last executing test programs: 4.250525419s ago: executing program 1 (id=2167): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x23, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000000c0)=r3, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000940)={r3, r3}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000040)="6700000011008188040f56ecdb4cb9cca7480ef435000000e3bd6efb440009000e202e0010000000ba80013ffa85f59a0000005a8c3774fa0af3dc59a933c1e6a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f", 0x67}], 0x1}, 0x4000094) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x4060, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r6 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) recvmsg$unix(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r9, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="10020000000000000000dfffffff", 0x0, 0x1ff, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) setsockopt$sock_attach_bpf(r6, 0x107, 0x12, &(0x7f00000008c0), 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_tracing={0x1a, 0x10, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000c8000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70200001c000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000002d54c0fff0ffffffbf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000219b2636a0b65a5d40cb71a2f9fb91155980032581b6c40380dd1d988d7894a3af"], &(0x7f0000000700)='syzkaller\x00', 0xe1, 0xda, &(0x7f0000000740)=""/218, 0x41000, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000840)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000880)={0x5, 0xd, 0x6, 0x9}, 0x10, 0x1eb61, r4, 0x0, 0x0, 0x0, 0x10, 0x81}, 0x94) 3.920306714s ago: executing program 3 (id=2171): socket$kcm(0xa, 0x3, 0x73) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, 0x0}, 0x240448c4) write$cgroup_devices(r0, &(0x7f0000000080)=ANY=[], 0xfefb) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xf, 0x11, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x2, 0x54, &(0x7f00000001c0)=""/84, 0x41000, 0x4, '\x00', 0x0, @cgroup_device, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x9a}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400020}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x1000}, 0x8) socket$kcm(0x21, 0x2, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000480)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000700)=ANY=[@ANYBLOB="62202a3a2a200f"], 0xa) r5 = perf_event_open(&(0x7f0000000800)={0x2, 0x80, 0xc4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x4100}, 0x0, 0x7, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000400)={0x7, 0x80, 0x8, 0x1, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x42028, 0x5, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x5, 0x2, @perf_bp={&(0x7f00000001c0), 0x6}, 0x4081, 0x0, 0x30000, 0x0, 0x82da, 0x401, 0x3, 0x0, 0x6, 0x0, 0x1000}, 0xffffffffffffffff, 0x1, r5, 0xe) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x40082406, &(0x7f0000001000)='cpu&00\t&&') perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0xfe, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={&(0x7f00000003c0), 0x2}, 0x8000, 0x100000000cdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0xad, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000002380)={0x1f, 0xe, &(0x7f00000006c0)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB], 0x0, 0x4, 0x0, 0x0, 0x0, 0x39, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10d, 0x2, 0x0, 0x0) socket$kcm(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'team0\x00', @random="2b0100004ec6"}) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x9, 0x20004, 0x3}, 0x50) 3.848205128s ago: executing program 2 (id=2172): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000016c0)=""/257, 0x101}, {0x0}, {&(0x7f0000000380)=""/156, 0x9c}, {&(0x7f00000047c0)=""/4042, 0xfca}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000000640)=""/149, 0x95}, {&(0x7f0000000b00)=""/185, 0xb9}, {&(0x7f0000001800)=""/224, 0xe0}, {&(0x7f0000001900)=""/166, 0xa6}, {&(0x7f0000000580)=""/97, 0x61}, {&(0x7f00000002c0)=""/110, 0x6e}, {&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000000040)=""/100, 0x64}], 0xd}, 0x2000) recvmsg$kcm(r0, &(0x7f0000000700)={0x0, 0xa00, 0x0}, 0x0) sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0a8187bae53dca2b007ea23e163ec40028e82fccdc09da15fef6a608649e7531765f0ef82e3c0076a705259a3651f60a84c9f4d4938037e70e4509c5bb0c9246444351db86078475483687054c", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000000) 3.79936704s ago: executing program 1 (id=2173): r0 = socket$kcm(0xa, 0x2, 0x0) openat$cgroup(0xffffffffffffffff, &(0x7f0000000800)='syz1\x00', 0x200002, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_bp={&(0x7f0000000640), 0x4}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone(0x40300000, &(0x7f0000000900)="633c2b838af4a7e4a9f56007a24f05ca5a25b28afaaeffa8f176072e6a366ed2681013fd81fb7da75dc29557762ee7183cd239652afccb0ae681a4204a0bdc61b925a8eaf5a1c2db8513e0a6528312f7752cccd6adfba597eca83c70fc8060d16688589db79b0d3fbf824e338586", 0x6e, &(0x7f0000000980), &(0x7f00000009c0), &(0x7f0000000c00)="227bce8f1d208c1f0228bf9f72ba7a9ab5f5901a227ca63b824a1d00") ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x2, 0x0, 0x15b, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext={0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r3, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair(0x22, 0x80000, 0xfffffffe, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000100)={r5, r4}) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x1f, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x4000}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000080)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000007c0)={0xffffffffffffffff, 0x58, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x17, 0x20, &(0x7f0000000ac0)=ANY=[@ANYBLOB="8759b634000000", @ANYRES32, @ANYBLOB="0000000000000000b70800008f0500007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100000085000000820000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000000850000000600000095000000000000001833000001000000000000000000000085100000fdffffff950000000000000018170000", @ANYRES32=r6, @ANYBLOB="000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000270500008500000006000000"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x97, &(0x7f0000000680)=""/151, 0x41000, 0x48, '\x00', r9, @cgroup_sysctl=0x12, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000840)={0x4, 0x6, 0x3, 0x6}, 0x10, 0x0, r4, 0x8, 0x0, &(0x7f0000000880)=[{0x0, 0x5, 0x6, 0x7}, {0x1, 0x5, 0x1, 0x1}, {0x2, 0x3, 0x5, 0x4}, {0x4, 0x3, 0xb}, {0x1, 0x2, 0xd, 0x9}, {0x1, 0x2, 0x3, 0xa}, {0x2, 0x4, 0x8, 0x1}, {0x1, 0x3, 0xc, 0x5}], 0x10, 0x7fff}, 0x94) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000280)={'wlan0\x00', @multicast}) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="180effb010b56fb104009ac6f09f010008080000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32], 0x48) r10 = socket$kcm(0x2, 0x1, 0x84) recvmsg$unix(r8, &(0x7f0000000600)={&(0x7f0000000200)=@abs, 0x6e, &(0x7f0000000440)=[{&(0x7f00000002c0)=""/176, 0xb0}, {&(0x7f0000000400)=""/48, 0x30}], 0x2, &(0x7f0000000580)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x78}, 0x40000000) setsockopt$sock_attach_bpf(r10, 0x84, 0x71, &(0x7f0000000000), 0x8) sendmsg$inet(r10, &(0x7f0000000380)={&(0x7f0000000100)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000140)=[{&(0x7f00000001c0)="01", 0x1}, {&(0x7f0000000040)="aa871778d156fdf00db8dd0d17795e449eec45131f94fbec1661b2034732b277cb5cf2c1bac90371659ae723152f42ccd1411e4cfc699f21325900d523b0c5fa7dc56227d93a3c3c2404f9676d126fd55cd438a0b95a90b8d9ae8515ef9f36f8aca54996f85f4599fe4ee9f51c8e2c3d92c16607c36f4a4e6575778e9cfe0e73ca9f97198a7597360fe8d2b26a3d6268c7ba13cf4f81d8bc024bb8a515a0f1", 0x9f}], 0x2}, 0x4040) 3.750530562s ago: executing program 0 (id=2174): perf_event_open(&(0x7f0000000a00)={0x1, 0x80, 0x2, 0x0, 0xf, 0x0, 0x0, 0x400, 0x1e37cf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x401, 0x200, 0x0, 0x7, 0x0, 0x100}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8919, &(0x7f0000000040)={'ip6_vti0\x00', @random="02000400"}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000005000000018010000776c6c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)="d80000001000810468f70082db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006000d00036010fab94dcf5c0461c1d67f6f94000534cf6ee08000a0e408e8dd095618e1f4dff3a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x20000004) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r5 = socket$kcm(0x2, 0x2, 0x73) sendmsg$inet(r5, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @empty}, 0x10, &(0x7f0000000400)}, 0x900000000000000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000140)={'nr0\x00', 0x6132}) write$cgroup_subtree(r6, &(0x7f0000000000), 0xfe3a) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'pimreg\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@timestamping={{0x14, 0x1, 0x25, 0xfffffffd}}], 0x18}, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) 3.629206028s ago: executing program 3 (id=2175): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000016c0)=""/257, 0x101}, {&(0x7f00000008c0)=""/161, 0xa1}, {&(0x7f0000000380)=""/156, 0x9c}, {&(0x7f00000047c0)=""/4042, 0xfca}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000000640)=""/149, 0x95}, {0x0}, {&(0x7f0000001800)=""/224, 0xe0}, {&(0x7f0000001900)=""/166, 0xa6}, {&(0x7f00000002c0)=""/110, 0x6e}, {&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000000040)=""/100, 0x64}], 0xc}, 0x2000) recvmsg$kcm(r0, &(0x7f0000000700)={0x0, 0xa00, 0x0}, 0x0) sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0a8187bae53dca2b007ea23e163ec40028e82fccdc09da15fef6a608649e7531765f0ef82e3c0076a705259a3651f60a84c9f4d4938037e70e4509c5bb0c9246444351db86078475483687054c", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000000) 3.561692671s ago: executing program 2 (id=2176): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10a900, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, @perf_bp={&(0x7f0000000640), 0x8}, 0x0, 0x32, 0x7, 0x7, 0x9, 0x6, 0x2, 0x0, 0xbde, 0x0, 0x2009}, 0x0, 0x7, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x10, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000280)="d8000000140081044e81f782db44b9040a1d080201000000040000a118000200ff030000000000000000000000000001a80016ea1f000840032e5f54c92011148ed08734843cb12b00000803600cfab94dcf5c0461c1d67f722f054f55153c6f94007134cf6ee08000a09108e8d8ef075c0100000000000000cb090000001fb791643a5e835913b06218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f52eb4edbb57a5025ccca9e00360d8bcc00400040fad95667e0060000000000000580bb9ad809d5e1cace81b341139fe3cd4032e8edb12d", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x4040c04) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8003}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x8, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb01001800000000000000240200002400000007000000030000000200009301000000010000000300020001000000040000007800000001000000002e61615f6100"], 0x0, 0x43, 0x0, 0x1}, 0x28) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x5, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, 0x0, 0x0, 0x4}, 0x94) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x0, 0x0, 0x0, 0x2006, 0x24023, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2, @perf_config_ext={0xcf82, 0x4}, 0x100, 0x0, 0xa482, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, 0x0, 0x0) write$cgroup_pid(r5, &(0x7f0000000100), 0x12) r6 = openat$cgroup_int(r4, &(0x7f0000000080)='cpuset.memory_spread_page\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f00000000c0)=0xd, 0x12) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vcan0\x00', 0x2}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0x8, &(0x7f0000001f80)=ANY=[@ANYBLOB="7a0af8ff7525732cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000f700000000b2595285fa97ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5956fc4a33ca263e2b5d47b2b00000000b1a297cfddd73f30f2382f6c2d3ffdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000010000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e3841bef895c5a637b0bf2eac3cb07b74a72291a1a2b523dd81b6651b1ee29e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c92cdfbea882b0b18914781ceb10814cf4ee23ddb79fff5eb156e0a000000000000f2bd164a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8fdf3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c66200349e62d4d0ab1a1dc51907c980000cfb215af2c1a3c22243cce23b00000a857d61b0d66c3f6da8aed31027c33204ea0fa0620111920d3f24980e9995a510bd87b06440a0a26130098b901c53a02cfbfd8bcbdec9f34542c3c9652adefde555ecd28ebc88082bab431ee3e1adb5b0ad14c79dd4411ecc96c512f3b72a9b3a0c3e07ec6b427bdc0bf3963e9f802a5feab82a989db62d8d1339f842b3f593d6c24fe015ec63c658ba7c4fae17514f802709ab4fa5caa932d4b65a5ecfc422899513ddde6ec04974f9981a8c155c26e0da70e524832ab04dec9ce66a62ceffbb15b1857c93666fe043a266a451f9a1e1f054211b9ae566b58f4f356c7a4054ce13f6fcc58912a175bd9cc3c494894ad39b36e34e608f4ac00cf22c27bb8c12bcf4beeb579fc9fa1c9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0xd}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x500, 0x4000000}, 0x28) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000380)='./file0\x00', 0x0, 0x10}, 0x18) 3.37698678s ago: executing program 3 (id=2177): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700"], 0x0, 0x80, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r4}, &(0x7f0000000280), &(0x7f0000000240)=r1}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="18080000000000000000000000000000181200", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 3.263256355s ago: executing program 3 (id=2178): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000080)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], 0x0}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f0000000300)=r5) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 3.192961178s ago: executing program 0 (id=2179): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x6, 0xf, 0x8, 0x41}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f0000000000), 0xce, r0}, 0x38) 3.041234765s ago: executing program 0 (id=2180): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x2}, 0x1090da, 0x0, 0x1, 0x0, 0x0, 0x4, 0x749}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'wlan1\x00', @local}) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x2, 0x640a9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_type(r4, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r5, 0x0, 0x0) r6 = openat$cgroup_procs(r4, 0x0, 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000100)=r3, 0x4) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00', 0xdebd12157dab626f}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r3, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x9, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x22, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f00000006c0), &(0x7f0000000300), 0x8, 0xbd, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00"/12], 0x50) 2.909000552s ago: executing program 0 (id=2181): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x23, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000000c0)=r3, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000940)={r3, r3}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000040)="6700000011008188040f56ecdb4cb9cca7480ef435000000e3bd6efb440009000e202e0010000000ba80013ffa85f59a0000005a8c3774fa0af3dc59a933c1e6a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f", 0x67}], 0x1}, 0x4000094) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x4060, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r6 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) recvmsg$unix(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r9, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="10020000000000000000dfffffff", 0x0, 0x1ff, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) setsockopt$sock_attach_bpf(r6, 0x107, 0x12, &(0x7f00000008c0), 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_tracing={0x1a, 0x10, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000c8000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70200001c000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000002d54c0fff0ffffffbf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000219b2636a0b65a5d40cb71a2f9fb91155980032581b6c40380dd1d988d7894a3af"], &(0x7f0000000700)='syzkaller\x00', 0xe1, 0xda, &(0x7f0000000740)=""/218, 0x41000, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000840)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000880)={0x5, 0xd, 0x6, 0x9}, 0x10, 0x1eb61, r4, 0x0, 0x0, 0x0, 0x10, 0x81}, 0x94) 2.903349902s ago: executing program 2 (id=2182): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="160000000000000004"], 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xe, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="180000007f000000000000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000001008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020002010000008500000084000000b7000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000400)={r1, 0x0, 0x0}, 0x10) socketpair(0x1, 0x2, 0x0, &(0x7f00000002c0)) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10, 0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x30}, 0x890) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0600000004000000040000000c00000000000000", @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000d5c500"/28], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0xa, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42082, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xffffffffffffffc1, 0xa5}, 0x0, 0x10, 0x4, 0x8, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000780)={0x5, 0x80, 0x6, 0xf5, 0x5, 0x9, 0x0, 0xd37, 0x2, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0x8}, 0x1197b, 0x8, 0xa, 0x4, 0x318, 0x8ebc, 0x9, 0x0, 0x93b1, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x89a0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89a2, &(0x7f0000000080)) 2.7244635s ago: executing program 1 (id=2183): socket$kcm(0xa, 0x3, 0x73) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, 0x0}, 0x240448c4) write$cgroup_devices(r0, &(0x7f0000000080)=ANY=[], 0xfefb) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xf, 0x11, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x2, 0x54, &(0x7f00000001c0)=""/84, 0x41000, 0x4, '\x00', 0x0, @cgroup_device, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x9a}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400020}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x1000}, 0x8) socket$kcm(0x21, 0x2, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000480)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000700)=ANY=[@ANYBLOB="62202a3a2a200f"], 0xa) r5 = perf_event_open(&(0x7f0000000800)={0x2, 0x80, 0xc4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x4100}, 0x0, 0x7, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000400)={0x7, 0x80, 0x8, 0x1, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x42028, 0x5, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x5, 0x2, @perf_bp={&(0x7f00000001c0), 0x6}, 0x4081, 0x0, 0x30000, 0x0, 0x82da, 0x401, 0x3, 0x0, 0x6, 0x0, 0x1000}, 0xffffffffffffffff, 0x1, r5, 0xe) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x40082406, &(0x7f0000001000)='cpu&00\t&&') perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0xfe, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={&(0x7f00000003c0), 0x2}, 0x8000, 0x100000000cdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0xad, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000002380)={0x1f, 0xe, &(0x7f00000006c0)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB], 0x0, 0x4, 0x0, 0x0, 0x0, 0x39, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10d, 0x2, 0x0, 0x0) socket$kcm(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'team0\x00', @random="2b0100004ec6"}) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x9, 0x20004, 0x3}, 0x50) 1.063832959s ago: executing program 0 (id=2184): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000008c0)=""/161, 0xa1}, {&(0x7f0000000380)=""/156, 0x9c}, {&(0x7f00000047c0)=""/4042, 0xfca}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000000640)=""/149, 0x95}, {&(0x7f0000000b00)=""/185, 0xb9}, {&(0x7f0000001800)=""/224, 0xe0}, {&(0x7f0000001900)=""/166, 0xa6}, {&(0x7f0000000580)=""/97, 0x61}, {&(0x7f00000002c0)=""/110, 0x6e}, {&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000000040)=""/100, 0x64}], 0xc}, 0x2000) recvmsg$kcm(r0, &(0x7f0000000700)={0x0, 0xa00, 0x0}, 0x0) sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0a8187bae53dca2b007ea23e163ec40028e82fccdc09da15fef6a608649e7531765f0ef82e3c0076a705259a3651f60a84c9f4d4938037e70e4509c5bb0c9246444351db86078475483687054c", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000000) 1.04492412s ago: executing program 1 (id=2185): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000016c0)=""/257, 0x101}, {&(0x7f00000008c0)=""/161, 0xa1}, {&(0x7f0000000380)=""/156, 0x9c}, {&(0x7f00000047c0)=""/4042, 0xfca}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000000640)=""/149, 0x95}, {0x0}, {&(0x7f0000001800)=""/224, 0xe0}, {&(0x7f0000001900)=""/166, 0xa6}, {&(0x7f00000002c0)=""/110, 0x6e}, {&(0x7f0000000000)=""/46, 0x2e}, {&(0x7f0000000040)=""/100, 0x64}], 0xc}, 0x2000) recvmsg$kcm(r0, &(0x7f0000000700)={0x0, 0xa00, 0x0}, 0x0) sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0a8187bae53dca2b007ea23e163ec40028e82fccdc09da15fef6a608649e7531765f0ef82e3c0076a705259a3651f60a84c9f4d4938037e70e4509c5bb0c9246444351db86078475483687054c", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000000) 1.005476122s ago: executing program 2 (id=2186): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700"], 0x0, 0x80, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r4}, &(0x7f0000000280), &(0x7f0000000240)=r1}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="18080000000000000000000000000000181200", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 972.360094ms ago: executing program 3 (id=2187): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x5, '\x00', r3, r0, 0x1, 0x3}, 0x50) (fail_nth: 3) 924.922666ms ago: executing program 2 (id=2188): perf_event_open(&(0x7f0000000a00)={0x1, 0x80, 0x2, 0x0, 0xf, 0x0, 0x0, 0x400, 0x1e37cf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x401, 0x200, 0x0, 0x7, 0x0, 0x100}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8919, &(0x7f0000000040)={'ip6_vti0\x00', @random="02000400"}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000005000000018010000776c6c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)="d80000001000810468f70082db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006000d00036010fab94dcf5c0461c1d67f6f94000534cf6ee08000a0e408e8dd095618e1f4dff3a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x20000004) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r5 = socket$kcm(0x2, 0x2, 0x73) sendmsg$inet(r5, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @empty}, 0x10, &(0x7f0000000400)}, 0x900000000000000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000140)={'nr0\x00', 0x6132}) write$cgroup_subtree(r6, &(0x7f0000000000), 0xfe3a) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'pimreg\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@timestamping={{0x14, 0x1, 0x25, 0xfffffffd}}], 0x18}, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) 645.311479ms ago: executing program 1 (id=2189): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x2}, 0x1090da, 0x0, 0x1, 0x0, 0x0, 0x4, 0x749}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'wlan1\x00', @local}) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x2, 0x640a9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_type(r4, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r5, 0x0, 0x0) r6 = openat$cgroup_procs(r4, 0x0, 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000100)=r3, 0x4) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00', 0xdebd12157dab626f}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r3, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x9, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x22, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f00000006c0), &(0x7f0000000300), 0x8, 0xbd, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00"/12], 0x50) 539.876624ms ago: executing program 3 (id=2190): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x10a900, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, @perf_bp={&(0x7f0000000640), 0x8}, 0x0, 0x32, 0x7, 0x7, 0x9, 0x6, 0x2, 0x0, 0xbde, 0x0, 0x2009}, 0x0, 0x7, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x10, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000280)="d8000000140081044e81f782db44b9040a1d080201000000040000a118000200ff030000000000000000000000000001a80016ea1f000840032e5f54c92011148ed08734843cb12b00000803600cfab94dcf5c0461c1d67f722f054f55153c6f94007134cf6ee08000a09108e8d8ef075c0100000000000000cb090000001fb791643a5e835913b06218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f52eb4edbb57a5025ccca9e00360d8bcc00400040fad95667e0060000000000000580bb9ad809d5e1cace81b341139fe3cd4032e8edb12d", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x4040c04) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8003}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x8, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb01001800000000000000240200002400000007000000030000000200009301000000010000000300020001000000040000007800000001000000002e61615f6100"], &(0x7f00000006c0)=""/237, 0x43, 0xed, 0x1}, 0x28) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, 0x0, 0x0, 0x4}, 0x94) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x0, 0x0, 0x0, 0x2006, 0x24023, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2, @perf_config_ext={0xcf82, 0x4}, 0x100, 0x0, 0xa482, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, 0x0, 0x0) write$cgroup_pid(r5, &(0x7f0000000100), 0x12) r6 = openat$cgroup_int(r4, &(0x7f0000000080)='cpuset.memory_spread_page\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f00000000c0)=0xd, 0x12) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vcan0\x00', 0x2}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0x8, &(0x7f0000001f80)=ANY=[@ANYBLOB="7a0af8ff7525732cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000f700000000b2595285fa97ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5956fc4a33ca263e2b5d47b2b00000000b1a297cfddd73f30f2382f6c2d3ffdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000010000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e3841bef895c5a637b0bf2eac3cb07b74a72291a1a2b523dd81b6651b1ee29e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c92cdfbea882b0b18914781ceb10814cf4ee23ddb79fff5eb156e0a000000000000f2bd164a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8fdf3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c66200349e62d4d0ab1a1dc51907c980000cfb215af2c1a3c22243cce23b00000a857d61b0d66c3f6da8aed31027c33204ea0fa0620111920d3f24980e9995a510bd87b06440a0a26130098b901c53a02cfbfd8bcbdec9f34542c3c9652adefde555ecd28ebc88082bab431ee3e1adb5b0ad14c79dd4411ecc96c512f3b72a9b3a0c3e07ec6b427bdc0bf3963e9f802a5feab82a989db62d8d1339f842b3f593d6c24fe015ec63c658ba7c4fae17514f802709ab4fa5caa932d4b65a5ecfc422899513ddde6ec04974f9981a8c155c26e0da70e524832ab04dec9ce66a62ceffbb15b1857c93666fe043a266a451f9a1e1f054211b9ae566b58f4f356c7a4054ce13f6fcc58912a175bd9cc3c494894ad39b36e34e608f4ac00cf22c27bb8c12bcf4beeb579fc9fa1c9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0xd}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x500, 0x4000000}, 0x28) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000380)='./file0\x00', 0x0, 0x10}, 0x18) 505.005016ms ago: executing program 1 (id=2191): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x9, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x44c}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) (async) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b02d25a806f8c6394f91424fc60040f030047000000053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r3, &(0x7f0000000dc0), &(0x7f0000001dc0)=""/4096}, 0x20) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r0}, 0x8) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x5, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000007d00000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x0, 0x0, 0xc}, {0x10000002}]}, 0x94) (async) r5 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) close(r7) (async) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) (async) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r5, 0x84, 0x76, &(0x7f0000000000)=r8, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r9 = socket$kcm(0x10, 0x2, 0x0) r10 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r11, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r13, 0x89a0, &(0x7f0000000080)) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r14, 0x89a1, &(0x7f0000000080)) (async) setsockopt$sock_attach_bpf(r10, 0x84, 0x64, &(0x7f0000000000)=r12, 0x10) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)="2e00000011008188040f80ec59acbca313a181002c000000000400000010001f0e0027000f00000000800200121f", 0x2e}, {&(0x7f0000000040)="888ec9062da020bd97b3c5d8d668e070d974163146ccef928886e7012a3ed5c88c7b4990ed9f177fc4486b6da62743a593dcf39546de475413929b6b1904cdb9ebc19190102451ae946ac808db3aa8232f3606c862bafe16d18454b1a5d0b4996895c17a70264bbeab2fb3e2267fcba1d713d6725ea58d5effff362be77b7dd976460300c947cc1e14d3500a73", 0x8d}, {0x0}, {&(0x7f0000000340)="3158c3a4d053dec7bf50de3a15a13b17f772692272ce9afac4e8ba6c53cefaf84966fc1f9942bdc0188d9985f20fba9597728d881150167e9733f6657b089268473eed89e59bc24fb5faf6b96f027146dea90dd042fcc7", 0x57}, {0x0}], 0x5}, 0x0) 272.798216ms ago: executing program 0 (id=2192): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x7, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000002000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x100, 0x3, 0x28}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x7, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0x66137, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) (async) r3 = socket$kcm(0x2, 0x5, 0x84) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x10001, 0x0, 0xfffffffc, 0x2}, {0x2}]}, 0x94) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) (async) recvmsg$unix(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="d8000000210081044e81f782db44b90402", 0x11}], 0x1}, 0x0) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x4, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="180000000000000000000000ba05000018150000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000800807b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000015000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ffffff7f850000000600000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) setsockopt$sock_attach_bpf(r3, 0x84, 0x6e, &(0x7f0000000000)=r6, 0x12) (async) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) (async) r9 = socket$kcm(0x10, 0x2, 0x0) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r0, 0x58, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x9, '\x00', r11, r6, 0x1, 0x0, 0x4}, 0x50) (async) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) (async) ioctl$TUNATTACHFILTER(r10, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f00000001c0)=[{0x30, 0x8, 0x3f, 0xfffff004}, {0x16, 0x4, 0xff, 0xfffffffe}]}) (async) ioctl$TUNGETVNETLE(r10, 0x800454dd, &(0x7f0000000000)) (async) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[], 0x33fe0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000a40000006311770000000000070000000000000095000000000000007a4f59fc1e64cc9c718b1f618b12be81248ddd4fd95335dd8f7e942562f2e07ff439b8ebd5bf1b87624caf3c00d319595dd5bfad052f1b30283efb37457decd07d2d20a59a51c4a7a8edc4b83c47cf32281d4d6bfbcb8405ecded3e7c9fe2a85178e499cf5c1ed61b87fd0eecba4d4a2663bfd7a020593131c946bdbfaa22470da5ea8793e4e4021aac0c7e35d969e032bab41071b055868de1a52b91384cb1da034552a887fe6e12e080a95550d9ca32afe7aabb61a"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xb579, &(0x7f000000cf3d)=""/195}, 0x23) 0s ago: executing program 2 (id=2193): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x23, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000000c0)=r3, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000940)={r3, r3}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000040)="6700000011008188040f56ecdb4cb9cca7480ef435000000e3bd6efb440009000e202e0010000000ba80013ffa85f59a0000005a8c3774fa0af3dc59a933c1e6a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f", 0x67}], 0x1}, 0x4000094) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x4060, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r6 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) recvmsg$unix(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r9, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="10020000000000000000dfffffff", 0x0, 0x1ff, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) setsockopt$sock_attach_bpf(r6, 0x107, 0x12, &(0x7f00000008c0), 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_tracing={0x1a, 0x10, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000c8000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70200001c000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000002d54c0fff0ffffffbf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000219b2636a0b65a5d40cb71a2f9fb91155980032581b6c40380dd1d988d7894a3af"], &(0x7f0000000700)='syzkaller\x00', 0xe1, 0xda, &(0x7f0000000740)=""/218, 0x41000, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000840)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000880)={0x5, 0xd, 0x6, 0x9}, 0x10, 0x1eb61, r4, 0x0, 0x0, 0x0, 0x10, 0x81}, 0x94) kernel console output (not intermixed with test programs): f7 d8 64 89 01 48 [ 263.999913][ T8485] RSP: 002b:00007f8595212028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 264.008341][ T8485] RAX: ffffffffffffffda RBX: 00007f8594625fa0 RCX: 00007f859439e159 [ 264.016332][ T8485] RDX: 000000000000004e RSI: 0000000000000029 RDI: 0000000000000005 [ 264.024318][ T8485] RBP: 00007f8595212090 R08: 0000000000004000 R09: 0000000000000000 [ 264.032307][ T8485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 264.040287][ T8485] R13: 00007f8594626038 R14: 00007f8594625fa0 R15: 00007ffdbd091478 [ 264.048294][ T8485] [ 267.955773][ T8497] netlink: 'syz.0.837': attribute type 21 has an invalid length. [ 267.963796][ T8497] __nla_validate_parse: 7 callbacks suppressed [ 267.963809][ T8497] netlink: 128 bytes leftover after parsing attributes in process `syz.0.837'. [ 267.980535][ T8497] netlink: 3 bytes leftover after parsing attributes in process `syz.0.837'. [ 268.100853][ T8500] netlink: 'syz.2.838': attribute type 10 has an invalid length. [ 268.599367][ T8513] netlink: 71 bytes leftover after parsing attributes in process `syz.0.844'. [ 268.859872][ T8510] netlink: 188 bytes leftover after parsing attributes in process `syz.2.843'. [ 269.107534][ T8529] netlink: 132 bytes leftover after parsing attributes in process `syz.1.846'. [ 269.258516][ T8532] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 269.472446][ T8537] netlink: 'syz.3.851': attribute type 10 has an invalid length. [ 269.852501][ T8549] netlink: 71 bytes leftover after parsing attributes in process `syz.3.857'. [ 270.730302][ T8564] netlink: 132 bytes leftover after parsing attributes in process `syz.3.860'. [ 270.869520][ T8571] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 270.940262][ T8574] netlink: 'syz.0.865': attribute type 10 has an invalid length. [ 271.944867][ T8601] FAULT_INJECTION: forcing a failure. [ 271.944867][ T8601] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 271.982976][ T8600] netlink: 'syz.3.877': attribute type 10 has an invalid length. [ 272.004951][ T8601] CPU: 0 PID: 8601 Comm: syz.2.875 Not tainted syzkaller #0 [ 272.012326][ T8601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 272.022430][ T8601] Call Trace: [ 272.025760][ T8601] [ 272.028753][ T8601] dump_stack_lvl+0x18c/0x250 [ 272.033764][ T8601] ? show_regs_print_info+0x20/0x20 [ 272.039018][ T8601] ? load_image+0x420/0x420 [ 272.043595][ T8601] ? __might_fault+0xaa/0x120 [ 272.048337][ T8601] ? __lock_acquire+0x7d80/0x7d80 [ 272.053409][ T8601] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 272.059113][ T8601] should_fail_ex+0x394/0x4c0 [ 272.063865][ T8601] _copy_from_user+0x2f/0xe0 [ 272.068514][ T8601] wext_handle_ioctl+0xc8/0x1e0 [ 272.073435][ T8601] ? call_commit_handler+0xf0/0xf0 [ 272.078655][ T8601] sock_ioctl+0x15d/0x7e0 [ 272.083046][ T8601] ? sock_poll+0x3e0/0x3e0 [ 272.087548][ T8601] ? bpf_lsm_file_ioctl+0x9/0x10 [ 272.092531][ T8601] ? security_file_ioctl+0x80/0xa0 [ 272.097694][ T8601] ? sock_poll+0x3e0/0x3e0 [ 272.102157][ T8601] __se_sys_ioctl+0xfd/0x170 [ 272.106805][ T8601] do_syscall_64+0x55/0xb0 [ 272.111304][ T8601] ? clear_bhb_loop+0x40/0x90 [ 272.116022][ T8601] ? clear_bhb_loop+0x40/0x90 [ 272.120746][ T8601] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 272.126683][ T8601] RIP: 0033:0x7fc3e079e159 [ 272.131315][ T8601] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 272.150967][ T8601] RSP: 002b:00007fc3e1638028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 272.159441][ T8601] RAX: ffffffffffffffda RBX: 00007fc3e0a25fa0 RCX: 00007fc3e079e159 [ 272.167446][ T8601] RDX: 0000200000000000 RSI: 0000000000008b19 RDI: 0000000000000003 [ 272.175456][ T8601] RBP: 00007fc3e1638090 R08: 0000000000000000 R09: 0000000000000000 [ 272.183560][ T8601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 272.191574][ T8601] R13: 00007fc3e0a26038 R14: 00007fc3e0a25fa0 R15: 00007ffc81d2b5e8 [ 272.199630][ T8601] [ 272.362318][ T8606] netlink: 132 bytes leftover after parsing attributes in process `syz.0.876'. [ 273.263245][ T8626] netlink: 'syz.3.887': attribute type 21 has an invalid length. [ 273.271259][ T8626] netlink: 128 bytes leftover after parsing attributes in process `syz.3.887'. [ 273.280344][ T8626] netlink: 3 bytes leftover after parsing attributes in process `syz.3.887'. [ 273.672004][ T8643] netlink: 44 bytes leftover after parsing attributes in process `syz.3.891'. [ 273.683739][ T8644] netlink: 60 bytes leftover after parsing attributes in process `syz.1.892'. [ 273.714104][ T8644] netlink: 60 bytes leftover after parsing attributes in process `syz.1.892'. [ 273.742346][ T8642] netlink: 60 bytes leftover after parsing attributes in process `syz.1.892'. [ 274.189315][ T8650] netlink: 128 bytes leftover after parsing attributes in process `syz.1.895'. [ 274.265158][ T8650] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 274.918854][ T8677] netlink: 60 bytes leftover after parsing attributes in process `syz.1.903'. [ 274.943642][ T8677] netlink: 60 bytes leftover after parsing attributes in process `syz.1.903'. [ 274.969522][ T8675] netlink: 60 bytes leftover after parsing attributes in process `syz.1.903'. [ 275.698737][ T8691] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 275.830848][ T8697] netlink: 'syz.3.913': attribute type 21 has an invalid length. [ 277.448456][ T8729] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 278.024497][ T8741] netlink: 'syz.1.929': attribute type 13 has an invalid length. [ 278.042335][ T8741] syz_tun: refused to change device tx_queue_len [ 278.055103][ T8741] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 278.605678][ T8759] __nla_validate_parse: 6 callbacks suppressed [ 278.605694][ T8759] netlink: 60 bytes leftover after parsing attributes in process `syz.0.934'. [ 278.632971][ T8755] netlink: 71 bytes leftover after parsing attributes in process `syz.3.935'. [ 278.691857][ T8759] netlink: 60 bytes leftover after parsing attributes in process `syz.0.934'. [ 278.731780][ T8752] netlink: 60 bytes leftover after parsing attributes in process `syz.0.934'. [ 278.740985][ T8756] netlink: 60 bytes leftover after parsing attributes in process `syz.0.934'. [ 279.026496][ T8767] netlink: 61211 bytes leftover after parsing attributes in process `syz.3.939'. [ 279.063672][ T8767] netlink: 'syz.3.939': attribute type 29 has an invalid length. [ 279.086190][ T8767] netlink: 'syz.3.939': attribute type 29 has an invalid length. [ 279.098623][ T8767] netlink: 'syz.3.939': attribute type 29 has an invalid length. [ 279.116002][ T8767] netlink: 'syz.3.939': attribute type 29 has an invalid length. [ 279.129539][ T8767] netlink: 'syz.3.939': attribute type 29 has an invalid length. [ 279.375289][ T8775] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 279.509537][ T8778] netlink: 'syz.3.944': attribute type 13 has an invalid length. [ 279.526856][ T8778] netlink: 152 bytes leftover after parsing attributes in process `syz.3.944'. [ 279.562006][ T8778] syz_tun: refused to change device tx_queue_len [ 279.584982][ T8778] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 280.314674][ T8796] netlink: 44 bytes leftover after parsing attributes in process `syz.2.949'. [ 280.344125][ T8798] netlink: 60 bytes leftover after parsing attributes in process `syz.1.948'. [ 280.366950][ T8798] netlink: 60 bytes leftover after parsing attributes in process `syz.1.948'. [ 281.304411][ T8814] netlink: 'syz.3.958': attribute type 13 has an invalid length. [ 281.317158][ T8814] syz_tun: refused to change device tx_queue_len [ 281.328002][ T8814] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 281.387925][ T8815] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 282.064053][ T8837] syzkaller0: entered promiscuous mode [ 282.082051][ T8837] syzkaller0: entered allmulticast mode [ 282.204387][ T8842] netlink: 'syz.3.969': attribute type 13 has an invalid length. [ 282.217708][ T8842] syz_tun: refused to change device tx_queue_len [ 282.225104][ T8842] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 283.872976][ T8851] __nla_validate_parse: 8 callbacks suppressed [ 283.872992][ T8851] netlink: 44 bytes leftover after parsing attributes in process `syz.0.971'. [ 283.922547][ T8851] bridge_slave_0: entered allmulticast mode [ 284.007525][ T8855] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 284.610567][ T8870] netlink: 60 bytes leftover after parsing attributes in process `syz.1.978'. [ 284.661298][ T8870] netlink: 60 bytes leftover after parsing attributes in process `syz.1.978'. [ 284.693250][ T8865] netlink: 60 bytes leftover after parsing attributes in process `syz.1.978'. [ 284.702948][ T8867] netlink: 60 bytes leftover after parsing attributes in process `syz.1.978'. [ 285.115292][ T8879] syzkaller0: entered promiscuous mode [ 285.124959][ T8879] syzkaller0: entered allmulticast mode [ 286.717226][ T8887] netlink: 'syz.0.985': attribute type 13 has an invalid length. [ 286.728598][ T8887] netlink: 152 bytes leftover after parsing attributes in process `syz.0.985'. [ 286.739753][ T8887] syz_tun: refused to change device tx_queue_len [ 286.746279][ T8887] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 286.766042][ T8894] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 287.101326][ T8912] netlink: 60 bytes leftover after parsing attributes in process `syz.1.990'. [ 287.187593][ T8912] netlink: 60 bytes leftover after parsing attributes in process `syz.1.990'. [ 287.216460][ T8905] netlink: 60 bytes leftover after parsing attributes in process `syz.1.990'. [ 287.291126][ T8910] netlink: 60 bytes leftover after parsing attributes in process `syz.1.990'. [ 287.570744][ T8924] netlink: 'syz.3.996': attribute type 13 has an invalid length. [ 287.583163][ T8924] syz_tun: refused to change device tx_queue_len [ 287.589555][ T8924] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 287.906295][ T8927] syzkaller0: entered promiscuous mode [ 287.921978][ T8927] syzkaller0: entered allmulticast mode [ 289.323950][ T8937] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 289.340186][ T8943] __nla_validate_parse: 2 callbacks suppressed [ 289.340196][ T8943] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1002'. [ 290.273596][ T8967] netlink: 'syz.0.1009': attribute type 13 has an invalid length. [ 290.288439][ T8967] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1009'. [ 290.327916][ T8967] syz_tun: refused to change device tx_queue_len [ 290.334778][ T8967] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 290.412718][ T8971] syzkaller0: entered promiscuous mode [ 290.418374][ T8971] syzkaller0: entered allmulticast mode [ 290.830174][ T8987] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1016'. [ 291.933434][ T8980] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 292.016182][ T8987] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1016'. [ 292.480827][ T9003] netlink: 'syz.0.1022': attribute type 13 has an invalid length. [ 292.504631][ T9003] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1022'. [ 292.516261][ T9003] syz_tun: refused to change device tx_queue_len [ 292.523249][ T9003] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 293.000772][ T9016] syzkaller0: entered promiscuous mode [ 293.011322][ T9016] syzkaller0: entered allmulticast mode [ 293.215824][ T9026] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1029'. [ 294.965239][ T9026] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1029'. [ 295.122173][ T9043] netlink: 'syz.0.1035': attribute type 13 has an invalid length. [ 295.130072][ T9043] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1035'. [ 295.161967][ T9043] syz_tun: refused to change device tx_queue_len [ 295.168464][ T9043] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 295.353203][ T9051] netlink: 3554 bytes leftover after parsing attributes in process `syz.3.1040'. [ 295.715263][ T9065] FAULT_INJECTION: forcing a failure. [ 295.715263][ T9065] name failslab, interval 1, probability 0, space 0, times 0 [ 295.747401][ T9065] CPU: 0 PID: 9065 Comm: syz.3.1045 Not tainted syzkaller #0 [ 295.754849][ T9065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 295.764932][ T9065] Call Trace: [ 295.768234][ T9065] [ 295.771189][ T9065] dump_stack_lvl+0x18c/0x250 [ 295.775914][ T9065] ? show_regs_print_info+0x20/0x20 [ 295.781160][ T9065] ? load_image+0x420/0x420 [ 295.785698][ T9065] ? __might_sleep+0xe0/0xe0 [ 295.790324][ T9065] ? __lock_acquire+0x7d80/0x7d80 [ 295.795409][ T9065] should_fail_ex+0x394/0x4c0 [ 295.800120][ T9065] should_failslab+0x9/0x20 [ 295.804655][ T9065] slab_pre_alloc_hook+0x59/0x300 [ 295.809712][ T9065] ? __get_vm_area_node+0x125/0x370 [ 295.814949][ T9065] __kmem_cache_alloc_node+0x53/0x250 [ 295.820363][ T9065] ? __get_vm_area_node+0x125/0x370 [ 295.825600][ T9065] kmalloc_node_trace+0x26/0xe0 [ 295.830483][ T9065] __get_vm_area_node+0x125/0x370 [ 295.835537][ T9065] __vmalloc_node_range+0x36f/0x1320 [ 295.840845][ T9065] ? netlink_sendmsg+0x602/0xbf0 [ 295.845828][ T9065] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 295.852015][ T9065] ? free_vm_area+0x50/0x50 [ 295.856550][ T9065] ? netlink_sendmsg+0x602/0xbf0 [ 295.861503][ T9065] vmalloc+0x79/0x90 [ 295.865429][ T9065] ? netlink_sendmsg+0x602/0xbf0 [ 295.870386][ T9065] netlink_sendmsg+0x602/0xbf0 [ 295.875176][ T9065] ? netlink_getsockopt+0x590/0x590 [ 295.880396][ T9065] ? apparmor_socket_sendmsg+0x8e/0x330 [ 295.885968][ T9065] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 295.891282][ T9065] ? security_socket_sendmsg+0x80/0xa0 [ 295.896765][ T9065] sock_write_iter+0x2dc/0x420 [ 295.901552][ T9065] ? sock_read_iter+0x3f0/0x3f0 [ 295.906432][ T9065] ? common_file_perm+0x198/0x1f0 [ 295.911483][ T9065] vfs_write+0x474/0x9a0 [ 295.915752][ T9065] ? file_end_write+0x250/0x250 [ 295.920622][ T9065] ? __fget_files+0x3fc/0x460 [ 295.925322][ T9065] ? __fdget_pos+0x1d8/0x330 [ 295.929930][ T9065] ? ksys_write+0x74/0x260 [ 295.934373][ T9065] ksys_write+0x151/0x260 [ 295.938738][ T9065] ? __ia32_sys_read+0x90/0x90 [ 295.943544][ T9065] ? syscall_enter_from_user_mode+0x2e/0x80 [ 295.949462][ T9065] do_syscall_64+0x55/0xb0 [ 295.953942][ T9065] ? clear_bhb_loop+0x40/0x90 [ 295.958638][ T9065] ? clear_bhb_loop+0x40/0x90 [ 295.963346][ T9065] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 295.969256][ T9065] RIP: 0033:0x7fbc42d9e159 [ 295.973689][ T9065] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 295.993318][ T9065] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 296.001755][ T9065] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 296.009737][ T9065] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 0000000000000006 [ 296.017722][ T9065] RBP: 00007fbc43c18090 R08: 0000000000000000 R09: 0000000000000000 [ 296.025704][ T9065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 296.033776][ T9065] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 296.041780][ T9065] [ 296.062822][ T9069] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1044'. [ 296.071519][ T9065] syz.3.1045: vmalloc error: size 65408, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 296.095077][ T9065] CPU: 1 PID: 9065 Comm: syz.3.1045 Not tainted syzkaller #0 [ 296.102511][ T9065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 296.112570][ T9065] Call Trace: [ 296.115859][ T9065] [ 296.118787][ T9065] dump_stack_lvl+0x18c/0x250 [ 296.123477][ T9065] ? show_regs_print_info+0x20/0x20 [ 296.128687][ T9065] ? load_image+0x420/0x420 [ 296.133191][ T9065] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 296.139610][ T9065] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 296.146206][ T9065] warn_alloc+0x246/0x340 [ 296.150536][ T9065] ? __get_vm_area_node+0x125/0x370 [ 296.155747][ T9065] ? zone_watermark_ok_safe+0x230/0x230 [ 296.161379][ T9065] ? rcu_is_watching+0x15/0xb0 [ 296.166155][ T9065] ? __get_vm_area_node+0x356/0x370 [ 296.171360][ T9065] __vmalloc_node_range+0x394/0x1320 [ 296.176664][ T9065] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 296.182834][ T9065] ? free_vm_area+0x50/0x50 [ 296.187347][ T9065] ? netlink_sendmsg+0x602/0xbf0 [ 296.192284][ T9065] vmalloc+0x79/0x90 [ 296.196180][ T9065] ? netlink_sendmsg+0x602/0xbf0 [ 296.201123][ T9065] netlink_sendmsg+0x602/0xbf0 [ 296.205902][ T9065] ? netlink_getsockopt+0x590/0x590 [ 296.211105][ T9065] ? apparmor_socket_sendmsg+0x8e/0x330 [ 296.216661][ T9065] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 296.221948][ T9065] ? security_socket_sendmsg+0x80/0xa0 [ 296.227406][ T9065] sock_write_iter+0x2dc/0x420 [ 296.232200][ T9065] ? sock_read_iter+0x3f0/0x3f0 [ 296.237060][ T9065] ? common_file_perm+0x198/0x1f0 [ 296.242097][ T9065] vfs_write+0x474/0x9a0 [ 296.246351][ T9065] ? file_end_write+0x250/0x250 [ 296.251209][ T9065] ? __fget_files+0x3fc/0x460 [ 296.255986][ T9065] ? __fdget_pos+0x1d8/0x330 [ 296.260579][ T9065] ? ksys_write+0x74/0x260 [ 296.265116][ T9065] ksys_write+0x151/0x260 [ 296.269457][ T9065] ? __ia32_sys_read+0x90/0x90 [ 296.274229][ T9065] ? syscall_enter_from_user_mode+0x2e/0x80 [ 296.280121][ T9065] do_syscall_64+0x55/0xb0 [ 296.284540][ T9065] ? clear_bhb_loop+0x40/0x90 [ 296.289217][ T9065] ? clear_bhb_loop+0x40/0x90 [ 296.293901][ T9065] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 296.299791][ T9065] RIP: 0033:0x7fbc42d9e159 [ 296.304245][ T9065] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.323855][ T9065] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 296.332270][ T9065] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 296.340246][ T9065] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 0000000000000006 [ 296.348238][ T9065] RBP: 00007fbc43c18090 R08: 0000000000000000 R09: 0000000000000000 [ 296.356210][ T9065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 296.364179][ T9065] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 296.372166][ T9065] [ 296.417080][ T9065] Mem-Info: [ 296.423136][ T9065] active_anon:5933 inactive_anon:0 isolated_anon:0 [ 296.423136][ T9065] active_file:15346 inactive_file:40035 isolated_file:0 [ 296.423136][ T9065] unevictable:768 dirty:155 writeback:0 [ 296.423136][ T9065] slab_reclaimable:10065 slab_unreclaimable:91548 [ 296.423136][ T9065] mapped:24706 shmem:1361 pagetables:577 [ 296.423136][ T9065] sec_pagetables:0 bounce:0 [ 296.423136][ T9065] kernel_misc_reclaimable:0 [ 296.423136][ T9065] free:1358381 free_pcp:6398 free_cma:0 [ 296.432227][ T9059] syzkaller0: entered promiscuous mode [ 296.476118][ T9059] syzkaller0: entered allmulticast mode [ 296.483668][ T9069] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1044'. [ 296.493504][ T9063] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1044'. [ 296.508081][ T9065] Node 0 active_anon:23632kB inactive_anon:0kB active_file:61384kB inactive_file:159940kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:98824kB dirty:620kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10500kB pagetables:2308kB sec_pagetables:0kB all_unreclaimable? no [ 296.556414][ T9065] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 296.608013][ T9065] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 296.659392][ T9065] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 296.670837][ T9065] Node 0 DMA32 free:1517336kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:23496kB inactive_anon:0kB active_file:61384kB inactive_file:159108kB unevictable:1536kB writepending:620kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:6828kB local_pcp:3544kB free_cma:0kB [ 296.703153][ T9065] lowmem_reserve[]: 0 0 0 0 0 [ 296.708189][ T9065] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:832kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 296.736689][ T9065] lowmem_reserve[]: 0 0 0 0 0 [ 296.741727][ T9065] Node 1 Normal free:3900824kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:18212kB local_pcp:6148kB free_cma:0kB [ 296.774706][ T9065] lowmem_reserve[]: 0 0 0 0 0 [ 296.779468][ T9065] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 296.795720][ T9065] Node 0 DMA32: 1972*4kB (UME) 1655*8kB (UME) 1229*16kB (UME) 806*32kB (UME) 1822*64kB (UME) 579*128kB (UME) 166*256kB (UME) 76*512kB (UME) 45*1024kB (UME) 13*2048kB (UM) 270*4096kB (UM) = 1517336kB [ 296.821506][ T9065] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 296.833958][ T9065] Node 1 Normal: 210*4kB (UM) 56*8kB (UME) 41*16kB (UME) 34*32kB (UME) 15*64kB (UME) 6*128kB (UE) 1*256kB (E) 1*512kB (M) 0*1024kB 0*2048kB 951*4096kB (UM) = 3900824kB [ 296.853678][ T9065] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 296.887113][ T9065] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 296.919197][ T9065] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 296.948026][ T9065] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 296.963049][ T9065] 56742 total pagecache pages [ 296.967764][ T9065] 0 pages in swap cache [ 296.975464][ T9065] Free swap = 124996kB [ 296.979659][ T9065] Total swap = 124996kB [ 296.990554][ T9065] 2097051 pages RAM [ 296.994822][ T9065] 0 pages HighMem/MovableOnly [ 296.999637][ T9065] 416965 pages reserved [ 297.004257][ T9065] 0 pages cma reserved [ 298.566576][ T9088] netlink: 'syz.3.1050': attribute type 13 has an invalid length. [ 298.575113][ T9088] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1050'. [ 298.602107][ T9088] syz_tun: refused to change device tx_queue_len [ 298.608735][ T9088] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 298.991235][ T9104] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1055'. [ 299.008796][ T9098] netlink: 10678 bytes leftover after parsing attributes in process `syz.1.1053'. [ 299.031213][ T9104] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1055'. [ 299.138809][ T9106] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 299.812819][ T9119] syzkaller0: entered promiscuous mode [ 299.841254][ T9119] syzkaller0: entered allmulticast mode [ 301.750176][ T9173] __nla_validate_parse: 2 callbacks suppressed [ 301.750188][ T9173] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1065'. [ 302.314387][ T9138] netlink: 'syz.2.1062': attribute type 13 has an invalid length. [ 302.323717][ T9138] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1062'. [ 302.333969][ T9138] syz_tun: refused to change device tx_queue_len [ 302.340343][ T9138] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 302.373840][ T9173] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1065'. [ 302.397353][ T9170] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1065'. [ 302.407599][ T9172] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1065'. [ 302.620606][ T9180] netlink: 'syz.0.1067': attribute type 10 has an invalid length. [ 302.649329][ T9180] team0: Device wg1 is up. Set it down before adding it as a team port [ 302.676855][ T9181] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 303.122863][ T9193] netlink: 'syz.3.1073': attribute type 10 has an invalid length. [ 303.246039][ T9197] netlink: 'syz.3.1074': attribute type 13 has an invalid length. [ 303.263017][ T9197] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1074'. [ 303.284891][ T9197] syz_tun: refused to change device tx_queue_len [ 303.295616][ T9197] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 303.524675][ T9199] syzkaller0: entered promiscuous mode [ 303.530520][ T9199] syzkaller0: entered allmulticast mode [ 303.884835][ T9220] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1080'. [ 305.513762][ T9220] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1080'. [ 305.531214][ T9219] netlink: 'syz.0.1081': attribute type 5 has an invalid length. [ 305.539149][ T9222] netlink: 'syz.3.1082': attribute type 10 has an invalid length. [ 305.715159][ T9237] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1083'. [ 305.726091][ T9237] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1083'. [ 305.753310][ T9231] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 306.097047][ T9243] netlink: 'syz.2.1087': attribute type 13 has an invalid length. [ 306.106764][ T9243] syz_tun: refused to change device tx_queue_len [ 306.115076][ T9243] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 306.401532][ T9250] netlink: 'syz.1.1090': attribute type 21 has an invalid length. [ 306.427063][ T9250] netlink: 'syz.1.1090': attribute type 4 has an invalid length. [ 306.547897][ T9263] netlink: 'syz.1.1094': attribute type 10 has an invalid length. [ 306.720299][ T9259] syzkaller0: entered promiscuous mode [ 306.727670][ T9259] syzkaller0: entered allmulticast mode [ 308.966245][ T9288] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 309.062740][ T9293] netlink: 'syz.2.1101': attribute type 13 has an invalid length. [ 309.100373][ T9293] __nla_validate_parse: 9 callbacks suppressed [ 309.100388][ T9293] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1101'. [ 309.166241][ T9293] syz_tun: refused to change device tx_queue_len [ 309.206253][ T9293] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 309.275792][ T9302] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1103'. [ 309.314979][ T9304] netlink: 'syz.1.1105': attribute type 10 has an invalid length. [ 309.324670][ T9302] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1103'. [ 309.354447][ T9298] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1103'. [ 309.384812][ T9301] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1103'. [ 309.567252][ T9309] syzkaller0: entered promiscuous mode [ 309.584316][ T9309] syzkaller0: entered allmulticast mode [ 312.223366][ T9341] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 312.269521][ T9346] netlink: 'syz.1.1114': attribute type 13 has an invalid length. [ 312.292998][ T9346] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1114'. [ 312.322444][ T9346] syz_tun: refused to change device tx_queue_len [ 312.330162][ T9346] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 312.652299][ T9354] netlink: 'syz.2.1118': attribute type 10 has an invalid length. [ 312.849498][ T9364] netlink: 'syz.2.1123': attribute type 21 has an invalid length. [ 312.850132][ T9366] netlink: 'syz.0.1122': attribute type 29 has an invalid length. [ 312.867950][ T9367] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1121'. [ 312.869910][ T9364] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1123'. [ 312.893723][ T9364] netlink: 'syz.2.1123': attribute type 4 has an invalid length. [ 312.906431][ T9364] netlink: 3 bytes leftover after parsing attributes in process `syz.2.1123'. [ 312.925484][ T9367] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1121'. [ 312.936729][ T9366] netlink: 'syz.0.1122': attribute type 29 has an invalid length. [ 312.958365][ T9371] netlink: 'syz.0.1122': attribute type 29 has an invalid length. [ 312.985106][ T9366] netlink: 'syz.0.1122': attribute type 29 has an invalid length. [ 313.204800][ T9373] syzkaller0: entered promiscuous mode [ 313.210502][ T9373] syzkaller0: entered allmulticast mode [ 313.218217][ T9378] netlink: 'syz.0.1127': attribute type 13 has an invalid length. [ 313.227749][ T9378] syz_tun: refused to change device tx_queue_len [ 313.234572][ T9378] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 313.278644][ T9380] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.083956][ T9392] netlink: 'syz.1.1131': attribute type 10 has an invalid length. [ 315.292526][ T9397] __nla_validate_parse: 4 callbacks suppressed [ 315.292547][ T9397] netlink: 71 bytes leftover after parsing attributes in process `syz.1.1133'. [ 315.338067][ T9401] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1134'. [ 315.357870][ T9401] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1134'. [ 315.400711][ T9399] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1134'. [ 315.443055][ T9400] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1134'. [ 315.653601][ T9408] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1138'. [ 315.731230][ T9409] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1135'. [ 315.740869][ T9409] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1135'. [ 316.625499][ T9427] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 316.901451][ T9441] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1146'. [ 316.918330][ T9441] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1146'. [ 317.381325][ T9463] validate_nla: 5 callbacks suppressed [ 317.381341][ T9463] netlink: 'syz.1.1153': attribute type 10 has an invalid length. [ 317.400396][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.400453][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.673295][ T9498] netlink: 'syz.2.1167': attribute type 10 has an invalid length. [ 318.830935][ T9500] netlink: 'syz.3.1169': attribute type 10 has an invalid length. [ 319.924753][ T9529] netlink: 'syz.1.1179': attribute type 10 has an invalid length. [ 320.547225][ T9551] __nla_validate_parse: 14 callbacks suppressed [ 320.547243][ T9551] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1186'. [ 320.663182][ T9554] netlink: 'syz.2.1189': attribute type 21 has an invalid length. [ 320.686727][ T9554] netlink: 176 bytes leftover after parsing attributes in process `syz.2.1189'. [ 320.742937][ T9556] netlink: 'syz.1.1191': attribute type 10 has an invalid length. [ 321.079671][ T9567] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1193'. [ 321.105329][ T9566] syzkaller0: entered promiscuous mode [ 321.119141][ T9567] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1193'. [ 321.143721][ T9563] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1193'. [ 323.588166][ T9564] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1193'. [ 323.619673][ T9586] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1201'. [ 323.639974][ T9589] netlink: 'syz.0.1199': attribute type 10 has an invalid length. [ 323.793042][ T9593] netlink: 71 bytes leftover after parsing attributes in process `syz.3.1202'. [ 324.737275][ T9621] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1210'. [ 324.772080][ T9621] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1210'. [ 325.973479][ T9649] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 325.993483][ T9653] __nla_validate_parse: 4 callbacks suppressed [ 325.993510][ T9653] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1223'. [ 326.027447][ T9653] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1223'. [ 326.062714][ T9651] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1223'. [ 326.091408][ T9655] netlink: 192 bytes leftover after parsing attributes in process `syz.0.1225'. [ 326.116933][ T9652] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1223'. [ 326.181430][ T9658] netlink: 71 bytes leftover after parsing attributes in process `syz.3.1226'. [ 326.556202][ T9665] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 326.713297][ T9677] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1231'. [ 326.732712][ T9677] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1231'. [ 326.743564][ T9673] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1231'. [ 326.767976][ T9681] netlink: 'syz.3.1234': attribute type 10 has an invalid length. [ 326.799447][ T9676] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1231'. [ 327.419771][ T9697] syzkaller0: entered allmulticast mode [ 327.505985][ T9704] netlink: 'syz.3.1240': attribute type 9 has an invalid length. [ 327.611181][ T9708] netlink: 'syz.2.1245': attribute type 10 has an invalid length. [ 327.705115][ T9711] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 329.066504][ T9740] syzkaller0: entered promiscuous mode [ 329.072333][ T9740] syzkaller0: entered allmulticast mode [ 329.084121][ T9747] netlink: 'syz.0.1258': attribute type 10 has an invalid length. [ 329.138272][ T9750] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 331.166963][ T9760] __nla_validate_parse: 12 callbacks suppressed [ 331.166980][ T9760] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1261'. [ 331.185835][ T9771] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1266'. [ 331.336023][ T9781] netlink: 'syz.3.1268': attribute type 10 has an invalid length. [ 331.539265][ T9785] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1271'. [ 331.563314][ T9783] netlink: 71 bytes leftover after parsing attributes in process `syz.1.1270'. [ 331.796823][ T9794] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1274'. [ 332.199694][ T9801] syzkaller0: entered promiscuous mode [ 332.206756][ T9801] syzkaller0: entered allmulticast mode [ 332.258603][ T9805] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1275'. [ 332.369454][ T9805] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1275'. [ 333.896437][ T9799] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1275'. [ 333.909189][ T9809] netlink: 'syz.0.1279': attribute type 10 has an invalid length. [ 334.134442][ T9818] netlink: 71 bytes leftover after parsing attributes in process `syz.3.1283'. [ 334.256982][ T9821] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1284'. [ 335.063795][ T9837] netlink: 'syz.0.1290': attribute type 10 has an invalid length. [ 335.248465][ T9842] syzkaller0: entered promiscuous mode [ 335.294494][ T9842] syzkaller0: entered allmulticast mode [ 337.432905][ T9863] __nla_validate_parse: 6 callbacks suppressed [ 337.432926][ T9863] netlink: 71 bytes leftover after parsing attributes in process `syz.0.1298'. [ 337.547525][ T9873] syzkaller0: entered promiscuous mode [ 337.560505][ T9873] syzkaller0: entered allmulticast mode [ 337.679427][ T9888] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1302'. [ 339.027069][ T9888] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1302'. [ 339.231732][ T9896] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1306'. [ 339.424505][ T9902] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 339.442347][ T9904] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1311'. [ 339.787282][ T9910] netlink: 71 bytes leftover after parsing attributes in process `syz.1.1312'. [ 339.963741][ T9912] syzkaller0: entered promiscuous mode [ 339.969306][ T9912] syzkaller0: entered allmulticast mode [ 340.169222][ T9920] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1314'. [ 341.423487][ T9920] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1314'. [ 341.533530][ T9926] netlink: 'syz.1.1317': attribute type 10 has an invalid length. [ 341.556444][ T9926] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1317'. [ 341.603537][ T9926] caif0: entered promiscuous mode [ 341.610892][ T9926] caif0: entered allmulticast mode [ 341.633675][ T9926] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 341.812256][ T9936] FAULT_INJECTION: forcing a failure. [ 341.812256][ T9936] name failslab, interval 1, probability 0, space 0, times 0 [ 341.825686][ T9936] CPU: 0 PID: 9936 Comm: syz.3.1322 Not tainted syzkaller #0 [ 341.833089][ T9936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 341.843179][ T9936] Call Trace: [ 341.846465][ T9936] [ 341.849398][ T9936] dump_stack_lvl+0x18c/0x250 [ 341.854078][ T9936] ? show_regs_print_info+0x20/0x20 [ 341.859271][ T9936] ? load_image+0x420/0x420 [ 341.863775][ T9936] ? __might_sleep+0xe0/0xe0 [ 341.868425][ T9936] ? __lock_acquire+0x7d80/0x7d80 [ 341.873486][ T9936] should_fail_ex+0x394/0x4c0 [ 341.878164][ T9936] should_failslab+0x9/0x20 [ 341.882668][ T9936] slab_pre_alloc_hook+0x59/0x300 [ 341.887706][ T9936] ? tomoyo_encode+0x2ad/0x570 [ 341.892482][ T9936] ? tomoyo_encode+0x2ad/0x570 [ 341.897260][ T9936] __kmem_cache_alloc_node+0x53/0x250 [ 341.902642][ T9936] ? tomoyo_encode+0x2ad/0x570 [ 341.907404][ T9936] __kmalloc+0xa7/0x240 [ 341.911569][ T9936] tomoyo_encode+0x2ad/0x570 [ 341.916164][ T9936] tomoyo_realpath_from_path+0x57c/0x5c0 [ 341.921794][ T9936] ? tomoyo_domain+0xd6/0x120 [ 341.926469][ T9936] tomoyo_path_number_perm+0x248/0x5e0 [ 341.931927][ T9936] ? tomoyo_path_number_perm+0x217/0x5e0 [ 341.937558][ T9936] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 341.943019][ T9936] ? ksys_write+0x1d2/0x260 [ 341.947546][ T9936] ? __fget_files+0x28/0x460 [ 341.952143][ T9936] security_file_ioctl+0x70/0xa0 [ 341.957081][ T9936] __se_sys_ioctl+0x48/0x170 [ 341.961670][ T9936] do_syscall_64+0x55/0xb0 [ 341.966087][ T9936] ? clear_bhb_loop+0x40/0x90 [ 341.970849][ T9936] ? clear_bhb_loop+0x40/0x90 [ 341.975612][ T9936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 341.981548][ T9936] RIP: 0033:0x7fbc42d9e159 [ 341.985963][ T9936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 342.005589][ T9936] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 342.014089][ T9936] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 342.022057][ T9936] RDX: 0000200000000080 RSI: 0000000000008b06 RDI: 0000000000000003 [ 342.030022][ T9936] RBP: 00007fbc43c18090 R08: 0000000000000000 R09: 0000000000000000 [ 342.037993][ T9936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.045961][ T9936] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 342.055144][ T9936] [ 342.090423][ T9936] ERROR: Out of memory at tomoyo_realpath_from_path. [ 342.125119][ T9938] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 342.227195][ T9941] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1324'. [ 342.557631][ T9954] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1327'. [ 342.795346][ T9955] syzkaller0: entered promiscuous mode [ 342.803540][ T9955] syzkaller0: entered allmulticast mode [ 342.821549][ T9954] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1327'. [ 342.841643][ T9948] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1327'. [ 342.859315][ T9951] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1327'. [ 344.451733][ T9966] netlink: 'syz.2.1331': attribute type 10 has an invalid length. [ 344.459599][ T9966] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1331'. [ 344.469704][ T9966] caif0: entered promiscuous mode [ 344.474825][ T9966] caif0: entered allmulticast mode [ 344.479953][ T9966] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 345.119537][ T9989] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1340'. [ 345.927464][T10007] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1345'. [ 346.429004][T10024] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1351'. [ 346.471216][T10024] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1351'. [ 346.489622][T10019] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1351'. [ 347.913069][T10065] __nla_validate_parse: 3 callbacks suppressed [ 347.913086][T10065] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1369'. [ 348.327320][T10073] netlink: 71 bytes leftover after parsing attributes in process `syz.0.1371'. [ 348.668106][T10086] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1374'. [ 348.738454][T10086] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1374'. [ 348.761953][T10080] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1374'. [ 348.788286][T10081] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1374'. [ 349.210317][T10103] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1382'. [ 349.285113][T10107] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1381'. [ 349.316655][T10107] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1381'. [ 349.379220][T10100] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1381'. [ 349.616692][T10114] syzkaller0: entered promiscuous mode [ 349.628432][T10114] syzkaller0: entered allmulticast mode [ 351.755873][T10129] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 351.887214][T10140] netlink: 'syz.2.1391': attribute type 9 has an invalid length. [ 352.662564][T10158] syz.2.1399 uses obsolete (PF_INET,SOCK_PACKET) [ 352.791851][T10165] syzkaller0: entered promiscuous mode [ 352.799665][T10165] syzkaller0: entered allmulticast mode [ 354.790625][T10169] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 354.920089][T10193] __nla_validate_parse: 6 callbacks suppressed [ 354.920105][T10193] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1410'. [ 355.854849][T10219] netlink: 71 bytes leftover after parsing attributes in process `syz.3.1420'. [ 356.172008][T10221] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 356.335442][T10227] syzkaller0: entered promiscuous mode [ 356.341166][T10227] syzkaller0: entered allmulticast mode [ 356.531582][T10239] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1424'. [ 357.883680][T10239] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1424'. [ 359.528008][T10242] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1425'. [ 359.832617][T10258] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1430'. [ 359.891610][T10264] netlink: 'syz.1.1433': attribute type 21 has an invalid length. [ 359.941331][T10264] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1433'. [ 360.101214][T10264] netlink: 'syz.1.1433': attribute type 10 has an invalid length. [ 360.135318][T10264] bridge0: port 3(batadv0) entered disabled state [ 360.154627][T10264] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.168245][T10264] bridge0: port 1(bridge_slave_0) entered disabled state [ 360.508972][T10264] bridge0: port 3(batadv0) entered blocking state [ 360.517988][T10264] bridge0: port 3(batadv0) entered forwarding state [ 360.529750][T10264] bridge0: port 2(bridge_slave_1) entered blocking state [ 360.540246][T10264] bridge0: port 2(bridge_slave_1) entered forwarding state [ 360.551341][T10264] bridge0: port 1(bridge_slave_0) entered blocking state [ 360.561793][T10264] bridge0: port 1(bridge_slave_0) entered forwarding state [ 360.609322][T10273] FAULT_INJECTION: forcing a failure. [ 360.609322][T10273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 360.723080][T10273] CPU: 0 PID: 10273 Comm: syz.2.1434 Not tainted syzkaller #0 [ 360.730639][T10273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 360.740747][T10273] Call Trace: [ 360.744072][T10273] [ 360.747043][T10273] dump_stack_lvl+0x18c/0x250 [ 360.751781][T10273] ? show_regs_print_info+0x20/0x20 [ 360.757031][T10273] ? load_image+0x420/0x420 [ 360.761600][T10273] ? __might_fault+0xaa/0x120 [ 360.766338][T10273] ? __lock_acquire+0x7d80/0x7d80 [ 360.771442][T10273] should_fail_ex+0x394/0x4c0 [ 360.776199][T10273] _copy_from_user+0x2f/0xe0 [ 360.780859][T10273] ___sys_recvmsg+0x174/0x590 [ 360.785619][T10273] ? __sys_recvmsg+0x2a0/0x2a0 [ 360.790456][T10273] ? ksys_write+0x1d2/0x260 [ 360.795055][T10273] ? __fget_files+0x3fc/0x460 [ 360.799835][T10273] __x64_sys_recvmsg+0x21e/0x2f0 [ 360.804839][T10273] ? ___sys_recvmsg+0x590/0x590 [ 360.809797][T10273] ? lockdep_hardirqs_on+0x98/0x150 [ 360.815059][T10273] do_syscall_64+0x55/0xb0 [ 360.819697][T10273] ? clear_bhb_loop+0x40/0x90 [ 360.824427][T10273] ? clear_bhb_loop+0x40/0x90 [ 360.829185][T10273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 360.835232][T10273] RIP: 0033:0x7fc3e079e159 [ 360.839741][T10273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.859412][T10273] RSP: 002b:00007fc3e1617028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 360.867899][T10273] RAX: ffffffffffffffda RBX: 00007fc3e0a26090 RCX: 00007fc3e079e159 [ 360.875932][T10273] RDX: 0000000000000000 RSI: 0000200000000700 RDI: 0000000000000003 [ 360.883958][T10273] RBP: 00007fc3e1617090 R08: 0000000000000000 R09: 0000000000000000 [ 360.891987][T10273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 360.900011][T10273] R13: 00007fc3e0a26128 R14: 00007fc3e0a26090 R15: 00007ffc81d2b5e8 [ 360.908094][T10273] [ 360.976465][T10264] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 361.038351][T10276] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1434'. [ 361.056292][T10278] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1436'. [ 361.070215][T10264] syz.1.1433 (10264) used greatest stack depth: 18024 bytes left [ 361.085269][T10276] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1434'. [ 361.105840][T10272] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1434'. [ 361.341045][T10287] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1437'. [ 361.398165][T10284] syzkaller0: entered promiscuous mode [ 361.441537][T10284] syzkaller0: entered allmulticast mode [ 361.460532][T10287] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1437'. [ 361.486404][T10282] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1437'. [ 363.328416][T10301] netlink: 71 bytes leftover after parsing attributes in process `syz.0.1443'. [ 363.454318][T10304] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 363.620476][T10312] netlink: 'syz.3.1447': attribute type 10 has an invalid length. [ 363.829886][T10319] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1449'. [ 364.502384][T10335] syzkaller0: entered promiscuous mode [ 364.510178][T10335] syzkaller0: entered allmulticast mode [ 366.577576][T10343] netlink: 'syz.2.1458': attribute type 10 has an invalid length. [ 366.588515][T10341] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 366.675029][T10351] netlink: 'syz.0.1460': attribute type 21 has an invalid length. [ 366.683381][T10351] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1460'. [ 366.695724][T10352] netlink: 'syz.0.1460': attribute type 10 has an invalid length. [ 366.858041][T10366] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1463'. [ 366.923577][T10366] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1463'. [ 366.946841][T10362] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1463'. [ 367.001499][T10370] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1465'. [ 367.645415][T10382] netlink: 'syz.2.1470': attribute type 10 has an invalid length. [ 367.760485][T10384] syzkaller0: entered promiscuous mode [ 367.772338][T10384] syzkaller0: entered allmulticast mode [ 367.850200][T10386] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.850963][T10404] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1476'. [ 370.400655][T10397] netlink: 'syz.2.1475': attribute type 21 has an invalid length. [ 370.408891][T10397] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1475'. [ 370.421433][T10400] netlink: 'syz.2.1475': attribute type 10 has an invalid length. [ 370.429298][T10400] bridge0: left allmulticast mode [ 370.434940][T10400] bond0: (slave bridge0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 370.449477][T10400] bridge0: port 3(hsr0) entered blocking state [ 370.455870][T10400] bridge0: port 3(hsr0) entered forwarding state [ 370.462660][T10400] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.469811][T10400] bridge0: port 2(bridge_slave_1) entered forwarding state [ 370.477362][T10400] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.484581][T10400] bridge0: port 1(bridge_slave_0) entered forwarding state [ 370.495582][T10400] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 370.504781][T10404] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1476'. [ 370.680863][T10418] netlink: 'syz.1.1482': attribute type 10 has an invalid length. [ 370.740596][T10417] syzkaller0: entered promiscuous mode [ 370.746207][T10417] syzkaller0: entered allmulticast mode [ 370.755861][T10416] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1481'. [ 372.573089][T10429] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 372.894616][T10443] syzkaller0: entered promiscuous mode [ 372.900142][T10443] syzkaller0: entered allmulticast mode [ 372.913629][T10448] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1490'. [ 372.925066][T10440] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1491'. [ 372.934782][T10446] netlink: 'syz.3.1489': attribute type 21 has an invalid length. [ 372.953353][T10446] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1489'. [ 373.011371][T10448] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1490'. [ 373.039728][T10445] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1490'. [ 373.087960][T10446] netlink: 'syz.3.1489': attribute type 10 has an invalid length. [ 373.099133][T10446] bridge0: left allmulticast mode [ 373.130919][T10446] bridge0: port 2(bridge_slave_1) entered blocking state [ 373.139373][T10446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 373.152198][T10446] bridge0: port 1(bridge_slave_0) entered blocking state [ 373.160982][T10446] bridge0: port 1(bridge_slave_0) entered forwarding state [ 373.317728][T10446] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 373.502811][T10453] netlink: 'syz.2.1492': attribute type 10 has an invalid length. [ 375.304463][T10468] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1497'. [ 375.653158][T10470] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 376.099330][T10484] netlink: 'syz.3.1505': attribute type 10 has an invalid length. [ 376.627364][T10501] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1513'. [ 377.270942][T10509] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 377.309739][T10511] netlink: 'syz.2.1516': attribute type 10 has an invalid length. [ 377.705715][T10521] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1522'. [ 378.204540][T10534] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1526'. [ 378.649931][T10540] netlink: 'syz.3.1529': attribute type 10 has an invalid length. [ 378.835971][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.842534][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.922783][T10547] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 379.282728][T10560] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1535'. [ 380.767530][T10560] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1535'. [ 381.029577][T10576] netlink: 'syz.1.1540': attribute type 10 has an invalid length. [ 381.161860][T10580] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1541'. [ 381.469955][T10586] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 381.734534][T10590] syzkaller0: entered promiscuous mode [ 381.740968][T10590] syzkaller0: entered allmulticast mode [ 381.794115][T10594] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1547'. [ 381.860550][T10594] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1547'. [ 383.224954][T10593] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1547'. [ 383.380047][T10606] netlink: 'syz.1.1551': attribute type 10 has an invalid length. [ 383.825754][T10619] syzkaller0: entered promiscuous mode [ 383.847075][T10619] syzkaller0: entered allmulticast mode [ 383.897071][T10625] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1558'. [ 384.009058][T10625] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1558'. [ 385.513880][T10621] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1558'. [ 385.568733][T10631] syzkaller0: entered promiscuous mode [ 385.574805][T10631] syzkaller0: entered allmulticast mode [ 387.346167][T10649] netlink: 'syz.2.1565': attribute type 10 has an invalid length. [ 387.577435][T10664] netlink: 'syz.0.1571': attribute type 13 has an invalid length. [ 387.590540][T10664] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1571'. [ 387.612041][T10664] syz_tun: refused to change device tx_queue_len [ 387.620068][T10664] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 387.690848][T10672] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1570'. [ 387.876459][T10672] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1570'. [ 387.932468][T10663] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1570'. [ 387.961613][T10667] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1570'. [ 388.359831][T10691] syzkaller0: entered promiscuous mode [ 388.380550][T10691] syzkaller0: entered allmulticast mode [ 388.388784][T10693] netlink: 'syz.0.1577': attribute type 10 has an invalid length. [ 388.685934][T10709] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1581'. [ 388.777188][T10711] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1583'. [ 390.113922][T10709] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1581'. [ 390.131211][T10711] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1583'. [ 390.223606][T10713] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1584'. [ 390.259295][T10713] openvswitch: netlink: Flow key attribute not present in set flow. [ 390.630714][T10731] netlink: 'syz.0.1591': attribute type 10 has an invalid length. [ 391.072904][T10742] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1595'. [ 391.094715][T10742] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1595'. [ 391.118915][T10740] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1595'. [ 391.139302][T10741] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1595'. [ 391.305217][T10744] syzkaller0: entered promiscuous mode [ 391.311870][T10744] syzkaller0: entered allmulticast mode [ 391.373755][T10749] syzkaller0: entered promiscuous mode [ 391.379437][T10749] syzkaller0: entered allmulticast mode [ 391.424470][T10754] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1598'. [ 394.339002][T10768] netlink: 'syz.3.1604': attribute type 10 has an invalid length. [ 394.687409][T10779] syzkaller0: entered promiscuous mode [ 394.693479][T10779] syzkaller0: entered allmulticast mode [ 394.701985][T10785] __nla_validate_parse: 3 callbacks suppressed [ 394.702002][T10785] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1607'. [ 394.743592][T10784] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 394.779430][T10787] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1609'. [ 394.800415][T10785] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1607'. [ 394.818081][T10787] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1609'. [ 396.230260][T10777] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1607'. [ 396.239761][T10781] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1609'. [ 396.442580][T10794] netlink: 'syz.2.1614': attribute type 10 has an invalid length. [ 396.461794][T10796] FAULT_INJECTION: forcing a failure. [ 396.461794][T10796] name failslab, interval 1, probability 0, space 0, times 0 [ 396.500352][T10796] CPU: 0 PID: 10796 Comm: syz.3.1615 Not tainted syzkaller #0 [ 396.507880][T10796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 396.517965][T10796] Call Trace: [ 396.521273][T10796] [ 396.524263][T10796] dump_stack_lvl+0x18c/0x250 [ 396.528977][T10796] ? show_regs_print_info+0x20/0x20 [ 396.534188][T10796] ? load_image+0x420/0x420 [ 396.538706][T10796] ? __might_sleep+0xe0/0xe0 [ 396.543317][T10796] ? __lock_acquire+0x7d80/0x7d80 [ 396.548431][T10796] should_fail_ex+0x394/0x4c0 [ 396.553215][T10796] should_failslab+0x9/0x20 [ 396.557762][T10796] slab_pre_alloc_hook+0x59/0x300 [ 396.562819][T10796] kmem_cache_alloc+0x5a/0x2c0 [ 396.567588][T10796] ? ptlock_alloc+0x20/0x70 [ 396.572090][T10796] ptlock_alloc+0x20/0x70 [ 396.576425][T10796] pte_alloc_one+0xcc/0x540 [ 396.581020][T10796] ? pfn_modify_allowed+0x560/0x560 [ 396.586221][T10796] ? hugepage_vma_check+0x471/0x560 [ 396.591432][T10796] handle_mm_fault+0x2f72/0x4a50 [ 396.596377][T10796] ? handle_mm_fault+0xe6/0x4a50 [ 396.601321][T10796] ? numa_migrate_prep+0x350/0x350 [ 396.606445][T10796] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 396.611847][T10796] do_user_addr_fault+0x736/0x12d0 [ 396.616995][T10796] exc_page_fault+0x64/0x100 [ 396.621587][T10796] asm_exc_page_fault+0x26/0x30 [ 396.626443][T10796] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 396.632250][T10796] Code: f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 [ 396.651864][T10796] RSP: 0018:ffffc90003557b90 EFLAGS: 00050202 [ 396.658018][T10796] RAX: ffffffff84342b01 RBX: 0000000000000018 RCX: 0000000000000018 [ 396.665987][T10796] RDX: 0000000000000001 RSI: 000000110c23403f RDI: ffffc90003557c20 [ 396.673955][T10796] RBP: ffffc90003557d88 R08: ffffc90003557c37 R09: 1ffff920006aaf86 [ 396.681940][T10796] R10: dffffc0000000000 R11: fffff520006aaf87 R12: 000000110c234057 [ 396.689910][T10796] R13: 1ffff11004c6e9a5 R14: ffffc90003557c20 R15: 000000110c23403f [ 396.697978][T10796] ? rcuref_put_slowpath+0x101/0x150 [ 396.703281][T10796] _copy_from_user+0x8b/0xe0 [ 396.707872][T10796] ipip6_tunnel_siocdevprivate+0x608/0x16e0 [ 396.713765][T10796] ? do_raw_spin_unlock+0x121/0x230 [ 396.719052][T10796] ? sit_tunnel_xmit+0x2390/0x2390 [ 396.724162][T10796] ? __mutex_lock+0x923/0xc80 [ 396.728838][T10796] ? __mutex_lock+0x4d2/0xc80 [ 396.733514][T10796] ? dev_ioctl+0x83c/0x1140 [ 396.738015][T10796] ? mutex_lock_nested+0x20/0x20 [ 396.742958][T10796] ? full_name_hash+0x92/0xe0 [ 396.747643][T10796] ? dev_ifsioc+0x957/0xc40 [ 396.752154][T10796] dev_ioctl+0x84c/0x1140 [ 396.756483][T10796] sock_ioctl+0x74c/0x7e0 [ 396.760817][T10796] ? sock_poll+0x3e0/0x3e0 [ 396.765246][T10796] ? bpf_lsm_file_ioctl+0x9/0x10 [ 396.770276][T10796] ? security_file_ioctl+0x80/0xa0 [ 396.775391][T10796] ? sock_poll+0x3e0/0x3e0 [ 396.779813][T10796] __se_sys_ioctl+0xfd/0x170 [ 396.784406][T10796] do_syscall_64+0x55/0xb0 [ 396.788824][T10796] ? clear_bhb_loop+0x40/0x90 [ 396.793501][T10796] ? clear_bhb_loop+0x40/0x90 [ 396.798179][T10796] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 396.804073][T10796] RIP: 0033:0x7fbc42d9e159 [ 396.808490][T10796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.828095][T10796] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 396.836530][T10796] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 396.844497][T10796] RDX: 0000200000000900 RSI: 00000000000089f9 RDI: 0000000000000004 [ 396.852464][T10796] RBP: 00007fbc43c18090 R08: 0000000000000000 R09: 0000000000000000 [ 396.860437][T10796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 396.868577][T10796] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 396.876557][T10796] [ 397.148668][T10805] syzkaller0: entered promiscuous mode [ 397.154562][T10805] syzkaller0: entered allmulticast mode [ 397.243338][T10812] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1620'. [ 397.267106][T10812] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1620'. [ 397.279349][T10809] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1620'. [ 397.283525][T10815] FAULT_INJECTION: forcing a failure. [ 397.283525][T10815] name failslab, interval 1, probability 0, space 0, times 0 [ 397.294052][T10810] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1620'. [ 397.312476][T10815] CPU: 0 PID: 10815 Comm: syz.3.1623 Not tainted syzkaller #0 [ 397.319997][T10815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 397.330097][T10815] Call Trace: [ 397.333399][T10815] [ 397.336337][T10815] dump_stack_lvl+0x18c/0x250 [ 397.341034][T10815] ? show_regs_print_info+0x20/0x20 [ 397.346274][T10815] ? load_image+0x420/0x420 [ 397.350787][T10815] ? __might_sleep+0xe0/0xe0 [ 397.355390][T10815] ? __lock_acquire+0x7d80/0x7d80 [ 397.360438][T10815] should_fail_ex+0x394/0x4c0 [ 397.365312][T10815] should_failslab+0x9/0x20 [ 397.369854][T10815] slab_pre_alloc_hook+0x59/0x300 [ 397.374919][T10815] ? __request_module+0x2ed/0x600 [ 397.379964][T10815] ? __request_module+0x2ed/0x600 [ 397.384992][T10815] __kmem_cache_alloc_node+0x53/0x250 [ 397.390386][T10815] ? __request_module+0x2ed/0x600 [ 397.395508][T10815] __kmalloc_node_track_caller+0xa4/0x230 [ 397.401249][T10815] kstrdup+0x3b/0x80 [ 397.405175][T10815] __request_module+0x2ed/0x600 [ 397.410044][T10815] ? module_enforce_rwx_sections+0x150/0x150 [ 397.416044][T10815] ? tcp_ca_find_autoload+0x115/0x240 [ 397.421465][T10815] ? bpf_lsm_capable+0x9/0x10 [ 397.426156][T10815] ? tcp_ca_find_autoload+0x115/0x240 [ 397.431546][T10815] tcp_ca_find_autoload+0x138/0x240 [ 397.436759][T10815] tcp_set_congestion_control+0x11e/0xae0 [ 397.442513][T10815] ? tcp_set_congestion_control+0x6e/0xae0 [ 397.448338][T10815] mptcp_setsockopt+0x25e9/0x3370 [ 397.453385][T10815] ? __fget_files+0x28/0x460 [ 397.457989][T10815] ? pm_nl_exit_net+0x230/0x230 [ 397.462861][T10815] ? aa_af_perm+0x330/0x330 [ 397.467384][T10815] ? __fget_files+0x28/0x460 [ 397.471984][T10815] ? aa_sock_opt_perm+0x74/0x100 [ 397.476931][T10815] ? sock_common_setsockopt+0x36/0xc0 [ 397.482402][T10815] ? sock_common_recvmsg+0x190/0x190 [ 397.487697][T10815] do_sock_setsockopt+0x175/0x1a0 [ 397.492734][T10815] ? __fdget+0x180/0x210 [ 397.496996][T10815] __x64_sys_setsockopt+0x182/0x200 [ 397.502213][T10815] do_syscall_64+0x55/0xb0 [ 397.506640][T10815] ? clear_bhb_loop+0x40/0x90 [ 397.511325][T10815] ? clear_bhb_loop+0x40/0x90 [ 397.516021][T10815] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 397.521930][T10815] RIP: 0033:0x7fbc42d9e159 [ 397.526358][T10815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 397.545974][T10815] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 397.554410][T10815] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 397.562388][T10815] RDX: 000000000000000d RSI: 0000000000000006 RDI: 0000000000000004 [ 397.570362][T10815] RBP: 00007fbc43c18090 R08: 0000000000000004 R09: 0000000000000000 [ 397.578897][T10815] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 397.586901][T10815] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 397.594909][T10815] [ 399.136460][T10822] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 399.346812][T10835] netlink: 'syz.2.1628': attribute type 10 has an invalid length. [ 399.619245][T10848] netlink: get zone limit has 4 unknown bytes [ 399.720560][T10854] FAULT_INJECTION: forcing a failure. [ 399.720560][T10854] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 399.749321][T10854] CPU: 1 PID: 10854 Comm: syz.2.1636 Not tainted syzkaller #0 [ 399.756939][T10854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 399.766563][T10857] __nla_validate_parse: 7 callbacks suppressed [ 399.766578][T10857] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1635'. [ 399.766994][T10854] Call Trace: [ 399.767004][T10854] [ 399.773579][T10857] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1635'. [ 399.782099][T10854] dump_stack_lvl+0x18c/0x250 [ 399.782139][T10854] ? show_regs_print_info+0x20/0x20 [ 399.782161][T10854] ? load_image+0x420/0x420 [ 399.782179][T10854] ? __might_fault+0xaa/0x120 [ 399.782197][T10854] ? __lock_acquire+0x7d80/0x7d80 [ 399.786016][T10851] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1635'. [ 399.788416][T10854] ? __virt_addr_valid+0x10c/0x380 [ 399.788447][T10854] should_fail_ex+0x394/0x4c0 [ 399.788474][T10854] _copy_from_user+0x2f/0xe0 [ 399.807333][T10855] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1635'. [ 399.811810][T10854] sctp_setsockopt+0x19e/0x11e0 [ 399.811845][T10854] ? sock_common_recvmsg+0x190/0x190 [ 399.811868][T10854] do_sock_setsockopt+0x175/0x1a0 [ 399.811889][T10854] ? __fdget+0x180/0x210 [ 399.811910][T10854] __x64_sys_setsockopt+0x182/0x200 [ 399.811935][T10854] do_syscall_64+0x55/0xb0 [ 399.882980][T10854] ? clear_bhb_loop+0x40/0x90 [ 399.887702][T10854] ? clear_bhb_loop+0x40/0x90 [ 399.892418][T10854] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 399.898522][T10854] RIP: 0033:0x7fc3e079e159 [ 399.902975][T10854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 399.922638][T10854] RSP: 002b:00007fc3e1638028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 399.931055][T10854] RAX: ffffffffffffffda RBX: 00007fc3e0a25fa0 RCX: 00007fc3e079e159 [ 399.939041][T10854] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 399.947027][T10854] RBP: 00007fc3e1638090 R08: 0000000000000010 R09: 0000000000000000 [ 399.955022][T10854] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 399.963036][T10854] R13: 00007fc3e0a26038 R14: 00007fc3e0a25fa0 R15: 00007ffc81d2b5e8 [ 399.971038][T10854] [ 400.148167][T10861] syzkaller0: entered promiscuous mode [ 400.155917][T10861] syzkaller0: entered allmulticast mode [ 403.665895][T10868] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 403.689012][T10873] netlink: 'syz.3.1641': attribute type 10 has an invalid length. [ 403.985374][T10894] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1646'. [ 404.002253][T10894] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1646'. [ 404.012733][T10895] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1647'. [ 404.022526][T10895] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1647'. [ 404.042135][T10886] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1646'. [ 404.052844][T10889] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1647'. [ 404.253462][T10903] netlink: 'syz.1.1652': attribute type 10 has an invalid length. [ 404.426669][T10906] syzkaller0: entered promiscuous mode [ 404.441244][T10906] syzkaller0: entered allmulticast mode [ 405.899719][T10929] __nla_validate_parse: 2 callbacks suppressed [ 405.899736][T10929] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1659'. [ 407.267902][T10920] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 407.288813][T10929] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1659'. [ 407.493613][T10938] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1660'. [ 407.549521][T10938] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1660'. [ 407.574362][T10931] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1660'. [ 407.591848][T10936] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1660'. [ 407.647757][T10943] netlink: 71 bytes leftover after parsing attributes in process `syz.1.1665'. [ 407.723208][T10945] netlink: 'syz.0.1664': attribute type 10 has an invalid length. [ 408.060212][T10957] syzkaller0: entered promiscuous mode [ 408.065969][T10957] syzkaller0: entered allmulticast mode [ 408.090561][T10960] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1669'. [ 408.127119][T10961] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1670'. [ 408.160141][T10960] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1669'. [ 409.600890][T10964] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 409.824498][T10976] netlink: 'syz.2.1675': attribute type 11 has an invalid length. [ 409.925659][T10980] FAULT_INJECTION: forcing a failure. [ 409.925659][T10980] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 409.976971][T10980] CPU: 0 PID: 10980 Comm: syz.2.1675 Not tainted syzkaller #0 [ 409.984507][T10980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 409.994619][T10980] Call Trace: [ 409.997912][T10980] [ 410.000840][T10980] dump_stack_lvl+0x18c/0x250 [ 410.005561][T10980] ? show_regs_print_info+0x20/0x20 [ 410.010800][T10980] ? load_image+0x420/0x420 [ 410.015347][T10980] ? __might_fault+0xaa/0x120 [ 410.020088][T10980] ? __lock_acquire+0x7d80/0x7d80 [ 410.025167][T10980] ? unix_ioctl+0x259/0x6b0 [ 410.029753][T10980] should_fail_ex+0x394/0x4c0 [ 410.034490][T10980] _copy_from_user+0x2f/0xe0 [ 410.039107][T10980] sock_do_ioctl+0x190/0x310 [ 410.043728][T10980] ? sock_show_fdinfo+0xb0/0xb0 [ 410.048655][T10980] sock_ioctl+0x5be/0x7e0 [ 410.053028][T10980] ? sock_poll+0x3e0/0x3e0 [ 410.057496][T10980] ? bpf_lsm_file_ioctl+0x9/0x10 [ 410.062499][T10980] ? security_file_ioctl+0x80/0xa0 [ 410.067695][T10980] ? sock_poll+0x3e0/0x3e0 [ 410.072147][T10980] __se_sys_ioctl+0xfd/0x170 [ 410.076800][T10980] do_syscall_64+0x55/0xb0 [ 410.081285][T10980] ? clear_bhb_loop+0x40/0x90 [ 410.086032][T10980] ? clear_bhb_loop+0x40/0x90 [ 410.090777][T10980] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 410.094989][T10983] netlink: 'syz.1.1677': attribute type 10 has an invalid length. [ 410.096690][T10980] RIP: 0033:0x7fc3e079e159 [ 410.096718][T10980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.128668][T10980] RSP: 002b:00007fc3e1617028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 410.137159][T10980] RAX: ffffffffffffffda RBX: 00007fc3e0a26090 RCX: 00007fc3e079e159 [ 410.145200][T10980] RDX: 0000200000000080 RSI: 0000000000008914 RDI: 000000000000000d [ 410.153208][T10980] RBP: 00007fc3e1617090 R08: 0000000000000000 R09: 0000000000000000 [ 410.161219][T10980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 410.169295][T10980] R13: 00007fc3e0a26128 R14: 00007fc3e0a26090 R15: 00007ffc81d2b5e8 [ 410.177322][T10980] [ 410.620717][T10997] syzkaller0: entered promiscuous mode [ 410.626291][T10997] syzkaller0: entered allmulticast mode [ 412.426158][T11001] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 412.449680][T11009] __nla_validate_parse: 17 callbacks suppressed [ 412.449696][T11009] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1685'. [ 412.566445][T11020] netlink: 'syz.2.1689': attribute type 10 has an invalid length. [ 412.797645][T11028] netlink: 'syz.0.1692': attribute type 1 has an invalid length. [ 412.808529][T11028] netlink: 'syz.0.1692': attribute type 3 has an invalid length. [ 412.818510][T11034] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1691'. [ 412.829543][T11028] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1692'. [ 412.854575][T11034] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1691'. [ 412.881754][T11024] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1691'. [ 412.891251][T11031] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1691'. [ 412.910870][T11037] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1693'. [ 412.928892][T11038] netlink: 71 bytes leftover after parsing attributes in process `syz.1.1694'. [ 413.131496][T11044] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1695'. [ 413.140549][T11044] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1695'. [ 413.206212][T11050] netlink: 'syz.2.1698': attribute type 12 has an invalid length. [ 413.271048][T11052] syzkaller0: entered promiscuous mode [ 413.286351][T11052] syzkaller0: entered allmulticast mode [ 415.201615][T11057] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 415.224038][T11064] netlink: 'syz.0.1701': attribute type 10 has an invalid length. [ 415.883749][T11096] netlink: 'syz.0.1712': attribute type 10 has an invalid length. [ 416.157793][T11104] syzkaller0: entered promiscuous mode [ 416.165670][T11108] FAULT_INJECTION: forcing a failure. [ 416.165670][T11108] name failslab, interval 1, probability 0, space 0, times 0 [ 416.167406][T11104] syzkaller0: entered allmulticast mode [ 416.179069][T11108] CPU: 0 PID: 11108 Comm: syz.0.1717 Not tainted syzkaller #0 [ 416.191584][T11108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 416.201666][T11108] Call Trace: [ 416.204967][T11108] [ 416.207918][T11108] dump_stack_lvl+0x18c/0x250 [ 416.212634][T11108] ? show_regs_print_info+0x20/0x20 [ 416.217864][T11108] ? load_image+0x420/0x420 [ 416.222397][T11108] ? __might_sleep+0xe0/0xe0 [ 416.223240][T11107] syzkaller0: entered promiscuous mode [ 416.226997][T11108] ? __lock_acquire+0x7d80/0x7d80 [ 416.237481][T11108] should_fail_ex+0x394/0x4c0 [ 416.242171][T11108] should_failslab+0x9/0x20 [ 416.246679][T11108] slab_pre_alloc_hook+0x59/0x300 [ 416.251714][T11108] kmem_cache_alloc_lru+0x4d/0x2b0 [ 416.256846][T11108] ? __d_alloc+0x31/0x710 [ 416.261172][T11108] __d_alloc+0x31/0x710 [ 416.265323][T11108] ? init_peercred+0x20c/0x2c0 [ 416.270087][T11108] d_alloc_pseudo+0x1d/0x70 [ 416.274614][T11108] alloc_file_pseudo+0xe4/0x210 [ 416.279465][T11108] ? fput+0x1a0/0x1a0 [ 416.283447][T11108] ? put_pid+0xc7/0x120 [ 416.287624][T11108] ? init_peercred+0x263/0x2c0 [ 416.292391][T11108] sock_alloc_file+0xb7/0x280 [ 416.297068][T11108] __sys_socketpair+0x2d0/0x550 [ 416.301918][T11108] __x64_sys_socketpair+0x9b/0xb0 [ 416.306939][T11108] do_syscall_64+0x55/0xb0 [ 416.311354][T11108] ? clear_bhb_loop+0x40/0x90 [ 416.316035][T11108] ? clear_bhb_loop+0x40/0x90 [ 416.320716][T11108] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 416.326610][T11108] RIP: 0033:0x7f1ea559e159 [ 416.331027][T11108] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 416.350634][T11108] RSP: 002b:00007f1ea6436028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 416.359049][T11108] RAX: ffffffffffffffda RBX: 00007f1ea5825fa0 RCX: 00007f1ea559e159 [ 416.367026][T11108] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000001 [ 416.375259][T11108] RBP: 00007f1ea6436090 R08: 0000000000000000 R09: 0000000000000000 [ 416.383245][T11108] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000002 [ 416.391230][T11108] R13: 00007f1ea5826038 R14: 00007f1ea5825fa0 R15: 00007ffc8ec39c08 [ 416.399306][T11108] [ 416.407651][T11107] syzkaller0: entered allmulticast mode [ 418.038418][T11117] __nla_validate_parse: 22 callbacks suppressed [ 418.038435][T11117] netlink: 71 bytes leftover after parsing attributes in process `syz.0.1718'. [ 418.275892][T11128] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1720'. [ 418.296712][T11129] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1721'. [ 419.449889][T11128] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1720'. [ 419.459587][T11129] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1721'. [ 419.618972][T11135] FAULT_INJECTION: forcing a failure. [ 419.618972][T11135] name failslab, interval 1, probability 0, space 0, times 0 [ 419.639205][T11135] CPU: 1 PID: 11135 Comm: syz.3.1724 Not tainted syzkaller #0 [ 419.646733][T11135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 419.656817][T11135] Call Trace: [ 419.660124][T11135] [ 419.663075][T11135] dump_stack_lvl+0x18c/0x250 [ 419.667787][T11135] ? show_regs_print_info+0x20/0x20 [ 419.673009][T11135] ? load_image+0x420/0x420 [ 419.677519][T11135] ? __might_sleep+0xe0/0xe0 [ 419.682111][T11135] ? __lock_acquire+0x7d80/0x7d80 [ 419.687139][T11135] should_fail_ex+0x394/0x4c0 [ 419.691843][T11135] should_failslab+0x9/0x20 [ 419.696347][T11135] slab_pre_alloc_hook+0x59/0x300 [ 419.701401][T11135] ? bpf_dev_bound_resolve_kfunc+0x150/0x150 [ 419.707420][T11135] ? nsim_bpf+0x6eb/0xcd0 [ 419.711777][T11135] __kmem_cache_alloc_node+0x53/0x250 [ 419.717183][T11135] ? nsim_bpf+0x6eb/0xcd0 [ 419.721521][T11135] kmalloc_trace+0x2a/0xe0 [ 419.725950][T11135] nsim_bpf+0x6eb/0xcd0 [ 419.730183][T11135] bpf_map_offload_map_alloc+0x3cf/0x610 [ 419.735841][T11135] ? bpf_prog_offload_info_fill_ns+0x410/0x410 [ 419.742012][T11135] ? __might_fault+0xaa/0x120 [ 419.746702][T11135] ? __lock_acquire+0x7d80/0x7d80 [ 419.751728][T11135] ? array_map_alloc_check+0x254/0x350 [ 419.757194][T11135] map_create+0x877/0x12f0 [ 419.761617][T11135] __sys_bpf+0x651/0x890 [ 419.765862][T11135] ? bpf_link_show_fdinfo+0x560/0x560 [ 419.771244][T11135] ? lock_chain_count+0x20/0x20 [ 419.776106][T11135] __x64_sys_bpf+0x7c/0x90 [ 419.780522][T11135] do_syscall_64+0x55/0xb0 [ 419.784960][T11135] ? clear_bhb_loop+0x40/0x90 [ 419.789645][T11135] ? clear_bhb_loop+0x40/0x90 [ 419.794326][T11135] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 419.800219][T11135] RIP: 0033:0x7fbc42d9e159 [ 419.804654][T11135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.824351][T11135] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 419.832793][T11135] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 419.840784][T11135] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 0000000000000000 [ 419.848761][T11135] RBP: 00007fbc43c18090 R08: 0000000000000000 R09: 0000000000000000 [ 419.856735][T11135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 419.864701][T11135] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 419.872685][T11135] [ 419.949675][T11140] netlink: 'syz.3.1726': attribute type 10 has an invalid length. [ 419.993378][T11141] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1725'. [ 420.002635][T11141] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1725'. [ 420.012814][T11137] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1725'. [ 420.031672][T11139] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1725'. [ 420.173505][T11146] netlink: 71 bytes leftover after parsing attributes in process `syz.1.1728'. [ 420.185226][T11147] netlink: 'syz.0.1727': attribute type 3 has an invalid length. [ 420.660090][T11165] syzkaller0: entered promiscuous mode [ 420.665911][T11165] syzkaller0: entered allmulticast mode [ 422.701178][T11174] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 422.708844][T11174] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 422.721290][T11176] netlink: 'syz.2.1738': attribute type 10 has an invalid length. [ 422.892597][T11180] netlink: 'syz.3.1739': attribute type 10 has an invalid length. [ 422.911714][T11180] ¥: port 1(team0) entered disabled state [ 422.940507][T11180] bridge0: port 3(team0) entered blocking state [ 422.955058][T11180] bridge0: port 3(team0) entered disabled state [ 422.969975][T11180] bridge0: port 3(team0) entered blocking state [ 422.976594][T11180] bridge0: port 3(team0) entered forwarding state [ 423.072998][T11191] __nla_validate_parse: 10 callbacks suppressed [ 423.073017][T11191] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1742'. [ 423.118741][T11191] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1742'. [ 423.128875][T11186] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1742'. [ 423.138710][T11188] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1742'. [ 423.520111][T11205] netlink: 'syz.3.1750': attribute type 10 has an invalid length. [ 423.576322][T11208] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1748'. [ 423.599787][T11208] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1748'. [ 423.615275][T11201] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1748'. [ 423.627577][T11206] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1748'. [ 423.657792][T11211] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1752'. [ 423.944936][T11218] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1755'. [ 424.195286][T11221] syzkaller0: entered promiscuous mode [ 424.217123][T11221] syzkaller0: entered allmulticast mode [ 424.374881][T11234] netlink: 'syz.2.1761': attribute type 10 has an invalid length. [ 426.395234][T11261] netlink: 'syz.3.1771': attribute type 10 has an invalid length. [ 426.654366][T11265] netlink: 'syz.1.1772': attribute type 10 has an invalid length. [ 426.670237][T11265] ¥: port 1(team0) entered disabled state [ 426.690545][T11265] bridge0: port 4(team0) entered blocking state [ 426.698812][T11265] bridge0: port 4(team0) entered disabled state [ 426.724837][T11265] bridge0: port 4(team0) entered blocking state [ 426.731481][T11265] bridge0: port 4(team0) entered forwarding state [ 426.794562][T11271] syzkaller0: entered promiscuous mode [ 426.800456][T11271] syzkaller0: entered allmulticast mode [ 428.873706][T11282] __nla_validate_parse: 22 callbacks suppressed [ 428.873717][T11282] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1777'. [ 428.890448][T11288] netlink: 71 bytes leftover after parsing attributes in process `syz.0.1779'. [ 428.899984][T11296] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1781'. [ 429.161928][T11305] netlink: 'syz.0.1783': attribute type 10 has an invalid length. [ 429.296875][T11313] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1787'. [ 429.339660][T11313] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1787'. [ 429.401029][T11307] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1787'. [ 429.433351][T11311] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1787'. [ 429.659427][T11326] netlink: 71 bytes leftover after parsing attributes in process `syz.3.1792'. [ 429.741665][T11328] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1791'. [ 429.791146][T11328] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1791'. [ 430.244200][T11344] netlink: 'syz.0.1797': attribute type 10 has an invalid length. [ 430.618684][T11354] netlink: 'syz.0.1809': attribute type 10 has an invalid length. [ 430.833283][T11361] FAULT_INJECTION: forcing a failure. [ 430.833283][T11361] name failslab, interval 1, probability 0, space 0, times 0 [ 430.859606][T11361] CPU: 1 PID: 11361 Comm: syz.0.1805 Not tainted syzkaller #0 [ 430.867145][T11361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 430.877232][T11361] Call Trace: [ 430.880534][T11361] [ 430.883486][T11361] dump_stack_lvl+0x18c/0x250 [ 430.888208][T11361] ? show_regs_print_info+0x20/0x20 [ 430.893436][T11361] ? load_image+0x420/0x420 [ 430.897959][T11361] ? __might_sleep+0xe0/0xe0 [ 430.902560][T11361] ? __lock_acquire+0x7d80/0x7d80 [ 430.907615][T11361] should_fail_ex+0x394/0x4c0 [ 430.912335][T11361] should_failslab+0x9/0x20 [ 430.916852][T11361] slab_pre_alloc_hook+0x59/0x300 [ 430.921897][T11361] ? bpf_dev_bound_resolve_kfunc+0x150/0x150 [ 430.927884][T11361] ? nsim_bpf+0x6eb/0xcd0 [ 430.932222][T11361] __kmem_cache_alloc_node+0x53/0x250 [ 430.937610][T11361] ? nsim_bpf+0x6eb/0xcd0 [ 430.941951][T11361] kmalloc_trace+0x2a/0xe0 [ 430.946398][T11361] nsim_bpf+0x6eb/0xcd0 [ 430.950599][T11361] bpf_map_offload_map_alloc+0x3cf/0x610 [ 430.956241][T11361] ? bpf_prog_offload_info_fill_ns+0x410/0x410 [ 430.962399][T11361] ? __might_fault+0xaa/0x120 [ 430.967098][T11361] ? __lock_acquire+0x7d80/0x7d80 [ 430.972155][T11361] ? array_map_alloc_check+0x254/0x350 [ 430.977625][T11361] map_create+0x877/0x12f0 [ 430.982051][T11361] __sys_bpf+0x651/0x890 [ 430.986295][T11361] ? bpf_link_show_fdinfo+0x560/0x560 [ 430.991679][T11361] ? lock_chain_count+0x20/0x20 [ 430.996629][T11361] __x64_sys_bpf+0x7c/0x90 [ 431.001048][T11361] do_syscall_64+0x55/0xb0 [ 431.005487][T11361] ? clear_bhb_loop+0x40/0x90 [ 431.010187][T11361] ? clear_bhb_loop+0x40/0x90 [ 431.014873][T11361] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 431.020771][T11361] RIP: 0033:0x7f1ea559e159 [ 431.025183][T11361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 431.044788][T11361] RSP: 002b:00007f1ea6436028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 431.053208][T11361] RAX: ffffffffffffffda RBX: 00007f1ea5825fa0 RCX: 00007f1ea559e159 [ 431.061213][T11361] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 0000000000000000 [ 431.069195][T11361] RBP: 00007f1ea6436090 R08: 0000000000000000 R09: 0000000000000000 [ 431.077160][T11361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 431.085124][T11361] R13: 00007f1ea5826038 R14: 00007f1ea5825fa0 R15: 00007ffc8ec39c08 [ 431.093103][T11361] [ 431.905042][T11386] netlink: 'syz.2.1813': attribute type 10 has an invalid length. [ 433.074681][T11422] netlink: 'syz.1.1827': attribute type 10 has an invalid length. [ 433.922346][T11457] netlink: 'syz.3.1840': attribute type 10 has an invalid length. [ 434.260867][T11464] __nla_validate_parse: 28 callbacks suppressed [ 434.260883][T11464] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1842'. [ 434.321414][T11465] syzkaller0: entered allmulticast mode [ 434.470647][T11475] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1845'. [ 434.499671][T11475] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1845'. [ 434.522982][T11469] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1845'. [ 434.563508][T11472] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1845'. [ 434.874585][T11489] netlink: 'syz.2.1852': attribute type 10 has an invalid length. [ 435.030163][T11494] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1854'. [ 435.524450][T11502] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1858'. [ 435.677084][T11506] bridge0: port 4(team0) entered disabled state [ 435.684202][T11506] bridge0: port 3(batadv0) entered disabled state [ 435.692559][T11506] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.700499][T11506] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.718763][T11506] bridge0: entered allmulticast mode [ 435.816574][T11512] bridge0: port 4(team0) entered blocking state [ 435.823133][T11512] bridge0: port 4(team0) entered forwarding state [ 435.829991][T11512] bridge0: port 3(batadv0) entered blocking state [ 435.836682][T11512] bridge0: port 3(batadv0) entered forwarding state [ 435.843659][T11512] bridge0: port 2(bridge_slave_1) entered blocking state [ 435.850912][T11512] bridge0: port 2(bridge_slave_1) entered forwarding state [ 435.858510][T11512] bridge0: port 1(bridge_slave_0) entered blocking state [ 435.865854][T11512] bridge0: port 1(bridge_slave_0) entered forwarding state [ 435.931516][T11512] bridge0: entered promiscuous mode [ 436.222769][T11522] netlink: 'syz.1.1865': attribute type 10 has an invalid length. [ 436.240234][T11520] FAULT_INJECTION: forcing a failure. [ 436.240234][T11520] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 436.268316][T11520] CPU: 0 PID: 11520 Comm: syz.0.1864 Not tainted syzkaller #0 [ 436.275843][T11520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 436.285925][T11520] Call Trace: [ 436.289222][T11520] [ 436.292173][T11520] dump_stack_lvl+0x18c/0x250 [ 436.296881][T11520] ? show_regs_print_info+0x20/0x20 [ 436.302111][T11520] ? load_image+0x420/0x420 [ 436.306643][T11520] ? __might_fault+0xaa/0x120 [ 436.311354][T11520] ? __lock_acquire+0x7d80/0x7d80 [ 436.316419][T11520] ? __virt_addr_valid+0x10c/0x380 [ 436.321570][T11520] should_fail_ex+0x394/0x4c0 [ 436.326298][T11520] _copy_from_user+0x2f/0xe0 [ 436.330952][T11520] ___bpf_copy_key+0xb0/0x100 [ 436.335666][T11520] map_update_elem+0x265/0x710 [ 436.340506][T11520] __sys_bpf+0x6b5/0x890 [ 436.344787][T11520] ? read_tsc+0x9/0x20 [ 436.348897][T11520] ? bpf_link_show_fdinfo+0x560/0x560 [ 436.354313][T11520] ? lock_chain_count+0x20/0x20 [ 436.359194][T11520] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 436.365212][T11520] __x64_sys_bpf+0x7c/0x90 [ 436.369662][T11520] do_syscall_64+0x55/0xb0 [ 436.374121][T11520] ? clear_bhb_loop+0x40/0x90 [ 436.378828][T11520] ? clear_bhb_loop+0x40/0x90 [ 436.383540][T11520] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 436.389466][T11520] RIP: 0033:0x7f1ea559e159 [ 436.393917][T11520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 436.413549][T11520] RSP: 002b:00007f1ea6436028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 436.421998][T11520] RAX: ffffffffffffffda RBX: 00007f1ea5825fa0 RCX: 00007f1ea559e159 [ 436.430000][T11520] RDX: 0000000000000020 RSI: 00002000000002c0 RDI: 0000000000000002 [ 436.437996][T11520] RBP: 00007f1ea6436090 R08: 0000000000000000 R09: 0000000000000000 [ 436.445994][T11520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 436.453995][T11520] R13: 00007f1ea5826038 R14: 00007f1ea5825fa0 R15: 00007ffc8ec39c08 [ 436.462105][T11520] [ 436.782801][T11529] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1869'. [ 437.344845][T11538] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 437.567621][T11547] netlink: 'syz.2.1875': attribute type 10 has an invalid length. [ 437.770775][T11558] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1877'. [ 437.788052][T11558] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1877'. [ 438.954754][T11585] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 439.057973][T11588] netlink: 'syz.2.1889': attribute type 10 has an invalid length. [ 439.545986][T11593] __nla_validate_parse: 11 callbacks suppressed [ 439.546003][T11593] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1890'. [ 439.581237][T11593] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1890'. [ 439.601192][T11591] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1890'. [ 439.616259][T11592] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1890'. [ 439.685684][T11599] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 439.736492][T11604] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 439.759484][T11604] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 439.820819][T11597] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 439.830586][T11600] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 440.164103][T11614] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1897'. [ 440.201674][T11616] netlink: 'syz.3.1898': attribute type 10 has an invalid length. [ 440.285939][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.298329][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.313607][T11620] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1900'. [ 441.162670][T11639] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 441.690820][T11652] netlink: 'syz.2.1909': attribute type 10 has an invalid length. [ 442.520458][T11681] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 442.764107][T11687] syzkaller0: entered promiscuous mode [ 442.769682][T11687] syzkaller0: entered allmulticast mode [ 442.796536][T11689] netlink: 'syz.3.1922': attribute type 10 has an invalid length. [ 444.581901][T11718] __nla_validate_parse: 33 callbacks suppressed [ 444.581918][T11718] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1928'. [ 444.598237][T11718] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1928'. [ 444.631930][T11710] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1928'. [ 444.663232][T11720] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1929'. [ 444.663774][T11714] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1928'. [ 444.701039][T11720] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1929'. [ 444.743330][T11716] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1929'. [ 444.839313][T11719] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1929'. [ 445.030393][T11726] netlink: 'syz.3.1933': attribute type 10 has an invalid length. [ 445.220900][T11735] syzkaller0: entered promiscuous mode [ 445.248471][T11735] syzkaller0: entered allmulticast mode [ 445.430040][T11742] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1946'. [ 447.200987][T11750] syzkaller0: entered promiscuous mode [ 447.214794][T11750] syzkaller0: entered allmulticast mode [ 447.322830][T11769] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1941'. [ 448.696382][T11765] netlink: 'syz.0.1943': attribute type 10 has an invalid length. [ 449.140075][T11786] netlink: 'syz.1.1951': attribute type 4 has an invalid length. [ 449.188412][T11786] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 449.333953][T11791] netlink: 'syz.3.1953': attribute type 10 has an invalid length. [ 449.659904][T11799] __nla_validate_parse: 11 callbacks suppressed [ 449.659923][T11799] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1955'. [ 449.685029][T11799] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1955'. [ 449.706748][T11796] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1955'. [ 449.754724][T11801] syzkaller0: entered promiscuous mode [ 449.760428][T11801] syzkaller0: entered allmulticast mode [ 449.768412][T11798] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1955'. [ 449.878750][T11803] netlink: 71 bytes leftover after parsing attributes in process `syz.1.1957'. [ 450.224563][T11812] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1959'. [ 452.170496][T11812] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1959'. [ 452.319226][T11826] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1963'. [ 452.388656][T11828] netlink: 'syz.3.1964': attribute type 4 has an invalid length. [ 452.404523][T11828] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1964'. [ 452.542853][T11828] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 452.590484][T11836] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1966'. [ 453.222655][T11850] syzkaller0: entered promiscuous mode [ 453.229466][T11850] syzkaller0: entered allmulticast mode [ 455.254701][T11870] __nla_validate_parse: 6 callbacks suppressed [ 455.254735][T11870] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1977'. [ 455.260698][T11876] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1976'. [ 455.292731][T11876] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1976'. [ 455.308798][T11868] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1976'. [ 455.318596][T11871] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1976'. [ 455.349883][T11873] netlink: 71 bytes leftover after parsing attributes in process `syz.0.1978'. [ 455.648308][T11879] netlink: 'syz.2.1980': attribute type 4 has an invalid length. [ 455.657987][T11879] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1980'. [ 455.743408][T11879] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 455.795140][T11883] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1982'. [ 456.008866][T11892] netlink: 71 bytes leftover after parsing attributes in process `syz.3.1984'. [ 456.072112][T11891] FAULT_INJECTION: forcing a failure. [ 456.072112][T11891] name failslab, interval 1, probability 0, space 0, times 0 [ 456.097817][T11891] CPU: 0 PID: 11891 Comm: syz.2.1985 Not tainted syzkaller #0 [ 456.105378][T11891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 456.115486][T11891] Call Trace: [ 456.118813][T11891] [ 456.121786][T11891] dump_stack_lvl+0x18c/0x250 [ 456.126525][T11891] ? show_regs_print_info+0x20/0x20 [ 456.131773][T11891] ? load_image+0x420/0x420 [ 456.136331][T11891] ? __might_sleep+0xe0/0xe0 [ 456.140967][T11891] ? __lock_acquire+0x7d80/0x7d80 [ 456.146062][T11891] should_fail_ex+0x394/0x4c0 [ 456.150893][T11891] should_failslab+0x9/0x20 [ 456.155441][T11891] slab_pre_alloc_hook+0x59/0x300 [ 456.160516][T11891] ? tomoyo_encode+0x2ad/0x570 [ 456.165318][T11891] ? tomoyo_encode+0x2ad/0x570 [ 456.170121][T11891] __kmem_cache_alloc_node+0x53/0x250 [ 456.175566][T11891] ? tomoyo_encode+0x2ad/0x570 [ 456.180365][T11891] __kmalloc+0xa7/0x240 [ 456.184578][T11891] tomoyo_encode+0x2ad/0x570 [ 456.189229][T11891] tomoyo_realpath_from_path+0x57c/0x5c0 [ 456.194907][T11891] ? tomoyo_domain+0xd6/0x120 [ 456.199648][T11891] tomoyo_path_number_perm+0x248/0x5e0 [ 456.205161][T11891] ? tomoyo_path_number_perm+0x217/0x5e0 [ 456.210843][T11891] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 456.216356][T11891] ? ksys_write+0x1d2/0x260 [ 456.221015][T11891] ? __fget_files+0x28/0x460 [ 456.225687][T11891] security_file_ioctl+0x70/0xa0 [ 456.230679][T11891] __se_sys_ioctl+0x48/0x170 [ 456.235320][T11891] do_syscall_64+0x55/0xb0 [ 456.239779][T11891] ? clear_bhb_loop+0x40/0x90 [ 456.244520][T11891] ? clear_bhb_loop+0x40/0x90 [ 456.249266][T11891] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 456.255208][T11891] RIP: 0033:0x7fc3e079e159 [ 456.259680][T11891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 456.279343][T11891] RSP: 002b:00007fc3e1638028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 456.287810][T11891] RAX: ffffffffffffffda RBX: 00007fc3e0a25fa0 RCX: 00007fc3e079e159 [ 456.295826][T11891] RDX: 00002000000013c0 RSI: 000000004008240b RDI: 0000000000000007 [ 456.303847][T11891] RBP: 00007fc3e1638090 R08: 0000000000000000 R09: 0000000000000000 [ 456.311857][T11891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.319862][T11891] R13: 00007fc3e0a26038 R14: 00007fc3e0a25fa0 R15: 00007ffc81d2b5e8 [ 456.327920][T11891] [ 456.350171][T11891] ERROR: Out of memory at tomoyo_realpath_from_path. [ 456.650809][T11898] syzkaller0: entered promiscuous mode [ 456.659383][T11898] syzkaller0: entered allmulticast mode [ 456.903274][T11911] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1990'. [ 458.821366][T11926] netlink: 'syz.0.1994': attribute type 4 has an invalid length. [ 458.911687][T11926] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 459.029458][T11929] netlink: 'syz.2.1996': attribute type 6 has an invalid length. [ 459.500541][T11942] syzkaller0: entered promiscuous mode [ 459.513345][T11942] syzkaller0: entered allmulticast mode [ 461.367025][T11954] __nla_validate_parse: 10 callbacks suppressed [ 461.367038][T11954] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2005'. [ 461.839656][T11967] netlink: 71 bytes leftover after parsing attributes in process `syz.3.2011'. [ 462.224681][T11975] syzkaller0: entered promiscuous mode [ 462.232780][T11975] syzkaller0: entered allmulticast mode [ 462.406988][T11982] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2014'. [ 463.009213][T11989] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2015'. [ 463.937705][T11982] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2014'. [ 463.947667][T11989] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2015'. [ 464.206815][T12001] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2021'. [ 464.357601][T12006] netlink: 71 bytes leftover after parsing attributes in process `syz.3.2023'. [ 464.624871][T12015] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2027'. [ 464.638808][T12016] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2025'. [ 464.877863][T12021] syzkaller0: entered promiscuous mode [ 464.888295][T12021] syzkaller0: entered allmulticast mode [ 466.735401][T12029] syzkaller0: entered promiscuous mode [ 466.755507][T12029] syzkaller0: entered allmulticast mode [ 468.755548][T12040] __nla_validate_parse: 3 callbacks suppressed [ 468.755562][T12040] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2033'. [ 468.771479][T12048] netlink: 71 bytes leftover after parsing attributes in process `syz.3.2035'. [ 468.925451][T12074] FAULT_INJECTION: forcing a failure. [ 468.925451][T12074] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 468.965452][T12074] CPU: 0 PID: 12074 Comm: syz.3.2039 Not tainted syzkaller #0 [ 468.972985][T12074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 468.979695][T12079] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2037'. [ 468.983045][T12074] Call Trace: [ 468.983057][T12074] [ 468.983065][T12074] dump_stack_lvl+0x18c/0x250 [ 469.002981][T12074] ? show_regs_print_info+0x20/0x20 [ 469.008207][T12074] ? load_image+0x420/0x420 [ 469.011257][T12079] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2037'. [ 469.012840][T12074] ? __might_fault+0xaa/0x120 [ 469.026518][T12074] ? __lock_acquire+0x7d80/0x7d80 [ 469.031611][T12074] ? __virt_addr_valid+0x10c/0x380 [ 469.036757][T12074] should_fail_ex+0x394/0x4c0 [ 469.041559][T12074] _copy_to_user+0x2f/0xa0 [ 469.045976][T12074] generic_map_lookup_batch+0x8ba/0xc60 [ 469.051549][T12074] ? bpf_map_update_value+0x710/0x710 [ 469.057010][T12074] ? __fdget+0x180/0x210 [ 469.061282][T12074] ? bpf_map_update_value+0x710/0x710 [ 469.066737][T12074] bpf_map_do_batch+0x2e3/0x600 [ 469.071609][T12074] ? bpf_lsm_bpf+0x9/0x10 [ 469.075939][T12074] ? security_bpf+0x7e/0xa0 [ 469.080472][T12074] __sys_bpf+0x7d7/0x890 [ 469.084719][T12074] ? bpf_link_show_fdinfo+0x560/0x560 [ 469.090097][T12074] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 469.096376][T12074] __x64_sys_bpf+0x7c/0x90 [ 469.100789][T12074] do_syscall_64+0x55/0xb0 [ 469.105204][T12074] ? clear_bhb_loop+0x40/0x90 [ 469.109877][T12074] ? clear_bhb_loop+0x40/0x90 [ 469.114551][T12074] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 469.120445][T12074] RIP: 0033:0x7fbc42d9e159 [ 469.124857][T12074] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 469.144462][T12074] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 469.152875][T12074] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 469.160840][T12074] RDX: 0000000000000038 RSI: 00002000000001c0 RDI: 0000000000000018 [ 469.168806][T12074] RBP: 00007fbc43c18090 R08: 0000000000000000 R09: 0000000000000000 [ 469.176770][T12074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 469.184733][T12074] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 469.192730][T12074] [ 469.218438][T12082] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2041'. [ 469.230265][T12072] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2037'. [ 469.239893][T12077] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2037'. [ 469.458358][T12088] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2042'. [ 469.506075][T12090] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2043'. [ 469.523134][T12090] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2043'. [ 470.081659][T12106] syzkaller0: entered promiscuous mode [ 470.089095][T12106] syzkaller0: entered allmulticast mode [ 471.727595][T12118] syzkaller0: entered promiscuous mode [ 471.734286][T12118] syzkaller0: entered allmulticast mode [ 473.476020][T12133] netlink: 'syz.1.2054': attribute type 13 has an invalid length. [ 473.493157][T12133] erspan0: refused to change device tx_queue_len [ 473.499609][T12133] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 473.764176][T12151] __nla_validate_parse: 23 callbacks suppressed [ 473.764194][T12151] netlink: 71 bytes leftover after parsing attributes in process `syz.0.2061'. [ 473.913501][T12159] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2062'. [ 473.951767][T12159] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2062'. [ 473.961488][T12161] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2063'. [ 473.974293][T12154] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2062'. [ 473.984880][T12161] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2063'. [ 473.998600][T12157] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2062'. [ 474.015485][T12156] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2063'. [ 474.024990][T12158] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2063'. [ 474.233535][T12173] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2065'. [ 474.579893][T12177] syzkaller0: entered promiscuous mode [ 474.611441][T12177] syzkaller0: entered allmulticast mode [ 477.162075][T12210] syzkaller0: entered promiscuous mode [ 477.172376][T12210] syzkaller0: entered allmulticast mode [ 478.939851][T12228] __nla_validate_parse: 17 callbacks suppressed [ 478.939888][T12228] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2085'. [ 478.956404][T12231] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.2088'. [ 479.019432][T12234] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2087'. [ 479.038688][T12234] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2087'. [ 479.049834][T12232] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2087'. [ 479.062010][T12233] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2087'. [ 479.234283][T12238] netlink: 71 bytes leftover after parsing attributes in process `syz.1.2090'. [ 479.415084][T12240] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2089'. [ 479.640970][T12253] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2093'. [ 479.659572][T12254] netlink: 'syz.0.2096': attribute type 10 has an invalid length. [ 479.675860][T12256] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2097'. [ 479.769279][T12258] syzkaller0: entered promiscuous mode [ 479.796923][T12258] syzkaller0: entered allmulticast mode [ 481.975162][T12282] netlink: 'syz.3.2106': attribute type 3 has an invalid length. [ 482.002497][T12282] netlink: 'syz.3.2106': attribute type 2 has an invalid length. [ 482.010493][T12283] netlink: 'syz.3.2106': attribute type 3 has an invalid length. [ 482.030950][T12283] netlink: 'syz.3.2106': attribute type 2 has an invalid length. [ 482.058143][T12285] netlink: 'syz.1.2108': attribute type 10 has an invalid length. [ 483.300664][T12314] syzkaller0: entered promiscuous mode [ 483.306492][T12314] syzkaller0: entered allmulticast mode [ 483.435930][T12318] netlink: 'syz.0.2120': attribute type 10 has an invalid length. [ 483.622219][T12324] FAULT_INJECTION: forcing a failure. [ 483.622219][T12324] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.636801][T12324] CPU: 0 PID: 12324 Comm: syz.0.2123 Not tainted syzkaller #0 [ 483.644316][T12324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 483.654409][T12324] Call Trace: [ 483.657685][T12324] [ 483.660633][T12324] dump_stack_lvl+0x18c/0x250 [ 483.665340][T12324] ? show_regs_print_info+0x20/0x20 [ 483.670567][T12324] ? load_image+0x420/0x420 [ 483.675079][T12324] ? __might_fault+0xaa/0x120 [ 483.679754][T12324] ? __lock_acquire+0x7d80/0x7d80 [ 483.684776][T12324] should_fail_ex+0x394/0x4c0 [ 483.689459][T12324] _copy_from_user+0x2f/0xe0 [ 483.694068][T12324] ___sys_sendmsg+0x1c7/0x360 [ 483.698893][T12324] ? __sys_sendmsg+0x2b0/0x2b0 [ 483.703663][T12324] ? trace_call_bpf+0xc3/0x6c0 [ 483.708455][T12324] __se_sys_sendmsg+0x1d0/0x2c0 [ 483.713304][T12324] ? perf_trace_preemptirq_template+0x269/0x330 [ 483.719579][T12324] ? __x64_sys_sendmsg+0x80/0x80 [ 483.724538][T12324] ? lockdep_hardirqs_on+0x98/0x150 [ 483.729834][T12324] do_syscall_64+0x55/0xb0 [ 483.734286][T12324] ? clear_bhb_loop+0x40/0x90 [ 483.738984][T12324] ? clear_bhb_loop+0x40/0x90 [ 483.743689][T12324] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 483.749703][T12324] RIP: 0033:0x7f1ea559e159 [ 483.754152][T12324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.773757][T12324] RSP: 002b:00007f1ea6436028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 483.782173][T12324] RAX: ffffffffffffffda RBX: 00007f1ea5825fa0 RCX: 00007f1ea559e159 [ 483.790155][T12324] RDX: 0000000000048110 RSI: 0000200000000b40 RDI: 0000000000000003 [ 483.798225][T12324] RBP: 00007f1ea6436090 R08: 0000000000000000 R09: 0000000000000000 [ 483.806223][T12324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.814218][T12324] R13: 00007f1ea5826038 R14: 00007f1ea5825fa0 R15: 00007ffc8ec39c08 [ 483.822289][T12324] [ 484.344378][T12332] __nla_validate_parse: 14 callbacks suppressed [ 484.344390][T12332] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2126'. [ 485.215699][T12321] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2122'. [ 485.284406][T12316] syzkaller0: entered promiscuous mode [ 485.290083][T12316] syzkaller0: entered allmulticast mode [ 487.291765][T12332] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2126'. [ 487.300928][T12336] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2128'. [ 487.310860][T12339] netlink: 71 bytes leftover after parsing attributes in process `syz.3.2129'. [ 487.430801][T12347] netlink: 'syz.3.2131': attribute type 10 has an invalid length. [ 487.506567][T12351] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2140'. [ 487.830958][T12359] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2135'. [ 488.032837][T12361] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2136'. [ 488.126561][T12369] netlink: 71 bytes leftover after parsing attributes in process `syz.1.2141'. [ 488.196785][T12372] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2138'. [ 488.439227][T12380] netlink: 'syz.3.2143': attribute type 10 has an invalid length. [ 488.592741][T12386] netlink: 'syz.2.2146': attribute type 5 has an invalid length. [ 488.862853][T12399] netlink: 'syz.2.2150': attribute type 5 has an invalid length. [ 489.455182][T12412] __nla_validate_parse: 82 callbacks suppressed [ 489.455201][T12412] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2152'. [ 489.504242][T12414] netlink: 71 bytes leftover after parsing attributes in process `syz.2.2154'. [ 489.541247][T12412] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2152'. [ 489.558513][T12410] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2152'. [ 489.584842][T12411] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2152'. [ 489.918580][T12419] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2156'. [ 489.957371][T12423] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.2158'. [ 490.243484][T12428] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 490.281221][T12434] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2161'. [ 490.312650][T12435] netlink: 21 bytes leftover after parsing attributes in process `syz.0.2162'. [ 490.331393][T12435] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 490.359572][T12434] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2161'. [ 491.383696][T12470] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 491.527733][T12475] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 491.546052][T12475] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 492.057888][T12486] syzkaller0: entered promiscuous mode [ 492.064056][T12486] syzkaller0: entered allmulticast mode [ 494.111877][T12514] FAULT_INJECTION: forcing a failure. [ 494.111877][T12514] name failslab, interval 1, probability 0, space 0, times 0 [ 494.124679][T12514] CPU: 0 PID: 12514 Comm: syz.3.2187 Not tainted syzkaller #0 [ 494.132166][T12514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 494.142248][T12514] Call Trace: [ 494.145550][T12514] [ 494.148502][T12514] dump_stack_lvl+0x18c/0x250 [ 494.153224][T12514] ? show_regs_print_info+0x20/0x20 [ 494.158450][T12514] ? load_image+0x420/0x420 [ 494.162984][T12514] ? __might_sleep+0xe0/0xe0 [ 494.167625][T12514] ? __lock_acquire+0x7d80/0x7d80 [ 494.172666][T12514] should_fail_ex+0x394/0x4c0 [ 494.177370][T12514] should_failslab+0x9/0x20 [ 494.181890][T12514] slab_pre_alloc_hook+0x59/0x300 [ 494.186970][T12514] ? bpf_dev_bound_resolve_kfunc+0x150/0x150 [ 494.192951][T12514] ? nsim_bpf+0x6eb/0xcd0 [ 494.197313][T12514] __kmem_cache_alloc_node+0x53/0x250 [ 494.202689][T12514] ? nsim_bpf+0x6eb/0xcd0 [ 494.207020][T12514] kmalloc_trace+0x2a/0xe0 [ 494.211439][T12514] nsim_bpf+0x6eb/0xcd0 [ 494.215598][T12514] bpf_map_offload_map_alloc+0x3cf/0x610 [ 494.221234][T12514] ? bpf_prog_offload_info_fill_ns+0x410/0x410 [ 494.227396][T12514] ? __might_fault+0xaa/0x120 [ 494.232072][T12514] ? __lock_acquire+0x7d80/0x7d80 [ 494.237097][T12514] ? array_map_alloc_check+0x254/0x350 [ 494.242563][T12514] map_create+0x877/0x12f0 [ 494.246986][T12514] __sys_bpf+0x651/0x890 [ 494.251230][T12514] ? bpf_link_show_fdinfo+0x560/0x560 [ 494.256613][T12514] ? lock_chain_count+0x20/0x20 [ 494.261471][T12514] __x64_sys_bpf+0x7c/0x90 [ 494.265884][T12514] do_syscall_64+0x55/0xb0 [ 494.270297][T12514] ? clear_bhb_loop+0x40/0x90 [ 494.274975][T12514] ? clear_bhb_loop+0x40/0x90 [ 494.279658][T12514] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 494.285560][T12514] RIP: 0033:0x7fbc42d9e159 [ 494.289982][T12514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 494.309612][T12514] RSP: 002b:00007fbc43c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 494.318030][T12514] RAX: ffffffffffffffda RBX: 00007fbc43025fa0 RCX: 00007fbc42d9e159 [ 494.326157][T12514] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 0000000000000000 [ 494.334132][T12514] RBP: 00007fbc43c18090 R08: 0000000000000000 R09: 0000000000000000 [ 494.342103][T12514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.350072][T12514] R13: 00007fbc43026038 R14: 00007fbc43025fa0 R15: 00007ffd2da180a8 [ 494.358054][T12514] [ 494.479301][T12516] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 494.511187][T12519] __nla_validate_parse: 25 callbacks suppressed [ 494.511208][T12519] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2184'. [ 494.536533][T12509] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2184'. [ 494.562667][T12524] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2190'. [ 494.588365][T12518] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2184'. [ 494.901729][T12530] netlink: 'syz.1.2191': attribute type 39 has an invalid length. [ 495.069002][T12533] ================================================================== [ 495.077128][T12533] BUG: KASAN: slab-out-of-bounds in stack_map_get_build_id_offset+0x6c0/0x720 [ 495.086021][T12533] Write of size 4 at addr ffff888025fdeb30 by task syz.0.2192/12533 [ 495.094021][T12533] [ 495.096354][T12533] CPU: 1 PID: 12533 Comm: syz.0.2192 Not tainted syzkaller #0 [ 495.103829][T12533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 495.113907][T12533] Call Trace: [ 495.117208][T12533] [ 495.120156][T12533] dump_stack_lvl+0x18c/0x250 [ 495.124867][T12533] ? __lock_acquire+0x7d80/0x7d80 [ 495.129960][T12533] ? show_regs_print_info+0x20/0x20 [ 495.135192][T12533] ? load_image+0x420/0x420 [ 495.139738][T12533] ? __virt_addr_valid+0x10c/0x380 [ 495.144882][T12533] ? __virt_addr_valid+0x10c/0x380 [ 495.150030][T12533] ? __virt_addr_valid+0x10c/0x380 [ 495.155180][T12533] print_report+0xa8/0x210 [ 495.159647][T12533] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 495.165823][T12533] kasan_report+0x117/0x150 [ 495.170356][T12533] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 495.176546][T12533] stack_map_get_build_id_offset+0x6c0/0x720 [ 495.182558][T12533] ? pcpu_freelist_pop+0x12a/0x190 [ 495.187699][T12533] ? __bpf_get_stackid+0x900/0x900 [ 495.192844][T12533] ? perf_get_regs_user+0x5bb/0x6b0 [ 495.198071][T12533] ? perf_reg_abi+0x62/0x90 [ 495.202630][T12533] __bpf_get_stackid+0x564/0x900 [ 495.207602][T12533] bpf_get_stackid_pe+0x343/0x410 [ 495.212664][T12533] bpf_prog_2414a5d5030ea31b+0x29/0x2d [ 495.218159][T12533] bpf_overflow_handler+0x1fc/0x510 [ 495.223401][T12533] ? bpf_overflow_handler+0xde/0x510 [ 495.228726][T12533] ? tp_perf_event_destroy+0x20/0x20 [ 495.234055][T12533] ? perf_trace_preemptirq_template+0x144/0x330 [ 495.240329][T12533] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 495.247570][T12533] ? __perf_event_account_interrupt+0x187/0x280 [ 495.253845][T12533] __perf_event_overflow+0x461/0x660 [ 495.259158][T12533] perf_swevent_event+0x319/0x570 [ 495.264211][T12533] ? perf_tp_event+0x1550/0x1550 [ 495.269266][T12533] ___perf_sw_event+0x4ab/0x730 [ 495.274142][T12533] ? ___perf_sw_event+0x19e/0x730 [ 495.279185][T12533] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 495.285715][T12533] ? __lock_acquire+0x1336/0x7d80 [ 495.290758][T12533] ? rep_movs_alternative+0x33/0x90 [ 495.295992][T12533] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 495.302007][T12533] ? lock_chain_count+0x20/0x20 [ 495.306895][T12533] __perf_sw_event+0x139/0x270 [ 495.311685][T12533] do_user_addr_fault+0x1242/0x12d0 [ 495.316925][T12533] ? rcu_is_watching+0x15/0xb0 [ 495.321733][T12533] exc_page_fault+0x64/0x100 [ 495.326344][T12533] asm_exc_page_fault+0x26/0x30 [ 495.331219][T12533] RIP: 0010:rep_movs_alternative+0x33/0x90 [ 495.337056][T12533] Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb [ 495.356779][T12533] RSP: 0018:ffffc9001939ed50 EFLAGS: 00050212 [ 495.362872][T12533] RAX: 3d65707974203152 RBX: 0000000000000016 RCX: 0000000000000016 [ 495.370879][T12533] RDX: 0000000000000000 RSI: ffff88805f33068c RDI: 000000000000cf3d [ 495.378872][T12533] RBP: ffff88805f330668 R08: ffff88805f3306a1 R09: 1ffff1100be660d4 [ 495.386866][T12533] R10: dffffc0000000000 R11: ffffed100be660d5 R12: 000000000000cf53 [ 495.394859][T12533] R13: 0000000000000016 R14: 000000000000cf3d R15: ffff88805f33068c [ 495.402869][T12533] _copy_to_user+0x85/0xa0 [ 495.407320][T12533] bpf_verifier_vlog+0x432/0x840 [ 495.412305][T12533] verbose+0x11e/0x1a0 [ 495.416406][T12533] ? kfunc_btf_cmp_by_off+0x90/0x90 [ 495.421644][T12533] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 495.427221][T12533] ? __check_reg_arg+0x4ec/0x800 [ 495.432177][T12533] ? mark_reg_read+0x3fc/0x500 [ 495.436972][T12533] check_helper_call+0x597f/0x6340 [ 495.442129][T12533] ? check_kfunc_call+0x4ca0/0x4ca0 [ 495.447361][T12533] ? push_jmp_history+0x14b/0x4f0 [ 495.452413][T12533] ? rcu_is_watching+0x15/0xb0 [ 495.457213][T12533] ? krealloc+0xf2/0x120 [ 495.461478][T12533] ? push_jmp_history+0x15c/0x4f0 [ 495.466537][T12533] do_check+0x87fb/0xd0a0 [ 495.470898][T12533] ? __stack_depot_save+0x1f/0x660 [ 495.476038][T12533] ? __kasan_kmalloc+0x8f/0xa0 [ 495.480823][T12533] ? __sys_bpf+0x5ba/0x890 [ 495.485256][T12533] ? __x64_sys_bpf+0x7c/0x90 [ 495.489864][T12533] ? do_syscall_64+0x55/0xb0 [ 495.494507][T12533] ? init_func_state+0x2d10/0x2d10 [ 495.499638][T12533] ? __asan_memset+0x22/0x40 [ 495.504254][T12533] ? init_func_state+0x1dc6/0x2d10 [ 495.509392][T12533] ? btf_check_subprog_arg_match+0x142/0x2a0 [ 495.515409][T12533] do_check_common+0xacc/0x1410 [ 495.520297][T12533] bpf_check+0x65df/0xec40 [ 495.524774][T12533] ? bpf_get_btf_vmlinux+0x20/0x20 [ 495.530009][T12533] ? __lock_acquire+0x7d80/0x7d80 [ 495.535065][T12533] ? mark_lock+0x94/0x320 [ 495.539419][T12533] ? __lock_acquire+0x1336/0x7d80 [ 495.544457][T12533] ? trace_call_bpf+0xc3/0x6c0 [ 495.549251][T12533] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 495.555083][T12533] ? verify_lock_unused+0x140/0x140 [ 495.560308][T12533] ? perf_trace_lock_acquire+0x342/0x400 [ 495.565966][T12533] ? perf_trace_lock+0xfc/0x3b0 [ 495.570888][T12533] ? trace_event_raw_event_lock+0x240/0x240 [ 495.576826][T12533] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 495.582830][T12533] ? __lock_acquire+0x7d80/0x7d80 [ 495.587882][T12533] ? lock_chain_count+0x20/0x20 [ 495.592759][T12533] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 495.599030][T12533] ? lockdep_hardirqs_on+0x98/0x150 [ 495.604245][T12533] ? ktime_get_with_offset+0x103/0x330 [ 495.609714][T12533] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 495.615971][T12533] ? ktime_get_real_ts64+0x440/0x440 [ 495.621285][T12533] ? do_raw_spin_unlock+0x121/0x230 [ 495.626517][T12533] ? bpf_obj_name_cpy+0x194/0x1e0 [ 495.631560][T12533] bpf_prog_load+0x10fa/0x1610 [ 495.636360][T12533] ? map_freeze+0x420/0x420 [ 495.640904][T12533] ? __might_fault+0xaa/0x120 [ 495.645600][T12533] ? __might_fault+0xc6/0x120 [ 495.650301][T12533] ? __might_fault+0xaa/0x120 [ 495.655001][T12533] ? bpf_lsm_bpf+0x9/0x10 [ 495.659361][T12533] ? security_bpf+0x7e/0xa0 [ 495.663895][T12533] __sys_bpf+0x5ba/0x890 [ 495.668161][T12533] ? bpf_link_show_fdinfo+0x560/0x560 [ 495.673565][T12533] ? lock_chain_count+0x20/0x20 [ 495.678443][T12533] __x64_sys_bpf+0x7c/0x90 [ 495.682915][T12533] do_syscall_64+0x55/0xb0 [ 495.687365][T12533] ? clear_bhb_loop+0x40/0x90 [ 495.692176][T12533] ? clear_bhb_loop+0x40/0x90 [ 495.696886][T12533] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 495.702805][T12533] RIP: 0033:0x7f1ea559e159 [ 495.707241][T12533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.726876][T12533] RSP: 002b:00007f1ea6415028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 495.735318][T12533] RAX: ffffffffffffffda RBX: 00007f1ea5826090 RCX: 00007f1ea559e159 [ 495.743325][T12533] RDX: 0000000000000023 RSI: 000020000000e000 RDI: 0000000000000005 [ 495.751327][T12533] RBP: 00007f1ea563506b R08: 0000000000000000 R09: 0000000000000000 [ 495.759321][T12533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 495.767317][T12533] R13: 00007f1ea5826128 R14: 00007f1ea5826090 R15: 00007ffc8ec39c08 [ 495.775321][T12533] [ 495.778338][T12533] [ 495.780651][T12533] Allocated by task 12532: [ 495.785054][T12533] kasan_set_track+0x4e/0x70 [ 495.789641][T12533] __kasan_kmalloc+0x8f/0xa0 [ 495.794228][T12533] __kmalloc_node+0xb6/0x240 [ 495.798814][T12533] bpf_map_area_alloc+0x5e/0x110 [ 495.803746][T12533] prealloc_elems_and_freelist+0x86/0x1c0 [ 495.809460][T12533] stack_map_alloc+0x32b/0x4b0 [ 495.814305][T12533] map_create+0x877/0x12f0 [ 495.818747][T12533] __sys_bpf+0x651/0x890 [ 495.822984][T12533] __x64_sys_bpf+0x7c/0x90 [ 495.827391][T12533] do_syscall_64+0x55/0xb0 [ 495.831802][T12533] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 495.837692][T12533] [ 495.840006][T12533] Last potentially related work creation: [ 495.845709][T12533] kasan_save_stack+0x3e/0x60 [ 495.850380][T12533] __kasan_record_aux_stack+0xaf/0xc0 [ 495.855750][T12533] insert_work+0x3d/0x310 [ 495.860073][T12533] __queue_work+0xbfd/0xfd0 [ 495.864569][T12533] queue_work_on+0x128/0x1f0 [ 495.869167][T12533] bpf_map_release+0x119/0x130 [ 495.873923][T12533] __fput+0x221/0x940 [ 495.877909][T12533] task_work_run+0x1d4/0x260 [ 495.882494][T12533] do_exit+0x986/0x2530 [ 495.886642][T12533] do_group_exit+0x22d/0x2f0 [ 495.891221][T12533] get_signal+0x12a6/0x1390 [ 495.895715][T12533] arch_do_signal_or_restart+0xc2/0x7b0 [ 495.901292][T12533] exit_to_user_mode_loop+0x70/0x110 [ 495.906577][T12533] exit_to_user_mode_prepare+0xee/0x180 [ 495.912118][T12533] syscall_exit_to_user_mode+0x1a/0x50 [ 495.917581][T12533] do_syscall_64+0x61/0xb0 [ 495.922022][T12533] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 495.927924][T12533] [ 495.930235][T12533] Second to last potentially related work creation: [ 495.936805][T12533] kasan_save_stack+0x3e/0x60 [ 495.941478][T12533] __kasan_record_aux_stack+0xaf/0xc0 [ 495.946845][T12533] insert_work+0x3d/0x310 [ 495.951174][T12533] __queue_work+0xbfd/0xfd0 [ 495.955680][T12533] queue_work_on+0x128/0x1f0 [ 495.960263][T12533] bpf_map_release+0x119/0x130 [ 495.965017][T12533] __fput+0x221/0x940 [ 495.968991][T12533] task_work_run+0x1d4/0x260 [ 495.973579][T12533] do_exit+0x986/0x2530 [ 495.977728][T12533] do_group_exit+0x22d/0x2f0 [ 495.982307][T12533] get_signal+0x12a6/0x1390 [ 495.986802][T12533] arch_do_signal_or_restart+0xc2/0x7b0 [ 495.992350][T12533] exit_to_user_mode_loop+0x70/0x110 [ 495.997701][T12533] exit_to_user_mode_prepare+0xee/0x180 [ 496.003246][T12533] syscall_exit_to_user_mode+0x1a/0x50 [ 496.008698][T12533] do_syscall_64+0x61/0xb0 [ 496.013109][T12533] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 496.018998][T12533] [ 496.021314][T12533] The buggy address belongs to the object at ffff888025fde800 [ 496.021314][T12533] which belongs to the cache kmalloc-cg-1k of size 1024 [ 496.035651][T12533] The buggy address is located 0 bytes to the right of [ 496.035651][T12533] allocated 816-byte region [ffff888025fde800, ffff888025fdeb30) [ 496.050140][T12533] [ 496.052455][T12533] The buggy address belongs to the physical page: [ 496.058864][T12533] page:ffffea000097f600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25fd8 [ 496.069011][T12533] head:ffffea000097f600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 496.077936][T12533] memcg:ffff888025175e01 [ 496.082169][T12533] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 496.090162][T12533] page_type: 0xffffffff() [ 496.094483][T12533] raw: 00fff00000000840 ffff888017c4f280 ffffea0001ebe600 dead000000000002 [ 496.103059][T12533] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff888025175e01 [ 496.111630][T12533] page dumped because: kasan: bad access detected [ 496.118037][T12533] page_owner tracks the page as allocated [ 496.123742][T12533] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5435, tgid 5435 (dhcpcd), ts 77423989914, free_ts 77422164294 [ 496.145966][T12533] post_alloc_hook+0x1c1/0x200 [ 496.150732][T12533] get_page_from_freelist+0x2181/0x22a0 [ 496.156269][T12533] __alloc_pages+0x1f0/0x460 [ 496.160849][T12533] alloc_slab_page+0x5d/0x180 [ 496.165515][T12533] new_slab+0x87/0x2d0 [ 496.169576][T12533] ___slab_alloc+0xc5c/0x12f0 [ 496.174242][T12533] __kmem_cache_alloc_node+0x11f/0x250 [ 496.179721][T12533] __kmalloc_node_track_caller+0xa4/0x230 [ 496.185526][T12533] kmalloc_reserve+0x116/0x240 [ 496.190313][T12533] __alloc_skb+0x138/0x2c0 [ 496.194723][T12533] alloc_skb_with_frags+0xcd/0x7a0 [ 496.199833][T12533] sock_alloc_send_pskb+0x883/0x9a0 [ 496.205025][T12533] unix_dgram_sendmsg+0x5a9/0x16e0 [ 496.210239][T12533] sock_write_iter+0x2dc/0x420 [ 496.215000][T12533] do_iter_write+0x747/0xc50 [ 496.219587][T12533] do_writev+0x27f/0x480 [ 496.223825][T12533] page last free stack trace: [ 496.228486][T12533] free_unref_page_prepare+0x7d7/0x8f0 [ 496.233938][T12533] free_unref_page+0x32/0x2e0 [ 496.238608][T12533] page_to_skb+0x735/0x8a0 [ 496.243053][T12533] receive_buf+0x321/0x3610 [ 496.247557][T12533] virtnet_poll+0x69e/0x1300 [ 496.252138][T12533] __napi_poll+0xbb/0x460 [ 496.256531][T12533] net_rx_action+0x65f/0xcc0 [ 496.261124][T12533] handle_softirqs+0x27d/0x820 [ 496.265888][T12533] __irq_exit_rcu+0xd3/0x190 [ 496.270475][T12533] irq_exit_rcu+0x9/0x20 [ 496.274727][T12533] common_interrupt+0xb9/0xd0 [ 496.279398][T12533] asm_common_interrupt+0x26/0x40 [ 496.284418][T12533] [ 496.286731][T12533] Memory state around the buggy address: [ 496.292355][T12533] ffff888025fdea00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 496.300413][T12533] ffff888025fdea80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 496.308465][T12533] >ffff888025fdeb00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 496.316513][T12533] ^ [ 496.322140][T12533] ffff888025fdeb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 496.330197][T12533] ffff888025fdec00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 496.338249][T12533] ================================================================== [ 496.346310][T12533] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 496.353491][T12533] CPU: 1 PID: 12533 Comm: syz.0.2192 Not tainted syzkaller #0 [ 496.360939][T12533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.371004][T12533] Call Trace: [ 496.374301][T12533] [ 496.377238][T12533] dump_stack_lvl+0x18c/0x250 [ 496.381926][T12533] ? show_regs_print_info+0x20/0x20 [ 496.387127][T12533] ? load_image+0x420/0x420 [ 496.391635][T12533] panic+0x2ca/0x720 [ 496.395535][T12533] ? bpf_jit_dump+0xd0/0xd0 [ 496.400034][T12533] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 496.406029][T12533] ? _raw_spin_unlock+0x40/0x40 [ 496.410880][T12533] ? print_memory_metadata+0x314/0x400 [ 496.416343][T12533] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 496.422495][T12533] check_panic_on_warn+0x84/0xa0 [ 496.427431][T12533] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 496.433590][T12533] end_report+0x6f/0x130 [ 496.437882][T12533] kasan_report+0x128/0x150 [ 496.442402][T12533] ? stack_map_get_build_id_offset+0x6c0/0x720 [ 496.448568][T12533] stack_map_get_build_id_offset+0x6c0/0x720 [ 496.454551][T12533] ? pcpu_freelist_pop+0x12a/0x190 [ 496.459660][T12533] ? __bpf_get_stackid+0x900/0x900 [ 496.464764][T12533] ? perf_get_regs_user+0x5bb/0x6b0 [ 496.469955][T12533] ? perf_reg_abi+0x62/0x90 [ 496.474451][T12533] __bpf_get_stackid+0x564/0x900 [ 496.479389][T12533] bpf_get_stackid_pe+0x343/0x410 [ 496.484414][T12533] bpf_prog_2414a5d5030ea31b+0x29/0x2d [ 496.489870][T12533] bpf_overflow_handler+0x1fc/0x510 [ 496.495068][T12533] ? bpf_overflow_handler+0xde/0x510 [ 496.500453][T12533] ? tp_perf_event_destroy+0x20/0x20 [ 496.505760][T12533] ? perf_trace_preemptirq_template+0x144/0x330 [ 496.512007][T12533] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 496.519230][T12533] ? __perf_event_account_interrupt+0x187/0x280 [ 496.525487][T12533] __perf_event_overflow+0x461/0x660 [ 496.530784][T12533] perf_swevent_event+0x319/0x570 [ 496.535809][T12533] ? perf_tp_event+0x1550/0x1550 [ 496.540751][T12533] ___perf_sw_event+0x4ab/0x730 [ 496.545623][T12533] ? ___perf_sw_event+0x19e/0x730 [ 496.550641][T12533] ? perf_swevent_put_recursion_context+0xb0/0xb0 [ 496.557086][T12533] ? __lock_acquire+0x1336/0x7d80 [ 496.562110][T12533] ? rep_movs_alternative+0x33/0x90 [ 496.567318][T12533] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 496.573294][T12533] ? lock_chain_count+0x20/0x20 [ 496.578148][T12533] __perf_sw_event+0x139/0x270 [ 496.582917][T12533] do_user_addr_fault+0x1242/0x12d0 [ 496.588116][T12533] ? rcu_is_watching+0x15/0xb0 [ 496.592892][T12533] exc_page_fault+0x64/0x100 [ 496.597482][T12533] asm_exc_page_fault+0x26/0x30 [ 496.602331][T12533] RIP: 0010:rep_movs_alternative+0x33/0x90 [ 496.608150][T12533] Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb [ 496.627900][T12533] RSP: 0018:ffffc9001939ed50 EFLAGS: 00050212 [ 496.633970][T12533] RAX: 3d65707974203152 RBX: 0000000000000016 RCX: 0000000000000016 [ 496.641943][T12533] RDX: 0000000000000000 RSI: ffff88805f33068c RDI: 000000000000cf3d [ 496.649906][T12533] RBP: ffff88805f330668 R08: ffff88805f3306a1 R09: 1ffff1100be660d4 [ 496.657886][T12533] R10: dffffc0000000000 R11: ffffed100be660d5 R12: 000000000000cf53 [ 496.665853][T12533] R13: 0000000000000016 R14: 000000000000cf3d R15: ffff88805f33068c [ 496.673829][T12533] _copy_to_user+0x85/0xa0 [ 496.678248][T12533] bpf_verifier_vlog+0x432/0x840 [ 496.683188][T12533] verbose+0x11e/0x1a0 [ 496.687253][T12533] ? kfunc_btf_cmp_by_off+0x90/0x90 [ 496.692448][T12533] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 496.698000][T12533] ? __check_reg_arg+0x4ec/0x800 [ 496.702934][T12533] ? mark_reg_read+0x3fc/0x500 [ 496.707694][T12533] check_helper_call+0x597f/0x6340 [ 496.712821][T12533] ? check_kfunc_call+0x4ca0/0x4ca0 [ 496.718021][T12533] ? push_jmp_history+0x14b/0x4f0 [ 496.723044][T12533] ? rcu_is_watching+0x15/0xb0 [ 496.727809][T12533] ? krealloc+0xf2/0x120 [ 496.732079][T12533] ? push_jmp_history+0x15c/0x4f0 [ 496.737113][T12533] do_check+0x87fb/0xd0a0 [ 496.741456][T12533] ? __stack_depot_save+0x1f/0x660 [ 496.746570][T12533] ? __kasan_kmalloc+0x8f/0xa0 [ 496.751416][T12533] ? __sys_bpf+0x5ba/0x890 [ 496.755825][T12533] ? __x64_sys_bpf+0x7c/0x90 [ 496.760405][T12533] ? do_syscall_64+0x55/0xb0 [ 496.765020][T12533] ? init_func_state+0x2d10/0x2d10 [ 496.770130][T12533] ? __asan_memset+0x22/0x40 [ 496.774718][T12533] ? init_func_state+0x1dc6/0x2d10 [ 496.779825][T12533] ? btf_check_subprog_arg_match+0x142/0x2a0 [ 496.785802][T12533] do_check_common+0xacc/0x1410 [ 496.790652][T12533] bpf_check+0x65df/0xec40 [ 496.795090][T12533] ? bpf_get_btf_vmlinux+0x20/0x20 [ 496.800194][T12533] ? __lock_acquire+0x7d80/0x7d80 [ 496.805216][T12533] ? mark_lock+0x94/0x320 [ 496.809539][T12533] ? __lock_acquire+0x1336/0x7d80 [ 496.814555][T12533] ? trace_call_bpf+0xc3/0x6c0 [ 496.819322][T12533] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 496.825125][T12533] ? verify_lock_unused+0x140/0x140 [ 496.830325][T12533] ? perf_trace_lock_acquire+0x342/0x400 [ 496.835952][T12533] ? perf_trace_lock+0xfc/0x3b0 [ 496.840807][T12533] ? trace_event_raw_event_lock+0x240/0x240 [ 496.846741][T12533] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 496.852715][T12533] ? __lock_acquire+0x7d80/0x7d80 [ 496.857753][T12533] ? lock_chain_count+0x20/0x20 [ 496.862598][T12533] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 496.868848][T12533] ? lockdep_hardirqs_on+0x98/0x150 [ 496.874041][T12533] ? ktime_get_with_offset+0x103/0x330 [ 496.879511][T12533] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 496.885746][T12533] ? ktime_get_real_ts64+0x440/0x440 [ 496.891024][T12533] ? do_raw_spin_unlock+0x121/0x230 [ 496.896227][T12533] ? bpf_obj_name_cpy+0x194/0x1e0 [ 496.901244][T12533] bpf_prog_load+0x10fa/0x1610 [ 496.906010][T12533] ? map_freeze+0x420/0x420 [ 496.910514][T12533] ? __might_fault+0xaa/0x120 [ 496.915270][T12533] ? __might_fault+0xc6/0x120 [ 496.919936][T12533] ? __might_fault+0xaa/0x120 [ 496.924604][T12533] ? bpf_lsm_bpf+0x9/0x10 [ 496.928928][T12533] ? security_bpf+0x7e/0xa0 [ 496.933425][T12533] __sys_bpf+0x5ba/0x890 [ 496.937663][T12533] ? bpf_link_show_fdinfo+0x560/0x560 [ 496.943058][T12533] ? lock_chain_count+0x20/0x20 [ 496.947933][T12533] __x64_sys_bpf+0x7c/0x90 [ 496.952395][T12533] do_syscall_64+0x55/0xb0 [ 496.956817][T12533] ? clear_bhb_loop+0x40/0x90 [ 496.961494][T12533] ? clear_bhb_loop+0x40/0x90 [ 496.966179][T12533] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 496.972075][T12533] RIP: 0033:0x7f1ea559e159 [ 496.976493][T12533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.996096][T12533] RSP: 002b:00007f1ea6415028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 497.004515][T12533] RAX: ffffffffffffffda RBX: 00007f1ea5826090 RCX: 00007f1ea559e159 [ 497.012576][T12533] RDX: 0000000000000023 RSI: 000020000000e000 RDI: 0000000000000005 [ 497.020542][T12533] RBP: 00007f1ea563506b R08: 0000000000000000 R09: 0000000000000000 [ 497.028504][T12533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 497.036467][T12533] R13: 00007f1ea5826128 R14: 00007f1ea5826090 R15: 00007ffc8ec39c08 [ 497.044446][T12533] [ 497.047760][T12533] Kernel Offset: disabled [ 497.052106][T12533] Rebooting in 86400 seconds..