bridge_slave_1: left promiscuous mode [ 298.313117][ T9994] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.336997][ T9994] bridge_slave_0: left allmulticast mode [ 298.343078][ T9994] bridge_slave_0: left promiscuous mode [ 298.350868][ T9994] bridge0: port 1(bridge_slave_0) entered disabled state [ 298.403971][ T9994] bond0: (slave bridge0): Releasing backup interface [ 298.593526][ T9999] netlink: 'syz.0.1492': attribute type 10 has an invalid length. [ 298.643127][T10000] netlink: 'syz.4.1482': attribute type 10 has an invalid length. [ 298.651913][T10000] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1482'. [ 298.672974][T10000] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 298.974552][T10014] netlink: 'syz.0.1489': attribute type 39 has an invalid length. [ 299.041666][T10013] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1486'. [ 299.175575][T10018] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1493'. [ 299.217231][T10018] netlink: 'syz.3.1493': attribute type 16 has an invalid length. [ 299.231304][T10018] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1493'. [ 299.268636][T10018] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.639829][T10031] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.653239][T10031] bridge0: entered allmulticast mode [ 299.692946][T10028] bridge_slave_1: left allmulticast mode [ 299.699545][T10028] bridge_slave_1: left promiscuous mode [ 299.707102][T10028] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.731585][T10028] bridge_slave_0: left promiscuous mode [ 299.742098][T10028] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.811853][T10028] bond0: (slave bridge0): Releasing backup interface [ 300.140875][T10035] netlink: 'syz.1.1499': attribute type 10 has an invalid length. [ 300.149656][T10035] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1499'. [ 300.176850][T10035] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 300.612291][T10055] netlink: 'syz.3.1508': attribute type 39 has an invalid length. [ 301.096933][T10063] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.114624][T10063] bridge0: entered allmulticast mode [ 301.138819][T10060] bridge_slave_1: left allmulticast mode [ 301.146859][T10060] bridge_slave_1: left promiscuous mode [ 301.153319][T10060] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.171069][T10060] bridge_slave_0: left promiscuous mode [ 301.182747][T10060] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.237141][T10060] bond0: (slave bridge0): Releasing backup interface [ 301.555845][T10067] netlink: 'syz.1.1512': attribute type 10 has an invalid length. [ 301.563704][T10067] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1512'. [ 301.595323][T10067] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 301.926348][T10073] netlink: 'syz.3.1515': attribute type 2 has an invalid length. [ 301.936067][T10073] netlink: 'syz.3.1515': attribute type 8 has an invalid length. [ 301.944127][T10073] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1515'. [ 303.622173][T10100] netlink: 'syz.1.1525': attribute type 10 has an invalid length. [ 303.630424][T10100] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1525'. [ 303.641230][T10100] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 303.716749][T10104] netlink: 'syz.1.1527': attribute type 39 has an invalid length. [ 304.530084][T10131] netlink: 'syz.0.1538': attribute type 10 has an invalid length. [ 304.549005][T10131] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1538'. [ 304.560311][T10131] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 304.686011][T10135] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.1539'. [ 306.248930][T10138] netlink: 'syz.0.1540': attribute type 2 has an invalid length. [ 306.257674][T10138] netlink: 'syz.0.1540': attribute type 8 has an invalid length. [ 306.270653][T10138] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1540'. [ 306.882614][T10171] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.1551'. [ 307.620929][T10199] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.1565'. [ 309.236062][T10207] netlink: 'syz.4.1567': attribute type 2 has an invalid length. [ 309.243842][T10207] netlink: 'syz.4.1567': attribute type 8 has an invalid length. [ 309.252701][T10207] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1567'. [ 309.672583][T10233] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.1575'. [ 310.466221][T10268] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1589'. [ 310.631481][T10276] netlink: 'syz.3.1592': attribute type 10 has an invalid length. [ 311.851513][T10273] netlink: 'syz.0.1591': attribute type 10 has an invalid length. [ 311.859577][T10273] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1591'. [ 311.869107][T10273] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 311.894520][T10276] netlink: 'syz.3.1592': attribute type 10 has an invalid length. [ 312.476369][T10293] netlink: 'syz.4.1597': attribute type 2 has an invalid length. [ 312.492404][T10293] netlink: 'syz.4.1597': attribute type 8 has an invalid length. [ 312.502494][T10293] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1597'. [ 312.613821][T10302] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1601'. [ 312.616549][T10305] netlink: 'syz.1.1603': attribute type 10 has an invalid length. [ 312.634635][T10305] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1603'. [ 312.659563][T10305] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 313.472393][T10345] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1616'. [ 313.706920][T10353] netlink: 'syz.4.1620': attribute type 10 has an invalid length. [ 313.726790][T10353] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1620'. [ 313.755913][T10353] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 313.979767][T10372] netlink: 'syz.1.1635': attribute type 10 has an invalid length. [ 314.019019][T10372] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1635'. [ 314.039766][T10372] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 314.256617][T10388] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.1631'. [ 314.750039][T10408] netlink: 'syz.4.1640': attribute type 10 has an invalid length. [ 314.765907][T10408] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1640'. [ 314.788703][T10408] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 315.066959][T10423] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1646'. [ 315.243688][T10432] netlink: 'syz.4.1650': attribute type 10 has an invalid length. [ 315.264960][T10432] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1650'. [ 315.433509][T10437] netlink: 'syz.1.1652': attribute type 10 has an invalid length. [ 315.444878][T10437] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1652'. [ 315.491271][T10437] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 315.797782][T10458] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.1658'. [ 316.016485][T10470] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1661'. [ 316.040455][T10470] netlink: 'syz.3.1661': attribute type 16 has an invalid length. [ 316.054650][T10470] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1661'. [ 316.222292][T10481] netlink: 'syz.1.1666': attribute type 10 has an invalid length. [ 316.234726][T10481] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1666'. [ 316.253604][T10481] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 316.326893][T10477] netlink: 98936 bytes leftover after parsing attributes in process `syz.3.1665'. [ 316.357723][T10477] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 316.431576][T10477] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 316.486838][T10491] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 316.776966][T10505] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.1674'. [ 316.815200][T10505] netlink: 'syz.1.1674': attribute type 16 has an invalid length. [ 316.823245][T10505] bridge_slave_0: entered allmulticast mode [ 316.929736][T10511] netlink: 'syz.0.1677': attribute type 10 has an invalid length. [ 316.965103][T10511] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 317.195326][T10526] ÿÿÿÿÿÿ: renamed from vlan1 [ 317.234688][T10530] ±ÿ: entered promiscuous mode [ 317.239949][T10530] bond_slave_1: entered promiscuous mode [ 317.245846][T10530] team_slave_0: entered promiscuous mode [ 317.251782][T10530] team_slave_1: entered promiscuous mode [ 317.258505][T10530] geneve1: entered promiscuous mode [ 317.318823][ T1272] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.325227][ T1272] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.730354][T10552] netlink: 'syz.0.1690': attribute type 16 has an invalid length. [ 317.856926][T10558] netlink: 'syz.3.1693': attribute type 10 has an invalid length. [ 317.883471][T10558] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 318.525876][T10593] netlink: 'syz.4.1705': attribute type 16 has an invalid length. [ 318.739147][T10606] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 319.327918][T10628] syzkaller0: entered promiscuous mode [ 319.333578][T10628] syzkaller0: entered allmulticast mode [ 319.879256][T10643] __nla_validate_parse: 9 callbacks suppressed [ 319.879301][T10643] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1722'. [ 321.381169][T10642] validate_nla: 1 callbacks suppressed [ 321.381183][T10642] netlink: 'syz.0.1722': attribute type 16 has an invalid length. [ 321.394895][T10642] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1722'. [ 321.589759][T10649] netlink: 'syz.0.1724': attribute type 10 has an invalid length. [ 321.605127][T10649] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1724'. [ 321.627229][T10649] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 322.159120][T10678] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1732'. [ 322.614575][T10676] netlink: 'syz.3.1732': attribute type 16 has an invalid length. [ 322.634505][T10676] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1732'. [ 322.939155][T10691] netlink: 'syz.3.1738': attribute type 10 has an invalid length. [ 322.949739][T10691] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1738'. [ 322.969603][T10691] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 323.479759][T10719] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.1745'. [ 323.512201][T10713] netlink: 'syz.4.1745': attribute type 16 has an invalid length. [ 323.534651][T10713] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1745'. [ 324.341456][T10726] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1758'. [ 324.422338][T10726] netlink: 'syz.0.1758': attribute type 16 has an invalid length. [ 324.446070][T10726] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1758'. [ 324.459610][T10732] netlink: 'syz.3.1754': attribute type 10 has an invalid length. [ 324.479652][T10732] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 325.063526][T10759] sit0: left promiscuous mode [ 325.138843][T10762] sit0: entered promiscuous mode [ 325.526214][T10776] __nla_validate_parse: 1 callbacks suppressed [ 325.526258][T10776] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1764'. [ 325.767833][T10776] netlink: 'syz.0.1764': attribute type 16 has an invalid length. [ 325.783102][T10776] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1764'. [ 325.795964][T10778] netlink: 'syz.1.1765': attribute type 10 has an invalid length. [ 325.806938][T10778] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1765'. [ 325.833648][T10778] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 326.195593][T10796] netlink: 'syz.0.1769': attribute type 10 has an invalid length. [ 327.266957][T10822] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1777'. [ 327.339972][T10822] validate_nla: 1 callbacks suppressed [ 327.340015][T10822] netlink: 'syz.0.1777': attribute type 16 has an invalid length. [ 327.354052][T10822] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1777'. [ 327.547548][T10829] netlink: 'syz.0.1781': attribute type 10 has an invalid length. [ 327.584856][T10829] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1781'. [ 327.633024][T10829] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 329.222016][T10852] syzkaller0: entered promiscuous mode [ 329.341656][T10858] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1787'. [ 329.475311][ T11] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 331.027871][T10858] netlink: 'syz.0.1787': attribute type 16 has an invalid length. [ 331.036046][T10858] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1787'. [ 331.410129][T10877] netlink: 'syz.1.1794': attribute type 10 has an invalid length. [ 331.444714][T10877] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1794'. [ 331.457006][T10877] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 331.520496][T10885] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1797'. [ 331.587230][T10885] netlink: 'syz.0.1797': attribute type 16 has an invalid length. [ 331.613692][T10885] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1797'. [ 331.819432][T10900] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1809'. [ 331.858043][T10900] netlink: 'syz.0.1809': attribute type 16 has an invalid length. [ 331.876279][T10900] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1809'. [ 332.151856][T10913] netlink: 'syz.4.1804': attribute type 10 has an invalid length. [ 332.200648][T10913] netlink: 'syz.4.1804': attribute type 10 has an invalid length. [ 332.820770][T10928] netlink: 'syz.0.1811': attribute type 10 has an invalid length. [ 332.831861][T10928] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1811'. [ 332.848134][T10928] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 332.898361][T10936] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1813'. [ 332.959534][T10936] netlink: 'syz.3.1813': attribute type 16 has an invalid length. [ 332.979206][T10936] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1813'. [ 333.634061][T10965] netlink: 'syz.4.1823': attribute type 10 has an invalid length. [ 333.680211][T10965] netlink: 'syz.4.1823': attribute type 10 has an invalid length. [ 334.706417][T10976] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1826'. [ 334.748270][T10978] netlink: 'syz.4.1827': attribute type 10 has an invalid length. [ 334.797809][T10978] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 334.871627][T10979] netlink: 'syz.0.1826': attribute type 16 has an invalid length. [ 337.054783][T11029] __nla_validate_parse: 2 callbacks suppressed [ 337.054825][T11029] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.1841'. [ 337.179496][T11027] netlink: 'syz.1.1841': attribute type 16 has an invalid length. [ 337.209201][T11027] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1841'. [ 337.306800][T11033] netlink: 'syz.0.1842': attribute type 10 has an invalid length. [ 337.364612][T11033] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1842'. [ 337.407886][T11033] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 338.073091][T11065] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.1852'. [ 338.111791][T11065] netlink: 'syz.1.1852': attribute type 16 has an invalid length. [ 338.128608][T11065] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1852'. [ 338.322356][T11072] netlink: 'syz.3.1855': attribute type 10 has an invalid length. [ 338.353127][T11072] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1855'. [ 338.398421][T11072] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 339.197793][T11103] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.1865'. [ 339.257606][T11103] netlink: 'syz.1.1865': attribute type 16 has an invalid length. [ 339.293203][T11103] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1865'. [ 340.174657][T11123] netlink: 'syz.4.1871': attribute type 10 has an invalid length. [ 340.193302][T11123] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1871'. [ 340.231238][T11123] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 340.384376][T11130] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.1875'. [ 340.577932][T11130] netlink: 'syz.1.1875': attribute type 16 has an invalid length. [ 341.481621][T11172] netlink: 'syz.1.1885': attribute type 10 has an invalid length. [ 341.494290][T11172] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 341.541830][T11177] netlink: 'syz.0.1887': attribute type 16 has an invalid length. [ 342.576322][T11220] netlink: 'syz.1.1898': attribute type 10 has an invalid length. [ 342.604098][T11220] __nla_validate_parse: 4 callbacks suppressed [ 342.604152][T11220] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1898'. [ 342.635512][T11220] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 342.798337][T11226] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1899'. [ 342.895962][T11223] netlink: 'syz.0.1899': attribute type 16 has an invalid length. [ 342.903819][T11223] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1899'. [ 343.325963][T11237] netlink: 'syz.0.1912': attribute type 16 has an invalid length. [ 343.334076][T11237] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1912'. [ 343.438274][T11242] wg2: left promiscuous mode [ 343.442923][T11242] wg2: left allmulticast mode [ 343.723013][T11242] wg2: entered promiscuous mode [ 343.735843][T11242] wg2: entered allmulticast mode [ 343.996465][T11256] netlink: 'syz.4.1910': attribute type 10 has an invalid length. [ 344.009497][T11256] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1910'. [ 344.023619][T11256] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 344.246984][T11270] netlink: 'syz.0.1915': attribute type 16 has an invalid length. [ 344.265316][T11270] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1915'. [ 344.729978][T11286] netlink: 'syz.1.1922': attribute type 10 has an invalid length. [ 344.743229][T11286] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1922'. [ 344.920076][T11291] netlink: 'syz.4.1924': attribute type 10 has an invalid length. [ 344.928989][T11291] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1924'. [ 344.939426][T11291] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 345.333144][T11309] netlink: 'syz.3.1929': attribute type 16 has an invalid length. [ 345.369585][T11309] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1929'. [ 345.552584][T11317] netlink: 'syz.1.1941': attribute type 16 has an invalid length. [ 345.573903][T11317] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1941'. [ 345.636294][T11322] netlink: 'syz.3.1933': attribute type 10 has an invalid length. [ 346.018120][T11335] netlink: 'syz.3.1937': attribute type 10 has an invalid length. [ 346.034185][T11335] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 346.366879][T11353] netlink: 'syz.4.1945': attribute type 16 has an invalid length. [ 347.148349][T11374] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 347.752271][T11405] __nla_validate_parse: 5 callbacks suppressed [ 347.752286][T11405] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.1962'. [ 347.858209][T11411] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1965'. [ 347.870641][T11411] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 348.015706][T11414] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.1967'. [ 348.062455][T11414] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1967'. [ 350.578544][T11458] netlink: 98936 bytes leftover after parsing attributes in process `syz.4.1976'. [ 350.597473][T11457] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.1978'. [ 350.817332][T11458] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 350.823372][T11457] validate_nla: 4 callbacks suppressed [ 350.823410][T11457] netlink: 'syz.1.1978': attribute type 16 has an invalid length. [ 350.837909][T11457] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1978'. [ 350.874750][T11464] mac80211_hwsim hwsim11 wlan0: entered allmulticast mode [ 351.229408][T11455] mac80211_hwsim hwsim11 wlan0: entered promiscuous mode [ 351.257455][T11468] netlink: 'syz.1.1980': attribute type 10 has an invalid length. [ 351.265679][T11468] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1980'. [ 351.276597][T11468] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 352.666381][T11512] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.1992'. [ 352.686332][T11508] sit0: left promiscuous mode [ 353.251441][T11512] netlink: 'syz.4.1992': attribute type 16 has an invalid length. [ 353.264359][T11512] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1992'. [ 353.531915][T11514] netlink: 'syz.3.1993': attribute type 10 has an invalid length. [ 353.540156][T11514] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1993'. [ 353.555292][T11514] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 354.436468][T11539] netlink: 98936 bytes leftover after parsing attributes in process `syz.0.1998'. [ 354.465030][T11539] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 354.528737][T11539] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 354.584781][T11544] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 355.155343][T11557] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.2007'. [ 355.217982][T11557] netlink: 'syz.1.2007': attribute type 16 has an invalid length. [ 355.251218][T11557] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2007'. [ 355.392742][T11562] netlink: 'syz.3.2008': attribute type 10 has an invalid length. [ 355.419772][T11562] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2008'. [ 355.434874][T11562] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 356.151081][T11596] ÿÿÿÿÿÿ: renamed from vlan1 [ 356.327628][T11604] netlink: 'syz.4.2022': attribute type 10 has an invalid length. [ 356.339920][T11601] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.2018'. [ 356.349711][T11604] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2022'. [ 356.374302][T11604] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 356.401222][T11601] netlink: 'syz.1.2018': attribute type 16 has an invalid length. [ 356.421177][T11601] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2018'. [ 356.928360][T11626] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2028'. [ 356.968091][T11626] bond_slave_0: entered promiscuous mode [ 356.973858][T11626] bond_slave_1: entered promiscuous mode [ 356.979609][T11626] team_slave_0: entered promiscuous mode [ 356.985397][T11626] team_slave_1: entered promiscuous mode [ 357.165101][T11637] netlink: 'syz.0.2033': attribute type 16 has an invalid length. [ 358.704726][T11648] netlink: 'syz.3.2037': attribute type 10 has an invalid length. [ 358.712835][T11648] __nla_validate_parse: 2 callbacks suppressed [ 358.712843][T11648] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2037'. [ 358.728664][T11648] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 358.977160][T11659] ÿÿÿÿÿÿ: renamed from vlan1 [ 359.109363][T11667] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.2046'. [ 359.142878][T11667] netlink: 'syz.3.2046': attribute type 16 has an invalid length. [ 359.153717][T11667] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2046'. [ 359.353017][T11676] netlink: 'syz.0.2049': attribute type 10 has an invalid length. [ 359.374895][T11676] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2049'. [ 359.405338][T11676] A link change request failed with some changes committed already. Interface »»»»»» may have been left with an inconsistent configuration, please check. [ 359.730930][T11702] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.2058'. [ 359.779064][T11702] netlink: 'syz.3.2058': attribute type 16 has an invalid length. [ 359.803824][T11702] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2058'. [ 359.941228][T11713] netlink: 'syz.3.2063': attribute type 10 has an invalid length. [ 360.065260][T11713] veth1_macvtap (unregistering): left allmulticast mode [ 360.865866][T11733] net veth1_virt_wifi »»»»»»: renamed from virt_wifi0 (while UP) [ 361.191155][T11742] netlink: 'syz.0.2080': attribute type 10 has an invalid length. [ 361.261322][T11742] veth1_macvtap (unregistering): left allmulticast mode [ 361.474660][ T11] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 361.627389][T11758] sctp: [Deprecated]: syz.4.2078 (pid 11758) Use of int in max_burst socket option deprecated. [ 361.627389][T11758] Use struct sctp_assoc_value instead [ 361.807068][T11758] syz.4.2078: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz4,mems_allowed=0-1 [ 361.834704][T11758] CPU: 0 PID: 11758 Comm: syz.4.2078 Not tainted 6.6.102-syzkaller #0 [ 361.842910][T11758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 361.852992][T11758] Call Trace: [ 361.856279][T11758] [ 361.859218][T11758] dump_stack_lvl+0x16c/0x230 [ 361.863910][T11758] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 361.870090][T11758] ? show_regs_print_info+0x20/0x20 [ 361.875304][T11758] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 361.881492][T11758] warn_alloc+0x210/0x300 [ 361.885844][T11758] ? zone_watermark_ok_safe+0x230/0x230 [ 361.891419][T11758] ? kasan_set_track+0x5f/0x70 [ 361.896199][T11758] ? kasan_set_track+0x4e/0x70 [ 361.900978][T11758] ? __kasan_kmalloc+0x8f/0xa0 [ 361.905765][T11758] ? xsk_init_queue+0xb0/0x110 [ 361.910541][T11758] ? xsk_setsockopt+0x4db/0x6f0 [ 361.915406][T11758] ? do_sock_setsockopt+0x175/0x1a0 [ 361.920613][T11758] ? __x64_sys_setsockopt+0x184/0x200 [ 361.926003][T11758] __vmalloc_node_range+0x126/0x1320 [ 361.931330][T11758] ? free_vm_area+0x50/0x50 [ 361.935872][T11758] vmalloc_user+0x74/0x80 [ 361.940213][T11758] ? xskq_create+0xbf/0x170 [ 361.944723][T11758] xskq_create+0xbf/0x170 [ 361.949057][T11758] xsk_init_queue+0xb0/0x110 [ 361.953640][T11758] xsk_setsockopt+0x4db/0x6f0 [ 361.958313][T11758] ? xsk_poll+0x670/0x670 [ 361.962632][T11758] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 361.968781][T11758] ? aa_sock_opt_perm+0x74/0x100 [ 361.973710][T11758] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 361.979246][T11758] ? security_socket_setsockopt+0x7e/0xa0 [ 361.984952][T11758] ? xsk_poll+0x670/0x670 [ 361.989278][T11758] do_sock_setsockopt+0x175/0x1a0 [ 361.994293][T11758] ? __fdget+0x180/0x210 [ 361.998532][T11758] __x64_sys_setsockopt+0x184/0x200 [ 362.003725][T11758] do_syscall_64+0x55/0xb0 [ 362.008129][T11758] ? clear_bhb_loop+0x40/0x90 [ 362.013225][T11758] ? clear_bhb_loop+0x40/0x90 [ 362.017888][T11758] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 362.024231][T11758] RIP: 0033:0x7f94b198ebe9 [ 362.028663][T11758] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 362.048312][T11758] RSP: 002b:00007f94b2886038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 362.056739][T11758] RAX: ffffffffffffffda RBX: 00007f94b1bb6090 RCX: 00007f94b198ebe9 [ 362.064722][T11758] RDX: 0000000000000002 RSI: 000000000000011b RDI: 000000000000000e [ 362.072692][T11758] RBP: 00007f94b1a11e19 R08: 0000000000000004 R09: 0000000000000000 [ 362.080660][T11758] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 362.088659][T11758] R13: 00007f94b1bb6128 R14: 00007f94b1bb6090 R15: 00007ffd9e8704e8 [ 362.096637][T11758] [ 362.115488][T11758] Mem-Info: [ 362.118900][T11758] active_anon:4577 inactive_anon:0 isolated_anon:0 [ 362.118900][T11758] active_file:17617 inactive_file:39939 isolated_file:0 [ 362.118900][T11758] unevictable:768 dirty:162 writeback:0 [ 362.118900][T11758] slab_reclaimable:10346 slab_unreclaimable:96312 [ 362.118900][T11758] mapped:23863 shmem:1576 pagetables:395 [ 362.118900][T11758] sec_pagetables:0 bounce:0 [ 362.118900][T11758] kernel_misc_reclaimable:0 [ 362.118900][T11758] free:1349109 free_pcp:7918 free_cma:0 [ 362.165442][T11758] Node 0 active_anon:18308kB inactive_anon:0kB active_file:70468kB inactive_file:159552kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:95452kB dirty:648kB writeback:0kB shmem:4768kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11124kB pagetables:1580kB sec_pagetables:0kB all_unreclaimable? no [ 362.205254][T11758] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 362.245716][T11758] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 362.273991][T11758] lowmem_reserve[]: 0 2525 2526 2526 2526 [ 362.280901][T11758] Node 0 DMA32 free:1480616kB boost:0kB min:34676kB low:43344kB high:52012kB reserved_highatomic:0KB active_anon:18364kB inactive_anon:0kB active_file:70468kB inactive_file:158232kB unevictable:1536kB writepending:648kB present:3129332kB managed:2589596kB mlocked:0kB bounce:0kB free_pcp:15088kB local_pcp:4624kB free_cma:0kB [ 362.334623][T11758] lowmem_reserve[]: 0 0 1 1 1 [ 362.340056][T11758] Node 0 Normal free:8kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1320kB unevictable:0kB writepending:0kB present:1048576kB managed:1384kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 362.374882][T11758] lowmem_reserve[]: 0 0 0 0 0 [ 362.380158][T11758] Node 1 Normal free:3900452kB boost:0kB min:55208kB low:69008kB high:82808kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:17760kB local_pcp:10016kB free_cma:0kB [ 362.411738][T11758] lowmem_reserve[]: 0 0 0 0 0 [ 362.417284][T11758] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 362.459149][T11758] Node 0 DMA32: 1464*4kB (UE) 1091*8kB (UME) 643*16kB (UME) 1004*32kB (UME) 419*64kB (UME) 139*128kB (UME) 40*256kB (UME) 31*512kB (UME) 7*1024kB (UME) 5*2048kB (UM) 326*4096kB (M) = 1480424kB [ 362.479914][T11758] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 362.515777][T11758] Node 1 Normal: 195*4kB (UME) 57*8kB (UME) 37*16kB (UME) 96*32kB (UME) 34*64kB (UE) 3*128kB (UME) 3*256kB (UE) 2*512kB (UM) 2*1024kB (UE) 1*2048kB (E) 949*4096kB (M) = 3900452kB [ 362.550393][T11758] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 362.560393][T11758] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 362.570574][T11758] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 362.625423][T11758] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 362.644759][T11758] 58932 total pagecache pages [ 362.649499][T11758] 0 pages in swap cache [ 362.653654][T11758] Free swap = 124996kB [ 362.664532][T11758] Total swap = 124996kB [ 362.668772][T11758] 2097051 pages RAM [ 362.672581][T11758] 0 pages HighMem/MovableOnly [ 362.683714][T11758] 416138 pages reserved [ 362.688210][T11758] 0 pages cma reserved [ 362.885549][T11773] veth0_vlan: left promiscuous mode [ 362.974498][T11773] veth0_vlan: entered promiscuous mode [ 363.206027][T11774] net veth1_virt_wifi »»»»»»: renamed from virt_wifi0 (while UP) [ 363.666398][T11786] netlink: 'syz.4.2089': attribute type 10 has an invalid length. [ 364.169298][T11799] netlink: 'syz.1.2092': attribute type 2 has an invalid length. [ 364.188289][T11799] netlink: 164 bytes leftover after parsing attributes in process `syz.1.2092'. [ 364.913241][T11815] sctp: [Deprecated]: syz.1.2096 (pid 11815) Use of int in max_burst socket option deprecated. [ 364.913241][T11815] Use struct sctp_assoc_value instead [ 365.358961][T11834] netlink: 'syz.4.2109': attribute type 10 has an invalid length. [ 365.372933][T11834] team_slave_0: left promiscuous mode [ 365.380434][T11834] team_slave_1: left promiscuous mode [ 365.465506][ T5791] Bluetooth: hci4: command 0x0406 tx timeout [ 365.633180][T11834] bond0: (slave team0): Releasing backup interface [ 365.652393][T11834] team0 (unregistering): Port device team_slave_0 removed [ 365.681142][T11834] team0 (unregistering): Port device team_slave_1 removed [ 365.890994][T11847] netlink: 'syz.4.2110': attribute type 2 has an invalid length. [ 365.908212][T11847] netlink: 164 bytes leftover after parsing attributes in process `syz.4.2110'. [ 366.261782][T11866] netlink: 'syz.0.2123': attribute type 10 has an invalid length. [ 366.264556][T11863] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.2118'. [ 366.475187][T11866] team0 (unregistering): Port device team_slave_0 removed [ 366.520952][T11866] team0 (unregistering): Port device team_slave_1 removed [ 366.542039][T11866] team0 (unregistering): Port device O3ãc¤± removed [ 366.566716][T11863] netlink: 'syz.4.2118': attribute type 16 has an invalid length. [ 366.575637][T11863] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2118'. [ 367.878640][T11901] netlink: 'syz.4.2130': attribute type 2 has an invalid length. [ 367.889640][T11901] netlink: 164 bytes leftover after parsing attributes in process `syz.4.2130'. [ 369.946141][T11946] wg2: entered promiscuous mode [ 369.951418][T11946] wg2: entered allmulticast mode [ 370.024994][T11950] syzkaller0: entered promiscuous mode [ 370.030508][T11950] syzkaller0: entered allmulticast mode [ 371.444107][T11955] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2151'. [ 372.069054][T11975] netlink: 'syz.0.2165': attribute type 10 has an invalid length. [ 372.211629][T11985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2159'. [ 372.234607][T11985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2159'. [ 372.260941][T11982] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2159'. [ 372.297061][T11985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2159'. [ 372.361971][T11987] syzkaller0: entered promiscuous mode [ 372.374520][T11987] syzkaller0: entered allmulticast mode [ 372.392011][T11991] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2163'. [ 374.073283][T12016] netlink: 'syz.1.2172': attribute type 10 has an invalid length. [ 374.520077][T12033] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2180'. [ 374.610814][T12033] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2180'. [ 374.637148][T12032] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2180'. [ 374.684733][T12037] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2180'. [ 376.211834][T12044] netlink: 'syz.3.2184': attribute type 10 has an invalid length. [ 376.386076][T12059] netlink: 'syz.1.2194': attribute type 10 has an invalid length. [ 377.093156][T12080] netlink: 'syz.4.2192': attribute type 10 has an invalid length. [ 377.183736][T12080] veth1_vlan: entered allmulticast mode [ 377.415717][T12092] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2198'. [ 377.445011][T12092] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2198'. [ 377.498017][T12091] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2198'. [ 377.554245][T12092] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2198'. [ 377.864826][T12100] netlink: 'syz.3.2200': attribute type 10 has an invalid length. [ 378.764492][ T1272] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.770830][ T1272] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.323653][T12141] netlink: 'syz.1.2212': attribute type 10 has an invalid length. [ 382.436357][T12167] syzkaller0: entered promiscuous mode [ 382.457338][T12167] syzkaller0: entered allmulticast mode [ 385.059190][T12200] netlink: 'syz.0.2233': attribute type 10 has an invalid length. [ 385.099520][T12200] veth1_vlan: entered allmulticast mode [ 387.180864][T12259] netlink: 'syz.4.2251': attribute type 10 has an invalid length. [ 387.235900][T12244] Ÿë: port 1(erspan0) entered blocking state [ 387.271398][T12244] Ÿë: port 1(erspan0) entered disabled state [ 387.302274][T12244] erspan0: entered allmulticast mode [ 387.331939][T12244] erspan0: entered promiscuous mode [ 387.372774][T12244] Ÿë: port 1(erspan0) entered blocking state [ 387.379039][T12244] Ÿë: port 1(erspan0) entered forwarding state [ 389.657644][T12286] netlink: 'syz.0.2260': attribute type 10 has an invalid length. [ 390.975558][T12326] netlink: 'syz.3.2271': attribute type 10 has an invalid length. [ 391.289350][T12328] [ 391.291718][T12328] ============================================ [ 391.297867][T12328] WARNING: possible recursive locking detected [ 391.304034][T12328] 6.6.102-syzkaller #0 Not tainted [ 391.309151][T12328] -------------------------------------------- [ 391.315301][T12328] syz.1.2273/12328 is trying to acquire lock: [ 391.321369][T12328] ffff88807efc0a38 (&trie->lock){..-.}-{2:2}, at: trie_delete_elem+0x96/0x6a0 [ 391.330297][T12328] [ 391.330297][T12328] but task is already holding lock: [ 391.333864][T12339] netlink: 'syz.0.2277': attribute type 10 has an invalid length. [ 391.337650][T12328] ffff888031dd9a38 (&trie->lock){..-.}-{2:2}, at: trie_update_elem+0xca/0xea0 [ 391.337704][T12328] [ 391.337704][T12328] other info that might help us debug this: [ 391.337709][T12328] Possible unsafe locking scenario: [ 391.337709][T12328] [ 391.369809][T12328] CPU0 [ 391.373085][T12328] ---- [ 391.376348][T12328] lock(&trie->lock); [ 391.380404][T12328] lock(&trie->lock); [ 391.384504][T12328] [ 391.384504][T12328] *** DEADLOCK *** [ 391.384504][T12328] [ 391.392635][T12328] May be due to missing lock nesting notation [ 391.392635][T12328] [ 391.401214][T12328] 3 locks held by syz.1.2273/12328: [ 391.406399][T12328] #0: ffffffff8cd2fbe0 (rcu_read_lock){....}-{1:2}, at: bpf_map_update_value+0x41d/0x720 [ 391.416323][T12328] #1: ffff888031dd9a38 (&trie->lock){..-.}-{2:2}, at: trie_update_elem+0xca/0xea0 [ 391.425624][T12328] #2: ffffffff8cd2fbe0 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0xfd/0x420 [ 391.434921][T12328] [ 391.434921][T12328] stack backtrace: [ 391.440793][T12328] CPU: 0 PID: 12328 Comm: syz.1.2273 Not tainted 6.6.102-syzkaller #0 [ 391.448926][T12328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 391.458970][T12328] Call Trace: [ 391.462238][T12328] [ 391.465157][T12328] dump_stack_lvl+0x16c/0x230 [ 391.469829][T12328] ? show_regs_print_info+0x20/0x20 [ 391.475035][T12328] ? print_deadlock_bug+0x435/0x5d0 [ 391.480222][T12328] __lock_acquire+0x5d40/0x7c80 [ 391.485067][T12328] ? mark_lock+0x94/0x320 [ 391.489382][T12328] ? verify_lock_unused+0x140/0x140 [ 391.494564][T12328] ? __lock_acquire+0x1260/0x7c80 [ 391.499579][T12328] lock_acquire+0x197/0x410 [ 391.504075][T12328] ? trie_delete_elem+0x96/0x6a0 [ 391.509008][T12328] ? verify_lock_unused+0x140/0x140 [ 391.514189][T12328] ? page_counter_try_charge+0x293/0x2c0 [ 391.519813][T12328] ? read_lock_is_recursive+0x20/0x20 [ 391.525193][T12328] ? try_charge_memcg+0x1342/0x1810 [ 391.530398][T12328] _raw_spin_lock_irqsave+0xa8/0xf0 [ 391.535602][T12328] ? trie_delete_elem+0x96/0x6a0 [ 391.540536][T12328] ? _raw_spin_lock+0x40/0x40 [ 391.545222][T12328] trie_delete_elem+0x96/0x6a0 [ 391.549984][T12328] ? __cant_sleep+0x210/0x210 [ 391.554657][T12328] bpf_prog_8c8ab8634bca3061+0x42/0x4c [ 391.560115][T12328] bpf_trace_run4+0x1f9/0x420 [ 391.564785][T12328] ? bpf_trace_run4+0xfd/0x420 [ 391.569561][T12328] ? bpf_trace_run3+0x400/0x400 [ 391.574411][T12328] ? percpu_ref_put+0xef/0x180 [ 391.579174][T12328] ? __memcg_kmem_charge_page+0x264/0x380 [ 391.584887][T12328] __alloc_pages+0x429/0x460 [ 391.589473][T12328] ? zone_statistics+0x170/0x170 [ 391.594400][T12328] ? bpf_map_get_memcg+0x4e/0x4e0 [ 391.599420][T12328] ? __lock_acquire+0x7c80/0x7c80 [ 391.604435][T12328] __kmalloc_large_node+0x8c/0x1e0 [ 391.609539][T12328] ? bpf_map_kmalloc_node+0xbc/0x1b0 [ 391.614815][T12328] __kmalloc_node+0x10f/0x230 [ 391.619482][T12328] bpf_map_kmalloc_node+0xbc/0x1b0 [ 391.624584][T12328] trie_update_elem+0x166/0xea0 [ 391.629424][T12328] ? read_lock_is_recursive+0x20/0x20 [ 391.634784][T12328] ? lockdep_hardirqs_on+0x98/0x150 [ 391.639975][T12328] bpf_map_update_value+0x660/0x720 [ 391.645162][T12328] generic_map_update_batch+0x5e0/0x810 [ 391.650702][T12328] ? rcu_read_unlock+0xa0/0xa0 [ 391.655472][T12328] ? rcu_read_unlock+0xa0/0xa0 [ 391.660244][T12328] bpf_map_do_batch+0x3d7/0x610 [ 391.665098][T12328] __sys_bpf+0x31b/0x800 [ 391.669343][T12328] ? bpf_link_show_fdinfo+0x350/0x350 [ 391.674707][T12328] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 391.680854][T12328] __x64_sys_bpf+0x7c/0x90 [ 391.685257][T12328] do_syscall_64+0x55/0xb0 [ 391.689659][T12328] ? clear_bhb_loop+0x40/0x90 [ 391.694317][T12328] ? clear_bhb_loop+0x40/0x90 [ 391.698975][T12328] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 391.704858][T12328] RIP: 0033:0x7fb70b58ebe9 [ 391.709263][T12328] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 391.728857][T12328] RSP: 002b:00007fb70c489038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 391.737257][T12328] RAX: ffffffffffffffda RBX: 00007fb70b7b5fa0 RCX: 00007fb70b58ebe9 [ 391.745214][T12328] RDX: 0000000000000038 RSI: 0000200000000300 RDI: 000000000000001a [ 391.753169][T12328] RBP: 00007fb70b611e19 R08: 0000000000000000 R09: 0000000000000000 [ 391.761123][T12328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 391.769080][T12328] R13: 00007fb70b7b6038 R14: 00007fb70b7b5fa0 R15: 00007fffdcff85d8 [ 391.777042][T12328] [ 393.465029][ T11] O3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)