last executing test programs: 2.67480719s ago: executing program 0 (id=21): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x5, [@enum={0x0, 0x1, 0x0, 0x6, 0x4, [{0x2}]}]}, {0x0, [0x0, 0x5f, 0x1]}}, 0x0, 0x31, 0x0, 0x8}, 0x28) 2.512452453s ago: executing program 0 (id=23): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000001480)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000580)="02042700ea0e0000000000001eafbcf706e105000000000000001104ee1606d4b8bf4a828bda305775c43824cee8", 0x2e}, {&(0x7f0000000440)="126873b363ceb3e6d803ab766b7a38e451d1", 0x12}], 0x2}, 0x40000) 2.368625195s ago: executing program 0 (id=25): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) socket$kcm(0xa, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r2}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) recvmsg(r0, &(0x7f0000000dc0)={0x0, 0x0, 0x0}, 0x102) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000980)='sys_exit\x00', r3}, 0x10) r4 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r2, &(0x7f0000000180)}, 0x20) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831373f00000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) 2.057813389s ago: executing program 1 (id=28): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) write$cgroup_subtree(r1, &(0x7f0000000a00)=ANY=[@ANYBLOB='-cpu'], 0x20) 1.539424207s ago: executing program 1 (id=29): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f00000003c0)={'b', ' *:* ', 'r\x00'}, 0x8) 1.156002053s ago: executing program 1 (id=33): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r0, 0x8922, &(0x7f0000002280)={'vlan0\x00', @random='\x00\a\x00\x00\v\x00'}) 1.110121733s ago: executing program 3 (id=34): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000f80)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe50a10a000600014002020c600e41b0000900ac000a0501000000160012000a00ff150048035c3b61c1d67f6f94007134cf6efb8007a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x4000044) 1.039928585s ago: executing program 2 (id=35): bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0xc, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10002}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000940)={{}, &(0x7f00000008c0), 0x0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0xfff, 0x5}, 0x48) socketpair(0x21, 0x800, 0x6, &(0x7f0000000000)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r0, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) r2 = gettid() perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x4, 0x10, 0x4, 0xf, 0x0, 0x4, 0x88000, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, @perf_bp={&(0x7f00000002c0)}, 0x4000, 0x80, 0x200, 0x1, 0x101, 0x7ff, 0x7, 0x0, 0xfff, 0x0, 0x9}, r2, 0x6, 0xffffffffffffffff, 0x8) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r1}, 0xc) r4 = getpid() syz_open_procfs$namespace(r4, &(0x7f00000001c0)='ns/cgroup\x00') close(r3) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.013269755s ago: executing program 1 (id=36): socket$kcm(0x2, 0x5, 0x84) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000840)={0xffffffffffffffff, 0x0, 0x0}, 0x10) r0 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x5, 0x4}, {0x10000002, 0x5}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) close(r0) r3 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) close(r3) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r3, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0xfffe, @dev={0xac, 0x14, 0x14, 0xe}}, 0xfffffc95, 0x0, 0x1}, 0xc8002) setsockopt$sock_attach_bpf(r0, 0x84, 0x6e, &(0x7f0000000000)=r7, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x581000, 0x0) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8916, &(0x7f0000000000)={'veth1_virt_wifi\x00', @random="0200ff7fac14"}) 963.041506ms ago: executing program 3 (id=37): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000080)='notify_on_release\x00', 0x2, 0x0) socket$kcm(0x2, 0x200000000000003, 0x106) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x2, 0x4, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000580)=ANY=[@ANYBLOB="180000008000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000c44185000000040000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200000a000000b703000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x88) socket$kcm(0x10, 0x2, 0x10) socket$kcm(0x1e, 0x4, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x2, 0x5, 0x84) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x56, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x1, @perf_bp={0x0, 0xd}, 0x14105, 0x2e, 0xfffffbff, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) socket$kcm(0x2, 0x5, 0x84) socket$kcm(0x2, 0x5, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x204080, 0x0) socket$kcm(0x2, 0x200000000000001, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x7}, 0x5f21df7aec8d40fb, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)=ANY=[@ANYRES32, @ANYRES32=r1, @ANYRES64=r1], 0x20) 822.108358ms ago: executing program 2 (id=38): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r0, 0x0, &(0x7f0000000340)=""/34}, 0x20) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r1) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x17, 0xffff7fff, 0x0, 0x2, 0x300}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x33, 0x0, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff0012fe00632f77fbac141416ac14141602089f034d2f87e5070c0cab845013f232", 0x0, 0xfe, 0x60000000}, 0x50) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0xc000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x5, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x4}, [@call={0x85, 0x0, 0x0, 0x23}]}, 0x0}, 0x90) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 697.34966ms ago: executing program 3 (id=39): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r0, 0x0, &(0x7f0000000340)=""/34}, 0x20) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r1) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x17, 0xffff7fff, 0x0, 0x2, 0x300}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x33, 0x0, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff0012fe00632f77fbac141416ac14141602089f034d2f87e5070c0cab845013f232", 0x0, 0xfe, 0x60000000}, 0x50) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0xc000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x5, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x4}, [@call={0x85, 0x0, 0x0, 0x23}]}, 0x0}, 0x90) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 644.3419ms ago: executing program 0 (id=40): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r0, 0x0, &(0x7f0000000340)=""/34}, 0x20) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r1) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x17, 0xffff7fff, 0x0, 0x2, 0x300}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x33, 0x0, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff0012fe00632f77fbac141416ac14141602089f034d2f87e5070c0cab845013f232", 0x0, 0xfe, 0x60000000}, 0x50) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0xc000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x5, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x4}, [@call={0x85, 0x0, 0x0, 0x23}]}, 0x0}, 0x90) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 586.367282ms ago: executing program 2 (id=41): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00'}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000002c0)={'veth1\x00', 0x400}) 477.068663ms ago: executing program 3 (id=42): socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008001500b7040000000000008500000058"], 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000300)='sys_enter\x00', r3}, 0x10) close(r0) 419.373574ms ago: executing program 1 (id=43): bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x12, 0x4, &(0x7f0000001300)=@framed={{}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x94) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000000)={'veth0_vlan\x00', @remote}) close(0x3) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000660000000000"], 0x0, 0x7ff}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) 354.875225ms ago: executing program 2 (id=44): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000040000000000000000000085000000cf000000850000002a00000095"], &(0x7f0000000400)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 337.881955ms ago: executing program 0 (id=45): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x182, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r2], 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r3}, 0x10) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) sendmsg$unix(0xffffffffffffffff, &(0x7f0000001e80)={&(0x7f0000000180)=@abs={0x1, 0x5c, 0x1}, 0x6e, 0x0}, 0x20000) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000180)) 279.205796ms ago: executing program 3 (id=46): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7040000000000008500000057"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000340)='fdb_delete\x00', r1}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) 166.781078ms ago: executing program 2 (id=47): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000200000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r0}, &(0x7f0000000000), &(0x7f00000005c0)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x49}, [@ldst={0x4, 0x3, 0x0, 0x1c10a1}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 117.995698ms ago: executing program 1 (id=48): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x8, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdb4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe15, 0x5, 0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffffffffff4b, 0x0}}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r2}, 0x0, 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r2, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r3}, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r4, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) 97.946809ms ago: executing program 3 (id=49): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x182, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r3}, 0x10) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) sendmsg$unix(0xffffffffffffffff, &(0x7f0000001e80)={&(0x7f0000000180)=@abs={0x1, 0x5c, 0x1}, 0x6e, 0x0}, 0x20000) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000180)) 10.83818ms ago: executing program 2 (id=50): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 0s ago: executing program 0 (id=51): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xf, &(0x7f00000006c0)=ANY=[@ANYBLOB="1803000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000800b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x18) sendmsg$tipc(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.94' (ED25519) to the list of known hosts. [ 55.901652][ T5771] cgroup: Unknown subsys name 'net' [ 56.018964][ T5771] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 57.375502][ T5771] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 58.730038][ T5792] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 58.738372][ T5792] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 58.748032][ T5792] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 58.760407][ T5793] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 58.767875][ T5797] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 58.775852][ T5797] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 58.784197][ T5797] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 58.787995][ T5795] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 58.791937][ T5797] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 58.805889][ T5797] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 58.813536][ T5795] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 58.820646][ T5791] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 58.821180][ T5795] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 58.834642][ T5792] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 58.837954][ T5795] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 58.849708][ T5795] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 58.857179][ T5797] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 58.860216][ T5795] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 58.871738][ T5792] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 58.879741][ T5792] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 58.887085][ T5792] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 58.894425][ T5797] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 58.895809][ T5795] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 58.911285][ T5795] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 59.265194][ T5783] chnl_net:caif_netlink_parms(): no params data found [ 59.345631][ T5785] chnl_net:caif_netlink_parms(): no params data found [ 59.457759][ T5783] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.466008][ T5783] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.473612][ T5783] bridge_slave_0: entered allmulticast mode [ 59.480242][ T5783] bridge_slave_0: entered promiscuous mode [ 59.491335][ T5783] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.498470][ T5783] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.505619][ T5783] bridge_slave_1: entered allmulticast mode [ 59.512768][ T5783] bridge_slave_1: entered promiscuous mode [ 59.541452][ T5782] chnl_net:caif_netlink_parms(): no params data found [ 59.559036][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 59.569602][ T5785] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.576808][ T5785] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.584300][ T5785] bridge_slave_0: entered allmulticast mode [ 59.591270][ T5785] bridge_slave_0: entered promiscuous mode [ 59.599526][ T5785] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.606769][ T5785] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.614293][ T5785] bridge_slave_1: entered allmulticast mode [ 59.620863][ T5785] bridge_slave_1: entered promiscuous mode [ 59.691470][ T5783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.728784][ T5783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.742964][ T5785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.756870][ T5785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.841412][ T5783] team0: Port device team_slave_0 added [ 59.859309][ T5785] team0: Port device team_slave_0 added [ 59.868162][ T5785] team0: Port device team_slave_1 added [ 59.874304][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.881420][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.888750][ T5782] bridge_slave_0: entered allmulticast mode [ 59.895530][ T5782] bridge_slave_0: entered promiscuous mode [ 59.903738][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.910849][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.918062][ T5782] bridge_slave_1: entered allmulticast mode [ 59.925286][ T5782] bridge_slave_1: entered promiscuous mode [ 59.933713][ T5783] team0: Port device team_slave_1 added [ 59.986759][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.994211][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.001314][ T5784] bridge_slave_0: entered allmulticast mode [ 60.008745][ T5784] bridge_slave_0: entered promiscuous mode [ 60.017770][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.025043][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.051040][ T5785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.064917][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.071868][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.097844][ T5785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.128946][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.136182][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.143856][ T5784] bridge_slave_1: entered allmulticast mode [ 60.150452][ T5784] bridge_slave_1: entered promiscuous mode [ 60.163853][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.176755][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.186481][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.193619][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.220035][ T5783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.261163][ T5783] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.268275][ T5783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.294401][ T5783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.321835][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.360699][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.372784][ T5782] team0: Port device team_slave_0 added [ 60.380574][ T5782] team0: Port device team_slave_1 added [ 60.389520][ T5785] hsr_slave_0: entered promiscuous mode [ 60.396301][ T5785] hsr_slave_1: entered promiscuous mode [ 60.458821][ T5784] team0: Port device team_slave_0 added [ 60.467178][ T5784] team0: Port device team_slave_1 added [ 60.487829][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.494840][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.521426][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.534008][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.540962][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.567119][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.582479][ T5783] hsr_slave_0: entered promiscuous mode [ 60.588765][ T5783] hsr_slave_1: entered promiscuous mode [ 60.595222][ T5783] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.603220][ T5783] Cannot create hsr debugfs directory [ 60.664932][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.671895][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.697918][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.711276][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.718932][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.744899][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.835074][ T5782] hsr_slave_0: entered promiscuous mode [ 60.841447][ T5782] hsr_slave_1: entered promiscuous mode [ 60.848242][ T5782] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.855882][ T5782] Cannot create hsr debugfs directory [ 60.898511][ T5784] hsr_slave_0: entered promiscuous mode [ 60.905651][ T5784] hsr_slave_1: entered promiscuous mode [ 60.911624][ T5784] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.919643][ T5795] Bluetooth: hci3: command tx timeout [ 60.926125][ T5784] Cannot create hsr debugfs directory [ 60.985674][ T5787] Bluetooth: hci1: command tx timeout [ 60.985719][ T50] Bluetooth: hci2: command tx timeout [ 60.994949][ T5795] Bluetooth: hci0: command tx timeout [ 61.222867][ T5783] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 61.235759][ T5783] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 61.248363][ T5783] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 61.258810][ T5783] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 61.316670][ T5785] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 61.327933][ T5785] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 61.340025][ T5785] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 61.349312][ T5785] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 61.441208][ T5784] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 61.457450][ T5784] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 61.470938][ T5784] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 61.480760][ T5784] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 61.553055][ T5782] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 61.564445][ T5782] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 61.583370][ T5782] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 61.601434][ T5782] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 61.630839][ T5783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.694352][ T5783] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.734195][ T2997] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.741492][ T2997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.757200][ T5785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.790227][ T5785] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.801421][ T2997] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.808570][ T2997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.850036][ T2997] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.857139][ T2997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.870639][ T2997] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.877732][ T2997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.922006][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.980902][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.997445][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.035149][ T2997] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.042327][ T2997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.083575][ T2997] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.090712][ T2997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.119926][ T5782] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.164136][ T2997] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.171267][ T2997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.196513][ T2997] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.203659][ T2997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.310985][ T5783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.338675][ T5782] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 62.373508][ T5782] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 62.517367][ T5783] veth0_vlan: entered promiscuous mode [ 62.538609][ T5785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.567524][ T5783] veth1_vlan: entered promiscuous mode [ 62.635170][ T5783] veth0_macvtap: entered promiscuous mode [ 62.647555][ T5783] veth1_macvtap: entered promiscuous mode [ 62.676430][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.704022][ T5785] veth0_vlan: entered promiscuous mode [ 62.734005][ T5785] veth1_vlan: entered promiscuous mode [ 62.750751][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 62.769224][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.780206][ T5783] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 62.818423][ T5785] veth0_macvtap: entered promiscuous mode [ 62.830154][ T5783] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.840705][ T5783] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.849545][ T5783] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.858289][ T5783] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.880041][ T5785] veth1_macvtap: entered promiscuous mode [ 62.966276][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.981574][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.983936][ T5795] Bluetooth: hci3: command tx timeout [ 62.999183][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.017599][ T5784] veth0_vlan: entered promiscuous mode [ 63.027499][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.039072][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.052776][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.060502][ T5782] veth0_vlan: entered promiscuous mode [ 63.066482][ T5795] Bluetooth: hci2: command tx timeout [ 63.072334][ T5795] Bluetooth: hci0: command tx timeout [ 63.072568][ T50] Bluetooth: hci1: command tx timeout [ 63.084392][ T5782] veth1_vlan: entered promiscuous mode [ 63.101667][ T5784] veth1_vlan: entered promiscuous mode [ 63.121580][ T5785] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.131050][ T5785] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.140632][ T5785] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.150747][ T5785] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.201049][ T5782] veth0_macvtap: entered promiscuous mode [ 63.233314][ T2997] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.241589][ T2997] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.257660][ T5782] veth1_macvtap: entered promiscuous mode [ 63.286881][ T5784] veth0_macvtap: entered promiscuous mode [ 63.310405][ T5784] veth1_macvtap: entered promiscuous mode [ 63.334262][ T1074] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.344403][ T1074] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.358613][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 63.375376][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.385676][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 63.396543][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.407507][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.420560][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.431441][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.441439][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.452242][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.463952][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.483005][ T5782] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.491714][ T5782] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.500933][ T5782] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.510195][ T5782] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.547987][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 63.559199][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.569072][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 63.580114][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.590017][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 63.600521][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.612921][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.660970][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.672744][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.684214][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.694833][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.706001][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.717709][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.728972][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.754270][ T2997] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.769789][ T2997] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.804048][ T5784] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.814757][ T5784] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.832988][ T5784] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.841774][ T5784] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.973634][ T1074] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.982001][ T1074] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.046498][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.070318][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.128541][ T1074] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.141464][ T1074] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.156911][ T2118] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.203251][ T2118] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.290204][ T2997] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.322744][ T2997] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.463881][ C1] hrtimer: interrupt took 29977 ns [ 64.507492][ T5878] netlink: 'syz.0.1': attribute type 10 has an invalid length. [ 64.621331][ T5878] team0: Port device netdevsim0 added [ 64.656020][ T5884] netlink: 'syz.0.1': attribute type 10 has an invalid length. [ 64.695108][ T5884] team0: Port device netdevsim0 removed [ 64.706490][ T5884] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 64.796804][ T5878] syz.0.1 (5878) used greatest stack depth: 20776 bytes left [ 65.063877][ T50] Bluetooth: hci3: command tx timeout [ 65.146598][ T50] Bluetooth: hci1: command tx timeout [ 65.150622][ T5795] Bluetooth: hci0: command tx timeout [ 65.152017][ T50] Bluetooth: hci2: command tx timeout [ 65.253983][ T5904] Driver unsupported XDP return value 0 on prog (id 14) dev N/A, expect packet loss! [ 65.736567][ T5923] netlink: 'syz.0.25': attribute type 39 has an invalid length. [ 65.772849][ T5923] veth0_macvtap: left promiscuous mode [ 65.975620][ T5927] sit0: entered allmulticast mode [ 66.068563][ T5925] sit0: entered allmulticast mode [ 66.242250][ T5930] sit0: entered promiscuous mode [ 66.679111][ T5929] sit0: entered promiscuous mode [ 66.750136][ T5940] warning: `syz.2.30' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 66.964915][ T5949] netlink: 'syz.3.34': attribute type 6 has an invalid length. [ 67.119624][ T5955] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 67.155933][ T50] Bluetooth: hci3: command tx timeout [ 67.175456][ T5956] syz.1.36 uses obsolete (PF_INET,SOCK_PACKET) [ 67.222222][ T5787] Bluetooth: hci1: command tx timeout [ 67.228122][ T50] Bluetooth: hci0: command tx timeout [ 67.234735][ T50] Bluetooth: hci2: command tx timeout [ 67.290434][ T5958] Zero length message leads to an empty skb [ 67.297943][ T5958] netlink: 'syz.2.38': attribute type 10 has an invalid length. [ 67.450236][ T5960] netlink: 'syz.3.39': attribute type 10 has an invalid length. [ 67.536507][ T5963] netlink: 'syz.0.40': attribute type 10 has an invalid length. [ 67.728151][ T5969] veth0_vlan: entered allmulticast mode [ 67.835339][ T5975] ªªªªªª: renamed from vlan0 [ 68.064118][ T5982] [ 68.066472][ T5982] ============================================ [ 68.072621][ T5982] WARNING: possible recursive locking detected [ 68.078774][ T5982] 6.6.95-syzkaller #0 Not tainted [ 68.083781][ T5982] -------------------------------------------- [ 68.089915][ T5982] syz.1.48/5982 is trying to acquire lock: [ 68.095706][ T5982] ffff888021162a38 (&trie->lock){....}-{2:2}, at: trie_delete_elem+0x96/0x6a0 [ 68.104584][ T5982] [ 68.104584][ T5982] but task is already holding lock: [ 68.111930][ T5982] ffff88807a6d7238 (&trie->lock){....}-{2:2}, at: trie_update_elem+0xca/0xea0 [ 68.120791][ T5982] [ 68.120791][ T5982] other info that might help us debug this: [ 68.128835][ T5982] Possible unsafe locking scenario: [ 68.128835][ T5982] [ 68.136268][ T5982] CPU0 [ 68.139528][ T5982] ---- [ 68.142788][ T5982] lock(&trie->lock); [ 68.146842][ T5982] lock(&trie->lock); [ 68.150892][ T5982] [ 68.150892][ T5982] *** DEADLOCK *** [ 68.150892][ T5982] [ 68.159017][ T5982] May be due to missing lock nesting notation [ 68.159017][ T5982] [ 68.167328][ T5982] 3 locks held by syz.1.48/5982: [ 68.172248][ T5982] #0: ffffffff8cd2f760 (rcu_read_lock){....}-{1:2}, at: bpf_map_update_value+0x439/0x740 [ 68.182168][ T5982] #1: ffff88807a6d7238 (&trie->lock){....}-{2:2}, at: trie_update_elem+0xca/0xea0 [ 68.191488][ T5982] #2: ffffffff8cd2f760 (rcu_read_lock){....}-{1:2}, at: bpf_trace_run4+0xfd/0x420 [ 68.200800][ T5982] [ 68.200800][ T5982] stack backtrace: [ 68.206692][ T5982] CPU: 1 PID: 5982 Comm: syz.1.48 Not tainted 6.6.95-syzkaller #0 [ 68.214492][ T5982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 68.224552][ T5982] Call Trace: [ 68.227821][ T5982] [ 68.230745][ T5982] dump_stack_lvl+0x16c/0x230 [ 68.235419][ T5982] ? show_regs_print_info+0x20/0x20 [ 68.240615][ T5982] ? print_deadlock_bug+0x435/0x5d0 [ 68.245803][ T5982] __lock_acquire+0x5d40/0x7c80 [ 68.250649][ T5982] ? mark_lock+0x94/0x320 [ 68.254969][ T5982] ? verify_lock_unused+0x140/0x140 [ 68.260155][ T5982] ? __lock_acquire+0x1260/0x7c80 [ 68.265177][ T5982] lock_acquire+0x197/0x410 [ 68.269670][ T5982] ? trie_delete_elem+0x96/0x6a0 [ 68.274599][ T5982] ? verify_lock_unused+0x140/0x140 [ 68.279781][ T5982] ? read_lock_is_recursive+0x20/0x20 [ 68.285150][ T5982] _raw_spin_lock_irqsave+0xa8/0xf0 [ 68.290333][ T5982] ? trie_delete_elem+0x96/0x6a0 [ 68.295257][ T5982] ? _raw_spin_lock+0x40/0x40 [ 68.299921][ T5982] trie_delete_elem+0x96/0x6a0 [ 68.304674][ T5982] ? __cant_sleep+0x210/0x210 [ 68.309338][ T5982] bpf_prog_2c29ac5cdc6b1842+0x42/0x46 [ 68.314782][ T5982] bpf_trace_run4+0x1f9/0x420 [ 68.319443][ T5982] ? bpf_trace_run4+0xfd/0x420 [ 68.324206][ T5982] ? bpf_trace_run3+0x400/0x400 [ 68.329061][ T5982] ? percpu_ref_put+0xef/0x180 [ 68.333822][ T5982] ? __memcg_kmem_charge_page+0x264/0x380 [ 68.339541][ T5982] __alloc_pages+0x429/0x460 [ 68.344125][ T5982] ? zone_statistics+0x170/0x170 [ 68.349052][ T5982] ? bpf_map_get_memcg+0x4e/0x4e0 [ 68.354085][ T5982] ? __lock_acquire+0x7c80/0x7c80 [ 68.359106][ T5982] ? __rwlock_init+0x150/0x150 [ 68.363862][ T5982] __kmalloc_large_node+0x8c/0x1e0 [ 68.368968][ T5982] ? bpf_map_kmalloc_node+0xbc/0x1b0 [ 68.374248][ T5982] __kmalloc_node+0x10f/0x230 [ 68.378910][ T5982] ? _raw_spin_lock+0x40/0x40 [ 68.383584][ T5982] bpf_map_kmalloc_node+0xbc/0x1b0 [ 68.388696][ T5982] trie_update_elem+0x166/0xea0 [ 68.393537][ T5982] ? __lock_acquire+0x7c80/0x7c80 [ 68.398551][ T5982] bpf_map_update_value+0x67c/0x740 [ 68.403741][ T5982] map_update_elem+0x57b/0x700 [ 68.408489][ T5982] __sys_bpf+0x652/0x800 [ 68.412715][ T5982] ? bpf_link_show_fdinfo+0x350/0x350 [ 68.418078][ T5982] ? lock_chain_count+0x20/0x20 [ 68.422921][ T5982] __x64_sys_bpf+0x7c/0x90 [ 68.427323][ T5982] do_syscall_64+0x55/0xb0 [ 68.431723][ T5982] ? clear_bhb_loop+0x40/0x90 [ 68.436387][ T5982] ? clear_bhb_loop+0x40/0x90 [ 68.441051][ T5982] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 68.446930][ T5982] RIP: 0033:0x7f5c80f8e929 [ 68.451330][ T5982] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 68.470917][ T5982] RSP: 002b:00007f5c81d5b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 68.479314][ T5982] RAX: ffffffffffffffda RBX: 00007f5c811b5fa0 RCX: 00007f5c80f8e929 [ 68.487270][ T5982] RDX: 0000000000000020 RSI: 0000200000000080 RDI: 0000000000000002 [ 68.495228][ T5982] RBP: 00007f5c81010b39 R08: 0000000000000000 R09: 0000000000000000 [ 68.503184][ T5982] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.511137][ T5982] R13: 0000000000000000 R14: 00007f5c811b5fa0 R15: 00007ffed52dba88 [ 68.519099][ T5982] [ 71.464423][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.470707][ T1279] ieee802154 phy1 wpan1: encryption failed: -22