last executing test programs: 16m28.541425973s ago: executing program 1 (id=1978): bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={0x0, &(0x7f0000000880)=""/1, 0x0, 0x1, 0x1, 0x3, 0x10000}, 0x28) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r6, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1, 0x0, 0x0, 0x6000}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r7}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) 16m27.361367891s ago: executing program 1 (id=1980): bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={0x0, &(0x7f0000000880)=""/1, 0x0, 0x1, 0x1, 0x3, 0x10000}, 0x28) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r6, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1, 0x0, 0x0, 0x6000}, 0x20) 16m26.387792114s ago: executing program 1 (id=1982): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_bp={0x0}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000200)}, 0x9, 0x9, 0xfffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x80000a, r3, 0x0) close(0xffffffffffffffff) socket$kcm(0xa, 0x7, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000ec0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000000000080000000200000000000000005f0000000000005f2e00"], &(0x7f0000002600)=""/4081, 0x3b, 0xff1, 0x1}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x4000, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xe, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffff0371a4f0ff0000000071103d00000000007d400500000000002604000001ed00000f030000000000007c440000000000006b0a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c26fc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dbb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b4501000000010000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1}, 0x10}, 0x94) socket$kcm(0x1e, 0x4, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="0100"}) r7 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r7, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev={0xfe, 0x80, '\x00', 0x22}, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f0000000500)=[{0x18, 0x110, 0xc, "aa"}, {0x18, 0x110, 0x1, '\x00'}], 0x30}, 0x0) r8 = syz_clone(0x6480, &(0x7f0000000740)="5910000000e698", 0x1, 0x0, 0x0, 0x0) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$unix(r1, &(0x7f0000000240)={&(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000006c0)=[{0x0}, {&(0x7f00000008c0)="b8d7b79ff3d9156f602f764eaade3c142a6d6bef0415fc7951bc37c517fc06356a30cbc7671f512037627fb0798692f4b729eacd02ec4614e3", 0x39}, {&(0x7f0000000500)="113a11f5949a17b491122ec76a345556bd8c", 0x12}, {&(0x7f0000000a80)="554e60df5418a2a40f09d02fabc292ea1e911268424071d96622bc47210d9dddfaa8acbb3d5a47a07c5c0e3ca45a382296709d13b6192d5a7d5c7ef1a5b746fef4c38d2263f831023d96feaac82e190837a28f57eaa247b665331bcece4819af595ea363ee4a77005cb4c8214e7a218f5acbd7ba856e3474db53c82e8c5ba81cb03e84513c5e35864c54370a2bb1996b5ae9f43a01b575007f96d4baad5755a177379033144d5f28c9af404becbbb9b9732b23f198356ba8", 0xb8}, {&(0x7f0000000600)}], 0x5, &(0x7f0000002840)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES8=r5, @ANYRES32=0xee01, @ANYRES32, @ANYBLOB="00000000180000001d000000010000000100", @ANYRES32=r2, @ANYRES32, @ANYBLOB="1c000000000000000100", @ANYRES64=0x0, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r8, @ANYRES32, @ANYBLOB="bc52283b7cbc2864399fad0e93d87a1087b533f6ca77fa9b19ad7344a27d5167e7844d8d37446884dc1b8530db6d485efeab88281d68c0934d7e10eff4364fbfcca95b99eaf52bdea0e0e52c2bd1a2fdd8470eab9f06388dad2e86297db9a1dca2a76d37c02f4428427a68d2096463af6cf477132910a37755adca2f439d64a8adb201c24fb5f44ecab1017c51aa006f6159c541daef04daea3645ce0a945f8bcc06aadba95ed9a9f355fd81ddc85c694196c6e9bfb32d8effb81fdc1fa48f4725bd7d069fdd8f15769a532c7651c2483b1885c79cae9b67c5215e7984ffc40d638962f97ee920d97d51b2d02ab03383d5673cd92afbf83cffe33596da058922d13c853c64e4356b1d22a7f1089efbef273526b292da3bbcf7d297dacada25dc8e0cff4310a70090435a82b4f64dece7f8a5798ccf3eb2dcaa1719b62ccc2edd14033594ec59e3f400e9c1a430e8b92e2787369e8d9398bf4ccd446f35bbd90a72953bf69898e3fb74a3421944129b689405604952817e2f382cbabb49a7dbd36299af9f31031019e1e26565852bfc914ebbdd8d662b7520f4ab7fd56d46f22753f27eae775cbb14ae3f744630a0dea30930c35bba2c9802544a1354a16920428a65f3175ae750361054ec55e8ec0eb305a26db4faeb06576dc0f3684bd730073a6306872572c3d0a03086b4a9e433a010e397c8bebf21c864298a0379ba84f81a0fee386d603ffd8e90e184815470586e13e0243f90846269d95ce461c4fda2830e95601d412bddc0e85cecf741b26bed858655d771825717c90bf52aaab04a04800ca72ab93caabd9a8eb22dd72cf4d48c360e37fa34044db3dc9f6c3bb475804fc3b35ab5f7d25efadcd848b0cc60c0a58b056e9233fca8e8e8e496957a83ede293978dbb055a4abe5d96299205da7febc1cc07f2965e98f2d25a9bd4eac93aa955c782910a1501d9d7aaa71044cb6f619e1eb5b0ea68423569f2ffd27c804a7768838aff55da7cbc1c1cb805198d3601791d27fe5fa5e3da8330f34d95bb650765bd69ef39d0086e3d45124b46926000a5e0762a4dae07e6fe90480970ffa7bbbe41269769141e62aa68cbd523c58ee0f8aeeb9bee3fb5ad6c0029109b9616eb197f02cfa5fafcbd06d335240c38ba08d5320eb8a9f1fe1e62e0ecbb4e16f4507f053ef84b00a9c99a35a55d2e86b2415937a323f53c8ef33169b8b7f9fe305ac99af26d655126f4a4e43e682bdcaaa701558d9672eea5f6d4a6b26d8c5a6dc0e99bad6e2377572b9dde32827d7228666e63d54097af7264748963577019ddb480ad26ebe697475a970242550311517148e25a1b5157e345480d66801ab660aa5836b698ab5e0c844ead049b3b1186abc1bb04092e8d07377866c394d87c26e5a1aa2038184088493f085befdee3774294cbe8de102e7b8744ab8b05739a85dfaf1d3c323efcee7c2d2f3027ad79306a16796dbf99bd5e31b64cd1eb17ae2b81f853953bd1fe93a20355ed37c4a138839f146a082612bbf02651aa662b479cc090fba5d2894a2184d20cc51f5c5ffa8c183dc460c1b02933cc14ef29554895a07ac698e22184cc7078b2be280f6711117e092a77cfcf2b83d905a93c0aafea40071e97b97432d701e2cce865d87ae0f415c10d2fc63a416320c789e3cd81f2340e991c12eb554a0116a260904c45a614c3b8a75af0334a23fa033ef7ca84611424a29852eeaf51bf1e90be32e0db5cebafc6c8e9955447f569e4427e1e28f31a424f760963794b65cea2f9c96e5868e7b2a99db797b0335aa3dbdd46b9198dcc09175df3f411075332ebbccfd0e2fc23fd64cd279b8131576e2c02ada7f8f199eea179c299167a7b4d6f51eb784eafa49f2051f5e1b5d916d3f6a382f329a89e400803a4d82f80f935389df1f88c4741a10626f280903120151b16351f041ab9cd3fd52e74df12d49b98e913efe4298e4e65628622d7313970a1c35abe25532a9080d8d072cc8c31560e29b675c5b8c07215d641aa72513ae2ce88367bcdca60f954b959306f03db99c625b76980c34b6cb1bd124e7a497b6ace595a8e7d9f70aeb6250dac1728ef08386c6ad3742b636ab1390a4193a52666d0fd4b8d4e9b45875d35eb60ed7fe5d39b67bff1468f627d18900eb9d5ddc0ee31fa69e34c0ce895d894834ede0bca5de530e0580a8ad5ae6433ae4ad7575061986cd786308c555ab4fd7986a7067f0472c73dbe2ea3b254f3aba74fa14ef3e2110329679e34504fbf59693569fe191f2ee681666a6b3d6929e713d354b7c4a4c03e118c7e6cf75fde3865ee6e0d5e504642c3af506e31323bfe6febd310c9206d8301c11b6622e2e4a03485b579358f5ed887fbf7a9f23efb89fee22dbcb283017555fd118548bb17e8608bccf72446a8eee496755ae39dbeb47a0959a3d0ef88f07b00fe203d120494de961beac12e28f769c29f8e1e79d92df5dcd89a02f4b1747619bdb43281026aad3d199587f24e36d6c56d42b007948dfc26a250a0ac5d7f3541e37b9efb9a2a7c6403d7f4624fc146ae8960d0a03c3384b7990205ce9bdcfb64b91faf7847b7215e9c9775e01fcb4cb2e21c3c1c229d92cdcd9d6f6447f1e666b148e602cbfd0e219b061c95dbdb7282cf86e6f9ec77f01a69c3a2f5fc749f9af4377555c71cdb25daa8e9b060900ff388a1695b2c05d4e620c57b8a52f3eabca1ea5dd3abfd9886664f5e387158fc5071bf054333d982e95fcc4c2b32e1cbb0a395eafb42a0612e6326f1eb20f36ee24553274ee20a68f1bced0d3f5cde0ee8b12f282273ec29591c2d3f68d99ce05f2a8d6fa3748bb6b6c8555b63f182b68e15ca1f9f52a9a0c1680af1101e67ea3bd17d2748584315208f5377567a85b1a390cd3b05c0eebd6b2a7de966d214e8b5052fe750b9ad79f6ad7e41c2bcaa4fc34ef90f86c649e09be0880a3d3a05b070901c8961b251f8b503c3fd46de6a599b4d28a39a510efe7f4cb2700bcc06e22cf613c6fe92dab6e4fe5cf54d8f44bebe8eb71bbf8d70c5cf2533218825ddccaa25cae5d9887667b37d2a09811c38164080defb1e58a58b7beca0caee528fb2185f543f507f534d3ad45931703c9ac09a84c10fc59c9d0febe878eb7b11b447361ce0ff13e25573b6e527cbb229317fec4e3cb2058747f9d7fe1a3d5482208d5e57e2616320e3d8fd6ae54dadecdb5efbc54c6f5344a8106c30fde5b93b797dad3807091a28518ccd7d1b8df2867465fbc119393f30b9cee118b3991f445f1b27fe736bf9b93bf7170ffa6d72574d15e6d64242ece4984394e06fad6aba256cef526c73e9b4bb26b836e27dbcb2b11f6d24c29e8bcc5f8f114a8bb54c7cb530c7ddfe2f38274d35a1d0ed5fcd8a0148c6a7940f60290e3ebabbf2bf450ed5f3481f5f5857f212285ed12a01bc64204286c9d5422d90aad4034af30b294d69eaf95cbdfa1ebbeb7259185c0411df38f6636045560a4d8e74e940f0ee0d4baf1d8f216bbbfc3c8db878af8a6de8f0b14f3c6d9136c730be7b4e5eced82c423925088db797df0a5b2e199d79a58f476cdc2f48b4b60d60b9693e4cc91ebe06e92bd0bbcb8fa22cc6926f387d29189a062a214322034bbb897feff46e06aee6f456aa4fe8681b4999aa8acf25f3f6fd5248cc562695dfe6e39414454f63470f37ad3f7445e5b7779b4e0cea3bd29eec70b481ba710bc593547c8ec227f39b249cecf0eb4c0af7cfe1801e64c1e130d12e59c0951903f026e5b95f1eb95432e272b74df68fe4c90da205ec39fdb57bef5e9941422fe61ea1d2ae09e7dc683bc21490d2a35236f47e8960d8c6483aea94a604372200574b2dba6abf0c8968d018c265ec772744e9e404727345363e7e510a6dab473c2a496d025cddabd01393c6bc5b7506536bbe3d9872f8786850f4645979a6e689d5f08596d71bb96768f81ffa843c8388053561aef33e977e395b59c684af91ca902c403bb27be824f83bcce23c47024236e6a12e406417bf2130e066e0a4e602eef0634270a8a50c7975178bb19fafb889b6c3bee0fffa92fc50226e32738ce398295f87087e0acff50e186a1eec89c38b33161f22faaa501a790f8998ae0a248b3bb09dc398d2fee12690ec5557330113bc2b1efcc95a8c2cab80f8598d90387bc9615137e55ce66770a05c4eebadb5189bdac78be5eb64981bede182b59542de02540e9baa637c94b69fc46de13551387f99625b3bad6b57f3d260890d8087876df823be2e66047c4c5444528d0ba0931d5b96602d08ad8d78b40943244a4980fb69129cbdec84929d5d4e53d563e0a891dbf8eff078be784830155ee582d99252c4d697342f868b850a7656a51b4dc7cdb9f8b36106550de8ec1b1eaad8380a67a51d7c9f32efeb6369066e6e5b7ee2f94c915c0e224a9cc1e1f4bafa5466c6ea702dfc2dc8195102394d3eed3f1c86c4f0f2f741fb34e78f15438c610f8d0f46bd950f1669b0ff006d6533e8977340d4d45a2892bec5f5df78d8b9ac7dc9e0f9a0c0324118bdd43be22d38cdd276f0f265b05d21212e8454e055dd085cb97aacf057564e0ddf00bdb8d9d26d02a039ade4d42d006c44ad65e5f88402fb39415f6452c17af4019e3a668aae809c65509510fd0ff72c1c7f6babed8594bcf1be35f00a9f480a71e8508c45dce677803dff85caea6205266e2644618675d6bb2cd54c46b8fb7ae08f910a9602d60cc6c377563649dc6b6d04dd8f78229ee1469635cf16d65f3219e8d4a5489025fd43f747ff1716f50783e34fbde2ac55f8316e678f24ac15758a42bcbb66303e82599c2798636b94ac0275abc9bdfdcfb8d049c600a26ddf65f46fb372528a8ea44573b175fef926d68ae0df674e091aeb8563a3174503cd9f373a0c6b297868640680a3b781bf2dd4140ef6a915a1c5b16aa04f7a6d2e68f0173d9dbffe4167cce8ec91cc1251009e27590f465188dc918ddbea4ba76dfffe4e6b3e523b4fb8030ef66d7d611b1c0720ac1e33bf173eb8182eb2e647e36bdd948c20c7f9d93349d58d99fc7bef8baca38dd5320ffa71285682920d20754ddf99dd0debb143bbc70e3bc538a8816567d1d361f194a3825d9434bb9a1565b0e1e7b95822e1052e3e7563f2cb3044df0cc0919cdde86dda6e7d3f61599bd502799a21419e10b81036a0c34a5f7f1424d4eed273d21a4cb21814ac60fd2f989a1a38877f221f62181d809d03bfb404733573dc5ccf91fc62c7aead19cef19d2c16c2ee4ae5d6bc6599cd7eb034745325183bf91c002624cdce2af1f0d1b3ae884726174744e703e0e1372f904172ae2a9cd8a752e04b6050f4db2faa27db29bab19d28c6757a391f4fd262b045733a2bc4f42ee3170be7cd81e407962db0a234d9db5c8f4b6b8deab5a90b93624469059a62e86d75a50235ecc4817df053c9fc6bac6046af047dfc11620367673a20e2928dffc2066fb43ff5096e9f18fa237666050c39eb9f1440e7ae2944b8a90c91cc61526546a875c220fdaa53fc6b784e51f5111ee2b9cee45bac7cc52b43feda28e7c065a324868ecb63761091177b8e05637fdd09d4f05979db8c0397470c03071f1516f845bd445eb3b56c199614378c1e4881a560b6f9a6bef6ac30e4e7a4b0fa12ac2c922bb49708350ed4e18ac9af5bf8b5823164a6266a5289543c475b8abcd2e00542b7bcb02afd3032ae51141e0c8c19a46ad90496688ca4a82102ff44927d8f157f9525a5b37579f54841d963ff01990d8f734cd40288bf17edde7748e8d205a4ec303e55", @ANYBLOB="000000001c00000000000000010000000200", @ANYRES32=r9, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x98, 0x20048040}, 0x44) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x14, &(0x7f00000002c0)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x0, 0x51}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b44", 0x3c5}], 0x1}, 0x0) r10 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000001340)=@hci={0x1f, 0xc00, 0xe}, 0x80, &(0x7f0000002540)=[{&(0x7f00000006c0)='b', 0x10}], 0x1}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, 0x1fff, 0x10000, @value=r6}, 0x28) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000780)=ANY=[@ANYBLOB="8fedcb7907001175f37538e4"], 0xfdef) 16m24.094009718s ago: executing program 1 (id=1995): bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={0x0, &(0x7f0000000880)=""/1, 0x0, 0x1, 0x1, 0x3, 0x10000}, 0x28) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfe33) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r6, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1, 0x0, 0x0, 0x6000}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYRES32=r7, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) 16m22.824792168s ago: executing program 1 (id=2002): r0 = socket$kcm(0x29, 0x2, 0x0) close(r0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f0000000100)=r2, 0x4) sendmsg$kcm(r1, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000e40)="97", 0x1}], 0x1}, 0x10) sendmsg(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)='R', 0x1}], 0x1}, 0x4) close(r0) 16m22.179074313s ago: executing program 1 (id=2006): bpf$MAP_CREATE(0xb00000000000000, 0x0, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000080)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f0000000300)=r4) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 16m7.005694303s ago: executing program 32 (id=2006): bpf$MAP_CREATE(0xb00000000000000, 0x0, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000080)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f0000000300)=r4) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 13.274330988s ago: executing program 2 (id=6688): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000001c0)='syzkaller\x00'}, 0x94) mkdir(&(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xf2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={0xffffffffffffffff, 0x0, 0x2, 0xffffffffffffff63, &(0x7f0000000100)="7a04", 0x0, 0x91eb, 0x0, 0xffffffffffffffaf, 0x0, 0x0, 0x0, 0x4, 0x0, 0x82}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000100)="c2", 0x1}], 0x1}, 0x80) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f0000000440)="2e00000024008f866b48922c6f130000005e14060800000000000000f1ffff00", 0x20}, {&(0x7f00000010c0)="018d4561b6", 0x5}], 0x2}, 0x4000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000008500000029000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe, 0x0, &(0x7f0000000400)="e4e647c9e0b8e9a2f2ab3026da58", 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mkdir(&(0x7f0000000380)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x20) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r3, &(0x7f0000000000), 0x2a979d) write$cgroup_pid(r3, &(0x7f0000000100), 0x12) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22041000f3fe80000000000000110880febb0007aafe8000000000000027bfa7b09303960e2b80"], 0xfdef) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000500)={r0, 0x0, 0x70, 0x0, &(0x7f0000000400)="438684204ab38d43dc971771382e3e5f06cd48de6a6b0bd34501afe74dcfbc866af1366e4f5114cbd2a515c71c70c8367942cc027337d4f0f5c3d39488fe8629c55c24aa0f8fbe9333dd0f2998cdb4e2dd66678424162387efe7d4422387e541f6f038d31d970aadc700a77e5b2efe7f", 0x0, 0xbd0f, 0x0, 0x48, 0x0, &(0x7f0000000480)="99b4c327e7ccde8ca4191a604d068e7b9a9aa711fce4908dac0270e3273a26e2bb8de186e8ba1712cb66b8974e608c8a995a0eaabc6a538435988d451cc6224a641b60eefe2228f5", 0x0, 0x2, 0x0, 0x3}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff00}, 0x48) 12.063055488s ago: executing program 2 (id=6700): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0x7, 0x0, 0x4) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r2, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) perf_event_open(0x0, 0x0, 0xffffefffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) recvmsg$unix(0xffffffffffffffff, &(0x7f0000004180)={&(0x7f00000009c0)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000004100)}, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x10001}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x30000000}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x50, 0x6000000}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x20}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0xf1}, {0x7, 0x1, 0x2, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x3, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) openat$cgroup_int(r5, &(0x7f0000000080)='hugetlb.1GB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000003feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000006f440000000000006b0a00fe000000007303000000000000b500feff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050cdcfc92f5daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf9bf04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff4e2c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40fc5d2f55ff07c53147de202ce517b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661061173f359e9052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff26b61aac8aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e26534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336dfaa6d5d164301190bc2d4c04087729033342045804a28082abc3b4762302a271722fb515f31e0dd115a292f1e68481a62cd15ea5460a29c60b1058fb7aa9bf4ee3cbe11b03711a15d730646b72d074dab1e8c429339f3460d324c17a4a8bfc7d7eab45bef00664d6dc8230000065937f36f6490eb033b1ce0d4922701cb42aa86ee11cd5950b58ebffffae2aba1a21410e6cb3835bc2c19c9dacbb5f836d1c0de069c20c55fa567859aca8be3afdc3a14779e9181a382831580eac154d314974d209c00896548b04f80d68da1c7ecdfea1e05d0f442b81c4f2a38ae1f43688aff1d3eb14112da5d5289bedeeff7093a12faf47f55bd7ffc82893600042e761ec18de4cd287e176befc4af4063e5f091f8a50cbf02ad70682c0131d616ff6d999fc6fba6e9d4a3fc4e6430aca493d38db18ef4b2d46a22c1dc14910a49126684e453d30ea51dc537a0c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffe27}, 0x48) 11.000970023s ago: executing program 2 (id=6705): socket$kcm(0xa, 0x3, 0x73) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d711851000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8912, &(0x7f0000000080)) 10.989503294s ago: executing program 3 (id=6706): perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9c, 0x1, 0x0, 0x0, 0x0, 0x5, 0x42020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd831, 0x1, @perf_config_ext={0x10000, 0x3}, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0xe, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x1, 0x0, 0x7, 0x0, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000000000085000000b300000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000700)={r1}, 0xc) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b701000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r3 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x7, &(0x7f0000000000)=r2, 0x4) (async) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x480283, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) 10.919246715s ago: executing program 5 (id=6707): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x800, 0x0, 0x80000000}, {0x1000000a, 0x4, 0x80}], 0x10, 0x40004}, 0x94) close(0x3) r0 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffe, 0x1}, 0x100010, 0x0, 0x8, 0x0, 0x4000002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) close(r1) close(0x3) socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x10001, 0x10000}, 0x80, 0x0}, 0xd0a0) setsockopt$sock_attach_bpf(r0, 0x84, 0x64, &(0x7f0000000000), 0x1c) r2 = socket$kcm(0x2, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa1000000000000070100"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000c1001000000000001c000000850000000e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000300), 0xc) sendmsg$inet(r2, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xb}, @multicast1}}}], 0x20}, 0x4008804) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f8480b0000005e140602000000000e0027001000000002800000121f", 0x2e}], 0x1}, 0x40000) socket$kcm(0x21, 0x2, 0x2) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x5, 0x3, &(0x7f0000000180)=ANY=[@ANYRESHEX=r2], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r4, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r5 = socket$kcm(0x10, 0x5, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020022003505d25a806f8c6394f97e24fc6004030e000a740100053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x74000000}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) 10.606090113s ago: executing program 3 (id=6708): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000040)={r1}, 0xc) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000040)="6700000011008188040f56ecdb4cb9cca7480ef435000000e3bd6efb440009000e002e0010000000ba80013ffa85f59a0000005a8c3774fa0af3dc59a933c1e6a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f", 0x67}], 0x1}, 0x24004004) perf_event_open(&(0x7f0000000040)={0x2, 0xfffffffffffffdf7, 0x65, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40008, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_config_ext={0x9, 0x2}, 0x4580, 0x2, 0x800000, 0x0, 0x2, 0x2, 0x0, 0x0, 0x8ba, 0x0, 0xc0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12000000050000900b00"/20, @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r4, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f0000000740)=r2}, 0x22) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r5, &(0x7f0000000080), 0x0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x16, &(0x7f0000000240)=ANY=[@ANYRES32=r0, @ANYRESDEC=r3, @ANYRES16=r3, @ANYRESHEX=r3, @ANYRESHEX=0x0, @ANYRES32=r2, @ANYRES8=r2], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xe}, 0x94) 10.602453703s ago: executing program 4 (id=6709): r0 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r0, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x4, @empty, 0x4}, 0x80, 0x0}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) recvmsg$kcm(r0, &(0x7f0000005140)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000240)=""/206, 0xce}, {0x0}], 0x2}, 0x10000) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f00000000c0)}, 0x20) recvmsg$kcm(r0, &(0x7f00000020c0)={&(0x7f0000001c00)=@nl=@proc, 0x80, &(0x7f0000002040)=[{&(0x7f0000001c80)=""/24, 0x18}, {&(0x7f0000001cc0)=""/201, 0xc9}, {&(0x7f0000001dc0)=""/220, 0xdc}, {&(0x7f0000001ec0)=""/125, 0x7d}, {&(0x7f0000001f40)=""/149, 0x95}, {&(0x7f0000002000)=""/29, 0x1d}], 0x6}, 0x2) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) recvmsg$kcm(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000940)=""/204, 0xcc}, {0x0}, {0x0}, {&(0x7f0000000e00)=""/253, 0xfd}, {&(0x7f0000000cc0)=""/224, 0xe0}, {&(0x7f0000000f40)=""/92, 0x5c}], 0x6}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x1f, 0x10, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB="ebad00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000030000000300000000000200d200"/29], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001a80)={0x18, 0xa, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000001000098312e4800000000000e00000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000d4336f00060000006b1a5000fcffffff9500000000000000"], &(0x7f0000000680)='syzkaller\x00', 0x7, 0x3c, &(0x7f00000006c0)=""/60, 0x41100, 0x21, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x1, 0x3}, 0x8, 0x10, &(0x7f0000000740)={0x4, 0x5, 0xa, 0x1}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000840)=[r3, r4], &(0x7f0000000880)=[{0x0, 0x5, 0x3, 0xb}, {0x4, 0x1, 0x3}, {0x2, 0x5, 0x10, 0x6}, {0x5, 0x1, 0x1, 0xb}, {0x3, 0x4, 0xb, 0xa}, {0x1, 0x1, 0xe, 0x9}], 0x10, 0x1}, 0x94) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f00ff0f00000000000050375ed08a56331dbf9ed78105001ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00010004080c00bdad01409bbc7a46e39a54cbbda812176679df069163ce955fed0009d78f0a947ee2b49e33538afaeb2713f450ebd010a20ff27fff", 0x89}, {&(0x7f0000000500)="0885fdb5d8f08a6c43fae5e10ecb35d716e9ad581b105cd9a93c9f9d5f267ae8af6b386212ba53d056e203ad00981061af5e2ec74ab1e687465f4160f011732cd907660181adb96f8c11245f06ede2593d938881c003ba03fd71ded30a86c57118ae6d1302cf3e1df6e8049dbbaa9d1b9f2b6017c66929f4549ef5727b6948d66d0482a233d53eb73d948c74", 0x8c}], 0x2, 0x0, 0x0, 0x7}, 0x4001) ioctl$sock_kcm_SIOCKCMUNATTACH(r5, 0x89e1, &(0x7f0000000380)={r1}) socket$kcm(0x29, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b702000014000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000100850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9bf0bdf81524f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6cd87cef9000000a39c15a7ef365cc27dfeac7b9b0e9048517354b0ca4f9cf8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19ea2eb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc089a9813c1efa26001b3f486ebfaae85c4d0b96778478ae5355e6f923b11056969f486f80a35f7f2339704fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d0000000000000000000000004e1fa60acabcf0553910ca2e5ea499fd5889dde9261f0848a5b8af657bfc96049308e8953431b269053627a1523551c160c813969925a892d266792352ec0204596a37ce8d6d260b32239bddbce2e79f93cb5a0ad897adb53b397d07c50f84b74f2605a565ee149016aa75ea31c0087dcd821b47c8b36efc6da4fb2ea7f1f36c85856b73ac9872babc62149699b6b8c796a79d833eb4b5ca668d430db5653a2b3c5b87e17ca1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x410, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}, 0x400}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.time\x00', 0x26e1, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2980, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext={0x0, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) 9.787550412s ago: executing program 2 (id=6710): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffa}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xffff, 0x81}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x4, 0x80, 0x2, 0x7, 0x2, 0x7f, 0x0, 0x6af, 0x38300, 0x5, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x101, 0x4, @perf_config_ext={0xc, 0xfff8000000000000}, 0x2000, 0x4, 0x5, 0x5, 0xb, 0x8, 0x400, 0x0, 0x9, 0x0, 0x921}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xa) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r0) socketpair(0x1, 0x801, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x5452, &(0x7f0000000400)='lo\x00\x96o\xd6Q\xb4Y\xa9\xc87,%\x81\xfe\x00\xd2\xd1|\x00\x00\x00\x00\x00\x00\xe3\xd8Yk\xdf\x85\xaac{\x8c\x8ffp`-\xcd\xd9\xd5\xf4\xe68\xe6O\xc2\xf1V0\x8b\t\xed\x13q2\xdd\xcc\xeeR\xf2/\xba\fE>k\a\xe7>t7\x8e(\xf0\x87d\xaf\x93\xfa`\xa6,o\x81.\x1cR\xa5\t\x00\x00\x00\x00\x00\x00\x00|pT\x15\xbc\f*d\xcb\xc2\xcd\x8f\x98\xdf\x00\x00\x1cM\x9c\xa5\xe0\xa8\x00\x00\x00\x80V\xf6\x80\x86\x1b\x05\xe6\"\x1d\f\xaey\x06\xd9$H!w\xa6m\xd8\x7f\xc6\x837\x83/\x9a\xdf\x01\xf2\x9e\xbb\xca\x04\x00\x05\xeb\xb8{7[\xf9\xe9\x15\xdc0]\x89\x9b~\x04\xb4\xa5\xad\v.\xd0*%`\xb0\x03\x00\x00\x00\x00\x00\x00\x00\xab\xf4\xa7\x83r\xa4\x80|\x03C\x9c\x00\xac\xba\xcb\xa4h\x86w_Eu\xbfy%,\xe5\n\xc1\xb3\xa4g\xa3P\x0f\x11\x93\xc7\xf3\xcf\x17\xf5\x86%\x7f\xec\xb2\xc5E\x00\xb2e\xa8\xf1<\xb2\xc82\xbf=o\x00\x00\x00\x00E\x00\xc6X\x92\x0e[\x19\xaa?\x06\xe5\x9d\xd1\x87\x922A\x95\x8e\xbc\xc80xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f0, &(0x7f0000000080)) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, &(0x7f0000000840)=""/121, &(0x7f0000000680), &(0x7f0000000540), 0x6c}, 0x38) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa1", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000061044c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) 9.682906246s ago: executing program 3 (id=6712): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRES32], 0x48) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r0}, 0x38) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10d113, 0xac5d, 0xfffffffe, 0x0, 0x2, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = perf_event_open(0x0, 0x0, 0xb, 0xffffffffffffffff, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r3, 0x0, 0x20044818) sendmsg$sock(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0x18}, 0x4000081) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="95ab8caad55817c0450000000000000085100000feffffff95"], &(0x7f0000000600)='syzkaller\x00', 0x4, 0xdf, &(0x7f0000000940)=""/223, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0xc, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x32, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000380)=r4}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r6, &(0x7f00000001c0), 0x0}, 0x20) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="b4050000000000007110a400000000001f010000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x6, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000040)=@framed={{0x18, 0x5, 0x0, 0x0, 0x63, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r8, 0xfffff000, 0xe, 0x0, &(0x7f0000001700)="61df7100c80400d5721ff59fe864", 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x1}, 0xf) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) 9.682086066s ago: executing program 4 (id=6713): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8912, &(0x7f0000000080)) close(0x3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d2e, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, @perf_config_ext={0xfffffffffffffffe, 0x5}, 0x51f5, 0x0, 0xfffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x3, 0x0) 9.679447495s ago: executing program 0 (id=6714): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0), 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={0x1, 0x58, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1e00000000000000010000000100008000020000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r0, @ANYRES32, @ANYBLOB="0400000003000000010000000e000000000007000000000000000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000005000000000000008510000002000000850000007600000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="e8a41f7fe89914cf00009500000800000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) 9.303433024s ago: executing program 0 (id=6715): socketpair(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) (async) socket$kcm(0x2, 0x2, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@struct={0x2}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x28, 0x0, 0x1}, 0x28) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d0e, 0x80218, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x7}, 0x2005, 0x0, 0x51, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r2 = socket$kcm(0x2a, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x440200, 0x0) (async) sendmsg$inet(r2, &(0x7f0000000640)={&(0x7f0000000000)={0x2a, 0x0, @broadcast}, 0x10, 0x0}, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) close(r2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x10, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) (async) sendmsg$tipc(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000240)="cf9a37a7805e9dfa339b1345cbbe06af9ba2b4e94aabb77d3f76a35f178f5ff6bd6da231bcc37a471d4067db34ac9ae4f68092c689bf44967baa474d5ebe27382de587bf97d4301ddf6d3a8f0d7423c9d6", 0x51}, {&(0x7f0000000300)="c35ed5a66bd80ff615fa16b39498f1d3b5b32b40f837fa26d8cc0488d092d671e1a0cbec381a35ad5a412db6b2f74ef5821a3173a361663b8ea77773980673c28787ca9cbaf9281554c1f930c2cf818ef22edcecb60cbba2b2f4b84e1d944a4ac3887d673d91077fa96fc2e122dcccfdcd7b748edbcae7906d1861797d80adc4b553e0eb237848a06f07d2090d3769589318ff80b8b4b9dc68241d6b52cb621a822e90f419b2cbb03e246fb4b7187a3d1517968aca4325a420bc026209fb11b82b93c722e2581a28e6be4d9aaac997fceca851", 0xd3}, {&(0x7f0000000400)="d90a3240ee7981540c4188f37c0e510f", 0x10}, {&(0x7f0000000500)="7c056ab516ed15c6311ecf50c1c63ffbc52dec220581a3736fb88708da97a1dbd151e74870016eed494dc7fd2831552098f2a4", 0x33}, {&(0x7f00000005c0)="225a65ecf85b1e8db31fb2bc2e454878899b819d100799aea6c53ff177ee9dc464ba3aa592d235f65d8331e8cb53963bcdcef27a91a9602718b6147932b5bad61052b6acfe4c52693b72bec815e0ca01e13682c1641ac41c19f269f2cf25cdc583e55c9f37684e9a814645ad8d7d7e6edad321a655b57a8d4d37a98d3a270fb314e2812c04f2c20c13ded9e0c4abbbd66d0b3faa2463e1be5cb43fc7f424027ead3b254d5fbdfc", 0xa7}, {&(0x7f00000006c0)="7e562cacc8b0f203384644a0e779823e9ad300bb6e4b7cf96d40ded7fdb0beef2009198d303798e150550d5723193d9012463a88d540ab6da73e4976bb1bea02bc2cb77e0c46ac390279feb8397e5de250fa54cb66b82d04c0dbfa3082f1da8a942d8661ae44ad005f3cba332213a25936566d0e338c173fbb96915558ddab1d132e7d7b3d9999a02ea82205b8e8fc2efd0f3f3b57a8b9b09e41a67cff278f8cfe0e79d2e5e0189ac41068b703cdc7ae316b296276c32c5817f5dc4246a0b031e4cae06643c858c6f7f287eb246005554d331e0b97b9ccaafe981f2e40ba", 0xde}, {&(0x7f00000007c0)="18c2a15e73713d4e2b5557114408a73186f2878edba6885e869408a8ca047175e08e59287d941121f47226909167e5a1b394bb6cf3601386534748bd170c7027cc59ea591a15ea5c3b615ced4f3731b490ade96d978f4d426c1e1dcdfe7ffd44a30799a825d49bac2f1eccba0c6269231be9f5b50aaf6e52b72e6b98b2b678eb0ad6", 0x82}], 0x7, &(0x7f0000000980), 0x0, 0x4004010}, 0x4) socketpair(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) (async) write$cgroup_devices(r1, &(0x7f00000008c0)=ANY=[], 0xee8a) 7.906739508s ago: executing program 5 (id=6716): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0xff, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11540}, 0x0, 0x6, 0xffffffffffffffff, 0xb) socket$kcm(0xa, 0x3, 0x73) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)}, 0x4000001) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0100000008000000080000000800000040000000", @ANYRES32, @ANYBLOB=' \x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000750e47d4e8f98bd03db5a2"], 0x50) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x4044}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open$cgroup(&(0x7f0000000040)={0x4, 0xfffffffffffffe77, 0xb2, 0xe0, 0x3, 0xb, 0x0, 0x1000000000000009, 0xde49, 0x7, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8000f, 0x2, @perf_config_ext={0x1001, 0x7}, 0x110708, 0x100008, 0x2, 0x8, 0x10004, 0x6, 0x7f, 0x0, 0x7, 0x0, 0x8000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, @perf_config_ext={0x0, 0xffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000480)={0x0, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_bp={&(0x7f0000000000), 0x3}, 0x58c8, 0x0, 0xdffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='8-N:0/2'], 0x6a) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008000000010000008000", @ANYRES32, @ANYBLOB="05000000000000000000000000000000000000007ef99ffc6b97e26a4e75a5a5efa73aaced1f2155d7d954e2a690059430d879173ff527dba6a5effe105205864ce5d8cd688a7732b09872b71a9c69539627717a15b2bd37b36dcfcd8970243edf9219b1a4cf6dde66241de76433461a881cbdc6ea586921360b0e36e5c45f3d023352dee32d2eef3048fc5833b274d4c6cd0ecb4a0efd2baa3612a7c4f60c57772071af141a7d9a57d8e5e273052239465d7b2d7e4c6f70deb6f91552f3aff1f4fe7234c73ef22ce04a4363123b303796c239", @ANYRES32=0x0, @ANYRES32], 0x50) r4 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f00000001c0), 0x4) openat$cgroup(r3, &(0x7f0000000200)='syz1\x00', 0x200002, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f00000007c0)=@nfc={0x27, 0x0, 0x0, 0x7}, 0x80, &(0x7f0000000400)}, 0x40) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) recvmsg$kcm(r1, &(0x7f0000002100)={&(0x7f0000000400)=@pptp={0x18, 0x2, {0x0, @empty}}, 0x80, &(0x7f0000001fc0)=[{&(0x7f0000000540)=""/38, 0x26}, {&(0x7f0000000580)=""/70, 0x46}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/110, 0x6e}, {&(0x7f0000001cc0)=""/241, 0xf1}, {&(0x7f0000001dc0)=""/130, 0x82}, {&(0x7f0000001e80)=""/163, 0xa3}, {&(0x7f0000001f40)=""/71, 0x47}], 0x8, &(0x7f0000002040)=""/158, 0x9e}, 0x10021) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x4310feed034fc9f2) 7.905962318s ago: executing program 4 (id=6717): r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0xffffffffffffffff, 0x6}, 0xc) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000000c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x5, &(0x7f0000000100)=[0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x47, &(0x7f0000000180)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0xe, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) r3 = socket$kcm(0x2, 0x5, 0x84) perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8100, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0, 0x2}, 0x360, 0x0, 0xc2ba, 0x3, 0x4000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=ANY=[@ANYBLOB="1809000000001800000000000000000018120000", @ANYRES32=r4, @ANYRESHEX=r2], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r4, &(0x7f0000000780)}, 0x20) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r6) ioctl$TUNSETIFF(r6, 0x400454ca, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=@base={0x14, 0x6, 0x7, 0x80000000, 0xa01, 0xffffffffffffffff, 0x3, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c40)=@bpf_tracing={0x1a, 0x8, &(0x7f0000000580)=@raw=[@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}], &(0x7f00000005c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x19, r6, 0x8, &(0x7f0000000780)={0x100007, 0x5}, 0x8, 0x10, &(0x7f00000009c0)={0x1, 0x80, 0x2, 0xd}, 0x10, 0x12dfc, 0xffffffffffffffff, 0x2, &(0x7f0000000bc0)=[r5, r7, r5], &(0x7f0000000c00)=[{0x0, 0x1, 0x1, 0x7}, {0x1004, 0x2, 0x1, 0xb}]}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x11, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x2a}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0xb3}}]}, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r8}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r9, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000700850000002d"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x84, 0x71, &(0x7f0000000000)=r10, 0x8) r12 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000440), 0x8) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@bloom_filter={0x1e, 0x9, 0xfffffffe, 0x1, 0x10880, r0, 0x5, '\x00', r1, r10, 0x3, 0x4, 0x2, 0x3, @void, @value, @value=r12}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffff1}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r13}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x54}}]}, &(0x7f0000000b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.881969149s ago: executing program 3 (id=6718): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x84}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB='c 75:', @ANYRESDEC=r2], 0x9) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0xc2841, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000001440)={'\x00', 0x4212}) ioctl$TUNSETTXFILTER(r5, 0x400454d1, &(0x7f0000002780)={0x1, 0xa, [@random="fa75fd00304e", @multicast, @local, @broadcast, @random="475ab1990100", @local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @multicast]}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa16ae, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x8}, 0x90, 0xa4, 0x2, 0x1, 0xa1, 0x9b9b, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair(0x2a, 0x2, 0x2, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x1a, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xeb, '\x00', 0x0, @tracing=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x8020) write$cgroup_subtree(r8, &(0x7f0000000300)=ANY=[@ANYBLOB="8fedcb7910009875f37538e486dd6317ce8102038700fe08000e40000200875a65969ff57b00ff020000000000000000000000000001"], 0xfdef) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002740)={&(0x7f00000025c0)=ANY=[@ANYBLOB="9feb010018000000000000005400000054000000040000000000000000000003000000000500000001000000040000000c0000000000000b050000000c000000000000080300000009000000ebff0002040000000e000000010000840a0000000b000000000000000000000000006100"], &(0x7f0000002640)=""/249, 0x70, 0xf9, 0x0, 0xfffffff8, 0x10000, @value=r8}, 0x28) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$TUNGETFILTER(r5, 0x801054db, &(0x7f00000015c0)=""/4096) perf_event_open(&(0x7f0000001480)={0x2, 0x80, 0x8b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x9}, 0x0, 0x0, 0x6, 0x9, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_clone(0x1100, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110c230000) r9 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='devices.list\x00', 0x0, 0x0) recvmsg$kcm(r9, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001440)=[{&(0x7f00000000c0)=""/106, 0x6a}, {&(0x7f0000000140)=""/19, 0x13}, {&(0x7f0000000200)=""/174, 0xae}, {&(0x7f00000002c0)=""/67, 0x43}, {&(0x7f0000000340)=""/153, 0x99}, {&(0x7f0000000400)=""/55, 0x37}, {&(0x7f0000000440)=""/4096, 0x1000}], 0x7, &(0x7f00000014c0)=""/157, 0x9d}, 0x40000042) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110c230000) close(r3) 7.83799791s ago: executing program 2 (id=6719): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x16, 0x0, &(0x7f0000000100)="b9ff03316844268cb89e14f086dd65e0ffff00122c00", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x16, 0x0, &(0x7f0000000100)="b9ff03316844268cb89e14f086dd65e0ffff00122c00", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, 0x50) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x36) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (async) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20, 0x12504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r3 = perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20, 0x12504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={r2, r2}, 0x10) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={r2, r2}, 0x10) syz_clone(0x220100, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r4 = syz_clone(0x220100, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000980)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r5, &(0x7f0000003440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003380)=[@cred={{0x1c, 0x1, 0x2, {r4}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x38, 0x20000004}, 0x4000011) ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0x3) (async) ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0x3) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x410800, 0x0) perf_event_open$cgroup(&(0x7f0000000200)={0x3, 0x80, 0x9, 0x3, 0x4, 0xfe, 0x0, 0x800, 0x80000, 0x14, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, @perf_bp={&(0x7f0000000140)}, 0x8, 0x5, 0x1, 0x2, 0xc2, 0xffffff81, 0x3, 0x0, 0x7, 0x0, 0x24d6d21a}, r2, 0x7, r3, 0x2) (async) perf_event_open$cgroup(&(0x7f0000000200)={0x3, 0x80, 0x9, 0x3, 0x4, 0xfe, 0x0, 0x800, 0x80000, 0x14, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, @perf_bp={&(0x7f0000000140)}, 0x8, 0x5, 0x1, 0x2, 0xc2, 0xffffff81, 0x3, 0x0, 0x7, 0x0, 0x24d6d21a}, r2, 0x7, r3, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xc, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000008000000850000001500000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0xe, 0xfeff, &(0x7f0000000100)="e0857f9f582f0300000000000000", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = bpf$ITER_CREATE(0xb, &(0x7f00000002c0)={r2}, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={@cgroup=r8, 0x20, 0x1, 0x1, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000003c0)={@fallback=r5, r8, 0xe, 0x2018, 0xffffffffffffffff, @value=r2, @void, @void, @void, r9}, 0x20) (async) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000003c0)={@fallback=r5, r8, 0xe, 0x2018, 0xffffffffffffffff, @value=r2, @void, @void, @void, r9}, 0x20) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) 7.789719291s ago: executing program 0 (id=6720): socket$kcm(0xa, 0x3, 0x73) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d711851000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8912, &(0x7f0000000080)) 7.490436898s ago: executing program 5 (id=6721): sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffff, 0x4}, 0x200, 0x2, 0x0, 0x7, 0x4, 0xfffffffe}, 0x0, 0x100000000, 0xffffffffffffffff, 0x1) (async) r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffff, 0x4}, 0x200, 0x2, 0x0, 0x7, 0x4, 0xfffffffe}, 0x0, 0x100000000, 0xffffffffffffffff, 0x1) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, &(0x7f00000037c0)={&(0x7f0000000600)=@xdp={0x2c, 0x4, 0x0, 0x2c}, 0x80, 0x0}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21bef5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f94306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a835701bea8240399c56ce8f58df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b262341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f9ac2f7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db000000000000e6ed75ca8fcda7ef3ee336189fef3b3ffb9f38fefc5ff39c4e69e3fa1f8b10ee97123e99b61eba065b1ad67530e7c4f11f9da7ae000002000000610101ad7f79cb9bbf64a0fc109f49fe8799fe266e2ccac80fefe750151f5ddfe51833ec65ece70e07ce8ab5d97db47da8f80000664dc0b86ae2b3ff9d4e220752a6b2f3ea9f793612386496dca5af7b8952aafa796ea7b156d19612297c63bb20e1e0469f7615f67a9218cbace38f5236821314f76302b98afa93044b83989339ca10e6ae30e70e17a82f03e915b8425e8e7a91614306d2ae0bc3550d856f2d7293672b5673d264fc886b0c8bdf436a0fcd21bf9da7bdca98e34cd6e59b0a7ce4ba1b466561aaa35448dff47bb1d7df23d467689a6669e4300d5acf12e4d0b35abf91569f605b2f6df0d861"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21bef5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f94306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a835701bea8240399c56ce8f58df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b262341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f9ac2f7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db000000000000e6ed75ca8fcda7ef3ee336189fef3b3ffb9f38fefc5ff39c4e69e3fa1f8b10ee97123e99b61eba065b1ad67530e7c4f11f9da7ae000002000000610101ad7f79cb9bbf64a0fc109f49fe8799fe266e2ccac80fefe750151f5ddfe51833ec65ece70e07ce8ab5d97db47da8f80000664dc0b86ae2b3ff9d4e220752a6b2f3ea9f793612386496dca5af7b8952aafa796ea7b156d19612297c63bb20e1e0469f7615f67a9218cbace38f5236821314f76302b98afa93044b83989339ca10e6ae30e70e17a82f03e915b8425e8e7a91614306d2ae0bc3550d856f2d7293672b5673d264fc886b0c8bdf436a0fcd21bf9da7bdca98e34cd6e59b0a7ce4ba1b466561aaa35448dff47bb1d7df23d467689a6669e4300d5acf12e4d0b35abf91569f605b2f6df0d861"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) r3 = socket$kcm(0x10, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x300, &(0x7f00000001c0)=[{&(0x7f0000000940)="2e00000010008188e6b62aa73772cc9f1ba1f8482e0000005e140602000000000e000a001000000002800000128c", 0x2e}], 0x1}, 0x0) 7.43275785s ago: executing program 0 (id=6722): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7}, 0x94) close(r0) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x14690, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_config_ext={0xb3b, 0xffffffffffbffff8}, 0x842, 0x0, 0x6, 0x0, 0x0, 0x101, 0xa6f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r3 = socket$kcm(0x10, 0x2, 0x10) socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="5400020029000b05d25a806f8c6394f90424fc602f0011002e2f0100053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000500000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1d, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00"], 0x0, 0xfffffffd, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r4, 0x0, 0x0}, 0x10) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x541b, 0x4000000000000000) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r5 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x806, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg$kcm(r1, &(0x7f0000005140)={0x0, 0x0, 0x0}, 0x10000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0xfa, 0xb, 0x0, 0x7, 0x0, 0x6, 0x1, 0x8, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, @perf_config_ext={0xed7d, 0x10000}, 0x102b21, 0x0, 0xffffff81, 0x4, 0x9, 0x1000, 0xfff7, 0x0, 0x7, 0x0, 0x4}, 0x0, 0x8, r5, 0x3) bpf$BPF_MAP_FREEZE(0x16, &(0x7f00000001c0)=r6, 0x4) 6.788897085s ago: executing program 5 (id=6723): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x881, 0xbf8f, 0xb2, 0x0, 0x57ce}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r1 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000022003507d25a806f8c6394f90524fc60", 0x14}], 0x1}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b44", 0x3c5}], 0x1}, 0x0) r3 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000001340)=@hci={0x1f, 0xc00, 0xe}, 0x80, &(0x7f0000002540)=[{&(0x7f00000006c0)='b', 0x10}], 0x1}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0xa, 0x922000000003, 0x11) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000540)={0x3, 0x80, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000000100), 0x1}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x10c002, 0xac59, 0xe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r4 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x900}, 0x60) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) close(0xffffffffffffffff) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYRES8, @ANYBLOB="3e971d"], 0x9a) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x11, &(0x7f0000001540)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000001c0)={&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000002900000043"], 0x18}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[], 0x50) socket$kcm(0x10, 0x2, 0x0) 6.780354156s ago: executing program 4 (id=6724): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @random="f8ff00400400"}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040033, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&\x00'/12, @ANYRES32, @ANYBLOB="f061d0c56d3ee12da1dfbbbc", @ANYRES64=0x0], 0x10) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x4000000, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @random="f8ff00400400"}) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040033, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) (async) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) close(r1) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&\x00'/12, @ANYRES32, @ANYBLOB="f061d0c56d3ee12da1dfbbbc", @ANYRES64=0x0], 0x10) (async) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) (async) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x4000000, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) (async) 6.356826126s ago: executing program 4 (id=6725): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x8d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0x6f5f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000095000000000000000000"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) r3 = socket$kcm(0x2, 0x3, 0x2) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89a0, &(0x7f0000000780)='..SN\xd5\xa8\xe7\x13\x9d\x11\x85\xb2\xda\xda%\x00\xe9\a\xd9\x12s\x03\x00\xd0O\x87\x8fI\xa5\xbbHd\xfd\x19l\xca\x89\x8e)P\x18\x14\'\x81\n\x02\\\xca\f\xc30p{\x94\xd8wn>\btn\xc3\xfd\xca\x0f\xdb\xab\xae\x04\x0e*\xb4\x06@v\xfd\x86\x9d\xb7\x801\x80\x9a\xc0N,\x8d\x13\x11eJ\x10CQ\xb9ab\xf311\xf9\x03\xd5\xec\x9fa7S\x8b\xdan\xd9W#\x06&P)\x1ak~LB\xa4\f@\xff\xb2]\xddk\xa9\xbd}\xefp}\x90\xd0\xdb\xcc\xf9\xe8\":O\f\x98D\xf07\\F\b\xe2\x82\xfa\xe3L\xb5\x8d\xe3\x87\xa6v\x9a\xb6\xf4\x80\x85\";\xe5\xdf\xa2\xbd\xf9}\\\xbe?\x93|\xcbg\x1c~\xb6Y\xaa\xf3\xd6%\x89\xe4\x1b\xb6.f\x12\xe5\xabm \xb6\\\xb9T\fZma\xb9\xd7xzS\xd3\x8b\x02Qj\xf5\xb7X\xc6\b\x19.\xae\xdd\xa9\xd0\xf2\xdc\x1f\xf1z\v\xf9\xc3\xf0V5D&a\xf6^\x94\x19\xe0\b\xf0\xdcD{(\x1b\xf9|\xe9\xa1]\xdc\xe8\xb8\xdb\xd5<2\x96\'s\xe7\x84\x82\xea\xbb\xff\xb7\xb8%-?\x83\x9cwOe|\xb4\xef\xb6\xf4\xdf\xbf\x1e\xc6OSs\xc4_6H\xde\x9eN\x12\x9cH\x86\x824\xaf\x177\t:\xe3_w-\xbf\x1b\x14\xc7\x1d\xb4\x99\x1f\xadf\x9e\xc7X\x040\x9e^ \xc9m\x9ek\x86\t\x9f \xc8\xcf\xf5\x80(\xd9l\x91\xf7x\x7f\xaa\xd9\xd4nO\xa0\xa0M6\v.\xd8[\xc9\xa4` ') ioctl$SIOCSIFHWADDR(r3, 0x8916, &(0x7f0000000040)={'ip6_vti0\x00', @random="02000400"}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r2, 0x0, 0xfffffffffffffffc}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0xf, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70200001400e9ffb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$kcm(0x11, 0x200000000000002, 0x300) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac59}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000005"], 0x48) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r9, 0x810000a6, 0x12, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888fb", 0x0, 0xadf0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000900)=r6, 0x4) close(0xffffffffffffffff) socket$kcm(0x2, 0x200000000000006, 0x0) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x8955, 0x0) r10 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) sendmsg$inet(r10, &(0x7f00000007c0)={&(0x7f00000000c0)={0x2, 0x4e23, @private=0xa010102}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000200)='Y', 0x1}], 0x1}, 0x40041) setsockopt$sock_attach_bpf(r10, 0x84, 0x22, &(0x7f0000000000), 0x10) bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 6.104348372s ago: executing program 0 (id=6726): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x14, 0x4, 0x4, 0x2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r2}, &(0x7f0000000500), &(0x7f0000000600)=r1}, 0x20) sendmsg$inet(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000780)="7b8484", 0x3}], 0x1}, 0x20000014) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000004440)={&(0x7f0000000ec0)=@name={0x1e, 0x2, 0x3, {{0x0, 0x3}, 0x3}}, 0x9, 0x0}, 0x101d0) (async, rerun: 32) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e1a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080e71113610e10d858e8327edb1fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18c65ae1bd4f4390af9a9ceafd07ed00b0000002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a4693986852ffffae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72c7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9624d37c10223fdae7ed04935c3c9068000000bc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b40000000000000007ff57c39495c826b956ba859ac8e3c177b9"], 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x4, 0x4, 0x4, 0x80004, 0x0, 0x1, 0x100, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2000006}, 0x50) (async) write$cgroup_devices(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="1e030a004d8c71ef2685634a8270e7123c00"/30], 0xffdd) 758.170262ms ago: executing program 2 (id=6727): socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffe, 0x1}, 0x100010, 0x0, 0x8, 0x0, 0x4000002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001240)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000aecd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad94ed406f21caf5adcf920569c00cc1199684fa75814709fea019af247c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c1faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6fab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b79db2e3d5986c82b5aa94e539b204d58f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c7160ec83070000020000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72b0000000000001cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2cc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78ac02ca3cdf6a662db1c9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad943e392955f4f979ea13201bafedcd2063d11dd665647223c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd89346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca2533659edc8be05cc85451c6a14507434eb54b6f43caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffca9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b272341c5e093fd66a294351c5356c1d06c92cf8ce3c7c56cd31121624d74517fd3666277f670e812b28e2f30d035cee5d0e77a3c7220000000000000005a474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f034b8d3ebce68663ef5af469abe75b314fae31a0445859a5ece8fb11a4ee8e46354c9c3a041e12282ce24463aaf28345bd168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f09000000000000004fc4bda3453602004535a976eacd3adaa4d2ee6fe0d072ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d401adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb40f7f02f750d6c977a191852c9ae031db044b2353199546609f9f69a6cfefdf879d447df53f3b9b70d10355b00300000000000000553d18a6cc50feeb7bfad9b7be3283b6450d264e7712d2f1d7004548b19162cef04d18d4f58fab987baab97a9bfbd8f185b5631820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe527340935aa3c0b4f3f45b418a18217747ae442e31560e5b741445ea2a1acee2a81425ff000000d2a0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51423b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f88735fce5115dc83ed73d8ee4a91322608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf5000000000000fa08ad0631c4b839688b22c4da2a6bc4cf45854d221a2d5f96bc64647f15daa2ba79cd0f4254ed55217912ef84bd2927df82fc061aef2920c49b2a90886da75561173fa186cb7ee86dd4285c4721eb428c953296bb2f5d825da54dbef07c1b349b4901e093d13e6b9a0000009b5b22e887bc061d40bcaf0aa18623fd9b7179ccc692ba74b531b65c4decf9d080a8ac7e82d4cde1267aa64b2a94fd87a009e6742c2ddc3a9d7eccbb1831b1fa218277c2814a91cab7cb59c697166d6f1bb1a360470000000000000000000000000000000000000000000000000000f9f9b4ce7e871f507084c8c88e0652decbe579b03ed84ea94597dd1059620a050f69ea03b99b4e19d35f4a3b54e96ae2172effecec80f6baa4bf69a6ebf5392882df78b0983e662dc0cb64b77f3f006b6b25443197ae93f0be6de5a703d003f00720943c0e4b33af00000000000000000021a688b2d7007fcc4b59f719afb0b3b7e0aee306ca70fe42bf4984a68f40e1fc043a03a17e4744359b87dc27c82d51cbeb64e52a28daeb6a78d6fe06181ecc840000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10003, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x401, 0x6}, 0x0, 0xf, 0x0, 0x0, 0x0, 0x3ff, 0x3, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x2d1}, 0x20a8, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r7, 0x40042408, r8) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xa, 0xc, &(0x7f0000001bc0)=ANY=[@ANYBLOB="180200000000000000000000d15100008500000027000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000007100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r9, 0x2f, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa5bc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r5) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) recvmsg$kcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000001640)=""/4096, 0x1000}], 0x1}, 0x0) r10 = socket$kcm(0x10, 0x2, 0x10) r11 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0xc2ba}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(r11, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000001880)="5c00000016006bab9a3fe3d46e17aa0a046b876c050048007ea60864160af36504bb4a43eee80fd1716dbbbc001a0038001d001931a0e69ce517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bba1", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4000000) recvmsg$kcm(r11, 0x0, 0x40012100) sendmsg$kcm(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c0001000b080c00bdad01409bbc7a46e39a8285dcdf12176679df069163ce947ee2b49e33538afaeb2713f450ebd010a20ff27fff0000000000000000", 0x89}], 0x1}, 0xff0f000000000000) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020032000b35d25a806f8c6394f91124fc602f0009000a740200053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) 652.522454ms ago: executing program 3 (id=6728): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRES32], 0x48) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r0}, 0x38) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10d113, 0xac5d, 0xfffffffe, 0x0, 0x2, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = perf_event_open(0x0, 0x0, 0xb, 0xffffffffffffffff, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r3, 0x0, 0x20044818) sendmsg$sock(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0x18}, 0x4000081) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="95ab8caad55817c0450000000000000085100000feffffff95"], &(0x7f0000000600)='syzkaller\x00', 0x4, 0xdf, &(0x7f0000000940)=""/223, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0xc, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x32, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000380)=r4}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r6, &(0x7f00000001c0), 0x0}, 0x20) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="b4050000000000007110a400000000001f010000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x6, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000040)=@framed={{0x18, 0x5, 0x0, 0x0, 0x63, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r8, 0xfffff000, 0xe, 0x0, &(0x7f0000001700)="61df7100c80400d5721ff59fe864", 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x1}, 0xf) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) 586.188055ms ago: executing program 5 (id=6729): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8912, &(0x7f0000000080)) close(0x3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d2e, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, @perf_config_ext={0xfffffffffffffffe, 0x5}, 0x51f5, 0x0, 0xfffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x3, 0x0) 508.234117ms ago: executing program 0 (id=6730): socket$kcm(0x2b, 0x7, 0x0) (async) r0 = socket$kcm(0x2b, 0x7, 0x0) setsockopt$sock_attach_bpf(r0, 0x6, 0x4, 0x0, 0x0) (async) setsockopt$sock_attach_bpf(r0, 0x6, 0x4, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20004, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x58c8, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000bcfffff400000000000000008500000041000000850000007d00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000bcfffff400000000000000008500000041000000850000007d00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000e00)=ANY=[@ANYBLOB="bf16000000000000b7070000010000004070000000000000500000000000e1ff95000000000000002ba76bb33123751c4e345c652fbc1626cca2a2ad75806150ae0209e62751ee04000000670d25010000020000040000009fc404000000c788b277beee11bf9b0a4def23d410f6accd3641110bec4e90a6341965dac03d04683712a0b09edc9e9ef8f6e396ad200e011ea665c45a3449abe802f5ab3e89cf40b8580218ce740068720000074e3e8eea3fd8cf49827ca311f5b87e1ca8433a8acd715f5888b2007f0000000000000000010000000000fb00010000000000414027efc84293af6a22000000005335001db43a5c000000000000000024000000000000000000e75a89faff01210cce39bf405f1e846c1242000000000000cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617da7fb5e2a431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf9938d6df8600a62e96b7cb8e52cbdc2ba9d580609e31c30891f7e5ff7fd6fce424c2200af6c3784a1975fa657de38a3a32a4fd67ce446ac5431d07db79240acaf091231b986e77d05d988d6edc71df48dca02113a38300c2bf2b5543ffc1669557b3819d8c396d2c2361629d1022f722ec23812770d72cd0010000007889b8c7044f563a1f68d4eff895fdbc463f747c08f40105869035000000000000000000000000000000000000000000000000080000003ddf4aa4b1c8baa0ae6feb6737c275dc2740f742b5425f1d581961471cdb0500000000000000d4123f955267fe4a75c114f874e086287547d4099aeec9f1538ee25a365ccf4a9b604e88e12ff25184d4e3c6f7f623559435b26b50fb7113000000f0bc440550ee91302f5a000000000000000000000000006d0000e67ccc00148ac4c43021cce9f24f4b2f9492c32e7af05c648978d9980ba49789906d923e4916f390ab7edcd3f5b9fe14446dd446a52131c464f2c08efb46d934615c8631b7c42efd0294bea179b0433f5c899119ec2c3f4523110c0acef5383b5a2720caeb68f1e9c05b05d89467ded84da093dea262e51811e2d7fa515722516bd5ef6c8c4966e5937562a5648a696ad3a042a7097ddefe0671f977fb145890f5bf41ba92b8c4c8b14f0d4a880ef4518bb32881dfd15dc84e79d326337e21e041654f06bd7f000000000000000000000000000000282ffe0000000009350cfa3ab109ab4a7d95938c5334a0dd177f1a7389ee570d95e543a27546d3770740f354df6dd6b1bfe4104d2262f33f596d606ccce75a3c3d5f9ad94a7316b0c6ad14f1398a6b39b07121f636da418b34d48677cf8d2d99ee8ac50142bcdcc73dd73cc6ec46896ffb35ac82ac7a9309ea07396d2814dc630ad1a9913934849be25f7b81b59aaa9fa2e9d6ecafcfa1de81b2d3581ab1138537f98d2240b6c2bf40569da4e2bb77532ab9220347d78319617d17e14f7331486e86b2145980b95c88ae11b1c6b6ea6c2b2311d6ce6315cc451dd50ac746acd59d075b41f9a747894956b10453ccf6527d8f579256e9849bbaf6c7c84362209d3d2320101d57"], &(0x7f0000000140)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000002c0)=r3, 0x4) perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8178e, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext={0x7, 0x7}, 0xb0, 0x8, 0x2, 0x1, 0xa0, 0x1f, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100000000000600"/22], 0x0, 0x1a}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000008000000000000000001801000020646c2500000000002020207b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r4, &(0x7f0000000080)='syz1\x00', 0x1ff) (async) mkdirat$cgroup(r4, &(0x7f0000000080)='syz1\x00', 0x1ff) openat$cgroup(r4, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) (async) r5 = openat$cgroup(r4, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r7, &(0x7f0000000100), 0x2, 0x0) (async) r8 = openat$cgroup_type(r7, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r8, &(0x7f0000000280), 0x9) (async) write$cgroup_type(r8, &(0x7f0000000280), 0x9) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000003c0)="d800000018007b18e00212ba0d8105040a0a1100fe0f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b01602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5", 0xd2}, {&(0x7f00000004c0)="f80ec2e2badd", 0x6}], 0x2, 0x0, 0x0, 0x2663}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={0x1}, 0x4) 121.708147ms ago: executing program 4 (id=6731): socket$kcm(0x21, 0x2, 0x2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="02000000000000004000"/20, @ANYRES32, @ANYBLOB="0000000000000093917aed3ea453f20000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28, @ANYRES64], 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="d80000001c0081044e81f782db440000041296a1180002000000000000000e1208000f0100810401a80035002000014003", 0x31}], 0x1, 0x0, 0x0, 0x7400}, 0x1) r0 = socket$kcm(0x10, 0x400000002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x17, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000006118"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x0, &(0x7f0000000040)}) perf_event_open(&(0x7f0000000380)={0x3, 0x80, 0xf6, 0x0, 0x0, 0x0, 0x0, 0x6, 0x20, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe88f5d9965ff4a44, @perf_bp={0x0, 0x7}, 0x10000, 0xca, 0x100, 0x0, 0x0, 0x8, 0x7, 0x0, 0x0, 0x0, 0x400100}, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x2) close(r2) recvmsg$unix(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xffffffbe}, 0x0) write$cgroup_subtree(r3, &(0x7f0000000180)=ANY=[@ANYRES8=r2, @ANYBLOB="3e971d"], 0x9a) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc0080002000700020006", 0x2d}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000085100000ffffffff"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f00}, 0x94) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x11, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002c000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x5, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x105402, 0xac5d, 0xfff, 0x5, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x1, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x0, 0x80, 0x0, 0xff, 0x1, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = socket$kcm(0x23, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) close(r5) r6 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x100001, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff3, 0x0, @perf_config_ext={0x85, 0xffffffffffffffff}, 0x3212, 0x7, 0x2, 0x2, 0xc, 0x3, 0x2, 0x0, 0x0, 0x0, 0x800000000e48}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x40082406, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xfffffffe}, 0x10, 0x0, r4, 0x32}, 0x94) r7 = socket$kcm(0xa, 0x2, 0x11) sendmsg$sock(r7, &(0x7f0000000200)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x3, @private2, 0xfffffffd}, 0x80, 0x0}, 0x8010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000000)=ANY=[], &(0x7f00000005c0)='syzkaller\x00'}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000ac0), 0xc) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) 0s ago: executing program 3 (id=6732): socket$kcm(0xa, 0x3, 0x73) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d711851000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8912, &(0x7f0000000080)) kernel console output (not intermixed with test programs): 15945] ? ieee80211_register_hw+0xee1/0x39f0 [ 1116.370063][T15945] ? ieee80211_tasklet_handler+0x20/0x20 [ 1116.375740][T15945] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1116.381687][T15945] ? __debug_object_init+0xed/0x440 [ 1116.386967][T15945] ? memset+0x1e/0x40 [ 1116.390993][T15945] ? __hrtimer_init+0x189/0x270 [ 1116.395902][T15945] mac80211_hwsim_new_radio+0x2927/0x4cd0 [ 1116.401686][T15945] ? memcpy+0x3c/0x60 [ 1116.405718][T15945] hwsim_new_radio_nl+0xab7/0xc90 [ 1116.410811][T15945] genl_family_rcv_msg_doit+0x22f/0x350 [ 1116.416409][T15945] ? end_current_label_crit_section+0x170/0x170 [ 1116.422707][T15945] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 1116.428658][T15945] ? bpf_lsm_capable+0x5/0x10 [ 1116.433380][T15945] ? security_capable+0x85/0xb0 [ 1116.438313][T15945] genl_rcv_msg+0x601/0x790 [ 1116.442887][T15945] ? genl_bind+0x360/0x360 [ 1116.447352][T15945] ? hwsim_tx_info_frame_received_nl+0xe30/0xe30 [ 1116.453762][T15945] netlink_rcv_skb+0x1ef/0x440 [ 1116.458587][T15945] ? genl_bind+0x360/0x360 [ 1116.463051][T15945] ? netlink_ack+0x1160/0x1160 [ 1116.467887][T15945] ? down_read+0x1a8/0x2d0 [ 1116.472356][T15945] genl_rcv+0x24/0x40 [ 1116.476389][T15945] netlink_unicast+0x7ad/0x920 [ 1116.481226][T15945] netlink_sendmsg+0x8ad/0xbd0 [ 1116.486053][T15945] ? netlink_getsockopt+0x550/0x550 [ 1116.491313][T15945] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1116.496915][T15945] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1116.502237][T15945] ? security_socket_sendmsg+0x7c/0xa0 [ 1116.507746][T15945] ? netlink_getsockopt+0x550/0x550 [ 1116.513004][T15945] ____sys_sendmsg+0x5ed/0x9a0 [ 1116.517832][T15945] ? __sys_sendmsg_sock+0x30/0x30 [ 1116.522948][T15945] ? __import_iovec+0x306/0x510 [ 1116.527866][T15945] ? import_iovec+0x6f/0xa0 [ 1116.532423][T15945] ___sys_sendmsg+0x2a2/0x360 [ 1116.537154][T15945] ? handle_mm_fault+0x33f5/0x3d40 [ 1116.542312][T15945] ? __sys_sendmsg+0x2a0/0x2a0 [ 1116.547189][T15945] __se_sys_sendmsg+0x1c3/0x2b0 [ 1116.549487][T15974] netlink: 'syz.0.3833': attribute type 28 has an invalid length. [ 1116.552093][T15945] ? ct_nmi_exit+0x145/0x1c0 [ 1116.552177][T15945] ? __x64_sys_sendmsg+0x80/0x80 [ 1116.552271][T15945] ? lockdep_hardirqs_on+0x94/0x140 [ 1116.562832][T15974] netlink: 'syz.0.3833': attribute type 3 has an invalid length. [ 1116.564623][T15945] do_syscall_64+0x4c/0xa0 [ 1116.564658][T15945] ? clear_bhb_loop+0x60/0xb0 [ 1116.564689][T15945] ? clear_bhb_loop+0x60/0xb0 [ 1116.564719][T15945] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1116.564748][T15945] RIP: 0033:0x7f7b99d9e0d9 [ 1116.564771][T15945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1116.564790][T15945] RSP: 002b:00007f7b9ab9d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1116.564817][T15945] RAX: ffffffffffffffda RBX: 00007f7b9a026180 RCX: 00007f7b99d9e0d9 [ 1116.564835][T15945] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 1116.564860][T15945] RBP: 00007f7b99e35024 R08: 0000000000000000 R09: 0000000000000000 [ 1116.564875][T15945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1116.564890][T15945] R13: 00007f7b9a026218 R14: 00007f7b9a026180 R15: 00007fffe2ce7b18 [ 1116.564926][T15945] [ 1116.691198][T15974] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3833'. [ 1116.706331][T15956] netlink: 126632 bytes leftover after parsing attributes in process `syz.4.3824'. [ 1116.730595][T15956] netlink: 8192 bytes leftover after parsing attributes in process `syz.4.3824'. [ 1116.998772][T15981] netlink: 'syz.2.3835': attribute type 16 has an invalid length. [ 1117.026524][T15981] netlink: 'syz.2.3835': attribute type 3 has an invalid length. [ 1117.075709][T15987] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3834'. [ 1117.096032][T15981] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3835'. [ 1117.150125][T15987] netlink: 'syz.3.3834': attribute type 10 has an invalid length. [ 1117.429361][T15987] team0 (unregistering): Port device team_slave_0 removed [ 1117.498578][T15987] team0 (unregistering): Port device team_slave_1 removed [ 1117.515677][T15987] bridge0: port 2(bridge_slave_1) entered disabled state [ 1117.523307][T15987] bridge0: port 1(bridge_slave_0) entered disabled state [ 1117.558707][T15987] team0 (unregistering): Port device bridge0 removed [ 1117.902631][T16003] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 1118.028214][T16007] device syzkaller0 entered promiscuous mode [ 1118.591427][T16022] netlink: 188 bytes leftover after parsing attributes in process `syz.3.3845'. [ 1120.695748][T16015] netlink: 14568 bytes leftover after parsing attributes in process `syz.0.3843'. [ 1120.705373][T16021] netlink: 14593 bytes leftover after parsing attributes in process `syz.3.3845'. [ 1121.029079][T16033] netlink: 'syz.3.3848': attribute type 10 has an invalid length. [ 1121.092381][T16040] netlink: 'syz.3.3848': attribute type 1 has an invalid length. [ 1121.112006][T16040] netlink: 127868 bytes leftover after parsing attributes in process `syz.3.3848'. [ 1121.216243][T16033] device bridge_slave_1 left promiscuous mode [ 1121.223993][T16033] bridge0: port 2(bridge_slave_1) entered disabled state [ 1123.141190][T16085] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1123.313864][T16085] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1124.664854][T16106] netlink: 'syz.2.3871': attribute type 10 has an invalid length. [ 1124.718428][T16106] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1124.769936][T16105] netlink: 'syz.2.3871': attribute type 10 has an invalid length. [ 1124.794615][T16105] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1125.224562][T16124] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3876'. [ 1125.833338][T16137] netlink: 'syz.3.3878': attribute type 16 has an invalid length. [ 1125.909327][T16137] netlink: 'syz.3.3878': attribute type 3 has an invalid length. [ 1125.922361][T16137] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3878'. [ 1126.324105][T16156] netlink: 'syz.2.3884': attribute type 10 has an invalid length. [ 1126.885262][ T48] Bluetooth: hci4: ISO packet for unknown connection handle 2622 [ 1133.255174][T16259] netlink: 'syz.5.3907': attribute type 16 has an invalid length. [ 1133.444961][T16259] netlink: 'syz.5.3907': attribute type 3 has an invalid length. [ 1133.544582][T16259] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3907'. [ 1138.143277][T16293] netlink: 'syz.2.3916': attribute type 153 has an invalid length. [ 1138.157451][T16293] netlink: 69544 bytes leftover after parsing attributes in process `syz.2.3916'. [ 1139.365252][T16331] netlink: 'syz.3.3925': attribute type 2 has an invalid length. [ 1139.373248][T16331] netlink: 10 bytes leftover after parsing attributes in process `syz.3.3925'. [ 1140.109774][T16351] netlink: 'syz.3.3930': attribute type 153 has an invalid length. [ 1140.149491][T16351] netlink: 69544 bytes leftover after parsing attributes in process `syz.3.3930'. [ 1145.164003][T16396] netlink: 'syz.4.3943': attribute type 153 has an invalid length. [ 1145.185998][T16396] netlink: 69544 bytes leftover after parsing attributes in process `syz.4.3943'. [ 1145.629817][T16415] netlink: 830 bytes leftover after parsing attributes in process `syz.5.3948'. [ 1146.143376][T16429] netlink: 'syz.4.3954': attribute type 2 has an invalid length. [ 1146.182738][T16429] netlink: 17267 bytes leftover after parsing attributes in process `syz.4.3954'. [ 1147.428955][T16461] device syzkaller0 entered promiscuous mode [ 1147.709788][T16478] netlink: 'syz.2.3965': attribute type 1 has an invalid length. [ 1147.726769][T16478] netlink: 157116 bytes leftover after parsing attributes in process `syz.2.3965'. [ 1150.969790][T16478] netlink: 'syz.2.3965': attribute type 21 has an invalid length. [ 1150.980272][T16478] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3965'. [ 1151.028438][T16499] netlink: 'syz.0.3969': attribute type 46 has an invalid length. [ 1154.597107][T16555] netlink: 'syz.2.3986': attribute type 2 has an invalid length. [ 1154.636054][T16555] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3986'. [ 1155.292311][T16579] netlink: 'syz.0.3990': attribute type 46 has an invalid length. [ 1155.329747][T16577] netlink: 128124 bytes leftover after parsing attributes in process `syz.4.3991'. [ 1155.565783][T16591] netlink: 1030 bytes leftover after parsing attributes in process `syz.2.3995'. [ 1155.598301][T16591] bridge: RTM_NEWNEIGH with invalid state 0x800 [ 1155.829504][T16601] netlink: 'syz.2.3997': attribute type 30 has an invalid length. [ 1155.975807][T16604] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3998'. [ 1156.125619][T16604] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1156.255108][T16604] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1156.532800][T16604] bond0 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 1156.702108][T16604] bond0 (unregistering): Released all slaves [ 1156.755194][T16627] netlink: 'syz.4.4004': attribute type 46 has an invalid length. [ 1157.206163][T16638] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.4008'. [ 1157.233066][T16634] netlink: 144 bytes leftover after parsing attributes in process `syz.4.4007'. [ 1158.322475][T16667] netlink: 'syz.5.4016': attribute type 4 has an invalid length. [ 1158.332362][T16667] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.4016'. [ 1158.352172][T16668] netlink: 'syz.5.4016': attribute type 4 has an invalid length. [ 1158.362229][T16668] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.4016'. [ 1161.023376][T16671] netlink: 'syz.2.4017': attribute type 46 has an invalid length. [ 1161.032533][T16676] netlink: 61963 bytes leftover after parsing attributes in process `syz.4.4018'. [ 1161.590132][T16700] netlink: 15487 bytes leftover after parsing attributes in process `syz.4.4026'. [ 1162.498166][T16718] netlink: 'syz.0.4030': attribute type 8 has an invalid length. [ 1162.506318][T16718] netlink: 'syz.0.4030': attribute type 1 has an invalid length. [ 1162.514929][T16718] netlink: 104088 bytes leftover after parsing attributes in process `syz.0.4030'. [ 1162.673118][T16720] netlink: 'syz.2.4031': attribute type 46 has an invalid length. [ 1162.991720][T16732] tipc: Started in network mode [ 1163.047616][T16732] tipc: Node identity 9215a268, cluster identity 4711 [ 1163.094958][T16732] tipc: Node number set to 2450891368 [ 1163.653164][T16743] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.4036'. [ 1164.071495][T16752] netlink: 'syz.2.4041': attribute type 29 has an invalid length. [ 1164.096654][T16752] netlink: 'syz.2.4041': attribute type 29 has an invalid length. [ 1164.132909][T16755] netlink: 'syz.2.4041': attribute type 29 has an invalid length. [ 1164.160688][T16752] netlink: 'syz.2.4041': attribute type 29 has an invalid length. [ 1164.507978][T16760] netlink: 'syz.2.4043': attribute type 46 has an invalid length. [ 1166.133163][T16798] syz.5.4051 (16798) used obsolete PPPIOCDETACH ioctl [ 1169.998233][T16824] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.4058'. [ 1170.089881][T16832] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:0603:0000:0023 with DS=0x3f [ 1170.996378][T16843] netlink: 'syz.4.4065': attribute type 10 has an invalid length. [ 1171.057885][T16843] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4065'. [ 1171.122088][T16843] device bond0 entered promiscuous mode [ 1171.144551][T16843] device bond_slave_0 entered promiscuous mode [ 1171.151565][T16843] device bond_slave_1 entered promiscuous mode [ 1171.203152][T16843] device bridge_slave_1 entered promiscuous mode [ 1171.235764][T16843] bridge0: port 2(bond0) entered blocking state [ 1171.243333][T16843] bridge0: port 2(bond0) entered disabled state [ 1171.279913][T16843] bridge0: port 2(bond0) entered blocking state [ 1171.286670][T16843] bridge0: port 2(bond0) entered forwarding state [ 1172.109242][T16862] netlink: 'syz.5.4072': attribute type 1 has an invalid length. [ 1172.144455][T16862] netlink: 112865 bytes leftover after parsing attributes in process `syz.5.4072'. [ 1172.381215][ T48] Bluetooth: hci1: ISO packet for unknown connection handle 9 [ 1177.039158][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.045931][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.941544][T16886] netlink: 10 bytes leftover after parsing attributes in process `syz.2.4075'. [ 1181.109441][T16932] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1181.309109][T16937] netlink: 14593 bytes leftover after parsing attributes in process `syz.3.4091'. [ 1181.321054][T16940] netlink: 'syz.4.4092': attribute type 29 has an invalid length. [ 1181.334048][T16940] netlink: 'syz.4.4092': attribute type 29 has an invalid length. [ 1181.354055][T16940] netlink: 'syz.4.4092': attribute type 29 has an invalid length. [ 1182.084869][T16947] delete_channel: no stack [ 1182.097270][T16961] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4100'. [ 1182.691510][T16987] netlink: 16410 bytes leftover after parsing attributes in process `syz.2.4107'. [ 1183.246413][T17004] device syzkaller0 entered promiscuous mode [ 1183.310841][T16999] netlink: 'syz.3.4108': attribute type 29 has an invalid length. [ 1183.382066][T16999] netlink: 'syz.3.4108': attribute type 29 has an invalid length. [ 1185.647308][T17024] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4115'. [ 1185.667299][T17029] netlink: 156 bytes leftover after parsing attributes in process `syz.5.4116'. [ 1186.418763][T17055] netlink: 'syz.2.4124': attribute type 2 has an invalid length. [ 1186.432928][T17055] netlink: 199848 bytes leftover after parsing attributes in process `syz.2.4124'. [ 1186.885353][T17078] netlink: 'syz.3.4131': attribute type 12 has an invalid length. [ 1186.893353][T17078] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4131'. [ 1186.997609][T17080] netlink: 'syz.0.4132': attribute type 3 has an invalid length. [ 1187.014530][T17080] netlink: 199824 bytes leftover after parsing attributes in process `syz.0.4132'. [ 1187.536069][T17104] netlink: 'syz.4.4139': attribute type 21 has an invalid length. [ 1187.543955][T17104] netlink: 16166 bytes leftover after parsing attributes in process `syz.4.4139'. [ 1187.607025][T17104] bridge0: port 2(bond0) entered disabled state [ 1187.657552][T17104] bridge0: port 3(team0) entered disabled state [ 1187.699460][T17104] device bridge_slave_0 left promiscuous mode [ 1187.715498][T17104] bridge0: port 1(bridge_slave_0) entered disabled state [ 1188.053581][T17110] netlink: 763 bytes leftover after parsing attributes in process `syz.0.4141'. [ 1188.066138][T17114] netlink: 'syz.0.4141': attribute type 17 has an invalid length. [ 1188.084862][T17114] netlink: 'syz.0.4141': attribute type 16 has an invalid length. [ 1188.096371][T17114] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4141'. [ 1188.137838][T17113] netlink: 'syz.3.4142': attribute type 12 has an invalid length. [ 1188.177103][T17113] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4142'. [ 1188.782084][T17125] netlink: 'syz.4.4144': attribute type 2 has an invalid length. [ 1188.876822][T17125] netlink: 'syz.4.4144': attribute type 1 has an invalid length. [ 1188.897063][T17125] netlink: 170140 bytes leftover after parsing attributes in process `syz.4.4144'. [ 1189.190990][T17138] netlink: 'syz.0.4147': attribute type 1 has an invalid length. [ 1191.843691][T17203] netlink: 'syz.5.4166': attribute type 2 has an invalid length. [ 1191.961457][T17207] netlink: 'syz.3.4167': attribute type 1 has an invalid length. [ 1191.979007][T17207] netlink: 112865 bytes leftover after parsing attributes in process `syz.3.4167'. [ 1194.094678][T17201] netlink: 14548 bytes leftover after parsing attributes in process `syz.4.4165'. [ 1194.112762][T17203] device 0 entered promiscuous mode [ 1194.377628][T17218] netlink: 'syz.2.4172': attribute type 21 has an invalid length. [ 1194.397489][T17218] netlink: 'syz.2.4172': attribute type 1 has an invalid length. [ 1194.424704][T17218] netlink: 16090 bytes leftover after parsing attributes in process `syz.2.4172'. [ 1194.680106][T17229] netlink: 122896 bytes leftover after parsing attributes in process `syz.2.4175'. [ 1195.257365][T17251] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.4180'. [ 1195.267041][ T48] Bluetooth: Frame is too long (len 149, expected len 4) [ 1195.417305][T17259] netlink: 'syz.2.4182': attribute type 10 has an invalid length. [ 1195.427727][T17259] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4182'. [ 1195.449723][T17259] bridge0: port 4(ipvlan1) entered blocking state [ 1195.466446][T17259] bridge0: port 4(ipvlan1) entered disabled state [ 1195.507056][T17259] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1195.589091][T17263] netlink: 'syz.5.4184': attribute type 13 has an invalid length. [ 1195.602794][T17263] netlink: 24859 bytes leftover after parsing attributes in process `syz.5.4184'. [ 1196.155748][T17274] netlink: 'syz.3.4188': attribute type 29 has an invalid length. [ 1196.901838][T17274] netlink: 'syz.3.4188': attribute type 29 has an invalid length. [ 1196.919524][T17290] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.4193'. [ 1197.206669][T17297] netlink: 'syz.3.4195': attribute type 29 has an invalid length. [ 1197.239674][T17297] netlink: 'syz.3.4195': attribute type 29 has an invalid length. [ 1197.337424][T17297] netlink: 14 bytes leftover after parsing attributes in process `syz.3.4195'. [ 1197.367845][T17297] openvswitch: netlink: Flow key attr not present in new flow. [ 1199.565639][T17326] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4202'. [ 1199.610369][T17326] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1199.646080][T17326] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1199.708063][T17322] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4202'. [ 1199.724734][T17322] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1199.748347][T17322] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1199.863386][T17342] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4210'. [ 1199.910847][T17342] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4210'. [ 1199.938420][T17347] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.4208'. [ 1200.334395][T17361] delete_channel: no stack [ 1202.148221][T17421] netlink: 16255 bytes leftover after parsing attributes in process `syz.2.4228'. [ 1203.192589][T17443] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4236'. [ 1203.261576][T17443] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4236'. [ 1203.307912][T17446] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4236'. [ 1203.357751][T17443] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4236'. [ 1203.878542][T17450] device syzkaller0 entered promiscuous mode [ 1203.904874][T17451] netlink: 164 bytes leftover after parsing attributes in process `syz.5.4238'. [ 1206.210534][ T48] Bluetooth: hci0: ISO packet for unknown connection handle 1854 [ 1208.705014][T17489] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4248'. [ 1209.683379][T17504] netlink: 'syz.0.4252': attribute type 46 has an invalid length. [ 1210.179759][T17534] netlink: 'syz.0.4260': attribute type 10 has an invalid length. [ 1211.966170][T17565] netlink: 'syz.5.4270': attribute type 46 has an invalid length. [ 1212.025823][ T48] Bluetooth: hci1: unexpected subevent 0x0a length: 150 > 30 [ 1214.078311][ T48] Bluetooth: hci1: command 0x2016 tx timeout [ 1215.068873][T17576] netlink: 'syz.2.4274': attribute type 10 has an invalid length. [ 1215.121115][T17576] bridge0: port 3(team0) entered disabled state [ 1215.275396][T17576] bridge0: port 3(team0) entered disabled state [ 1215.294776][T17576] device team_slave_0 left promiscuous mode [ 1215.377225][T17576] team0 (unregistering): Port device team_slave_0 removed [ 1215.410493][T17576] device team_slave_1 left promiscuous mode [ 1215.450031][T17576] team0 (unregistering): Port device team_slave_1 removed [ 1215.810042][T17607] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4280'. [ 1215.898124][T17608] delete_channel: no stack [ 1216.329428][T17618] netlink: 'syz.4.4283': attribute type 10 has an invalid length. [ 1216.349652][T17618] netlink: 65015 bytes leftover after parsing attributes in process `syz.4.4283'. [ 1216.393656][T17619] netlink: 'syz.2.4284': attribute type 46 has an invalid length. [ 1216.635850][T17633] netlink: 'syz.0.4285': attribute type 12 has an invalid length. [ 1216.668810][T17633] netlink: 164 bytes leftover after parsing attributes in process `syz.0.4285'. [ 1217.496554][T17640] netlink: 'syz.4.4290': attribute type 21 has an invalid length. [ 1217.514903][T17640] netlink: 14548 bytes leftover after parsing attributes in process `syz.4.4290'. [ 1218.588195][T17656] netlink: 'syz.0.4294': attribute type 10 has an invalid length. [ 1218.613069][T17656] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4294'. [ 1218.663771][T17656] device team0 entered promiscuous mode [ 1218.699059][T17656] device team_slave_0 entered promiscuous mode [ 1218.733192][T17656] device team_slave_1 entered promiscuous mode [ 1218.792079][T17656] device bridge0 entered promiscuous mode [ 1218.816514][T17656] bridge0: port 3(team0) entered blocking state [ 1218.869506][T17656] bridge0: port 3(team0) entered disabled state [ 1218.940224][T17656] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1224.658228][T17769] netlink: 'syz.4.4309': attribute type 41 has an invalid length. [ 1227.631516][T17780] netlink: 'syz.0.4311': attribute type 4 has an invalid length. [ 1227.706794][T17780] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4311'. [ 1228.543051][T17807] netlink: 'syz.3.4318': attribute type 33 has an invalid length. [ 1228.572777][T17807] netlink: 152 bytes leftover after parsing attributes in process `syz.3.4318'. [ 1228.656904][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.769396][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.779368][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.788992][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.798696][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.808449][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.818091][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.827754][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.837436][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1228.847198][T17811] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1230.168707][T17843] netlink: 'syz.2.4328': attribute type 21 has an invalid length. [ 1231.181501][T17869] netlink: 'syz.3.4336': attribute type 25 has an invalid length. [ 1231.204883][T17869] netlink: 'syz.3.4336': attribute type 29 has an invalid length. [ 1231.225972][T17869] netlink: 5 bytes leftover after parsing attributes in process `syz.3.4336'. [ 1232.350502][T17906] netlink: 'syz.4.4343': attribute type 3 has an invalid length. [ 1232.365667][T17906] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.4343'. [ 1232.665537][T17906] netlink: 'syz.4.4343': attribute type 29 has an invalid length. [ 1232.673816][T17906] netlink: 'syz.4.4343': attribute type 29 has an invalid length. [ 1232.905069][T17913] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4344'. [ 1234.408059][T17942] device syzkaller0 entered promiscuous mode [ 1235.666048][T17956] net_ratelimit: 3257 callbacks suppressed [ 1235.666071][T17956] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1237.124361][T17952] netlink: 'syz.4.4357': attribute type 10 has an invalid length. [ 1237.331251][T17965] netlink: 'syz.3.4360': attribute type 46 has an invalid length. [ 1238.492069][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.504938][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.971117][T18008] netlink: 'syz.5.4375': attribute type 10 has an invalid length. [ 1240.440860][T18021] netlink: 'syz.2.4378': attribute type 2 has an invalid length. [ 1240.576758][T18008] bridge0: port 3(netdevsim0) entered blocking state [ 1240.590729][T18008] bridge0: port 3(netdevsim0) entered disabled state [ 1240.613132][T18008] device netdevsim0 entered promiscuous mode [ 1240.649521][T18010] netlink: 'syz.0.4376': attribute type 25 has an invalid length. [ 1240.674564][T18010] netlink: 'syz.0.4376': attribute type 29 has an invalid length. [ 1240.715273][T18015] netlink: 5 bytes leftover after parsing attributes in process `syz.0.4376'. [ 1240.778558][T18021] device 0 entered promiscuous mode [ 1241.034747][T18025] netlink: 'syz.5.4379': attribute type 10 has an invalid length. [ 1241.134911][T18025] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1241.415846][T18032] device bridge_slave_0 left promiscuous mode [ 1241.423945][T18032] bridge0: port 1(bridge_slave_0) entered disabled state [ 1242.213567][T18038] netlink: 'syz.5.4384': attribute type 21 has an invalid length. [ 1242.273143][T18038] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4384'. [ 1242.284373][T18038] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4384'. [ 1242.596044][T18030] netlink: 202920 bytes leftover after parsing attributes in process `syz.4.4380'. [ 1243.013070][T18054] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.4388'. [ 1243.037202][T18054] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.4388'. [ 1243.071377][T18054] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.4388'. [ 1243.155267][T18057] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.4388'. [ 1243.252445][T18054] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.4388'. [ 1244.199092][T18080] netlink: 'syz.3.4393': attribute type 15 has an invalid length. [ 1244.245450][T18080] netlink: 'syz.3.4393': attribute type 7 has an invalid length. [ 1244.388110][T18080] netlink: 'syz.3.4393': attribute type 39 has an invalid length. [ 1246.026584][T18096] netlink: 'syz.5.4403': attribute type 3 has an invalid length. [ 1246.064472][T18096] netlink: 'syz.5.4403': attribute type 1 has an invalid length. [ 1246.072713][T18092] netlink: 'syz.0.4401': attribute type 19 has an invalid length. [ 1246.095952][T18092] netlink: 14552 bytes leftover after parsing attributes in process `syz.0.4401'. [ 1246.526378][T18105] device bond_slave_1 entered promiscuous mode [ 1248.669646][T18145] netlink: 830 bytes leftover after parsing attributes in process `syz.3.4412'. [ 1249.328957][T18159] netlink: 'syz.3.4415': attribute type 29 has an invalid length. [ 1249.359527][T18157] netlink: 'syz.3.4415': attribute type 1 has an invalid length. [ 1249.366971][T18159] netlink: 'syz.3.4415': attribute type 29 has an invalid length. [ 1249.428303][T18157] netlink: 127868 bytes leftover after parsing attributes in process `syz.3.4415'. [ 1249.560334][T18157] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4415'. [ 1249.613605][T18159] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4415'. [ 1249.702601][T18165] -1: renamed from syzkaller0 [ 1250.088241][T18186] netlink: 'syz.5.4423': attribute type 46 has an invalid length. [ 1250.493249][T18192] netlink: 'syz.5.4426': attribute type 21 has an invalid length. [ 1251.273212][T18208] netlink: 'syz.3.4428': attribute type 29 has an invalid length. [ 1251.324736][T18208] netlink: 'syz.3.4428': attribute type 29 has an invalid length. [ 1251.390224][T18213] netlink: 'syz.5.4431': attribute type 2 has an invalid length. [ 1251.419329][T18213] netlink: 'syz.5.4431': attribute type 1 has an invalid length. [ 1251.462349][T18213] netlink: 170140 bytes leftover after parsing attributes in process `syz.5.4431'. [ 1252.231257][T18211] tipc: Started in network mode [ 1252.261606][T18211] tipc: Node identity 9215a268, cluster identity 4711 [ 1252.294211][T18211] tipc: Node number set to 2450891368 [ 1252.532579][T18224] netlink: 'syz.5.4433': attribute type 27 has an invalid length. [ 1252.581093][T18224] netlink: 164 bytes leftover after parsing attributes in process `syz.5.4433'. [ 1253.632013][T18255] netlink: 14552 bytes leftover after parsing attributes in process `syz.3.4443'. [ 1254.322266][T18281] netlink: 14 bytes leftover after parsing attributes in process `syz.5.4447'. [ 1254.374769][T18281] openvswitch: netlink: Flow key attr not present in new flow. [ 1255.322092][T18304] validate_nla: 2 callbacks suppressed [ 1255.322110][T18304] netlink: 'syz.5.4452': attribute type 46 has an invalid length. [ 1255.447367][T18300] device sit0 entered promiscuous mode [ 1256.567153][T18315] netlink: 'syz.5.4455': attribute type 39 has an invalid length. [ 1256.822892][T18332] device sit0 entered promiscuous mode [ 1256.943397][T18336] netlink: 'syz.4.4461': attribute type 3 has an invalid length. [ 1257.228415][T18347] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4464'. [ 1257.402399][T18349] netlink: 'syz.5.4465': attribute type 46 has an invalid length. [ 1258.452389][T18371] device sit0 left promiscuous mode [ 1258.877524][T18371] device sit0 entered promiscuous mode [ 1259.224636][T18393] netlink: 'syz.2.4475': attribute type 1 has an invalid length. [ 1259.263527][T18393] netlink: 131740 bytes leftover after parsing attributes in process `syz.2.4475'. [ 1259.302854][T18383] netlink: 16255 bytes leftover after parsing attributes in process `syz.5.4474'. [ 1259.336406][T18386] netlink: 16255 bytes leftover after parsing attributes in process `syz.5.4474'. [ 1259.815813][T18403] netlink: 'syz.2.4478': attribute type 46 has an invalid length. [ 1260.342325][T18410] netlink: 'syz.0.4479': attribute type 39 has an invalid length. [ 1260.737482][T18422] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4481'. [ 1261.424139][T18442] netlink: 'syz.0.4488': attribute type 10 has an invalid length. [ 1261.432505][T18442] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4488'. [ 1261.522260][T18446] netlink: 'syz.5.4489': attribute type 1 has an invalid length. [ 1261.630148][T18446] netlink: 'syz.5.4489': attribute type 1 has an invalid length. [ 1261.642303][T18451] netlink: 'syz.3.4491': attribute type 46 has an invalid length. [ 1261.790666][T18446] netlink: 116376 bytes leftover after parsing attributes in process `syz.5.4489'. [ 1261.909312][T18454] bridge0: port 1(hsr0) entered disabled state [ 1261.915774][T18454] bridge0: port 2(bridge_slave_1) entered disabled state [ 1262.039967][T18459] netlink: 'syz.5.4489': attribute type 1 has an invalid length. [ 1262.420966][T18459] netlink: 'syz.5.4489': attribute type 1 has an invalid length. [ 1262.464233][T18459] netlink: 116376 bytes leftover after parsing attributes in process `syz.5.4489'. [ 1262.672113][T18466] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1262.694292][T18466] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1262.907058][T18466] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1262.936625][T18466] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1263.203281][T18472] netlink: 'syz.0.4495': attribute type 22 has an invalid length. [ 1263.221949][T18472] netlink: 14526 bytes leftover after parsing attributes in process `syz.0.4495'. [ 1263.426332][T18475] netlink: 134056 bytes leftover after parsing attributes in process `syz.5.4496'. [ 1263.627557][T18483] netlink: 10 bytes leftover after parsing attributes in process `syz.4.4498'. [ 1263.754533][T18489] netlink: 'syz.3.4500': attribute type 39 has an invalid length. [ 1263.939442][T18495] netlink: 'syz.4.4504': attribute type 46 has an invalid length. [ 1264.068691][T18499] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4502'. [ 1264.227335][T18499] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1264.906773][T18526] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1264.955475][T18526] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1265.197522][T18526] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1265.318535][T18526] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1265.325428][T18530] netlink: 131740 bytes leftover after parsing attributes in process `syz.3.4514'. [ 1265.359564][T18526] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 1265.398349][T18526] batman_adv: batadv0: Removing interface: virt_wifi0 [ 1265.804499][T18537] validate_nla: 2 callbacks suppressed [ 1265.804518][T18537] netlink: 'syz.0.4515': attribute type 39 has an invalid length. [ 1266.026500][T18540] netlink: 'syz.3.4516': attribute type 46 has an invalid length. [ 1266.135838][T18546] netlink: 64859 bytes leftover after parsing attributes in process `syz.4.4518'. [ 1267.240132][T18562] device syzkaller0 entered promiscuous mode [ 1270.031035][T18591] netlink: 'syz.3.4530': attribute type 46 has an invalid length. [ 1270.498805][ T48] Bluetooth: hci0: unexpected subevent 0x19 length: 150 > 28 [ 1270.506494][ T48] Bluetooth: hci0: Unable to find connection with handle 0x0000 [ 1271.201743][T18649] netlink: 'syz.4.4546': attribute type 46 has an invalid length. [ 1271.268043][T18651] netlink: 'syz.2.4545': attribute type 10 has an invalid length. [ 1271.383185][T18653] netlink: 'syz.3.4547': attribute type 4 has an invalid length. [ 1271.405073][T18653] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.4547'. [ 1271.741264][T18663] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4551'. [ 1271.829207][T18665] netlink: 'syz.5.4553': attribute type 3 has an invalid length. [ 1271.860350][T18665] netlink: 105116 bytes leftover after parsing attributes in process `syz.5.4553'. [ 1272.131063][T18673] netlink: 'syz.5.4556': attribute type 21 has an invalid length. [ 1272.164287][T18673] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4556'. [ 1272.369009][T18680] netlink: 'syz.5.4558': attribute type 2 has an invalid length. [ 1272.377322][T18680] netlink: 'syz.5.4558': attribute type 8 has an invalid length. [ 1272.432540][T18680] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4558'. [ 1275.249913][T18704] netlink: 'syz.3.4566': attribute type 29 has an invalid length. [ 1275.289168][T18704] netlink: 'syz.3.4566': attribute type 29 has an invalid length. [ 1275.327883][T18704] netlink: 'syz.3.4566': attribute type 29 has an invalid length. [ 1275.648206][T18713] netlink: 144 bytes leftover after parsing attributes in process `syz.4.4568'. [ 1275.809099][T18720] netlink: 127868 bytes leftover after parsing attributes in process `syz.5.4570'. [ 1275.841200][T18720] netlink: 6955 bytes leftover after parsing attributes in process `syz.5.4570'. [ 1276.165035][T18727] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4573'. [ 1276.798054][T18744] device syzkaller0 entered promiscuous mode [ 1276.989553][T18765] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4583'. [ 1277.055061][T18766] netlink: 'syz.2.4582': attribute type 11 has an invalid length. [ 1277.109492][T18766] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.4582'. [ 1277.564546][ T48] Bluetooth: hci5: unexpected subevent 0x06 length: 150 > 10 [ 1277.781084][T18762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1278.969452][T18765] netlink: 128 bytes leftover after parsing attributes in process `syz.3.4583'. [ 1278.992226][T18765] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1279.027468][T18774] validate_nla: 2 callbacks suppressed [ 1279.027484][T18774] netlink: 'syz.4.4585': attribute type 33 has an invalid length. [ 1279.050789][T18774] netlink: 152 bytes leftover after parsing attributes in process `syz.4.4585'. [ 1279.480967][T18798] netlink: 'syz.2.4591': attribute type 1 has an invalid length. [ 1279.584554][T18798] netlink: 83992 bytes leftover after parsing attributes in process `syz.2.4591'. [ 1279.594373][ T48] Bluetooth: hci5: command 0x2021 tx timeout [ 1279.702535][T18807] netlink: 'syz.3.4593': attribute type 3 has an invalid length. [ 1279.710982][T18807] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.4593'. [ 1280.604822][T18834] tun0: tun_chr_ioctl cmd 1074025681 [ 1281.372054][T18839] netlink: 10 bytes leftover after parsing attributes in process `syz.4.4603'. [ 1281.640699][T18846] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.4605'. [ 1281.706302][T18846] netlink: 'syz.3.4605': attribute type 10 has an invalid length. [ 1284.298763][T18859] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.4607'. [ 1284.377699][T18859] debugfs: Directory '.!' with parent 'ieee80211' already present! [ 1284.487040][T18863] netlink: 'syz.5.4608': attribute type 2 has an invalid length. [ 1284.504783][T18863] netlink: 10 bytes leftover after parsing attributes in process `syz.5.4608'. [ 1284.573517][T18863] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.4608'. [ 1284.900232][T18873] netlink: 'syz.4.4612': attribute type 29 has an invalid length. [ 1284.964635][T18873] netlink: 'syz.4.4612': attribute type 29 has an invalid length. [ 1284.978022][T18873] netlink: 'syz.4.4612': attribute type 29 has an invalid length. [ 1285.000472][T18873] netlink: 129384 bytes leftover after parsing attributes in process `syz.4.4612'. [ 1285.150668][T18883] netlink: 'syz.4.4614': attribute type 11 has an invalid length. [ 1285.189302][T18883] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.4614'. [ 1285.369701][T18889] netlink: 'syz.2.4616': attribute type 1 has an invalid length. [ 1285.395696][T18886] netlink: 5427 bytes leftover after parsing attributes in process `syz.3.4615'. [ 1285.396407][T18889] netlink: 157116 bytes leftover after parsing attributes in process `syz.2.4616'. [ 1285.420955][T18886] netlink: 52477 bytes leftover after parsing attributes in process `syz.3.4615'. [ 1285.441853][T18886] netlink: 71676 bytes leftover after parsing attributes in process `syz.3.4615'. [ 1286.273711][T18896] device syzkaller0 entered promiscuous mode [ 1286.414375][T18907] netlink: 'syz.5.4620': attribute type 10 has an invalid length. [ 1286.466202][T18907] netlink: 2 bytes leftover after parsing attributes in process `syz.5.4620'. [ 1286.505771][T18907] device bond0 entered promiscuous mode [ 1286.534267][T18907] device bond_slave_0 entered promiscuous mode [ 1286.540837][T18907] device wlan1 entered promiscuous mode [ 1286.577587][T18907] bridge0: port 4(bond0) entered blocking state [ 1286.584398][T18907] bridge0: port 4(bond0) entered disabled state [ 1290.132722][T18911] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4622'. [ 1290.142595][T18922] netlink: 'syz.5.4623': attribute type 10 has an invalid length. [ 1292.873946][T18976] netlink: 'syz.0.4636': attribute type 10 has an invalid length. [ 1293.014685][T18976] device geneve1 entered promiscuous mode [ 1293.021380][T18976] team0: Port device geneve1 added [ 1295.775119][T19046] netlink: 'syz.4.4653': attribute type 3 has an invalid length. [ 1295.782926][T19046] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4653'. [ 1297.591907][T19069] mac80211_hwsim hwsim26 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1298.732652][T19094] netlink: 'syz.4.4667': attribute type 10 has an invalid length. [ 1298.885912][T19094] device geneve1 entered promiscuous mode [ 1298.896912][T19094] team0: Port device geneve1 added [ 1299.475672][T19108] device syzkaller0 entered promiscuous mode [ 1299.973361][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1299.979818][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1306.311438][T19138] netlink: 'syz.4.4679': attribute type 21 has an invalid length. [ 1306.328430][T19138] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4679'. [ 1306.339644][T19138] netlink: 'syz.4.4679': attribute type 5 has an invalid length. [ 1306.348667][T19138] netlink: 'syz.4.4679': attribute type 6 has an invalid length. [ 1306.356573][T19138] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4679'. [ 1306.374300][T19153] netlink: 'syz.2.4683': attribute type 21 has an invalid length. [ 1306.759122][T19183] sctp: [Deprecated]: syz.0.4690 (pid 19183) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1306.759122][T19183] Use struct sctp_sack_info instead [ 1308.216028][T19217] netlink: 'syz.5.4699': attribute type 10 has an invalid length. [ 1308.235561][T19217] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4699'. [ 1311.916398][T19297] netlink: 'syz.2.4722': attribute type 27 has an invalid length. [ 1311.946141][T19297] netlink: 'syz.2.4722': attribute type 6 has an invalid length. [ 1315.358462][T19390] netlink: 'syz.0.4746': attribute type 29 has an invalid length. [ 1315.427283][T19390] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4746'. [ 1315.523585][T19390] netlink: 'syz.0.4746': attribute type 29 has an invalid length. [ 1315.604108][T19390] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4746'. [ 1316.989754][T19415] netlink: 'syz.3.4753': attribute type 21 has an invalid length. [ 1318.891277][T19458] netlink: 'syz.5.4767': attribute type 1 has an invalid length. [ 1318.915649][T19458] netlink: 116376 bytes leftover after parsing attributes in process `syz.5.4767'. [ 1318.945154][T19461] netlink: 'syz.2.4768': attribute type 13 has an invalid length. [ 1318.953652][T19461] netlink: 'syz.2.4768': attribute type 58 has an invalid length. [ 1318.985439][T19461] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4768'. [ 1319.777802][T19489] netlink: 'syz.4.4774': attribute type 3 has an invalid length. [ 1319.840348][T19489] netlink: 'syz.4.4774': attribute type 1 has an invalid length. [ 1319.923093][T19489] netlink: 60387 bytes leftover after parsing attributes in process `syz.4.4774'. [ 1322.936290][T19554] device sit0 left promiscuous mode [ 1325.271142][T19565] netlink: 'syz.5.4794': attribute type 3 has an invalid length. [ 1325.299276][T19565] netlink: 'syz.5.4794': attribute type 1 has an invalid length. [ 1325.368832][T19565] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4794'. [ 1325.749749][T19556] device sit0 entered promiscuous mode [ 1327.313238][T19607] netlink: 'syz.0.4803': attribute type 2 has an invalid length. [ 1327.470606][T19607] netlink: 175020 bytes leftover after parsing attributes in process `syz.0.4803'. [ 1327.546182][ T48] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 1328.408357][T19626] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4808'. [ 1328.570731][T19630] netlink: 822 bytes leftover after parsing attributes in process `syz.5.4810'. [ 1329.213952][T19635] netlink: 'syz.3.4811': attribute type 2 has an invalid length. [ 1329.254295][T19635] netlink: 'syz.3.4811': attribute type 1 has an invalid length. [ 1329.382059][T19635] netlink: 'syz.3.4811': attribute type 8 has an invalid length. [ 1329.525117][T19635] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4811'. [ 1330.190514][T19670] netlink: 'syz.5.4822': attribute type 7 has an invalid length. [ 1330.765327][T19682] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4824'. [ 1330.845916][T19680] delete_channel: no stack [ 1331.469014][T19701] netlink: 'syz.5.4827': attribute type 5 has an invalid length. [ 1331.618241][T19701] netlink: 168 bytes leftover after parsing attributes in process `syz.5.4827'. [ 1331.723441][T19700] netlink: 39087 bytes leftover after parsing attributes in process `syz.4.4831'. [ 1332.291179][T19709] netlink: 'syz.3.4834': attribute type 3 has an invalid length. [ 1332.350562][T19709] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.4834'. [ 1333.551630][T19731] netlink: 188 bytes leftover after parsing attributes in process `syz.4.4839'. [ 1333.983667][T19735] device syzkaller0 entered promiscuous mode [ 1335.758323][T19773] netlink: 9275 bytes leftover after parsing attributes in process `syz.4.4849'. [ 1337.437768][T19751] netlink: 'syz.2.4844': attribute type 10 has an invalid length. [ 1338.773456][T19814] netlink: 'syz.4.4859': attribute type 10 has an invalid length. [ 1339.775734][T19836] device syzkaller0 entered promiscuous mode [ 1342.812965][T19892] netlink: 'syz.3.4880': attribute type 10 has an invalid length. [ 1342.851591][T19896] netlink: 'syz.4.4883': attribute type 16 has an invalid length. [ 1342.881301][T19896] netlink: 'syz.4.4883': attribute type 3 has an invalid length. [ 1342.917375][T19896] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4883'. [ 1343.099129][T19900] netlink: 'syz.0.4885': attribute type 21 has an invalid length. [ 1343.110282][T19902] netlink: 'syz.5.4884': attribute type 9 has an invalid length. [ 1343.120649][T19900] netlink: 156 bytes leftover after parsing attributes in process `syz.0.4885'. [ 1343.136695][T19902] netlink: 209852 bytes leftover after parsing attributes in process `syz.5.4884'. [ 1344.079141][T19932] netlink: 154020 bytes leftover after parsing attributes in process `syz.2.4893'. [ 1344.089539][T19932] openvswitch: netlink: ufid size 48894 bytes exceeds the range (1, 16) [ 1344.130786][T19932] netlink: 'syz.2.4893': attribute type 10 has an invalid length. [ 1344.172590][T19932] bridge0: port 2(bridge_slave_1) entered disabled state [ 1344.180479][T19932] bridge0: port 1(bridge_slave_0) entered disabled state [ 1344.211978][T19939] sctp: [Deprecated]: syz.5.4896 (pid 19939) Use of int in maxseg socket option. [ 1344.211978][T19939] Use struct sctp_assoc_value instead [ 1344.259177][T19932] bridge0: port 2(bridge_slave_1) entered blocking state [ 1344.267351][T19932] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1344.275678][T19932] bridge0: port 1(bridge_slave_0) entered blocking state [ 1344.283247][T19932] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1344.303422][T19939] netlink: 'syz.5.4896': attribute type 2 has an invalid length. [ 1344.319108][T19932] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1344.329671][T19939] netlink: 'syz.5.4896': attribute type 7 has an invalid length. [ 1344.344471][T19939] netlink: 198452 bytes leftover after parsing attributes in process `syz.5.4896'. [ 1344.973922][T19949] delete_channel: no stack [ 1345.461289][T19960] netlink: 'syz.2.4913': attribute type 5 has an invalid length. [ 1345.504512][T19960] netlink: 'syz.2.4913': attribute type 1 has an invalid length. [ 1345.557654][T19960] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1346.017899][T19977] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4907'. [ 1346.089152][T19977] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 1346.449836][T19993] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.4910'. [ 1346.602836][T19999] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.4914'. [ 1346.643361][T19999] netlink: 1034 bytes leftover after parsing attributes in process `syz.2.4914'. [ 1349.536693][T19995] device sit0 left promiscuous mode [ 1349.647992][T20017] netlink: 122896 bytes leftover after parsing attributes in process `syz.5.4919'. [ 1349.957095][T20025] validate_nla: 1 callbacks suppressed [ 1349.957116][T20025] netlink: 'syz.2.4921': attribute type 27 has an invalid length. [ 1353.456909][T20068] netlink: 'syz.4.4932': attribute type 1 has an invalid length. [ 1353.486293][T20068] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4932'. [ 1353.567751][T20078] netlink: 'syz.2.4934': attribute type 10 has an invalid length. [ 1353.639169][T20078] bridge0: port 2(bridge_slave_1) entered disabled state [ 1353.700652][T20078] device bridge_slave_1 left promiscuous mode [ 1353.713675][T20078] bridge0: port 2(bridge_slave_1) entered disabled state [ 1353.843220][T20078] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1354.185022][T20094] netlink: 'syz.0.4938': attribute type 10 has an invalid length. [ 1360.751994][T20163] netlink: 'syz.3.4962': attribute type 46 has an invalid length. [ 1360.999855][T20171] FAULT_INJECTION: forcing a failure. [ 1360.999855][T20171] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1361.090408][T20171] CPU: 1 PID: 20171 Comm: syz.5.4963 Not tainted syzkaller #0 [ 1361.097980][T20171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1361.108106][T20171] Call Trace: [ 1361.111440][T20171] [ 1361.114421][T20171] dump_stack_lvl+0x188/0x24e [ 1361.119172][T20171] ? show_regs_print_info+0x12/0x12 [ 1361.124440][T20171] ? load_image+0x410/0x410 [ 1361.129013][T20171] ? __lock_acquire+0x7c40/0x7c40 [ 1361.134125][T20171] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 1361.140009][T20171] should_fail_ex+0x390/0x4c0 [ 1361.144771][T20171] _copy_from_user+0x2c/0x170 [ 1361.149513][T20171] ___sys_sendmsg+0x1c3/0x360 [ 1361.154272][T20171] ? __sys_sendmsg+0x2a0/0x2a0 [ 1361.159144][T20171] ? __lock_acquire+0x7c40/0x7c40 [ 1361.164277][T20171] __se_sys_sendmsg+0x1c3/0x2b0 [ 1361.169206][T20171] ? __x64_sys_sendmsg+0x80/0x80 [ 1361.174246][T20171] ? lockdep_hardirqs_on+0x94/0x140 [ 1361.179947][T20171] do_syscall_64+0x4c/0xa0 [ 1361.184427][T20171] ? clear_bhb_loop+0x60/0xb0 [ 1361.189198][T20171] ? clear_bhb_loop+0x60/0xb0 [ 1361.193941][T20171] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1361.199933][T20171] RIP: 0033:0x7f7b1fd9e0d9 [ 1361.204405][T20171] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1361.224086][T20171] RSP: 002b:00007f7b20c19028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1361.232575][T20171] RAX: ffffffffffffffda RBX: 00007f7b20025fa0 RCX: 00007f7b1fd9e0d9 [ 1361.240611][T20171] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 1361.248646][T20171] RBP: 00007f7b20c19090 R08: 0000000000000000 R09: 0000000000000000 [ 1361.256683][T20171] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1361.264720][T20171] R13: 00007f7b20026038 R14: 00007f7b20025fa0 R15: 00007fff45e4ce48 [ 1361.272782][T20171] [ 1361.364521][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.370895][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.387210][T20176] netlink: 'syz.0.4965': attribute type 46 has an invalid length. [ 1363.409157][T20191] netlink: 'syz.4.4970': attribute type 15 has an invalid length. [ 1363.419017][T20191] netlink: 'syz.4.4970': attribute type 7 has an invalid length. [ 1363.448517][T20202] netlink: 'syz.5.4972': attribute type 10 has an invalid length. [ 1363.467667][T20202] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1363.489066][T20202] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1363.614734][T20202] device batadv_slave_0 entered promiscuous mode [ 1363.621877][T20202] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 1363.682957][T20206] netlink: 'syz.2.4975': attribute type 46 has an invalid length. [ 1363.843855][T20211] FAULT_INJECTION: forcing a failure. [ 1363.843855][T20211] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1363.857141][T20211] CPU: 1 PID: 20211 Comm: syz.0.4977 Not tainted syzkaller #0 [ 1363.864662][T20211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1363.874769][T20211] Call Trace: [ 1363.878109][T20211] [ 1363.881090][T20211] dump_stack_lvl+0x188/0x24e [ 1363.885848][T20211] ? show_regs_print_info+0x12/0x12 [ 1363.891109][T20211] ? load_image+0x410/0x410 [ 1363.895691][T20211] ? __lock_acquire+0x7c40/0x7c40 [ 1363.900809][T20211] should_fail_ex+0x390/0x4c0 [ 1363.905556][T20211] _copy_from_user+0x2c/0x170 [ 1363.910280][T20211] iovec_from_user+0x143/0x360 [ 1363.915097][T20211] __import_iovec+0x6c/0x510 [ 1363.919738][T20211] import_iovec+0x6f/0xa0 [ 1363.924128][T20211] ___sys_sendmsg+0x252/0x360 [ 1363.928896][T20211] ? __sys_sendmsg+0x2a0/0x2a0 [ 1363.933734][T20211] ? __lock_acquire+0x7c40/0x7c40 [ 1363.938846][T20211] __se_sys_sendmsg+0x1c3/0x2b0 [ 1363.943745][T20211] ? __x64_sys_sendmsg+0x80/0x80 [ 1363.948751][T20211] ? lockdep_hardirqs_on+0x94/0x140 [ 1363.953993][T20211] do_syscall_64+0x4c/0xa0 [ 1363.958447][T20211] ? clear_bhb_loop+0x60/0xb0 [ 1363.963162][T20211] ? clear_bhb_loop+0x60/0xb0 [ 1363.967970][T20211] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1363.973895][T20211] RIP: 0033:0x7ffa4bf9e0d9 [ 1363.978344][T20211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1363.997984][T20211] RSP: 002b:00007ffa4cdc0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1364.006434][T20211] RAX: ffffffffffffffda RBX: 00007ffa4c225fa0 RCX: 00007ffa4bf9e0d9 [ 1364.014439][T20211] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 1364.022444][T20211] RBP: 00007ffa4cdc0090 R08: 0000000000000000 R09: 0000000000000000 [ 1364.030450][T20211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1364.038464][T20211] R13: 00007ffa4c226038 R14: 00007ffa4c225fa0 R15: 00007ffe9d6b7478 [ 1364.046518][T20211] [ 1365.028964][T20229] netlink: 'syz.2.4983': attribute type 46 has an invalid length. [ 1366.111523][T20263] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4993'. [ 1366.238213][T20264] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4993'. [ 1366.593515][T20272] device syzkaller0 entered promiscuous mode [ 1367.140307][T20282] sctp: [Deprecated]: syz.2.4997 (pid 20282) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1367.140307][T20282] Use struct sctp_sack_info instead [ 1369.285348][T20291] netlink: 'syz.2.4997': attribute type 46 has an invalid length. [ 1369.304208][T20298] netlink: 'syz.4.5002': attribute type 46 has an invalid length. [ 1370.415792][T20316] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5008'. [ 1371.149679][T20344] netlink: 'syz.2.5016': attribute type 46 has an invalid length. [ 1371.230408][T20346] netlink: 'syz.4.5020': attribute type 46 has an invalid length. [ 1372.028552][T20376] netlink: 'syz.2.5029': attribute type 3 has an invalid length. [ 1372.053787][T20377] netlink: 'syz.2.5029': attribute type 3 has an invalid length. [ 1372.150075][T20376] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.5029'. [ 1372.214816][T20377] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.5029'. [ 1372.424042][T20383] netlink: 'syz.4.5031': attribute type 46 has an invalid length. [ 1373.010816][T20397] netlink: 'syz.5.5034': attribute type 27 has an invalid length. [ 1373.036120][T20400] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.5037'. [ 1373.067730][T20397] netlink: 164 bytes leftover after parsing attributes in process `syz.5.5034'. [ 1373.084768][T20399] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.5037'. [ 1373.102617][T20402] netlink: 'syz.2.5036': attribute type 2 has an invalid length. [ 1373.131226][T20402] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5036'. [ 1373.981960][T20416] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5042'. [ 1374.003861][T20422] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5044'. [ 1374.016208][T20419] netlink: 'syz.4.5043': attribute type 46 has an invalid length. [ 1374.188437][T20422] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5044'. [ 1374.341534][T20424] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5044'. [ 1375.838888][T20453] netlink: 'syz.4.5050': attribute type 3 has an invalid length. [ 1376.627543][T20476] TCP: TCP_TX_DELAY enabled [ 1378.376345][T20468] __nla_validate_parse: 3 callbacks suppressed [ 1378.376362][T20468] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5055'. [ 1378.392307][T20476] netlink: 'syz.0.5057': attribute type 46 has an invalid length. [ 1379.009362][T20495] netlink: 'syz.5.5060': attribute type 16 has an invalid length. [ 1379.146377][T20495] netlink: 156 bytes leftover after parsing attributes in process `syz.5.5060'. [ 1380.167421][T20506] netlink: 'syz.4.5068': attribute type 46 has an invalid length. [ 1380.229492][T20506] FAULT_INJECTION: forcing a failure. [ 1380.229492][T20506] name failslab, interval 1, probability 0, space 0, times 0 [ 1380.289678][T20506] CPU: 0 PID: 20506 Comm: syz.4.5068 Not tainted syzkaller #0 [ 1380.297231][T20506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1380.307426][T20506] Call Trace: [ 1380.310752][T20506] [ 1380.313730][T20506] dump_stack_lvl+0x188/0x24e [ 1380.318528][T20506] ? show_regs_print_info+0x12/0x12 [ 1380.323793][T20506] ? load_image+0x410/0x410 [ 1380.328368][T20506] ? __might_sleep+0xd0/0xd0 [ 1380.333012][T20506] ? __lock_acquire+0x7c40/0x7c40 [ 1380.338123][T20506] should_fail_ex+0x390/0x4c0 [ 1380.342899][T20506] should_failslab+0x5/0x20 [ 1380.347457][T20506] slab_pre_alloc_hook+0x59/0x300 [ 1380.352546][T20506] kmem_cache_alloc_node+0x5a/0x310 [ 1380.357800][T20506] ? __alloc_skb+0xf9/0x7d0 [ 1380.362367][T20506] __alloc_skb+0xf9/0x7d0 [ 1380.366767][T20506] netlink_ack+0x373/0x1160 [ 1380.371343][T20506] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 1380.377152][T20506] ? perf_trace_lock+0x301/0x390 [ 1380.382182][T20506] ? netlink_dump+0xcd0/0xcd0 [ 1380.386929][T20506] ? __copy_skb_header+0x3ba/0x4f0 [ 1380.392121][T20506] ? __skb_clone+0x446/0x6c0 [ 1380.396790][T20506] netlink_rcv_skb+0x26d/0x440 [ 1380.401620][T20506] ? rtnetlink_bind+0x80/0x80 [ 1380.406459][T20506] ? netlink_ack+0x1160/0x1160 [ 1380.411309][T20506] ? netlink_deliver_tap+0x2e/0x1b0 [ 1380.416583][T20506] netlink_unicast+0x7ad/0x920 [ 1380.421435][T20506] netlink_sendmsg+0x8ad/0xbd0 [ 1380.426285][T20506] ? netlink_getsockopt+0x550/0x550 [ 1380.431576][T20506] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1380.437195][T20506] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1380.442530][T20506] ? security_socket_sendmsg+0x7c/0xa0 [ 1380.448044][T20506] ? netlink_getsockopt+0x550/0x550 [ 1380.453312][T20506] ____sys_sendmsg+0x5ed/0x9a0 [ 1380.458160][T20506] ? __sys_sendmsg_sock+0x30/0x30 [ 1380.463246][T20506] ? __import_iovec+0x306/0x510 [ 1380.468183][T20506] ? import_iovec+0x6f/0xa0 [ 1380.472753][T20506] ___sys_sendmsg+0x2a2/0x360 [ 1380.477503][T20506] ? __sys_sendmsg+0x2a0/0x2a0 [ 1380.482375][T20506] ? __lock_acquire+0x7c40/0x7c40 [ 1380.487513][T20506] __se_sys_sendmsg+0x1c3/0x2b0 [ 1380.492426][T20506] ? ct_nmi_exit+0x145/0x1c0 [ 1380.497073][T20506] ? __x64_sys_sendmsg+0x80/0x80 [ 1380.502115][T20506] ? lockdep_hardirqs_on+0x94/0x140 [ 1380.507375][T20506] do_syscall_64+0x4c/0xa0 [ 1380.511849][T20506] ? clear_bhb_loop+0x60/0xb0 [ 1380.516585][T20506] ? clear_bhb_loop+0x60/0xb0 [ 1380.521323][T20506] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1380.527273][T20506] RIP: 0033:0x7fd4a619e0d9 [ 1380.531736][T20506] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1380.551400][T20506] RSP: 002b:00007fd4a6fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1380.559873][T20506] RAX: ffffffffffffffda RBX: 00007fd4a6425fa0 RCX: 00007fd4a619e0d9 [ 1380.567890][T20506] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 1380.575913][T20506] RBP: 00007fd4a6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1380.583932][T20506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1380.591950][T20506] R13: 00007fd4a6426038 R14: 00007fd4a6425fa0 R15: 00007ffde52e93d8 [ 1380.600009][T20506] [ 1380.625533][T20510] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5069'. [ 1380.891623][T20516] netlink: 134268 bytes leftover after parsing attributes in process `syz.3.5071'. [ 1380.950005][T20521] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5073'. [ 1381.008691][T20521] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5073'. [ 1381.073681][T20521] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1381.134730][T20521] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1381.663786][ T9636] device syz_tun left promiscuous mode [ 1381.703619][ T9636] ¥: port 1(syz_tun) entered disabled state [ 1381.740911][T20535] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1381.752179][T20535] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1381.761129][T20535] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1381.780051][T20528] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1381.787541][T20528] IPv6: NLM_F_CREATE should be set when creating new route [ 1381.795531][T20528] IPv6: NLM_F_CREATE should be set when creating new route [ 1381.803244][T20528] IPv6: NLM_F_CREATE should be set when creating new route [ 1381.813052][T20535] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1381.822157][T20535] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1381.833126][T20535] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1381.940635][T13656] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.063664][T13656] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.349447][T13656] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.611750][T13656] device netdevsim0 left promiscuous mode [ 1382.668498][T13656] bridge0: port 3(netdevsim0) entered disabled state [ 1382.712276][T13656] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.872878][T20558] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.5082'. [ 1382.944317][T20556] netlink: 'syz.3.5082': attribute type 3 has an invalid length. [ 1382.997413][T20531] chnl_net:caif_netlink_parms(): no params data found [ 1383.118411][T20556] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.5082'. [ 1383.358652][T20558] netlink: 'syz.3.5082': attribute type 10 has an invalid length. [ 1383.421945][T20558] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1383.567255][T13656] device 0 left promiscuous mode [ 1383.914730][T20535] Bluetooth: hci2: command 0x0409 tx timeout [ 1384.029923][T20531] bridge0: port 1(bridge_slave_0) entered blocking state [ 1384.054249][T20531] bridge0: port 1(bridge_slave_0) entered disabled state [ 1384.068247][T20531] device bridge_slave_0 entered promiscuous mode [ 1384.078828][T20575] netlink: 15743 bytes leftover after parsing attributes in process `syz.2.5086'. [ 1384.090238][T20531] bridge0: port 2(bridge_slave_1) entered blocking state [ 1384.107881][T20531] bridge0: port 2(bridge_slave_1) entered disabled state [ 1384.125377][T20531] device bridge_slave_1 entered promiscuous mode [ 1384.390871][T20531] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1385.326390][T13656] device ip6gretap0 left promiscuous mode [ 1385.332244][T13656] : port 1(ip6gretap0) entered disabled state [ 1385.427508][T20531] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1385.741265][T20531] team0: Port device team_slave_0 added [ 1385.859400][T20531] team0: Port device team_slave_1 added [ 1386.004285][T20535] Bluetooth: hci2: command 0x041b tx timeout [ 1386.061838][T20531] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1386.099001][T20531] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1386.231086][T20531] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1386.538170][T20531] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1386.581896][T20531] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1386.653611][T20531] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1386.706013][T20630] netlink: 'syz.2.5098': attribute type 22 has an invalid length. [ 1386.718595][T20630] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5098'. [ 1386.858831][T20641] netlink: 'syz.4.5101': attribute type 2 has an invalid length. [ 1386.952819][T20531] device hsr_slave_0 entered promiscuous mode [ 1386.995836][T20531] device hsr_slave_1 entered promiscuous mode [ 1387.201138][T20641] device 0 entered promiscuous mode [ 1387.302935][T20651] netlink: 'syz.3.5102': attribute type 27 has an invalid length. [ 1387.327500][T20651] netlink: 152 bytes leftover after parsing attributes in process `syz.3.5102'. [ 1387.409320][T20651] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1387.858181][T20668] delete_channel: no stack [ 1388.076355][ T48] Bluetooth: hci2: command 0x040f tx timeout [ 1388.497054][T20685] netlink: 'syz.3.5109': attribute type 29 has an invalid length. [ 1389.026339][T20684] netlink: 212940 bytes leftover after parsing attributes in process `syz.2.5110'. [ 1389.053921][T13656] bond0: (slave wlan1): Releasing backup interface [ 1389.074665][T20681] can: request_module (can-proto-0) failed. [ 1389.163041][T13656] device wlan1 left promiscuous mode [ 1389.355280][T20690] netlink: 184 bytes leftover after parsing attributes in process `syz.3.5109'. [ 1389.435947][T20685] netlink: 'syz.3.5109': attribute type 29 has an invalid length. [ 1389.793114][T20688] netlink: 'syz.3.5109': attribute type 29 has an invalid length. [ 1389.854445][T20685] netlink: 'syz.3.5109': attribute type 46 has an invalid length. [ 1389.947320][T20692] netlink: 'syz.3.5109': attribute type 29 has an invalid length. [ 1390.009141][T13656] device hsr_slave_0 left promiscuous mode [ 1390.070052][T13656] device hsr_slave_1 left promiscuous mode [ 1390.085596][T13656] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1390.100603][T13656] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1390.145026][T13656] device bond0 left promiscuous mode [ 1390.150413][T13656] device bond_slave_0 left promiscuous mode [ 1390.156875][ T48] Bluetooth: hci2: command 0x0419 tx timeout [ 1390.184394][T13656] device batadv_slave_0 left promiscuous mode [ 1390.229113][T13656] bridge0: port 4(bond0) entered disabled state [ 1390.368907][T13656] bridge0: port 1(hsr0) entered disabled state [ 1390.396788][T13656] device bridge_slave_1 left promiscuous mode [ 1390.403088][T13656] bridge0: port 2(bridge_slave_1) entered disabled state [ 1391.166474][T13656] bond0 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 1391.249814][T13656] device team_slave_1 left promiscuous mode [ 1391.260983][T13656] team0 (unregistering): Port device team_slave_1 removed [ 1391.309114][T13656] device team_slave_0 left promiscuous mode [ 1391.325481][T13656] team0 (unregistering): Port device team_slave_0 removed [ 1391.397774][T13656] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1391.457952][T13656] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1391.748284][T13656] device bridge0 left promiscuous mode [ 1391.757577][T13656] team0 (unregistering): Port device bridge0 removed [ 1391.805404][T13656] bond0 (unregistering): Released all slaves [ 1391.908466][T20698] netlink: 'syz.3.5109': attribute type 29 has an invalid length. [ 1391.980494][T20708] netlink: 'syz.2.5114': attribute type 3 has an invalid length. [ 1391.993346][T20708] netlink: 16066 bytes leftover after parsing attributes in process `syz.2.5114'. [ 1392.010276][T20717] netlink: 'syz.0.5117': attribute type 10 has an invalid length. [ 1392.109251][T20717] device veth0_vlan left promiscuous mode [ 1392.169252][T20717] device veth0_vlan entered promiscuous mode [ 1392.195564][T20717] team0: Device veth0_vlan failed to register rx_handler [ 1392.983531][T20531] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1393.025571][T20531] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1393.051903][T20531] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1393.110606][T20732] netlink: 'syz.2.5123': attribute type 10 has an invalid length. [ 1393.162946][T20742] netlink: 'syz.3.5124': attribute type 2 has an invalid length. [ 1393.193052][T20732] device netdevsim0 entered promiscuous mode [ 1393.233297][T20531] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1393.539173][T20742] device 0 entered promiscuous mode [ 1393.774834][T20531] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1393.815353][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1393.849815][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1393.873500][T20531] 8021q: adding VLAN 0 to HW filter on device team0 [ 1393.895707][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1393.921720][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1393.941638][T13656] bridge0: port 1(bridge_slave_0) entered blocking state [ 1393.948920][T13656] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1393.972487][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1393.990679][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1394.040114][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1394.070823][T13656] bridge0: port 2(bridge_slave_1) entered blocking state [ 1394.078066][T13656] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1394.110250][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1394.245184][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1394.293776][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1394.393562][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1394.529647][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1394.632640][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1394.680827][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1394.701777][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1394.815351][T20531] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1394.908092][T20531] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1395.043030][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1395.085237][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1395.131760][T13656] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1396.015026][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1396.022576][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1396.093921][T20531] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1396.126800][T20809] netlink: 'syz.0.5138': attribute type 2 has an invalid length. [ 1396.537151][T20809] device 0 entered promiscuous mode [ 1396.612341][T20814] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1396.775797][T20814] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1396.802967][T20823] netlink: 'syz.4.5141': attribute type 1 has an invalid length. [ 1398.197842][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1398.266672][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1398.445509][T11891] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1398.461288][T11891] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1398.582620][T11891] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1398.640534][T11891] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1398.711823][T20531] device veth0_vlan entered promiscuous mode [ 1398.868255][T20535] Bluetooth: hci3: unexpected event 0x1d length: 15 > 5 [ 1399.039103][T20531] device veth1_vlan entered promiscuous mode [ 1402.361785][ T4382] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1402.373350][T20891] netlink: 'syz.4.5155': attribute type 10 has an invalid length. [ 1402.382393][T20891] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1402.391493][T20891] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1402.401315][T20891] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1402.411883][T20891] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1402.553816][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1402.575108][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1402.605514][T20531] device veth0_macvtap entered promiscuous mode [ 1402.669480][T20531] device veth1_macvtap entered promiscuous mode [ 1402.757636][T20531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1402.780178][T20531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1402.819200][T20531] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1402.910804][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1402.933937][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1403.029356][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1403.085136][T13659] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1403.136554][T20531] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1403.168614][T20531] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1403.202662][T20531] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1403.217798][ T4382] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1403.230648][ T4382] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1403.300319][T20531] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.318889][T20531] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.331079][T20531] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.347255][T20531] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.648843][T20927] netlink: 'syz.2.5163': attribute type 46 has an invalid length. [ 1404.027856][T11891] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1404.065174][T11891] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1404.224273][T11891] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1404.282345][T11891] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1404.363391][T11891] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1404.429765][T11891] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1404.843745][T20948] sctp: [Deprecated]: syz.5.5080 (pid 20948) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1404.843745][T20948] Use struct sctp_sack_info instead [ 1405.028582][T20952] netlink: 'syz.3.5168': attribute type 1 has an invalid length. [ 1406.226001][T20981] netlink: 'syz.5.5181': attribute type 46 has an invalid length. [ 1406.607975][T20995] netlink: 8964 bytes leftover after parsing attributes in process `syz.5.5184'. [ 1407.105460][T21007] delete_channel: no stack [ 1408.541703][T21040] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.5194'. [ 1408.658367][T21040] netlink: 'syz.3.5194': attribute type 46 has an invalid length. [ 1410.386922][T21093] netlink: 'syz.4.5211': attribute type 10 has an invalid length. [ 1410.480111][T21094] delete_channel: no stack [ 1410.851452][T21101] netlink: 'syz.5.5214': attribute type 46 has an invalid length. [ 1414.171204][T21136] netlink: 'syz.5.5220': attribute type 21 has an invalid length. [ 1414.590900][T21152] netlink: 164 bytes leftover after parsing attributes in process `syz.2.5224'. [ 1414.623787][T21152] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1414.800805][T21161] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1415.016644][T21168] netlink: 'syz.4.5228': attribute type 46 has an invalid length. [ 1416.550622][T21206] netlink: 'syz.2.5240': attribute type 2 has an invalid length. [ 1416.573256][T21206] netlink: 'syz.2.5240': attribute type 1 has an invalid length. [ 1416.616299][T21205] netlink: 'syz.5.5239': attribute type 21 has an invalid length. [ 1416.639314][T21205] netlink: 128 bytes leftover after parsing attributes in process `syz.5.5239'. [ 1416.644442][T21206] netlink: 'syz.2.5240': attribute type 4 has an invalid length. [ 1416.676748][T21205] netlink: 'syz.5.5239': attribute type 5 has an invalid length. [ 1416.710262][T21206] netlink: 208312 bytes leftover after parsing attributes in process `syz.2.5240'. [ 1416.720911][T21205] netlink: 'syz.5.5239': attribute type 6 has an invalid length. [ 1416.776234][T21205] netlink: 3 bytes leftover after parsing attributes in process `syz.5.5239'. [ 1416.944974][T21210] netlink: 763 bytes leftover after parsing attributes in process `syz.5.5239'. [ 1417.249548][T21225] netlink: 'syz.4.5245': attribute type 46 has an invalid length. [ 1417.626366][T21229] netlink: 16178 bytes leftover after parsing attributes in process `syz.5.5246'. [ 1418.624347][T21254] netlink: 9275 bytes leftover after parsing attributes in process `syz.5.5255'. [ 1422.799691][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.806155][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.137952][T21332] netlink: 'syz.2.5275': attribute type 10 has an invalid length. [ 1423.879066][T21342] netlink: 'syz.2.5278': attribute type 3 has an invalid length. [ 1424.007725][T21342] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.5278'. [ 1424.091127][T21346] netlink: 'syz.4.5279': attribute type 10 has an invalid length. [ 1424.119986][T21346] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5279'. [ 1424.181483][T21346] openvswitch: netlink: Flow key attr not present in new flow. [ 1424.321483][T21346] netlink: 'syz.4.5279': attribute type 46 has an invalid length. [ 1426.735873][T21359] netlink: 'syz.0.5285': attribute type 2 has an invalid length. [ 1427.041816][T21357] device syzkaller0 entered promiscuous mode [ 1427.064966][T21371] netlink: 'syz.5.5287': attribute type 29 has an invalid length. [ 1427.166540][T21381] netlink: 202920 bytes leftover after parsing attributes in process `syz.0.5288'. [ 1427.167263][T21380] netlink: 202920 bytes leftover after parsing attributes in process `syz.0.5288'. [ 1429.521748][T21371] netlink: 'syz.5.5287': attribute type 29 has an invalid length. [ 1429.530309][T21375] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5287'. [ 1429.544391][T21389] netlink: 'syz.4.5292': attribute type 46 has an invalid length. [ 1429.853917][T21412] netlink: 'syz.3.5298': attribute type 29 has an invalid length. [ 1429.873187][T21412] netlink: 'syz.3.5298': attribute type 29 has an invalid length. [ 1429.873639][T21413] netlink: 168864 bytes leftover after parsing attributes in process `syz.4.5297'. [ 1429.896910][T21414] netlink: 'syz.3.5298': attribute type 29 has an invalid length. [ 1429.948976][T21413] netlink: zone id is out of range [ 1430.045934][T21413] netlink: zone id is out of range [ 1430.130108][T21413] netlink: zone id is out of range [ 1430.274965][T21413] netlink: zone id is out of range [ 1430.397196][T21413] netlink: zone id is out of range [ 1430.434013][T21413] netlink: zone id is out of range [ 1430.458922][T21413] netlink: zone id is out of range [ 1430.481111][T21413] netlink: zone id is out of range [ 1430.481274][T21412] can: request_module (can-proto-0) failed. [ 1430.510446][T21413] netlink: zone id is out of range [ 1430.582166][T21413] netlink: zone id is out of range [ 1432.121456][T21455] netlink: 'syz.5.5308': attribute type 3 has an invalid length. [ 1432.183787][T21455] netlink: 105116 bytes leftover after parsing attributes in process `syz.5.5308'. [ 1432.203826][T21461] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.5313'. [ 1432.245989][T21458] netlink: 'syz.2.5312': attribute type 10 has an invalid length. [ 1434.925506][T21458] bridge0: port 1(bridge_slave_0) entered disabled state [ 1435.137807][T21485] netlink: 'syz.5.5319': attribute type 29 has an invalid length. [ 1435.173339][T21485] netlink: 'syz.5.5319': attribute type 29 has an invalid length. [ 1435.192142][T21486] netlink: 'syz.5.5319': attribute type 29 has an invalid length. [ 1436.523043][T21526] netlink: 'syz.5.5330': attribute type 30 has an invalid length. [ 1436.951953][T21553] netlink: 122896 bytes leftover after parsing attributes in process `syz.5.5338'. [ 1441.636398][T21598] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.5351'. [ 1442.502046][T21606] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.5355'. [ 1443.116537][T21616] netlink: 'syz.2.5357': attribute type 2 has an invalid length. [ 1443.174136][T21616] netlink: 'syz.2.5357': attribute type 8 has an invalid length. [ 1443.202611][T21616] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5357'. [ 1443.448899][T21622] tipc: Started in network mode [ 1443.453860][T21622] tipc: Node identity 9215a268, cluster identity 4711 [ 1443.564279][T21622] tipc: Node number set to 2450891368 [ 1443.685904][T21627] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.5361'. [ 1444.403737][T21642] netlink: 'syz.0.5366': attribute type 19 has an invalid length. [ 1444.498468][T21641] netlink: 'syz.0.5366': attribute type 10 has an invalid length. [ 1444.514177][T21641] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5366'. [ 1444.541834][T21641] net_ratelimit: 141 callbacks suppressed [ 1444.541852][T21641] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1445.880272][T21652] netlink: 1042 bytes leftover after parsing attributes in process `syz.3.5370'. [ 1446.423174][T20535] Bluetooth: hci4: ISO packet for unknown connection handle 0 [ 1449.471163][T21673] device wlan1 entered promiscuous mode [ 1449.478981][T21675] netlink: 'syz.2.5375': attribute type 3 has an invalid length. [ 1449.488190][T21675] netlink: 114680 bytes leftover after parsing attributes in process `syz.2.5375'. [ 1449.499101][T21683] C: renamed from team_slave_0 [ 1449.506987][T21683] netlink: 'syz.4.5379': attribute type 2 has an invalid length. [ 1449.527451][T21683] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5379'. [ 1449.545163][T21683] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1450.900105][T21742] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5398'. [ 1451.709154][T21758] netlink: 'syz.3.5402': attribute type 10 has an invalid length. [ 1452.896675][T21775] netlink: 'syz.5.5406': attribute type 33 has an invalid length. [ 1452.917747][T21775] netlink: 152 bytes leftover after parsing attributes in process `syz.5.5406'. [ 1453.171279][T21785] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.5409'. [ 1453.248969][T21785] netlink: 'syz.2.5409': attribute type 29 has an invalid length. [ 1453.295688][T21785] netlink: 'syz.2.5409': attribute type 29 has an invalid length. [ 1453.345973][T21793] netlink: 'syz.2.5409': attribute type 29 has an invalid length. [ 1453.385961][T21785] netlink: 'syz.2.5409': attribute type 29 has an invalid length. [ 1454.268466][T21819] netlink: 'syz.4.5419': attribute type 4 has an invalid length. [ 1454.324545][T21819] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.5419'. [ 1455.309678][T21851] netlink: 'syz.0.5428': attribute type 27 has an invalid length. [ 1455.431557][T21853] netlink: 'syz.4.5429': attribute type 3 has an invalid length. [ 1455.482795][T21853] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.5429'. [ 1455.727463][T21859] netlink: 'syz.3.5432': attribute type 21 has an invalid length. [ 1456.408950][T21882] : port 1(ip6gretap0) entered blocking state [ 1456.427341][T21882] : port 1(ip6gretap0) entered disabled state [ 1456.488391][T21882] device ip6gretap0 entered promiscuous mode [ 1456.570199][T21885] device ip6gretap0 left promiscuous mode [ 1456.605293][T21885] : port 1(ip6gretap0) entered disabled state [ 1459.508458][T21955] : port 1(ip6gretap0) entered blocking state [ 1459.575769][T21955] : port 1(ip6gretap0) entered disabled state [ 1459.685905][T21955] device ip6gretap0 entered promiscuous mode [ 1459.969000][T21966] netlink: 'syz.5.5462': attribute type 3 has an invalid length. [ 1460.019106][T21966] netlink: 105116 bytes leftover after parsing attributes in process `syz.5.5462'. [ 1461.396325][T22004] netlink: 'syz.5.5472': attribute type 3 has an invalid length. [ 1461.424254][T22004] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.5472'. [ 1461.682684][T22008] netlink: 'syz.0.5471': attribute type 2 has an invalid length. [ 1461.760203][T22008] netlink: 'syz.0.5471': attribute type 8 has an invalid length. [ 1461.882234][T22008] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5471'. [ 1462.172427][T22024] netlink: 'syz.5.5487': attribute type 11 has an invalid length. [ 1462.180425][T22024] netlink: 140 bytes leftover after parsing attributes in process `syz.5.5487'. [ 1462.398152][T22026] netlink: 'syz.3.5477': attribute type 3 has an invalid length. [ 1462.424570][T22026] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.5477'. [ 1463.236548][T20535] Bluetooth: hci1: unexpected subevent 0x01 length: 150 > 18 [ 1463.244509][T20535] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 1463.254666][T20535] CPU: 1 PID: 20535 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 1463.262361][T20535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1463.272465][T20535] Workqueue: hci1 hci_rx_work [ 1463.277211][T20535] Call Trace: [ 1463.280517][T20535] [ 1463.283489][T20535] dump_stack_lvl+0x188/0x24e [ 1463.288268][T20535] ? show_regs_print_info+0x12/0x12 [ 1463.293542][T20535] ? load_image+0x410/0x410 [ 1463.298106][T20535] sysfs_create_dir_ns+0x26a/0x290 [ 1463.303250][T20535] ? __lock_acquire+0x7c40/0x7c40 [ 1463.308324][T20535] ? sysfs_warn_dup+0xa0/0xa0 [ 1463.313071][T20535] ? do_raw_spin_unlock+0x11d/0x230 [ 1463.318302][T20535] kobject_add_internal+0x617/0xca0 [ 1463.323532][T20535] kobject_add+0x160/0x230 [ 1463.327979][T20535] ? kobject_init+0x1c0/0x1c0 [ 1463.332687][T20535] ? __raw_spin_lock_init+0x41/0x100 [ 1463.338197][T20535] ? klist_children_get+0x50/0x50 [ 1463.343265][T20535] ? get_device_parent+0x121/0x3e0 [ 1463.348418][T20535] device_add+0x470/0x1050 [ 1463.352879][T20535] hci_conn_add_sysfs+0xd1/0x1e0 [ 1463.357859][T20535] le_conn_complete_evt+0xfac/0x15c0 [ 1463.363188][T20535] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 1463.369466][T20535] ? bt_info+0x180/0x180 [ 1463.373751][T20535] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 1463.379421][T20535] ? mutex_unlock+0x10/0x10 [ 1463.383955][T20535] ? skb_pull_data+0xec/0x1f0 [ 1463.388668][T20535] hci_le_conn_complete_evt+0x183/0x440 [ 1463.394247][T20535] ? hci_remote_host_features_evt+0x230/0x230 [ 1463.400343][T20535] hci_event_packet+0x7b3/0x1290 [ 1463.405317][T20535] ? __lock_acquire+0x7c40/0x7c40 [ 1463.410372][T20535] ? bis_list+0x280/0x280 [ 1463.414736][T20535] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1463.420657][T20535] ? kcov_remote_start+0x4b0/0x7e0 [ 1463.425817][T20535] ? do_machine_check+0x380/0x750 [ 1463.430882][T20535] ? hci_send_to_monitor+0x9c/0x4a0 [ 1463.436111][T20535] hci_rx_work+0x3eb/0xd40 [ 1463.440557][T20535] ? _raw_spin_unlock+0x40/0x40 [ 1463.445456][T20535] ? process_one_work+0x7b4/0x1160 [ 1463.450608][T20535] process_one_work+0x8ab/0x1160 [ 1463.455617][T20535] ? worker_detach_from_pool+0x240/0x240 [ 1463.461288][T20535] ? _raw_spin_lock_irq+0x86/0xf0 [ 1463.466338][T20535] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1463.471391][T20535] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1463.476970][T20535] ? wq_worker_running+0x97/0x190 [ 1463.482029][T20535] worker_thread+0xaf5/0x12a0 [ 1463.486748][T20535] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1463.492678][T20535] kthread+0x29d/0x330 [ 1463.496767][T20535] ? worker_clr_flags+0x1a0/0x1a0 [ 1463.501820][T20535] ? kthread_blkcg+0xd0/0xd0 [ 1463.506435][T20535] ret_from_fork+0x1f/0x30 [ 1463.510894][T20535] [ 1463.514958][T20535] kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1463.528129][T20535] Bluetooth: hci1: failed to register connection device [ 1464.532973][T22064] netlink: 'syz.0.5488': attribute type 3 has an invalid length. [ 1464.624486][T22064] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.5488'. [ 1464.739227][T22076] netlink: 'syz.5.5489': attribute type 12 has an invalid length. [ 1465.261592][T22094] netlink: 'syz.5.5494': attribute type 4 has an invalid length. [ 1465.312657][T22091] netlink: 'syz.4.5496': attribute type 3 has an invalid length. [ 1465.332982][T22094] netlink: 176 bytes leftover after parsing attributes in process `syz.5.5494'. [ 1465.355065][T22091] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.5496'. [ 1465.468677][T22096] netlink: 'syz.0.5495': attribute type 2 has an invalid length. [ 1465.505241][T22096] netlink: 199820 bytes leftover after parsing attributes in process `syz.0.5495'. [ 1466.151363][T22111] netlink: 14 bytes leftover after parsing attributes in process `syz.2.5497'. [ 1466.170011][T22111] openvswitch: netlink: Flow key attr not present in new flow. [ 1467.291803][T22130] netlink: 'syz.2.5503': attribute type 2 has an invalid length. [ 1467.342792][T22130] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5503'. [ 1467.905344][T22145] netlink: 188 bytes leftover after parsing attributes in process `syz.0.5506'. [ 1469.932578][T22198] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1470.599041][T22217] device bond_slave_1 entered promiscuous mode [ 1470.854198][T22224] netlink: 'syz.5.5528': attribute type 21 has an invalid length. [ 1471.669207][T22261] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5534'. [ 1471.698897][T20535] Bluetooth: hci4: unexpected subevent 0x01 length: 150 > 18 [ 1472.487903][T22284] netlink: 'syz.4.5543': attribute type 2 has an invalid length. [ 1472.513068][T22284] netlink: 199820 bytes leftover after parsing attributes in process `syz.4.5543'. [ 1473.136178][T22291] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5544'. [ 1473.352145][T22299] netlink: 'syz.3.5546': attribute type 10 has an invalid length. [ 1473.372822][T22299] device hsr0 entered promiscuous mode [ 1473.381116][T22299] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1476.753449][T22328] FAULT_INJECTION: forcing a failure. [ 1476.753449][T22328] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1476.796383][T22328] CPU: 1 PID: 22328 Comm: syz.2.5554 Not tainted syzkaller #0 [ 1476.803932][T22328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1476.814031][T22328] Call Trace: [ 1476.817347][T22328] [ 1476.820313][T22328] dump_stack_lvl+0x188/0x24e [ 1476.825042][T22328] ? show_regs_print_info+0x12/0x12 [ 1476.830291][T22328] ? load_image+0x410/0x410 [ 1476.834843][T22328] ? __lock_acquire+0x7c40/0x7c40 [ 1476.839928][T22328] should_fail_ex+0x390/0x4c0 [ 1476.844668][T22328] _copy_from_user+0x2c/0x170 [ 1476.849406][T22328] ___sys_sendmsg+0x1c3/0x360 [ 1476.854124][T22328] ? __sys_sendmsg+0x2a0/0x2a0 [ 1476.858958][T22328] ? rcu_is_watching+0x11/0xa0 [ 1476.863769][T22328] __se_sys_sendmsg+0x1c3/0x2b0 [ 1476.868658][T22328] ? __x64_sys_sendmsg+0x80/0x80 [ 1476.873643][T22328] ? lockdep_hardirqs_on+0x94/0x140 [ 1476.878866][T22328] do_syscall_64+0x4c/0xa0 [ 1476.883319][T22328] ? clear_bhb_loop+0x60/0xb0 [ 1476.888038][T22328] ? clear_bhb_loop+0x60/0xb0 [ 1476.892742][T22328] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1476.898664][T22328] RIP: 0033:0x7f7b99d9e0d9 [ 1476.903101][T22328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1476.922733][T22328] RSP: 002b:00007f7b9abdf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1476.931183][T22328] RAX: ffffffffffffffda RBX: 00007f7b9a025fa0 RCX: 00007f7b99d9e0d9 [ 1476.939176][T22328] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000006 [ 1476.947183][T22328] RBP: 00007f7b9abdf090 R08: 0000000000000000 R09: 0000000000000000 [ 1476.955175][T22328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1476.963163][T22328] R13: 00007f7b9a026038 R14: 00007f7b9a025fa0 R15: 00007fffe2ce7b18 [ 1476.971178][T22328] [ 1477.203521][T22347] FAULT_INJECTION: forcing a failure. [ 1477.203521][T22347] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1477.229959][T22347] CPU: 1 PID: 22347 Comm: syz.3.5561 Not tainted syzkaller #0 [ 1477.237505][T22347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1477.247598][T22347] Call Trace: [ 1477.250915][T22347] [ 1477.253877][T22347] dump_stack_lvl+0x188/0x24e [ 1477.258617][T22347] ? show_regs_print_info+0x12/0x12 [ 1477.263863][T22347] ? load_image+0x410/0x410 [ 1477.268408][T22347] ? __lock_acquire+0x7c40/0x7c40 [ 1477.273487][T22347] should_fail_ex+0x390/0x4c0 [ 1477.278224][T22347] _copy_from_user+0x2c/0x170 [ 1477.282950][T22347] ___sys_sendmsg+0x1c3/0x360 [ 1477.287683][T22347] ? __sys_sendmsg+0x2a0/0x2a0 [ 1477.292525][T22347] ? __lock_acquire+0x7c40/0x7c40 [ 1477.297629][T22347] __se_sys_sendmsg+0x1c3/0x2b0 [ 1477.302546][T22347] ? __x64_sys_sendmsg+0x80/0x80 [ 1477.307555][T22347] ? lockdep_hardirqs_on+0x94/0x140 [ 1477.312800][T22347] do_syscall_64+0x4c/0xa0 [ 1477.317264][T22347] ? clear_bhb_loop+0x60/0xb0 [ 1477.321995][T22347] ? clear_bhb_loop+0x60/0xb0 [ 1477.326732][T22347] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1477.332676][T22347] RIP: 0033:0x7f0b8a79e0d9 [ 1477.337135][T22347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1477.356792][T22347] RSP: 002b:00007f0b8b6fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1477.365259][T22347] RAX: ffffffffffffffda RBX: 00007f0b8aa25fa0 RCX: 00007f0b8a79e0d9 [ 1477.373271][T22347] RDX: 0000000000000020 RSI: 0000200000000980 RDI: 0000000000000003 [ 1477.381285][T22347] RBP: 00007f0b8b6fc090 R08: 0000000000000000 R09: 0000000000000000 [ 1477.389300][T22347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1477.397322][T22347] R13: 00007f0b8aa26038 R14: 00007f0b8aa25fa0 R15: 00007ffd4b1d5dc8 [ 1477.405353][T22347] [ 1478.157577][T22359] netlink: 'syz.0.5559': attribute type 10 has an invalid length. [ 1478.585473][T22359] device wg1 entered promiscuous mode [ 1478.591030][T22359] team0: Device wg1 is of different type [ 1479.661210][T22394] FAULT_INJECTION: forcing a failure. [ 1479.661210][T22394] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1479.700188][T22394] CPU: 0 PID: 22394 Comm: syz.3.5572 Not tainted syzkaller #0 [ 1479.707766][T22394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1479.717852][T22394] Call Trace: [ 1479.721153][T22394] [ 1479.724109][T22394] dump_stack_lvl+0x188/0x24e [ 1479.728827][T22394] ? show_regs_print_info+0x12/0x12 [ 1479.734084][T22394] ? load_image+0x410/0x410 [ 1479.738630][T22394] ? __lock_acquire+0x7c40/0x7c40 [ 1479.743688][T22394] should_fail_ex+0x390/0x4c0 [ 1479.748414][T22394] _copy_from_user+0x2c/0x170 [ 1479.753117][T22394] iovec_from_user+0x143/0x360 [ 1479.757922][T22394] __import_iovec+0x6c/0x510 [ 1479.762554][T22394] import_iovec+0x6f/0xa0 [ 1479.766926][T22394] ___sys_sendmsg+0x252/0x360 [ 1479.771641][T22394] ? __sys_sendmsg+0x2a0/0x2a0 [ 1479.776470][T22394] ? __lock_acquire+0x7c40/0x7c40 [ 1479.781548][T22394] __se_sys_sendmsg+0x1c3/0x2b0 [ 1479.786438][T22394] ? __x64_sys_sendmsg+0x80/0x80 [ 1479.791413][T22394] ? lockdep_hardirqs_on+0x94/0x140 [ 1479.796657][T22394] do_syscall_64+0x4c/0xa0 [ 1479.801110][T22394] ? clear_bhb_loop+0x60/0xb0 [ 1479.805815][T22394] ? clear_bhb_loop+0x60/0xb0 [ 1479.810520][T22394] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1479.816445][T22394] RIP: 0033:0x7f0b8a79e0d9 [ 1479.820890][T22394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1479.840519][T22394] RSP: 002b:00007f0b8b6fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1479.848961][T22394] RAX: ffffffffffffffda RBX: 00007f0b8aa25fa0 RCX: 00007f0b8a79e0d9 [ 1479.856963][T22394] RDX: 0000000000000020 RSI: 0000200000000980 RDI: 0000000000000003 [ 1479.864960][T22394] RBP: 00007f0b8b6fc090 R08: 0000000000000000 R09: 0000000000000000 [ 1479.872958][T22394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1479.880953][T22394] R13: 00007f0b8aa26038 R14: 00007f0b8aa25fa0 R15: 00007ffd4b1d5dc8 [ 1479.888968][T22394] [ 1480.024199][T22399] : port 1(ip6gretap0) entered blocking state [ 1480.065262][T22399] : port 1(ip6gretap0) entered disabled state [ 1480.183742][T22399] device ip6gretap0 entered promiscuous mode [ 1480.284665][T22403] device ip6gretap0 left promiscuous mode [ 1480.290685][T22403] : port 1(ip6gretap0) entered disabled state [ 1481.190557][T22430] netlink: 'syz.5.5581': attribute type 2 has an invalid length. [ 1481.218055][T22430] netlink: 199820 bytes leftover after parsing attributes in process `syz.5.5581'. [ 1482.000432][T22454] FAULT_INJECTION: forcing a failure. [ 1482.000432][T22454] name failslab, interval 1, probability 0, space 0, times 0 [ 1482.033373][T22454] CPU: 1 PID: 22454 Comm: syz.0.5588 Not tainted syzkaller #0 [ 1482.040936][T22454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1482.051043][T22454] Call Trace: [ 1482.054358][T22454] [ 1482.057328][T22454] dump_stack_lvl+0x188/0x24e [ 1482.062058][T22454] ? show_regs_print_info+0x12/0x12 [ 1482.067309][T22454] ? load_image+0x410/0x410 [ 1482.071871][T22454] ? __might_sleep+0xd0/0xd0 [ 1482.076514][T22454] ? __lock_acquire+0x7c40/0x7c40 [ 1482.081601][T22454] should_fail_ex+0x390/0x4c0 [ 1482.086336][T22454] should_failslab+0x5/0x20 [ 1482.090873][T22454] slab_pre_alloc_hook+0x59/0x300 [ 1482.095958][T22454] kmem_cache_alloc_node+0x5a/0x310 [ 1482.101206][T22454] ? __alloc_skb+0xf9/0x7d0 [ 1482.105773][T22454] __alloc_skb+0xf9/0x7d0 [ 1482.110164][T22454] alloc_skb_with_frags+0xa7/0x710 [ 1482.115331][T22454] ? aa_label_sk_perm+0x4cc/0x660 [ 1482.120404][T22454] ? verify_lock_unused+0x140/0x140 [ 1482.125665][T22454] sock_alloc_send_pskb+0x87f/0x9a0 [ 1482.130936][T22454] ? sock_kzfree_s+0x50/0x50 [ 1482.135594][T22454] ? is_bpf_text_address+0x22/0x2a0 [ 1482.140844][T22454] ? apparmor_socket_getpeersec_dgram+0x5/0x10 [ 1482.147052][T22454] ? security_socket_getpeersec_dgram+0x9d/0xc0 [ 1482.153381][T22454] unix_stream_sendmsg+0x431/0xa70 [ 1482.158650][T22454] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1482.163745][T22454] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 1482.170217][T22454] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1482.175829][T22454] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1482.181163][T22454] ? security_socket_sendmsg+0x7c/0xa0 [ 1482.186710][T22454] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1482.191792][T22454] ____sys_sendmsg+0x5ed/0x9a0 [ 1482.196617][T22454] ? __sys_sendmsg_sock+0x30/0x30 [ 1482.201693][T22454] ? __import_iovec+0x306/0x510 [ 1482.206599][T22454] ? import_iovec+0x6f/0xa0 [ 1482.211154][T22454] ___sys_sendmsg+0x2a2/0x360 [ 1482.215898][T22454] ? __sys_sendmsg+0x2a0/0x2a0 [ 1482.220732][T22454] ? __lock_acquire+0x7c40/0x7c40 [ 1482.225834][T22454] __se_sys_sendmsg+0x1c3/0x2b0 [ 1482.230746][T22454] ? __x64_sys_sendmsg+0x80/0x80 [ 1482.235750][T22454] ? lockdep_hardirqs_on+0x94/0x140 [ 1482.240996][T22454] do_syscall_64+0x4c/0xa0 [ 1482.245458][T22454] ? clear_bhb_loop+0x60/0xb0 [ 1482.250184][T22454] ? clear_bhb_loop+0x60/0xb0 [ 1482.254924][T22454] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1482.260871][T22454] RIP: 0033:0x7ffa4bf9e0d9 [ 1482.265342][T22454] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1482.284996][T22454] RSP: 002b:00007ffa4cdc0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1482.293459][T22454] RAX: ffffffffffffffda RBX: 00007ffa4c225fa0 RCX: 00007ffa4bf9e0d9 [ 1482.301482][T22454] RDX: 0000000000000020 RSI: 0000200000000980 RDI: 0000000000000003 [ 1482.309497][T22454] RBP: 00007ffa4cdc0090 R08: 0000000000000000 R09: 0000000000000000 [ 1482.317507][T22454] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1482.325524][T22454] R13: 00007ffa4c226038 R14: 00007ffa4c225fa0 R15: 00007ffe9d6b7478 [ 1482.333562][T22454] [ 1483.823696][T22493] netlink: 'syz.5.5603': attribute type 16 has an invalid length. [ 1483.846114][T22493] netlink: 48 bytes leftover after parsing attributes in process `syz.5.5603'. [ 1484.248639][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.255188][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.827506][T22535] netlink: 'syz.2.5617': attribute type 5 has an invalid length. [ 1485.750931][T22558] netlink: 156 bytes leftover after parsing attributes in process `syz.4.5623'. [ 1485.853754][T22554] sock: sock_set_timeout: `syz.5.5622' (pid 22554) tries to set negative timeout [ 1486.485651][T22567] netlink: 'syz.4.5625': attribute type 3 has an invalid length. [ 1486.552942][T22567] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5625'. [ 1487.965350][T22591] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.5633'. [ 1488.054193][T22595] netlink: 192156 bytes leftover after parsing attributes in process `syz.3.5635'. [ 1488.098344][T22595] netlink: zone id is out of range [ 1488.127709][T22595] netlink: zone id is out of range [ 1488.137015][T22595] netlink: zone id is out of range [ 1488.165593][T22595] netlink: zone id is out of range [ 1488.170968][T22595] netlink: zone id is out of range [ 1488.196755][T22595] netlink: zone id is out of range [ 1488.217049][T22595] netlink: zone id is out of range [ 1488.236670][T22595] netlink: zone id is out of range [ 1488.251229][T22595] netlink: zone id is out of range [ 1489.183050][T22611] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5639'. [ 1489.701135][T22631] netlink: 'syz.3.5646': attribute type 2 has an invalid length. [ 1489.726715][T22631] netlink: 'syz.3.5646': attribute type 8 has an invalid length. [ 1489.747985][T22631] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5646'. [ 1490.646754][T22650] netlink: 'syz.5.5651': attribute type 39 has an invalid length. [ 1490.716135][T22650] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5651'. [ 1491.097464][T22673] netlink: 'syz.5.5659': attribute type 10 has an invalid length. [ 1491.197026][T22666] netlink: 9286 bytes leftover after parsing attributes in process `syz.4.5656'. [ 1491.666662][T22686] netlink: 'syz.5.5662': attribute type 10 has an invalid length. [ 1491.737246][T22686] device syz_tun entered promiscuous mode [ 1491.904397][T22686] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1492.151059][T22695] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.5665'. [ 1492.891971][T22706] netlink: 'syz.5.5666': attribute type 39 has an invalid length. [ 1492.917324][T22706] device macvlan0 entered promiscuous mode [ 1493.212988][T22713] netlink: 'syz.0.5670': attribute type 39 has an invalid length. [ 1493.262041][T22713] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5670'. [ 1493.338842][T22717] FAULT_INJECTION: forcing a failure. [ 1493.338842][T22717] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1493.547312][T22717] CPU: 0 PID: 22717 Comm: syz.4.5671 Not tainted syzkaller #0 [ 1493.554865][T22717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1493.564972][T22717] Call Trace: [ 1493.568292][T22717] [ 1493.571262][T22717] dump_stack_lvl+0x188/0x24e [ 1493.576046][T22717] ? show_regs_print_info+0x12/0x12 [ 1493.581324][T22717] ? load_image+0x410/0x410 [ 1493.585880][T22717] ? __might_fault+0xa6/0x120 [ 1493.590609][T22717] should_fail_ex+0x390/0x4c0 [ 1493.595348][T22717] copyin+0x1b/0x120 [ 1493.599292][T22717] _copy_from_iter+0x447/0x1130 [ 1493.604198][T22717] ? sock_alloc_send_pskb+0x89d/0x9a0 [ 1493.609626][T22717] ? copyout_mc+0x110/0x110 [ 1493.614189][T22717] ? __virt_addr_valid+0x188/0x540 [ 1493.619399][T22717] ? __virt_addr_valid+0x188/0x540 [ 1493.624573][T22717] ? __virt_addr_valid+0x467/0x540 [ 1493.629754][T22717] ? __check_object_size+0x4f6/0xa70 [ 1493.635098][T22717] skb_copy_datagram_from_iter+0xee/0x6b0 [ 1493.640966][T22717] ? unix_scm_to_skb+0x336/0x4e0 [ 1493.645059][T22727] netlink: 'syz.2.5676': attribute type 27 has an invalid length. [ 1493.645937][T22717] ? skb_put+0x10e/0x200 [ 1493.645977][T22717] unix_stream_sendmsg+0x4d5/0xa70 [ 1493.646018][T22717] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1493.668287][T22717] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 1493.674774][T22717] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1493.680379][T22717] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1493.685713][T22717] ? security_socket_sendmsg+0x7c/0xa0 [ 1493.691234][T22717] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1493.696314][T22717] ____sys_sendmsg+0x5ed/0x9a0 [ 1493.701144][T22717] ? __sys_sendmsg_sock+0x30/0x30 [ 1493.706217][T22717] ? __import_iovec+0x306/0x510 [ 1493.711131][T22717] ? import_iovec+0x6f/0xa0 [ 1493.715685][T22717] ___sys_sendmsg+0x2a2/0x360 [ 1493.720430][T22717] ? __sys_sendmsg+0x2a0/0x2a0 [ 1493.725266][T22717] ? __lock_acquire+0x7c40/0x7c40 [ 1493.727841][T22727] netlink: 164 bytes leftover after parsing attributes in process `syz.2.5676'. [ 1493.730352][T22717] __se_sys_sendmsg+0x1c3/0x2b0 [ 1493.730393][T22717] ? __x64_sys_sendmsg+0x80/0x80 [ 1493.749305][T22717] ? lockdep_hardirqs_on+0x94/0x140 [ 1493.754553][T22717] do_syscall_64+0x4c/0xa0 [ 1493.759033][T22717] ? clear_bhb_loop+0x60/0xb0 [ 1493.763763][T22717] ? clear_bhb_loop+0x60/0xb0 [ 1493.768500][T22717] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1493.774448][T22717] RIP: 0033:0x7fd4a619e0d9 [ 1493.778911][T22717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1493.798563][T22717] RSP: 002b:00007fd4a6fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1493.807018][T22717] RAX: ffffffffffffffda RBX: 00007fd4a6425fa0 RCX: 00007fd4a619e0d9 [ 1493.815017][T22717] RDX: 0000000000000020 RSI: 0000200000000980 RDI: 0000000000000003 [ 1493.823010][T22717] RBP: 00007fd4a6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1493.831040][T22717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1493.839040][T22717] R13: 00007fd4a6426038 R14: 00007fd4a6425fa0 R15: 00007ffde52e93d8 [ 1493.847057][T22717] [ 1494.802601][T22758] FAULT_INJECTION: forcing a failure. [ 1494.802601][T22758] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1494.816376][T22758] CPU: 1 PID: 22758 Comm: syz.4.5682 Not tainted syzkaller #0 [ 1494.823900][T22758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1494.834007][T22758] Call Trace: [ 1494.837326][T22758] [ 1494.840293][T22758] dump_stack_lvl+0x188/0x24e [ 1494.845020][T22758] ? show_regs_print_info+0x12/0x12 [ 1494.850304][T22758] ? load_image+0x410/0x410 [ 1494.854838][T22758] ? __lock_acquire+0x7c40/0x7c40 [ 1494.859897][T22758] ? snprintf+0xe5/0x140 [ 1494.864172][T22758] should_fail_ex+0x390/0x4c0 [ 1494.868888][T22758] _copy_to_user+0x2c/0x130 [ 1494.873418][T22758] simple_read_from_buffer+0xe3/0x150 [ 1494.878819][T22758] proc_fail_nth_read+0x1a6/0x220 [ 1494.883911][T22758] ? proc_fault_inject_write+0x310/0x310 [ 1494.889579][T22758] ? fsnotify_perm+0x248/0x550 [ 1494.894375][T22758] ? proc_fault_inject_write+0x310/0x310 [ 1494.900037][T22758] vfs_read+0x2db/0x960 [ 1494.904238][T22758] ? kernel_read+0x1e0/0x1e0 [ 1494.908859][T22758] ? __fget_files+0x28/0x460 [ 1494.913482][T22758] ? __fget_files+0x3fc/0x460 [ 1494.918199][T22758] ? __fdget_pos+0x2ae/0x360 [ 1494.922819][T22758] ? ksys_read+0x70/0x260 [ 1494.927182][T22758] ksys_read+0x14d/0x260 [ 1494.931456][T22758] ? vfs_write+0x9a0/0x9a0 [ 1494.935902][T22758] ? lockdep_hardirqs_on+0x94/0x140 [ 1494.941159][T22758] do_syscall_64+0x4c/0xa0 [ 1494.945608][T22758] ? clear_bhb_loop+0x60/0xb0 [ 1494.950323][T22758] ? clear_bhb_loop+0x60/0xb0 [ 1494.955031][T22758] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1494.960954][T22758] RIP: 0033:0x7fd4a615e90e [ 1494.965395][T22758] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1494.985031][T22758] RSP: 002b:00007fd4a6fabfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1494.993490][T22758] RAX: ffffffffffffffda RBX: 00007fd4a6fac6c0 RCX: 00007fd4a615e90e [ 1495.001488][T22758] RDX: 000000000000000f RSI: 00007fd4a6fac0a0 RDI: 000000000000000c [ 1495.009480][T22758] RBP: 00007fd4a6fac090 R08: 0000000000000000 R09: 0000000000000000 [ 1495.017477][T22758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1495.025470][T22758] R13: 00007fd4a6426218 R14: 00007fd4a6426180 R15: 00007ffde52e93d8 [ 1495.033483][T22758] [ 1496.010031][T22771] netlink: 'syz.4.5685': attribute type 39 has an invalid length. [ 1496.108250][T22778] netlink: 10 bytes leftover after parsing attributes in process `syz.0.5688'. [ 1496.253466][T22771] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5685'. [ 1496.279102][T22773] netlink: 188 bytes leftover after parsing attributes in process `syz.3.5687'. [ 1496.585289][ T48] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1496.594928][ T48] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1496.602821][ T48] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1496.613391][ T48] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1496.621182][ T48] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1496.633428][ T48] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1496.809553][T17726] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1496.927977][T17726] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1497.119326][T22794] FAULT_INJECTION: forcing a failure. [ 1497.119326][T22794] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1497.135764][T17726] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1497.168926][T22794] CPU: 0 PID: 22794 Comm: syz.5.5693 Not tainted syzkaller #0 [ 1497.176494][T22794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1497.186590][T22794] Call Trace: [ 1497.189923][T22794] [ 1497.192899][T22794] dump_stack_lvl+0x188/0x24e [ 1497.197635][T22794] ? show_regs_print_info+0x12/0x12 [ 1497.202890][T22794] ? load_image+0x410/0x410 [ 1497.207446][T22794] ? __might_fault+0xa6/0x120 [ 1497.212174][T22794] should_fail_ex+0x390/0x4c0 [ 1497.216907][T22794] copyin+0x1b/0x120 [ 1497.220858][T22794] _copy_from_iter+0x447/0x1130 [ 1497.225766][T22794] ? copyout_mc+0x110/0x110 [ 1497.230318][T22794] ? copyout_mc+0x110/0x110 [ 1497.234856][T22794] ? __virt_addr_valid+0x188/0x540 [ 1497.240008][T22794] ? page_copy_sane+0x194/0x390 [ 1497.244890][T22794] copy_page_from_iter+0x77/0x100 [ 1497.249948][T22794] skb_copy_datagram_from_iter+0x2c5/0x6b0 [ 1497.255812][T22794] unix_stream_sendmsg+0x4d5/0xa70 [ 1497.260965][T22794] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1497.266016][T22794] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 1497.272463][T22794] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1497.278041][T22794] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1497.283355][T22794] ? security_socket_sendmsg+0x7c/0xa0 [ 1497.288845][T22794] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1497.293924][T22794] ____sys_sendmsg+0x5ed/0x9a0 [ 1497.298728][T22794] ? __sys_sendmsg_sock+0x30/0x30 [ 1497.303781][T22794] ? __import_iovec+0x306/0x510 [ 1497.308673][T22794] ? import_iovec+0x6f/0xa0 [ 1497.313206][T22794] ___sys_sendmsg+0x2a2/0x360 [ 1497.317921][T22794] ? __sys_sendmsg+0x2a0/0x2a0 [ 1497.322738][T22794] ? __lock_acquire+0x7c40/0x7c40 [ 1497.327819][T22794] __se_sys_sendmsg+0x1c3/0x2b0 [ 1497.332707][T22794] ? __x64_sys_sendmsg+0x80/0x80 [ 1497.337696][T22794] ? lockdep_hardirqs_on+0x94/0x140 [ 1497.342915][T22794] do_syscall_64+0x4c/0xa0 [ 1497.347366][T22794] ? clear_bhb_loop+0x60/0xb0 [ 1497.352086][T22794] ? clear_bhb_loop+0x60/0xb0 [ 1497.356788][T22794] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1497.362707][T22794] RIP: 0033:0x7f53cd79e0d9 [ 1497.367142][T22794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1497.386769][T22794] RSP: 002b:00007f53ce621028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1497.395213][T22794] RAX: ffffffffffffffda RBX: 00007f53cda25fa0 RCX: 00007f53cd79e0d9 [ 1497.403204][T22794] RDX: 0000000000000020 RSI: 0000200000000980 RDI: 0000000000000003 [ 1497.411206][T22794] RBP: 00007f53ce621090 R08: 0000000000000000 R09: 0000000000000000 [ 1497.419203][T22794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1497.427195][T22794] R13: 00007f53cda26038 R14: 00007f53cda25fa0 R15: 00007ffd7465fcd8 [ 1497.435200][T22794] [ 1497.570170][T17726] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1497.803595][T22783] chnl_net:caif_netlink_parms(): no params data found [ 1497.992428][T17726] device 0 left promiscuous mode [ 1498.063491][T22783] bridge0: port 1(bridge_slave_0) entered blocking state [ 1498.111552][T22783] bridge0: port 1(bridge_slave_0) entered disabled state [ 1498.135298][T22783] device bridge_slave_0 entered promiscuous mode [ 1498.173787][T22783] bridge0: port 2(bridge_slave_1) entered blocking state [ 1498.194219][T22783] bridge0: port 2(bridge_slave_1) entered disabled state [ 1498.202577][T22783] device bridge_slave_1 entered promiscuous mode [ 1498.235715][T17726] tipc: Left network mode [ 1498.283830][T22783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1498.307090][T22783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1498.377236][T22783] team0: Port device team_slave_0 added [ 1498.397635][T22783] team0: Port device team_slave_1 added [ 1498.724308][T20535] Bluetooth: hci1: command 0x0409 tx timeout [ 1498.877775][T22783] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1498.894658][T22783] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1498.995534][T22783] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1499.086428][T22831] netlink: 3752 bytes leftover after parsing attributes in process `syz.0.5698'. [ 1499.340895][T22783] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1499.363431][T22783] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1499.463087][T22848] netlink: 188 bytes leftover after parsing attributes in process `syz.5.5699'. [ 1499.483141][T22783] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1499.576845][T22842] netlink: 'syz.3.5700': attribute type 21 has an invalid length. [ 1499.627451][T22842] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5700'. [ 1499.717947][T22842] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5700'. [ 1500.649722][T22783] device hsr_slave_0 entered promiscuous mode [ 1500.678737][T22783] device hsr_slave_1 entered promiscuous mode [ 1500.700444][T22783] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1500.720106][T22783] Cannot create hsr debugfs directory [ 1500.794274][T20535] Bluetooth: hci1: command 0x041b tx timeout [ 1501.034887][T22874] FAULT_INJECTION: forcing a failure. [ 1501.034887][T22874] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1501.127194][T22874] CPU: 1 PID: 22874 Comm: syz.3.5704 Not tainted syzkaller #0 [ 1501.134758][T22874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1501.144893][T22874] Call Trace: [ 1501.148221][T22874] [ 1501.151197][T22874] dump_stack_lvl+0x188/0x24e [ 1501.155937][T22874] ? show_regs_print_info+0x12/0x12 [ 1501.161187][T22874] ? load_image+0x410/0x410 [ 1501.165744][T22874] ? __might_fault+0xa6/0x120 [ 1501.170484][T22874] should_fail_ex+0x390/0x4c0 [ 1501.175223][T22874] copyin+0x1b/0x120 [ 1501.179181][T22874] _copy_from_iter+0x447/0x1130 [ 1501.184115][T22874] ? copyout_mc+0x110/0x110 [ 1501.188689][T22874] ? copyout_mc+0x110/0x110 [ 1501.193240][T22874] ? __virt_addr_valid+0x188/0x540 [ 1501.198455][T22874] ? page_copy_sane+0x194/0x390 [ 1501.203371][T22874] copy_page_from_iter+0x77/0x100 [ 1501.208455][T22874] skb_copy_datagram_from_iter+0x2c5/0x6b0 [ 1501.214340][T22874] unix_stream_sendmsg+0x4d5/0xa70 [ 1501.219545][T22874] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1501.224611][T22874] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 1501.231084][T22874] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1501.236692][T22874] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1501.242014][T22874] ? security_socket_sendmsg+0x7c/0xa0 [ 1501.247515][T22874] ? unix_show_fdinfo+0x2c0/0x2c0 [ 1501.252594][T22874] ____sys_sendmsg+0x5ed/0x9a0 [ 1501.257446][T22874] ? __sys_sendmsg_sock+0x30/0x30 [ 1501.262518][T22874] ? __import_iovec+0x306/0x510 [ 1501.267435][T22874] ? import_iovec+0x6f/0xa0 [ 1501.272010][T22874] ___sys_sendmsg+0x2a2/0x360 [ 1501.276756][T22874] ? __sys_sendmsg+0x2a0/0x2a0 [ 1501.281623][T22874] ? __lock_acquire+0x7c40/0x7c40 [ 1501.286755][T22874] __se_sys_sendmsg+0x1c3/0x2b0 [ 1501.291705][T22874] ? __x64_sys_sendmsg+0x80/0x80 [ 1501.296736][T22874] ? lockdep_hardirqs_on+0x94/0x140 [ 1501.301983][T22874] do_syscall_64+0x4c/0xa0 [ 1501.306456][T22874] ? clear_bhb_loop+0x60/0xb0 [ 1501.311174][T22874] ? clear_bhb_loop+0x60/0xb0 [ 1501.315905][T22874] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1501.321842][T22874] RIP: 0033:0x7f0b8a79e0d9 [ 1501.326320][T22874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1501.345973][T22874] RSP: 002b:00007f0b8b6fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1501.354428][T22874] RAX: ffffffffffffffda RBX: 00007f0b8aa25fa0 RCX: 00007f0b8a79e0d9 [ 1501.362435][T22874] RDX: 0000000000000020 RSI: 0000200000000980 RDI: 0000000000000003 [ 1501.370467][T22874] RBP: 00007f0b8b6fc090 R08: 0000000000000000 R09: 0000000000000000 [ 1501.378476][T22874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1501.386490][T22874] R13: 00007f0b8aa26038 R14: 00007f0b8aa25fa0 R15: 00007ffd4b1d5dc8 [ 1501.394564][T22874] [ 1501.600519][T22878] netlink: 'syz.5.5706': attribute type 29 has an invalid length. [ 1502.874780][T20535] Bluetooth: hci1: command 0x040f tx timeout [ 1503.553808][T22898] netlink: 188 bytes leftover after parsing attributes in process `syz.0.5711'. [ 1503.830814][T22905] netlink: 36 bytes leftover after parsing attributes in process `syz.5.5712'. [ 1503.887949][T22909] netlink: 1047 bytes leftover after parsing attributes in process `syz.5.5712'. [ 1504.247801][T22917] netlink: 830 bytes leftover after parsing attributes in process `syz.0.5715'. [ 1504.298119][T22919] net_ratelimit: 7 callbacks suppressed [ 1504.298140][T22919] sock: sock_set_timeout: `syz.5.5714' (pid 22919) tries to set negative timeout [ 1504.732012][T22783] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1504.954187][ T48] Bluetooth: hci1: command 0x0419 tx timeout [ 1504.989717][T22783] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1505.033848][T22783] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1505.084578][T22783] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1505.153615][T17726] device hsr_slave_1 left promiscuous mode [ 1505.176620][T17726] device bridge_slave_0 left promiscuous mode [ 1505.182941][T17726] bridge0: port 1(bridge_slave_0) entered disabled state [ 1505.208706][T22948] netlink: 146340 bytes leftover after parsing attributes in process `syz.4.5719'. [ 1505.226373][T22948] openvswitch: netlink: Key type 386 is out of range max 32 [ 1505.271910][T17726] device veth1_macvtap left promiscuous mode [ 1505.312727][T17726] device veth0_macvtap left promiscuous mode [ 1505.363190][T17726] device veth1_vlan left promiscuous mode [ 1505.374676][T17726] device veth0_vlan left promiscuous mode [ 1506.796468][T20535] Bluetooth: hci2: command 0x0406 tx timeout [ 1507.160699][T17726] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1507.206974][T17726] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1507.446615][T17726] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1507.455713][T17726] bond0 (unregistering): Released all slaves [ 1507.856181][T22783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1507.949768][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1507.989168][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1508.051856][T22783] 8021q: adding VLAN 0 to HW filter on device team0 [ 1508.095875][T22957] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5722'. [ 1508.175782][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1508.217361][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1508.252505][T22253] bridge0: port 1(bridge_slave_0) entered blocking state [ 1508.259746][T22253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1508.320864][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1508.351486][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1508.380024][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1508.395436][T22253] bridge0: port 2(bridge_slave_1) entered blocking state [ 1508.402632][T22253] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1508.450038][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1508.477031][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1508.500903][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1508.519183][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1508.549251][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1508.573331][T22968] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5724'. [ 1508.595978][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1508.605457][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1508.634544][T22968] netlink: 1047 bytes leftover after parsing attributes in process `syz.4.5724'. [ 1508.663481][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1508.677203][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1508.722227][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1508.740783][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1508.752308][T22783] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1509.138907][T22978] netlink: 'syz.0.5726': attribute type 3 has an invalid length. [ 1509.179452][T22978] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.5726'. [ 1509.230836][T22975] netlink: 188 bytes leftover after parsing attributes in process `syz.4.5725'. [ 1509.812048][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1509.823659][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1509.909406][T22783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1510.228988][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1510.250907][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1510.287204][T23005] IPv6: Can't replace route, no match found [ 1510.452359][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1510.485348][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1510.525183][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1510.546738][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1510.579154][T22783] device veth0_vlan entered promiscuous mode [ 1510.637273][T22783] device veth1_vlan entered promiscuous mode [ 1510.734217][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1510.748045][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1510.766954][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1510.807158][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1510.845375][T22783] device veth0_macvtap entered promiscuous mode [ 1510.874290][T23016] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5735'. [ 1510.898290][T23020] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.5735'. [ 1510.916270][T23020] device bridge_slave_1 entered promiscuous mode [ 1510.924416][T23021] netlink: 3752 bytes leftover after parsing attributes in process `syz.5.5737'. [ 1510.948946][T22783] device veth1_macvtap entered promiscuous mode [ 1511.037845][T22783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1511.085017][T22783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1511.129354][T22783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1511.169890][T22783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1511.219319][T22783] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1511.271435][T22783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1511.314165][T22783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1511.335435][T22783] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1511.361637][T22783] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1511.402402][T22783] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1511.443141][T23025] netlink: 'syz.4.5738': attribute type 10 has an invalid length. [ 1511.499561][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1511.522463][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1511.567991][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1511.616069][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1511.652631][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1511.692742][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1511.756762][T22783] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1511.800943][T22783] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1511.873183][T22783] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1511.912729][T22783] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1512.152338][T23046] netlink: 'syz.5.5741': attribute type 1 has an invalid length. [ 1512.238050][T22251] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1512.268107][T22251] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1512.281788][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1512.370300][T17726] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1512.394109][T17726] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1512.427855][T17726] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1513.111124][T23069] netlink: 'syz.0.5746': attribute type 21 has an invalid length. [ 1513.178670][T23069] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5746'. [ 1513.357863][T23069] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5746'. [ 1514.082331][T23088] netlink: 'syz.3.5750': attribute type 39 has an invalid length. [ 1514.670208][T23099] netlink: 'syz.2.5752': attribute type 10 has an invalid length. [ 1514.999651][T23099] bridge0: port 2(bridge_slave_1) entered disabled state [ 1515.007542][T23099] bridge0: port 1(bridge_slave_0) entered disabled state [ 1515.354075][T23099] bridge0: port 2(bridge_slave_1) entered blocking state [ 1515.361592][T23099] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1515.370318][T23099] bridge0: port 1(bridge_slave_0) entered blocking state [ 1515.377623][T23099] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1516.223364][T23099] team0: Port device bridge0 added [ 1517.455303][T22246] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1517.539253][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1517.555155][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1517.563677][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1517.572658][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1517.581389][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1517.588921][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1517.716660][T22246] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1518.430015][T23128] chnl_net:caif_netlink_parms(): no params data found [ 1518.592167][T23152] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5766'. [ 1518.710156][T23128] bridge0: port 1(bridge_slave_0) entered blocking state [ 1518.725134][T23128] bridge0: port 1(bridge_slave_0) entered disabled state [ 1518.740755][T23128] device bridge_slave_0 entered promiscuous mode [ 1518.906770][T22246] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1518.981617][T23160] can: request_module (can-proto-4) failed. [ 1518.991189][T23128] bridge0: port 2(bridge_slave_1) entered blocking state [ 1518.998685][T23128] bridge0: port 2(bridge_slave_1) entered disabled state [ 1519.026462][T23128] device bridge_slave_1 entered promiscuous mode [ 1519.139931][T23128] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1519.167073][T23128] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1519.349622][T22246] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1519.534757][T23179] netlink: 'syz.5.5769': attribute type 10 has an invalid length. [ 1519.674493][T20535] Bluetooth: hci0: command 0x0409 tx timeout [ 1519.694616][T23179] bridge0: port 2(bridge_slave_1) entered disabled state [ 1519.702758][T23179] bridge0: port 1(bridge_slave_0) entered disabled state [ 1519.847558][T23179] bridge0: port 2(bridge_slave_1) entered blocking state [ 1519.855232][T23179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1519.864851][T23179] bridge0: port 1(bridge_slave_0) entered blocking state [ 1519.872152][T23179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1519.970465][T23184] netlink: 'syz.2.5773': attribute type 2 has an invalid length. [ 1519.990100][T23184] netlink: 'syz.2.5773': attribute type 1 has an invalid length. [ 1520.065613][T23184] netlink: 170140 bytes leftover after parsing attributes in process `syz.2.5773'. [ 1520.129963][T23179] team0: Port device bridge0 added [ 1520.244873][T23128] team0: Port device team_slave_0 added [ 1520.282770][T23128] team0: Port device team_slave_1 added [ 1520.392108][T23128] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1520.420959][T23128] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1520.541329][T23128] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1520.585992][T23128] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1520.619473][T23128] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1520.703919][T23128] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1521.267581][T23128] device hsr_slave_0 entered promiscuous mode [ 1521.378705][T23128] device hsr_slave_1 entered promiscuous mode [ 1521.390747][T23128] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1521.437376][T23128] Cannot create hsr debugfs directory [ 1521.447652][T22246] device 0 left promiscuous mode [ 1521.585466][T23209] netlink: 'syz.3.5779': attribute type 2 has an invalid length. [ 1521.606036][T22246] tipc: Left network mode [ 1521.634928][T23209] netlink: 17 bytes leftover after parsing attributes in process `syz.3.5779'. [ 1521.754507][T20535] Bluetooth: hci0: command 0x041b tx timeout [ 1521.982142][T23208] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5777'. [ 1523.836143][T20535] Bluetooth: hci0: command 0x040f tx timeout [ 1524.021194][T23128] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1524.295553][T23128] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1524.607789][T23128] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1524.704157][T23128] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1525.115104][T23271] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5793'. [ 1525.147647][T23278] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 1525.170564][T23278] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 1525.226958][T23278] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 1525.295325][T22246] device hsr_slave_0 left promiscuous mode [ 1525.305562][T22246] device hsr_slave_1 left promiscuous mode [ 1525.318122][T22246] device bridge_slave_1 left promiscuous mode [ 1525.374374][T22246] bridge0: port 2(bridge_slave_1) entered disabled state [ 1525.435123][T22246] device bridge_slave_0 left promiscuous mode [ 1525.444593][T22246] bridge0: port 1(bridge_slave_0) entered disabled state [ 1525.547794][T22246] device veth1_macvtap left promiscuous mode [ 1525.571021][T22246] device veth0_macvtap left promiscuous mode [ 1525.597051][T22246] device veth1_vlan left promiscuous mode [ 1525.914327][T20535] Bluetooth: hci0: command 0x0419 tx timeout [ 1526.347076][T22246] device geneve1 left promiscuous mode [ 1526.391409][T22246] team0 (unregistering): Port device geneve1 removed [ 1527.555378][T22246] device team_slave_1 left promiscuous mode [ 1527.563130][T22246] team0 (unregistering): Port device team_slave_1 removed [ 1527.617072][T22246] device team_slave_0 left promiscuous mode [ 1527.631901][T22246] team0 (unregistering): Port device team_slave_0 removed [ 1528.050158][T22246] device bridge0 left promiscuous mode [ 1528.060995][T22246] team0 (unregistering): Port device bridge0 removed [ 1528.493531][T23326] netlink: 122896 bytes leftover after parsing attributes in process `syz.5.5807'. [ 1528.524891][T23128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1528.607154][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1528.638867][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1528.758769][T23128] 8021q: adding VLAN 0 to HW filter on device team0 [ 1528.860146][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1528.885357][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1528.922746][T17733] bridge0: port 1(bridge_slave_0) entered blocking state [ 1528.930002][T17733] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1528.968899][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1529.019182][T17726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1529.059113][T17726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1529.086725][T17726] bridge0: port 2(bridge_slave_1) entered blocking state [ 1529.093951][T17726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1529.122815][T17726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1529.188866][T23345] FAULT_INJECTION: forcing a failure. [ 1529.188866][T23345] name failslab, interval 1, probability 0, space 0, times 0 [ 1529.264737][T23345] CPU: 1 PID: 23345 Comm: syz.3.5812 Not tainted syzkaller #0 [ 1529.272284][T23345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1529.282382][T23345] Call Trace: [ 1529.285699][T23345] [ 1529.288682][T23345] dump_stack_lvl+0x188/0x24e [ 1529.293404][T23345] ? show_regs_print_info+0x12/0x12 [ 1529.298648][T23345] ? load_image+0x410/0x410 [ 1529.303185][T23345] ? __might_sleep+0xd0/0xd0 [ 1529.307803][T23345] ? __lock_acquire+0x7c40/0x7c40 [ 1529.312864][T23345] should_fail_ex+0x390/0x4c0 [ 1529.317581][T23345] should_failslab+0x5/0x20 [ 1529.322109][T23345] slab_pre_alloc_hook+0x59/0x300 [ 1529.327180][T23345] ? __get_vm_area_node+0x122/0x330 [ 1529.332411][T23345] __kmem_cache_alloc_node+0x4f/0x270 [ 1529.337823][T23345] ? __get_vm_area_node+0x122/0x330 [ 1529.343066][T23345] kmalloc_node_trace+0x22/0xe0 [ 1529.347957][T23345] __get_vm_area_node+0x122/0x330 [ 1529.353016][T23345] __vmalloc_node_range+0x357/0x1380 [ 1529.358329][T23345] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 1529.364039][T23345] ? aa_get_newest_label+0xf9/0x5b0 [ 1529.369277][T23345] ? free_vm_area+0x50/0x50 [ 1529.373806][T23345] ? end_current_label_crit_section+0x170/0x170 [ 1529.380082][T23345] ? __lock_acquire+0x7c40/0x7c40 [ 1529.385136][T23345] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 1529.390714][T23345] __vmalloc+0x76/0x80 [ 1529.394810][T23345] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 1529.400385][T23345] bpf_prog_alloc_no_stats+0x37/0x3a0 [ 1529.405795][T23345] ? bpf_prog_alloc+0x13/0x1b0 [ 1529.410598][T23345] bpf_prog_alloc+0x1c/0x1b0 [ 1529.415226][T23345] bpf_prog_load+0x7d4/0x1530 [ 1529.419954][T23345] ? map_freeze+0x390/0x390 [ 1529.424490][T23345] ? __might_fault+0xa6/0x120 [ 1529.429196][T23345] ? trace_call_bpf+0xbf/0x6b0 [ 1529.434067][T23345] ? __might_fault+0xa6/0x120 [ 1529.438773][T23345] ? __might_fault+0xc2/0x120 [ 1529.443470][T23345] ? __might_fault+0xa6/0x120 [ 1529.448171][T23345] ? bpf_lsm_bpf+0x5/0x10 [ 1529.452521][T23345] ? security_bpf+0x7a/0xa0 [ 1529.457061][T23345] __sys_bpf+0x5b8/0x780 [ 1529.461333][T23345] ? bpf_link_show_fdinfo+0x380/0x380 [ 1529.466742][T23345] ? lock_chain_count+0x20/0x20 [ 1529.471622][T23345] __x64_sys_bpf+0x78/0x90 [ 1529.476077][T23345] do_syscall_64+0x4c/0xa0 [ 1529.480533][T23345] ? clear_bhb_loop+0x60/0xb0 [ 1529.485237][T23345] ? clear_bhb_loop+0x60/0xb0 [ 1529.489942][T23345] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1529.495868][T23345] RIP: 0033:0x7f0b8a79e0d9 [ 1529.500337][T23345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1529.519992][T23345] RSP: 002b:00007f0b8b6fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1529.528895][T23345] RAX: ffffffffffffffda RBX: 00007f0b8aa25fa0 RCX: 00007f0b8a79e0d9 [ 1529.536890][T23345] RDX: 0000000000000080 RSI: 0000200000000140 RDI: 0000000000000005 [ 1529.544882][T23345] RBP: 00007f0b8b6fc090 R08: 0000000000000000 R09: 0000000000000000 [ 1529.552870][T23345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1529.560861][T23345] R13: 00007f0b8aa26038 R14: 00007f0b8aa25fa0 R15: 00007ffd4b1d5dc8 [ 1529.568874][T23345] [ 1529.726836][T23345] syz.3.5812: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 1529.781610][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1529.795331][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1529.811596][T23345] CPU: 0 PID: 23345 Comm: syz.3.5812 Not tainted syzkaller #0 [ 1529.819126][T23345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1529.829224][T23345] Call Trace: [ 1529.832538][T23345] [ 1529.835508][T23345] dump_stack_lvl+0x188/0x24e [ 1529.840376][T23345] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 1529.846954][T23345] ? show_regs_print_info+0x12/0x12 [ 1529.852209][T23345] ? load_image+0x410/0x410 [ 1529.856767][T23345] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 1529.863227][T23345] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 1529.869779][T23345] warn_alloc+0x242/0x330 [ 1529.874158][T23345] ? __get_vm_area_node+0x122/0x330 [ 1529.879415][T23345] ? zone_watermark_ok_safe+0x270/0x270 [ 1529.885062][T23345] ? rcu_is_watching+0x11/0xa0 [ 1529.889924][T23345] ? __get_vm_area_node+0x318/0x330 [ 1529.895180][T23345] __vmalloc_node_range+0x37c/0x1380 [ 1529.900544][T23345] ? aa_get_newest_label+0xf9/0x5b0 [ 1529.905794][T23345] ? free_vm_area+0x50/0x50 [ 1529.910344][T23345] ? end_current_label_crit_section+0x170/0x170 [ 1529.911678][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1529.916666][T23345] ? __lock_acquire+0x7c40/0x7c40 [ 1529.916703][T23345] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 1529.916747][T23345] __vmalloc+0x76/0x80 [ 1529.916772][T23345] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 1529.916803][T23345] bpf_prog_alloc_no_stats+0x37/0x3a0 [ 1529.916833][T23345] ? bpf_prog_alloc+0x13/0x1b0 [ 1529.916865][T23345] bpf_prog_alloc+0x1c/0x1b0 [ 1529.916898][T23345] bpf_prog_load+0x7d4/0x1530 [ 1529.916937][T23345] ? map_freeze+0x390/0x390 [ 1529.916965][T23345] ? __might_fault+0xa6/0x120 [ 1529.916986][T23345] ? trace_call_bpf+0xbf/0x6b0 [ 1529.917022][T23345] ? __might_fault+0xa6/0x120 [ 1529.917042][T23345] ? __might_fault+0xc2/0x120 [ 1529.917062][T23345] ? __might_fault+0xa6/0x120 [ 1529.917084][T23345] ? bpf_lsm_bpf+0x5/0x10 [ 1529.917105][T23345] ? security_bpf+0x7a/0xa0 [ 1529.917137][T23345] __sys_bpf+0x5b8/0x780 [ 1529.917166][T23345] ? bpf_link_show_fdinfo+0x380/0x380 [ 1529.917209][T23345] ? lock_chain_count+0x20/0x20 [ 1529.917246][T23345] __x64_sys_bpf+0x78/0x90 [ 1529.917274][T23345] do_syscall_64+0x4c/0xa0 [ 1529.917301][T23345] ? clear_bhb_loop+0x60/0xb0 [ 1529.917328][T23345] ? clear_bhb_loop+0x60/0xb0 [ 1529.917357][T23345] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1529.958127][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1529.960217][T23345] RIP: 0033:0x7f0b8a79e0d9 [ 1529.960244][T23345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1529.960263][T23345] RSP: 002b:00007f0b8b6fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1530.080080][T23345] RAX: ffffffffffffffda RBX: 00007f0b8aa25fa0 RCX: 00007f0b8a79e0d9 [ 1530.088075][T23345] RDX: 0000000000000080 RSI: 0000200000000140 RDI: 0000000000000005 [ 1530.096068][T23345] RBP: 00007f0b8b6fc090 R08: 0000000000000000 R09: 0000000000000000 [ 1530.104063][T23345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1530.112059][T23345] R13: 00007f0b8aa26038 R14: 00007f0b8aa25fa0 R15: 00007ffd4b1d5dc8 [ 1530.120063][T23345] [ 1530.178372][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1530.227293][T17733] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1530.292159][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1530.311187][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1530.338043][T23128] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1530.398300][T23128] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1530.411132][T20535] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 1530.421977][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1530.441288][T23345] Mem-Info: [ 1530.445938][T23345] active_anon:8053 inactive_anon:0 isolated_anon:0 [ 1530.445938][T23345] active_file:21111 inactive_file:40385 isolated_file:0 [ 1530.445938][T23345] unevictable:768 dirty:466 writeback:0 [ 1530.445938][T23345] slab_reclaimable:21790 slab_unreclaimable:94951 [ 1530.445938][T23345] mapped:29756 shmem:1373 pagetables:691 [ 1530.445938][T23345] sec_pagetables:0 bounce:0 [ 1530.445938][T23345] kernel_misc_reclaimable:0 [ 1530.445938][T23345] free:1314633 free_pcp:8812 free_cma:0 [ 1530.502145][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1530.521666][T23345] Node 0 active_anon:32312kB inactive_anon:0kB active_file:84444kB inactive_file:161336kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:119024kB dirty:1860kB writeback:0kB shmem:3956kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11204kB pagetables:2764kB sec_pagetables:0kB all_unreclaimable? no [ 1530.560593][T23345] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1530.697757][T23363] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:0603:0000:0023 with DS=0x3f [ 1530.710586][T23345] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1530.800623][T23345] lowmem_reserve[]: 0 2527 2528 2528 2528 [ 1530.820884][T23345] Node 0 DMA32 free:1337224kB boost:0kB min:34692kB low:43364kB high:52036kB reserved_highatomic:0KB active_anon:32304kB inactive_anon:0kB active_file:84444kB inactive_file:161344kB unevictable:1536kB writepending:1860kB present:3129332kB managed:2592912kB mlocked:0kB bounce:0kB free_pcp:25656kB local_pcp:19704kB free_cma:0kB [ 1530.980308][T23345] lowmem_reserve[]: 0 0 1 1 1 [ 1531.005835][T23345] Node 0 Normal free:12kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:1424kB mlocked:0kB bounce:0kB free_pcp:24kB local_pcp:12kB free_cma:0kB [ 1531.325273][T23345] lowmem_reserve[]: 0 0 0 0 0 [ 1531.330100][T23345] Node 1 Normal free:3905688kB boost:0kB min:55192kB low:68988kB high:82784kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:8864kB local_pcp:0kB free_cma:0kB [ 1531.497576][T23376] netlink: 'syz.5.5820': attribute type 2 has an invalid length. [ 1531.534281][T23345] lowmem_reserve[]: 0 0 0 0 0 [ 1531.539112][T23345] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1531.564443][T23376] netlink: 'syz.5.5820': attribute type 1 has an invalid length. [ 1531.609373][T23345] Node 0 DMA32: 1212*4kB (UM) 1381*8kB (ME) 1204*16kB (UME) 1588*32kB (UME) 1602*64kB (UM) 787*128kB (UME) 239*256kB (UM) 160*512kB (UME) 81*1024kB (UME) 17*2048kB (UM) 192*4096kB (UM) = 1336536kB [ 1531.696770][T23345] Node 0 Normal: 1*4kB (U) 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 1531.762969][T23345] Node 1 Normal: 220*4kB (UE) 67*8kB (UE) 29*16kB (UME) 130*32kB (UME) 48*64kB (UME) 14*128kB (UM) 12*256kB (UME) 3*512kB (UME) 1*1024kB (U) 1*2048kB (E) 949*4096kB (M) = 3905688kB [ 1531.870952][T23345] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1531.904177][T23345] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1531.924314][T23345] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1531.968938][T23345] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1532.024169][T23345] 62872 total pagecache pages [ 1532.029029][T23345] 0 pages in swap cache [ 1532.046357][T23345] Free swap = 124996kB [ 1532.064453][T23345] Total swap = 124996kB [ 1532.088859][T23345] 2097051 pages RAM [ 1532.114113][T23345] 0 pages HighMem/MovableOnly [ 1532.134676][T23345] 415222 pages reserved [ 1532.149153][T23345] 0 pages cma reserved [ 1532.302714][T23397] netlink: 'syz.5.5821': attribute type 29 has an invalid length. [ 1532.399394][T23397] netlink: 'syz.5.5821': attribute type 29 has an invalid length. [ 1532.448536][T23391] netlink: 'syz.5.5821': attribute type 29 has an invalid length. [ 1532.521000][T23405] netlink: 'syz.5.5821': attribute type 29 has an invalid length. [ 1532.548201][T22246] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1532.560587][T22246] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1532.609908][T23128] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1532.667886][T23409] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5826'. [ 1532.708154][T17726] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1532.727357][T17726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1532.798370][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1532.819315][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1532.849857][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1532.879777][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1532.910568][T23128] device veth0_vlan entered promiscuous mode [ 1532.949110][T23128] device veth1_vlan entered promiscuous mode [ 1533.079524][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1533.089676][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1533.119917][T23128] device veth0_macvtap entered promiscuous mode [ 1533.160248][T23128] device veth1_macvtap entered promiscuous mode [ 1533.258397][T23128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1533.269070][T23128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1533.322532][T23128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1533.333471][T23128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1533.407118][T23128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1533.431568][T23128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1533.457958][T23128] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1533.499102][T23128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1533.591454][T23128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1533.644682][T23128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1533.675722][T23128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1533.711434][T23128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1533.749886][T23128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1533.819148][T23128] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1533.852185][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1533.871294][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1533.891462][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1533.910688][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1533.926723][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1533.942244][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1533.966946][T23128] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1533.983144][T23128] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1533.995380][T23128] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1534.014620][T23128] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1534.394443][T22253] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1534.410298][T22253] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1534.441250][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1534.502239][T17726] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1534.516235][T17726] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1534.528883][T22253] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1534.749568][T23443] netlink: 164 bytes leftover after parsing attributes in process `syz.0.5755'. [ 1535.287647][T23454] -1: renamed from syzkaller0 [ 1536.571393][T23481] delete_channel: no stack [ 1536.666964][T20535] Bluetooth: hci0: ISO packet for unknown connection handle 2366 [ 1536.923649][T23496] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5851'. [ 1537.049910][T23487] device sit0 entered promiscuous mode [ 1537.150497][T23496] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5851'. [ 1537.292496][T23498] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5851'. [ 1537.344125][T23499] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.5854'. [ 1537.394382][T23503] netlink: 'syz.2.5855': attribute type 10 has an invalid length. [ 1537.411585][T23503] device netdevsim0 entered promiscuous mode [ 1537.428399][T23499] sysfs: cannot create duplicate filename '/class/ieee80211/.!' [ 1537.466354][T23499] CPU: 1 PID: 23499 Comm: syz.4.5854 Not tainted syzkaller #0 [ 1537.473995][T23499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1537.484096][T23499] Call Trace: [ 1537.487413][T23499] [ 1537.490383][T23499] dump_stack_lvl+0x188/0x24e [ 1537.495129][T23499] ? show_regs_print_info+0x12/0x12 [ 1537.500405][T23499] ? load_image+0x410/0x410 [ 1537.504970][T23499] sysfs_warn_dup+0x8a/0xa0 [ 1537.509529][T23499] sysfs_do_create_link_sd+0xc0/0x110 [ 1537.514959][T23499] device_add+0x83b/0x1050 [ 1537.519431][T23499] wiphy_register+0x1d8b/0x2aa0 [ 1537.524352][T23499] ? cfg80211_event_work+0x40/0x40 [ 1537.529522][T23499] ? minstrel_ht_alloc+0x894/0xa20 [ 1537.534696][T23499] ? ieee80211_init_rate_ctrl_alg+0x55e/0x5e0 [ 1537.540820][T23499] ieee80211_register_hw+0x2d48/0x39f0 [ 1537.546360][T23499] ? ieee80211_register_hw+0xee1/0x39f0 [ 1537.551962][T23499] ? ieee80211_register_hw+0xee1/0x39f0 [ 1537.557613][T23499] ? ieee80211_tasklet_handler+0x20/0x20 [ 1537.563304][T23499] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1537.569252][T23499] ? __debug_object_init+0xed/0x440 [ 1537.574524][T23499] ? memset+0x1e/0x40 [ 1537.578560][T23499] ? __hrtimer_init+0x189/0x270 [ 1537.583465][T23499] mac80211_hwsim_new_radio+0x2927/0x4cd0 [ 1537.589250][T23499] ? memcpy+0x3c/0x60 [ 1537.593296][T23499] hwsim_new_radio_nl+0xab7/0xc90 [ 1537.598399][T23499] genl_family_rcv_msg_doit+0x22f/0x350 [ 1537.604002][T23499] ? end_current_label_crit_section+0x170/0x170 [ 1537.610306][T23499] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 1537.616261][T23499] ? bpf_lsm_capable+0x5/0x10 [ 1537.620989][T23499] ? security_capable+0x85/0xb0 [ 1537.625912][T23499] genl_rcv_msg+0x601/0x790 [ 1537.630483][T23499] ? genl_bind+0x360/0x360 [ 1537.634979][T23499] ? hwsim_tx_info_frame_received_nl+0xe30/0xe30 [ 1537.641386][T23499] netlink_rcv_skb+0x1ef/0x440 [ 1537.646211][T23499] ? genl_bind+0x360/0x360 [ 1537.650687][T23499] ? netlink_ack+0x1160/0x1160 [ 1537.655518][T23499] ? down_read+0x1a8/0x2d0 [ 1537.659998][T23499] genl_rcv+0x24/0x40 [ 1537.664069][T23499] netlink_unicast+0x7ad/0x920 [ 1537.668937][T23499] netlink_sendmsg+0x8ad/0xbd0 [ 1537.673771][T23499] ? netlink_getsockopt+0x550/0x550 [ 1537.679039][T23499] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1537.684681][T23499] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1537.690021][T23499] ? security_socket_sendmsg+0x7c/0xa0 [ 1537.695535][T23499] ? netlink_getsockopt+0x550/0x550 [ 1537.700832][T23499] ____sys_sendmsg+0x5ed/0x9a0 [ 1537.705667][T23499] ? __sys_sendmsg_sock+0x30/0x30 [ 1537.710750][T23499] ? __import_iovec+0x306/0x510 [ 1537.715667][T23499] ? import_iovec+0x6f/0xa0 [ 1537.720235][T23499] ___sys_sendmsg+0x2a2/0x360 [ 1537.724982][T23499] ? __sys_sendmsg+0x2a0/0x2a0 [ 1537.729864][T23499] __se_sys_sendmsg+0x1c3/0x2b0 [ 1537.734787][T23499] ? ct_nmi_exit+0x145/0x1c0 [ 1537.739467][T23499] ? __x64_sys_sendmsg+0x80/0x80 [ 1537.744483][T23499] ? lockdep_hardirqs_on+0x94/0x140 [ 1537.749736][T23499] do_syscall_64+0x4c/0xa0 [ 1537.754207][T23499] ? clear_bhb_loop+0x60/0xb0 [ 1537.758938][T23499] ? clear_bhb_loop+0x60/0xb0 [ 1537.763672][T23499] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1537.769620][T23499] RIP: 0033:0x7fd4a619e0d9 [ 1537.774078][T23499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1537.793741][T23499] RSP: 002b:00007fd4a6fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1537.802218][T23499] RAX: ffffffffffffffda RBX: 00007fd4a6425fa0 RCX: 00007fd4a619e0d9 [ 1537.810263][T23499] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000c [ 1537.818287][T23499] RBP: 00007fd4a6235024 R08: 0000000000000000 R09: 0000000000000000 [ 1537.826325][T23499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1537.834395][T23499] R13: 00007fd4a6426038 R14: 00007fd4a6425fa0 R15: 00007ffde52e93d8 [ 1537.842443][T23499] [ 1538.161925][T23517] netlink: 763 bytes leftover after parsing attributes in process `syz.2.5859'. [ 1538.357311][T23525] netlink: 164 bytes leftover after parsing attributes in process `syz.5.5861'. [ 1538.378892][T23525] tc_dump_action: action bad kind [ 1539.358787][T23544] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5867'. [ 1539.368562][T23544] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5867'. [ 1539.405964][T23544] netlink: 33 bytes leftover after parsing attributes in process `syz.5.5867'. [ 1539.425097][T23544] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5867'. [ 1539.465542][T23544] netlink: 33 bytes leftover after parsing attributes in process `syz.5.5867'. [ 1539.504267][T23544] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5867'. [ 1539.513219][T23544] netlink: 33 bytes leftover after parsing attributes in process `syz.5.5867'. [ 1540.701992][T23589] netlink: 16098 bytes leftover after parsing attributes in process `syz.5.5880'. [ 1541.043703][T23593] netlink: 'syz.0.5881': attribute type 29 has an invalid length. [ 1541.085925][T23593] netlink: 'syz.0.5881': attribute type 29 has an invalid length. [ 1541.839698][T23616] netlink: 'syz.3.5887': attribute type 3 has an invalid length. [ 1542.142139][T23633] netlink: 'syz.2.5892': attribute type 10 has an invalid length. [ 1542.313443][T23636] netlink: 'syz.3.5894': attribute type 2 has an invalid length. [ 1543.617188][T23636] device 1 entered promiscuous mode [ 1544.267167][T23683] __nla_validate_parse: 4 callbacks suppressed [ 1544.267214][T23683] netlink: 63503 bytes leftover after parsing attributes in process `syz.4.5897'. [ 1544.816438][T23696] netlink: 'syz.3.5904': attribute type 12 has an invalid length. [ 1545.423401][T23712] netlink: 'syz.0.5908': attribute type 10 has an invalid length. [ 1545.520882][T23712] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5908'. [ 1545.594483][T23712] bridge0: port 3(bond0) entered blocking state [ 1545.600904][T23712] bridge0: port 3(bond0) entered disabled state [ 1545.687597][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.694170][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1545.861707][T23712] device bond0 entered promiscuous mode [ 1545.965148][T23712] device bond_slave_0 entered promiscuous mode [ 1546.089734][T23712] device bond_slave_1 entered promiscuous mode [ 1546.172671][T23712] bridge0: port 3(bond0) entered blocking state [ 1546.179232][T23712] bridge0: port 3(bond0) entered forwarding state [ 1548.930152][T23736] netlink: 'syz.0.5914': attribute type 39 has an invalid length. [ 1548.941469][T23739] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.5917'. [ 1549.116554][T23736] device hsr_slave_1 left promiscuous mode [ 1549.238170][T23735] netlink: 'syz.0.5914': attribute type 39 has an invalid length. [ 1549.473703][T23760] netlink: 'syz.3.5921': attribute type 10 has an invalid length. [ 1550.723619][T23795] netlink: 'syz.2.5931': attribute type 28 has an invalid length. [ 1550.733957][T23795] netlink: 'syz.2.5931': attribute type 4 has an invalid length. [ 1550.750096][T23795] netlink: 136 bytes leftover after parsing attributes in process `syz.2.5931'. [ 1550.761461][T23799] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.5933'. [ 1551.850005][T23815] device syzkaller0 entered promiscuous mode [ 1555.470717][T23855] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5948'. [ 1555.490785][T23862] netlink: 'syz.5.5949': attribute type 21 has an invalid length. [ 1555.513405][T23862] netlink: 128 bytes leftover after parsing attributes in process `syz.5.5949'. [ 1555.528675][T23862] netlink: 'syz.5.5949': attribute type 4 has an invalid length. [ 1555.592519][T23862] netlink: 'syz.5.5949': attribute type 5 has an invalid length. [ 1555.614402][T23862] netlink: 3 bytes leftover after parsing attributes in process `syz.5.5949'. [ 1555.721207][T23867] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.5950'. [ 1556.086415][T23874] netlink: 'syz.5.5954': attribute type 3 has an invalid length. [ 1556.104195][T23874] netlink: 'syz.5.5954': attribute type 1 has an invalid length. [ 1556.111998][T23874] netlink: 193500 bytes leftover after parsing attributes in process `syz.5.5954'. [ 1556.250389][T23879] netlink: 168864 bytes leftover after parsing attributes in process `syz.5.5954'. [ 1556.287279][T23879] netlink: zone id is out of range [ 1556.292519][T23879] netlink: zone id is out of range [ 1556.319332][T23879] netlink: zone id is out of range [ 1556.331218][T23879] netlink: zone id is out of range [ 1556.351450][T23879] netlink: zone id is out of range [ 1556.372411][T23879] netlink: zone id is out of range [ 1556.384848][T23879] netlink: zone id is out of range [ 1556.405699][T23879] netlink: zone id is out of range [ 1556.411003][T23879] netlink: zone id is out of range [ 1556.440279][T23879] netlink: zone id is out of range [ 1556.736476][T23894] netlink: 'syz.4.5959': attribute type 12 has an invalid length. [ 1556.789430][T23894] netlink: 14585 bytes leftover after parsing attributes in process `syz.4.5959'. [ 1557.282512][T23926] device sit0 entered promiscuous mode [ 1557.350502][T23923] device sit0 left promiscuous mode [ 1558.051683][T23946] netlink: 'syz.5.5973': attribute type 11 has an invalid length. [ 1558.246596][T23951] netlink: 'syz.4.5974': attribute type 21 has an invalid length. [ 1559.247358][T23974] netlink: 'syz.3.5980': attribute type 1 has an invalid length. [ 1559.300153][T23974] netlink: 'syz.3.5980': attribute type 4 has an invalid length. [ 1559.330978][T23974] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.5980'. [ 1559.623192][T23986] netlink: 'syz.3.5986': attribute type 27 has an invalid length. [ 1560.716922][T24024] netlink: 'syz.5.5994': attribute type 16 has an invalid length. [ 1560.778744][T24028] netlink: 'syz.5.5994': attribute type 21 has an invalid length. [ 1560.800348][T24024] netlink: 132 bytes leftover after parsing attributes in process `syz.5.5994'. [ 1561.532803][T24045] validate_nla: 1 callbacks suppressed [ 1561.532820][T24045] netlink: 'syz.0.5998': attribute type 10 has an invalid length. [ 1561.578101][T24045] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5998'. [ 1561.747533][T24045] netlink: 'syz.0.5998': attribute type 10 has an invalid length. [ 1561.775446][T24045] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5998'. [ 1561.801854][T24049] netlink: 'syz.0.5998': attribute type 21 has an invalid length. [ 1561.839768][T24038] netlink: 'syz.0.5998': attribute type 10 has an invalid length. [ 1561.885381][T24038] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5998'. [ 1562.154874][T24054] netlink: 'syz.5.6001': attribute type 4 has an invalid length. [ 1562.163663][T24054] netlink: 'syz.5.6001': attribute type 1 has an invalid length. [ 1562.227070][T24054] netlink: 181400 bytes leftover after parsing attributes in process `syz.5.6001'. [ 1562.437820][T24064] netlink: 146340 bytes leftover after parsing attributes in process `syz.3.6005'. [ 1562.504260][T24064] net_ratelimit: 24 callbacks suppressed [ 1562.504277][T24064] openvswitch: netlink: Key type 386 is out of range max 32 [ 1563.655144][T24098] netlink: 'syz.3.6013': attribute type 1 has an invalid length. [ 1563.677894][T24098] netlink: 164 bytes leftover after parsing attributes in process `syz.3.6013'. [ 1569.512669][T24070] netlink: 'syz.5.6007': attribute type 13 has an invalid length. [ 1569.521060][T24070] netlink: 24643 bytes leftover after parsing attributes in process `syz.5.6007'. [ 1569.548889][T24114] netlink: 'syz.4.6016': attribute type 21 has an invalid length. [ 1569.562955][T24114] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6016'. [ 1569.875367][T24123] netlink: 'syz.2.6017': attribute type 39 has an invalid length. [ 1570.057708][T24133] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6020'. [ 1570.132392][T24123] device hsr_slave_1 left promiscuous mode [ 1570.963752][T24171] sock: sock_set_timeout: `syz.5.6031' (pid 24171) tries to set negative timeout [ 1571.019430][T24174] netlink: 'syz.4.6029': attribute type 19 has an invalid length. [ 1571.053673][T24174] netlink: 156 bytes leftover after parsing attributes in process `syz.4.6029'. [ 1571.111208][T24171] device ip6gretap0 left promiscuous mode [ 1571.127259][T24171] : port 1(ip6gretap0) entered disabled state [ 1572.265363][T24205] netlink: 'syz.4.6044': attribute type 3 has an invalid length. [ 1572.294154][T24205] netlink: 148 bytes leftover after parsing attributes in process `syz.4.6044'. [ 1572.311084][T24209] netlink: 65051 bytes leftover after parsing attributes in process `syz.2.6046'. [ 1572.432579][T24208] netlink: 'syz.0.6045': attribute type 10 has an invalid length. [ 1572.476932][T24208] device geneve0 entered promiscuous mode [ 1572.532227][T24215] netlink: 'syz.5.6047': attribute type 2 has an invalid length. [ 1572.573878][T24215] netlink: 199848 bytes leftover after parsing attributes in process `syz.5.6047'. [ 1572.627658][T24208] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 1572.966563][T24222] device syzkaller0 entered promiscuous mode [ 1574.567572][T20535] Bluetooth: hci4: unexpected subevent 0x0c length: 150 > 5 [ 1575.132960][T24282] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.6066'. [ 1575.246322][T24282] sysfs: cannot create duplicate filename '/class/ieee80211/.!' [ 1575.271747][T24282] CPU: 0 PID: 24282 Comm: syz.4.6066 Not tainted syzkaller #0 [ 1575.279312][T24282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1575.289421][T24282] Call Trace: [ 1575.292752][T24282] [ 1575.295737][T24282] dump_stack_lvl+0x188/0x24e [ 1575.300487][T24282] ? show_regs_print_info+0x12/0x12 [ 1575.305758][T24282] ? load_image+0x410/0x410 [ 1575.310333][T24282] sysfs_warn_dup+0x8a/0xa0 [ 1575.314917][T24282] sysfs_do_create_link_sd+0xc0/0x110 [ 1575.320357][T24282] device_add+0x83b/0x1050 [ 1575.324851][T24282] wiphy_register+0x1d8b/0x2aa0 [ 1575.329787][T24282] ? cfg80211_event_work+0x40/0x40 [ 1575.334969][T24282] ? minstrel_ht_alloc+0x894/0xa20 [ 1575.340151][T24282] ? ieee80211_init_rate_ctrl_alg+0x55e/0x5e0 [ 1575.346288][T24282] ieee80211_register_hw+0x2d48/0x39f0 [ 1575.351813][T24282] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1575.358042][T24282] ? ieee80211_register_hw+0xee1/0x39f0 [ 1575.363657][T24282] ? ieee80211_register_hw+0xee1/0x39f0 [ 1575.369277][T24282] ? ieee80211_tasklet_handler+0x20/0x20 [ 1575.374973][T24282] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1575.380932][T24282] ? __debug_object_init+0xed/0x440 [ 1575.386220][T24282] ? memset+0x1e/0x40 [ 1575.390262][T24282] ? __hrtimer_init+0x189/0x270 [ 1575.395169][T24282] mac80211_hwsim_new_radio+0x2927/0x4cd0 [ 1575.400985][T24282] ? memcpy+0x3c/0x60 [ 1575.405038][T24282] hwsim_new_radio_nl+0xab7/0xc90 [ 1575.410151][T24282] genl_family_rcv_msg_doit+0x22f/0x350 [ 1575.415756][T24282] ? end_current_label_crit_section+0x170/0x170 [ 1575.422061][T24282] ? lockdep_hardirqs_on+0x94/0x140 [ 1575.427338][T24282] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 1575.433305][T24282] ? bpf_lsm_capable+0x5/0x10 [ 1575.438040][T24282] ? security_capable+0x85/0xb0 [ 1575.442968][T24282] genl_rcv_msg+0x601/0x790 [ 1575.447542][T24282] ? genl_bind+0x360/0x360 [ 1575.452013][T24282] ? hwsim_tx_info_frame_received_nl+0xe30/0xe30 [ 1575.458424][T24282] netlink_rcv_skb+0x1ef/0x440 [ 1575.463267][T24282] ? genl_bind+0x360/0x360 [ 1575.467750][T24282] ? netlink_ack+0x1160/0x1160 [ 1575.472598][T24282] ? down_read+0x1a8/0x2d0 [ 1575.477078][T24282] genl_rcv+0x24/0x40 [ 1575.481115][T24282] netlink_unicast+0x7ad/0x920 [ 1575.485966][T24282] netlink_sendmsg+0x8ad/0xbd0 [ 1575.490806][T24282] ? netlink_getsockopt+0x550/0x550 [ 1575.496072][T24282] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1575.501699][T24282] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1575.507045][T24282] ? security_socket_sendmsg+0x7c/0xa0 [ 1575.512571][T24282] ? netlink_getsockopt+0x550/0x550 [ 1575.517843][T24282] ____sys_sendmsg+0x5ed/0x9a0 [ 1575.522688][T24282] ? __sys_sendmsg_sock+0x30/0x30 [ 1575.527776][T24282] ? __import_iovec+0x306/0x510 [ 1575.532707][T24282] ? import_iovec+0x6f/0xa0 [ 1575.537278][T24282] ___sys_sendmsg+0x2a2/0x360 [ 1575.542035][T24282] ? __sys_sendmsg+0x2a0/0x2a0 [ 1575.546888][T24282] ? ktime_get+0x7b/0x270 [ 1575.551310][T24282] __se_sys_sendmsg+0x1c3/0x2b0 [ 1575.556229][T24282] ? __x64_sys_sendmsg+0x80/0x80 [ 1575.561254][T24282] ? lockdep_hardirqs_on+0x94/0x140 [ 1575.566524][T24282] do_syscall_64+0x4c/0xa0 [ 1575.571014][T24282] ? clear_bhb_loop+0x60/0xb0 [ 1575.575761][T24282] ? clear_bhb_loop+0x60/0xb0 [ 1575.580505][T24282] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1575.586458][T24282] RIP: 0033:0x7fd4a619e0d9 [ 1575.590936][T24282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1575.610598][T24282] RSP: 002b:00007fd4a6fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1575.619084][T24282] RAX: ffffffffffffffda RBX: 00007fd4a6425fa0 RCX: 00007fd4a619e0d9 [ 1575.627138][T24282] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 1575.635249][T24282] RBP: 00007fd4a6235024 R08: 0000000000000000 R09: 0000000000000000 [ 1575.643274][T24282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1575.651306][T24282] R13: 00007fd4a6426038 R14: 00007fd4a6425fa0 R15: 00007ffde52e93d8 [ 1575.659346][T24282] [ 1575.829003][T24288] netlink: 'syz.2.6067': attribute type 11 has an invalid length. [ 1575.852372][T24285] netlink: 'syz.3.6064': attribute type 2 has an invalid length. [ 1575.905263][T24288] netlink: 168 bytes leftover after parsing attributes in process `syz.2.6067'. [ 1575.929257][T24285] netlink: 'syz.3.6064': attribute type 1 has an invalid length. [ 1575.978381][T24285] netlink: 'syz.3.6064': attribute type 4 has an invalid length. [ 1576.015061][T24285] netlink: 'syz.3.6064': attribute type 6 has an invalid length. [ 1576.074335][T24285] netlink: 'syz.3.6064': attribute type 7 has an invalid length. [ 1576.120374][T24285] netlink: 'syz.3.6064': attribute type 5 has an invalid length. [ 1576.175407][T24285] netlink: 206468 bytes leftover after parsing attributes in process `syz.3.6064'. [ 1577.849663][ T48] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1577.859822][ T48] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1577.868599][ T48] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1577.877153][ T48] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1577.889268][ T4333] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 1577.896792][ T4333] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1578.544500][T24333] netlink: 'syz.5.6082': attribute type 2 has an invalid length. [ 1578.576015][T24333] netlink: 17267 bytes leftover after parsing attributes in process `syz.5.6082'. [ 1579.057730][T24317] chnl_net:caif_netlink_parms(): no params data found [ 1579.145998][T24349] netlink: 'syz.0.6083': attribute type 10 has an invalid length. [ 1579.207569][T24349] netlink: 55 bytes leftover after parsing attributes in process `syz.0.6083'. [ 1579.392222][T24359] netlink: 'syz.5.6088': attribute type 29 has an invalid length. [ 1579.810865][T24358] can: request_module (can-proto-0) failed. [ 1579.924630][ T4333] Bluetooth: hci5: command 0x0409 tx timeout [ 1580.319058][T24317] bridge0: port 1(bridge_slave_0) entered blocking state [ 1580.340530][T24317] bridge0: port 1(bridge_slave_0) entered disabled state [ 1580.405400][T24317] device bridge_slave_0 entered promiscuous mode [ 1581.996371][ T4333] Bluetooth: hci5: command 0x041b tx timeout [ 1582.896558][T24317] bridge0: port 2(bridge_slave_1) entered blocking state [ 1582.903730][T24317] bridge0: port 2(bridge_slave_1) entered disabled state [ 1582.913436][T24317] device bridge_slave_1 entered promiscuous mode [ 1582.945017][T24317] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1583.002335][T24317] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1583.141880][T24317] team0: Port device team_slave_0 added [ 1583.185177][T24317] team0: Port device team_slave_1 added [ 1583.285399][T24426] validate_nla: 3 callbacks suppressed [ 1583.285435][T24426] netlink: 'syz.0.6102': attribute type 29 has an invalid length. [ 1583.286201][T24317] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1583.343298][T24317] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1583.419798][T24317] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1583.452295][T24426] netlink: 'syz.0.6102': attribute type 29 has an invalid length. [ 1583.518663][T24317] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1583.525908][T24317] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1583.610708][T24317] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1583.680071][T24435] can: request_module (can-proto-0) failed. [ 1583.731879][T24428] netlink: 'syz.0.6102': attribute type 29 has an invalid length. [ 1583.825208][T24317] device hsr_slave_0 entered promiscuous mode [ 1583.865505][T24317] device hsr_slave_1 entered promiscuous mode [ 1583.879899][T24317] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1583.917986][T24317] Cannot create hsr debugfs directory [ 1584.074250][ T4333] Bluetooth: hci5: command 0x040f tx timeout [ 1584.890024][T24462] netlink: 'syz.3.6111': attribute type 2 has an invalid length. [ 1584.920239][T24462] netlink: 199848 bytes leftover after parsing attributes in process `syz.3.6111'. [ 1586.154594][ T4333] Bluetooth: hci5: command 0x0419 tx timeout [ 1586.935454][T24459] nr0: port 1(hsr0) entered blocking state [ 1586.941406][T24459] nr0: port 1(hsr0) entered disabled state [ 1586.965635][T24459] device hsr0 entered promiscuous mode [ 1587.357024][T24472] netlink: 'syz.2.6115': attribute type 4 has an invalid length. [ 1587.379491][T24472] netlink: 168 bytes leftover after parsing attributes in process `syz.2.6115'. [ 1588.156942][T24494] netlink: 'syz.2.6119': attribute type 29 has an invalid length. [ 1588.232166][T24494] netlink: 'syz.2.6119': attribute type 29 has an invalid length. [ 1588.288570][T24498] netlink: 'syz.2.6119': attribute type 29 has an invalid length. [ 1588.462139][T24317] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1588.490857][T24505] netlink: 'syz.0.6123': attribute type 2 has an invalid length. [ 1588.544076][T24505] netlink: 'syz.0.6123': attribute type 1 has an invalid length. [ 1588.555230][T24505] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.6123'. [ 1588.619108][T24493] can: request_module (can-proto-0) failed. [ 1589.199216][T24317] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1589.266941][T24512] can: request_module (can-proto-0) failed. [ 1589.287168][T24317] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1589.324344][T24506] ªªªªª6: renamed from veth0_vlan [ 1589.360344][T24505] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.6123'. [ 1589.448768][T24505] netlink: 6320 bytes leftover after parsing attributes in process `syz.0.6123'. [ 1589.474813][T24317] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1589.688605][T24317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1589.781167][T24317] 8021q: adding VLAN 0 to HW filter on device team0 [ 1589.850026][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1589.874416][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1589.974588][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1589.994626][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1590.014803][T22245] bridge0: port 1(bridge_slave_0) entered blocking state [ 1590.021996][T22245] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1590.051525][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1590.065990][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1590.083847][T22245] bridge0: port 2(bridge_slave_1) entered blocking state [ 1590.091107][T22245] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1590.124854][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1590.162290][T24538] netlink: 'syz.5.6132': attribute type 2 has an invalid length. [ 1590.245191][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1590.263821][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1590.310571][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1590.322616][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1590.388506][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1590.420990][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1590.453872][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1590.501182][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1590.519639][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1590.579281][T24317] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1590.618660][T24317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1590.689357][T24549] netlink: 'syz.3.6135': attribute type 3 has an invalid length. [ 1590.701795][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1590.720928][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1590.766233][T24553] netlink: 'syz.3.6135': attribute type 3 has an invalid length. [ 1590.782641][T24550] netlink: 'syz.3.6135': attribute type 3 has an invalid length. [ 1590.841797][T24549] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.6135'. [ 1590.887534][T24553] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.6135'. [ 1590.926242][T24551] netlink: 'syz.0.6134': attribute type 10 has an invalid length. [ 1590.934363][T24550] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.6135'. [ 1590.968525][T24551] netlink: 2 bytes leftover after parsing attributes in process `syz.0.6134'. [ 1590.988869][T24551] device hsr0 entered promiscuous mode [ 1590.996057][T24551] bridge0: port 4(hsr0) entered blocking state [ 1591.002590][T24551] bridge0: port 4(hsr0) entered disabled state [ 1591.011208][T24551] bridge0: port 4(hsr0) entered blocking state [ 1591.017581][T24551] bridge0: port 4(hsr0) entered forwarding state [ 1591.245701][T24560] tap0: tun_chr_ioctl cmd 1074025677 [ 1591.251759][T24560] tap0: linktype set to 270 [ 1591.426077][T24564] netlink: 'syz.0.6138': attribute type 2 has an invalid length. [ 1591.464329][T24564] netlink: 'syz.0.6138': attribute type 4 has an invalid length. [ 1591.506836][T24564] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6138'. [ 1591.914800][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1591.930183][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1591.982301][T24317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1592.577946][T24585] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1592.585581][T24585] IPv6: NLM_F_CREATE should be set when creating new route [ 1592.593496][T24585] IPv6: NLM_F_CREATE should be set when creating new route [ 1592.601297][T24585] IPv6: NLM_F_CREATE should be set when creating new route [ 1593.131972][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1593.142311][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1593.244364][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1593.263328][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1593.314560][T24317] device veth0_vlan entered promiscuous mode [ 1593.335410][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1593.352408][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1593.389680][T24317] device veth1_vlan entered promiscuous mode [ 1593.690023][T24622] netlink: 14975 bytes leftover after parsing attributes in process `syz.3.6151'. [ 1593.801173][T24317] device veth0_macvtap entered promiscuous mode [ 1593.864076][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1593.882161][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1593.893478][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1593.903939][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1593.925867][T24317] device veth1_macvtap entered promiscuous mode [ 1593.933132][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1593.947984][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1593.995570][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1594.015406][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.036457][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1594.064119][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.084077][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1594.114923][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.135767][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1594.164055][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.177764][T24317] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1594.212636][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1594.225961][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1594.299624][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1594.321041][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.341637][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1594.366804][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.384102][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1594.403366][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.420135][T24317] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1594.437876][T24317] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1594.464174][T24317] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1594.499077][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1594.518977][T22252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1594.589256][T24317] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.600920][T24317] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.616799][T24317] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.630875][T24317] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1594.836645][T17734] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1594.852305][T24650] netlink: 'syz.5.6160': attribute type 21 has an invalid length. [ 1594.860415][T17734] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1594.952623][T22250] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1594.986320][T22245] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1595.015145][T22245] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1595.053254][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1595.132897][T24659] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6162'. [ 1595.537714][T24668] ref_ctr_offset mismatch. inode: 0xc66 offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 1595.586707][T24667] netlink: 168 bytes leftover after parsing attributes in process `syz.4.6072'. [ 1595.819120][T24675] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6166'. [ 1595.869397][T24675] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6166'. [ 1595.917019][T24679] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6166'. [ 1596.373127][T24688] netlink: 'syz.5.6169': attribute type 6 has an invalid length. [ 1596.407898][T24688] netlink: 1034 bytes leftover after parsing attributes in process `syz.5.6169'. [ 1597.077386][T20535] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1597.087445][T20535] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1597.095548][T20535] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1597.113143][T20535] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1597.122510][T20535] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1597.131425][ T48] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1599.207624][ T4333] Bluetooth: hci4: command 0x0409 tx timeout [ 1599.847019][T22252] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1600.095795][T24716] netlink: 'syz.5.6174': attribute type 2 has an invalid length. [ 1600.103622][T24716] netlink: 9039 bytes leftover after parsing attributes in process `syz.5.6174'. [ 1601.285239][ T4333] Bluetooth: hci4: command 0x041b tx timeout [ 1602.864122][T24710] chnl_net:caif_netlink_parms(): no params data found [ 1602.932439][T22252] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1603.095816][T22252] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1603.172841][T24734] netlink: 'syz.4.6180': attribute type 10 has an invalid length. [ 1603.212100][T24734] batman_adv: batadv0: Adding interface: netdevsim0 [ 1603.254240][T24734] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1603.359334][ T4333] Bluetooth: hci4: command 0x040f tx timeout [ 1603.380040][T24734] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 1603.474241][T24746] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.6183'. [ 1603.607876][T22252] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1603.776903][T24710] bridge0: port 1(bridge_slave_0) entered blocking state [ 1603.824788][T24710] bridge0: port 1(bridge_slave_0) entered disabled state [ 1603.858990][T24710] device bridge_slave_0 entered promiscuous mode [ 1603.901765][T24710] bridge0: port 2(bridge_slave_1) entered blocking state [ 1603.941075][T24710] bridge0: port 2(bridge_slave_1) entered disabled state [ 1603.973365][T24710] device bridge_slave_1 entered promiscuous mode [ 1604.162910][T24710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1604.223065][T24710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1604.346103][T24710] team0: Port device team_slave_0 added [ 1604.387124][T24710] team0: Port device team_slave_1 added [ 1604.433704][T22252] device 0 left promiscuous mode [ 1604.550646][T24710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1604.653594][T24710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1604.682398][T24710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1604.695063][T22252] device 1 left promiscuous mode [ 1604.718106][T24768] netlink: 168 bytes leftover after parsing attributes in process `syz.2.6190'. [ 1604.745153][T24710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1604.752205][T24710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1604.898119][T24710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1605.113462][T24784] netlink: 'syz.2.6195': attribute type 28 has an invalid length. [ 1605.123442][T24784] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6195'. [ 1605.147158][T24783] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.6194'. [ 1605.434342][ T4333] Bluetooth: hci4: command 0x0419 tx timeout [ 1605.732227][T24783] netlink: 'syz.0.6194': attribute type 10 has an invalid length. [ 1605.759118][T24783] netlink: 156 bytes leftover after parsing attributes in process `syz.0.6194'. [ 1605.901796][T24710] device hsr_slave_0 entered promiscuous mode [ 1605.929932][T24710] device hsr_slave_1 entered promiscuous mode [ 1605.938631][T24710] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1605.953687][T24710] Cannot create hsr debugfs directory [ 1606.522925][T24815] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6201'. [ 1606.657408][T24808] netlink: 'syz.5.6201': attribute type 6 has an invalid length. [ 1606.706785][T24808] netlink: 168 bytes leftover after parsing attributes in process `syz.5.6201'. [ 1606.771212][T24815] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6201'. [ 1606.923242][T24816] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6201'. [ 1607.154701][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.161190][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1608.339322][T24864] netlink: 'syz.4.6213': attribute type 11 has an invalid length. [ 1608.435209][T24710] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1608.485914][T24710] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1608.768460][T24710] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1608.815736][T24878] device sit0 entered promiscuous mode [ 1609.006488][T24883] netlink: 194236 bytes leftover after parsing attributes in process `syz.0.6217'. [ 1609.066291][T24883] netlink: zone id is out of range [ 1609.090594][T24710] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1609.097865][T24883] netlink: zone id is out of range [ 1609.126300][T24883] netlink: zone id is out of range [ 1609.131501][T24883] netlink: zone id is out of range [ 1609.204524][T24883] netlink: zone id is out of range [ 1609.209854][T24883] netlink: zone id is out of range [ 1609.234151][T24883] netlink: get zone limit has 8 unknown bytes [ 1609.491612][T22252] device hsr_slave_0 left promiscuous mode [ 1609.515740][T22252] device hsr_slave_1 left promiscuous mode [ 1609.552661][T24892] netlink: 14719 bytes leftover after parsing attributes in process `syz.2.6219'. [ 1610.906774][T22252] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1610.976999][T22252] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1611.002526][T22252] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1611.034249][T22252] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1611.154227][T22252] device veth1_vlan left promiscuous mode [ 1611.160219][T22252] device veth0_vlan left promiscuous mode [ 1612.482099][T22252] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1612.565899][T22252] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1612.615156][T22252] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1612.862232][T22252] bond0 (unregistering): Released all slaves [ 1613.074998][T24710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1613.126647][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1613.160924][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1613.189883][T24710] 8021q: adding VLAN 0 to HW filter on device team0 [ 1613.258943][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1613.295348][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1613.345372][T22245] bridge0: port 1(bridge_slave_0) entered blocking state [ 1613.352595][T22245] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1613.395020][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1613.409475][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1613.452500][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1613.467941][T22245] bridge0: port 2(bridge_slave_1) entered blocking state [ 1613.475396][T22245] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1613.509540][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1613.638210][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1613.657457][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1613.681870][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1613.692291][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1613.712646][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1613.743303][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1613.761108][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1613.786959][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1613.809118][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1613.831179][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1613.870621][T24947] netlink: 'syz.4.6231': attribute type 29 has an invalid length. [ 1613.892598][T24710] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1613.940590][T24948] netlink: 'syz.4.6231': attribute type 29 has an invalid length. [ 1613.977336][T24947] netlink: 'syz.4.6231': attribute type 29 has an invalid length. [ 1614.427834][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1614.447097][T22249] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1614.460763][T24710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1614.522361][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1614.543977][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1614.608033][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1614.619057][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1614.637168][T24710] device veth0_vlan entered promiscuous mode [ 1614.648159][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1614.665287][T22251] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1614.692252][T24710] device veth1_vlan entered promiscuous mode [ 1614.832196][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1614.850477][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1614.870258][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1614.880363][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1614.901678][T24710] device veth0_macvtap entered promiscuous mode [ 1614.922725][T24710] device veth1_macvtap entered promiscuous mode [ 1614.955347][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1614.970743][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1614.985711][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1615.005200][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.028057][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1615.067630][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.081010][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1615.095518][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.112427][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1615.132707][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.155626][T24710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1615.179336][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1615.193809][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1615.236483][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1615.256427][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.267051][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1615.278036][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.288406][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1615.299168][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.309386][T24710] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1615.328077][T24710] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1615.343350][T24710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1615.394468][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1615.403418][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1615.423083][T24710] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1615.433214][T24710] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1615.446293][T24710] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1615.455305][T24710] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1615.669770][T22245] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1615.704110][T22245] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1615.774719][T22245] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1615.862558][T22245] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1615.885292][T22245] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1615.892971][T17734] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1616.064664][T24991] device syzkaller0 entered promiscuous mode [ 1619.025343][T25023] netlink: 'syz.3.6249': attribute type 17 has an invalid length. [ 1619.064123][T25023] netlink: 148 bytes leftover after parsing attributes in process `syz.3.6249'. [ 1619.434278][ T48] Bluetooth: hci1: command 0x0406 tx timeout [ 1619.728373][T13650] tipc: Subscription rejected, illegal request [ 1619.762672][T25050] sock: sock_set_timeout: `syz.0.6257' (pid 25050) tries to set negative timeout [ 1619.780690][T25044] netlink: 'syz.5.6255': attribute type 1 has an invalid length. [ 1619.827704][T25044] netlink: 127868 bytes leftover after parsing attributes in process `syz.5.6255'. [ 1620.143145][T25054] netlink: 14 bytes leftover after parsing attributes in process `syz.4.6258'. [ 1620.620186][T25054] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1620.735684][T25054] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1620.791806][T25054] bond0 (unregistering): Released all slaves [ 1620.840534][T25059] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6258'. [ 1620.978480][T25064] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.6261'. [ 1621.030286][T25069] netlink: 'syz.0.6263': attribute type 10 has an invalid length. [ 1621.059448][T25069] netlink: 168 bytes leftover after parsing attributes in process `syz.0.6263'. [ 1621.363312][T25077] netlink: 'syz.4.6266': attribute type 21 has an invalid length. [ 1621.416600][T25077] netlink: 'syz.4.6266': attribute type 6 has an invalid length. [ 1621.442547][T25077] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6266'. [ 1622.118877][T25109] netlink: 14 bytes leftover after parsing attributes in process `syz.3.6275'. [ 1622.142736][T25109] device hsr_slave_0 left promiscuous mode [ 1622.201081][T25109] device hsr_slave_1 left promiscuous mode [ 1622.394366][T25107] netlink: 14 bytes leftover after parsing attributes in process `syz.3.6275'. [ 1622.403552][T25124] netlink: 'syz.0.6278': attribute type 10 has an invalid length. [ 1622.663606][T25124] team0: Device wg1 is of different type [ 1623.606021][T25163] -1: renamed from syzkaller0 [ 1623.977968][T25169] netlink: 'syz.4.6293': attribute type 13 has an invalid length. [ 1623.993640][T25169] netlink: 152 bytes leftover after parsing attributes in process `syz.4.6293'. [ 1624.015505][ C1] bridge0: received packet on bond0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1624.045711][T25169] erspan0: refused to change device tx_queue_len [ 1624.071453][T25169] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1624.324249][T25171] netlink: 'syz.2.6292': attribute type 46 has an invalid length. [ 1624.384026][T25171] netlink: 55 bytes leftover after parsing attributes in process `syz.2.6292'. [ 1626.107921][T25214] netlink: 'syz.0.6305': attribute type 29 has an invalid length. [ 1626.143538][T25214] netlink: 'syz.0.6305': attribute type 29 has an invalid length. [ 1626.197713][T25214] netlink: 'syz.0.6305': attribute type 29 has an invalid length. [ 1626.477262][T25221] netlink: 128124 bytes leftover after parsing attributes in process `syz.0.6308'. [ 1626.777562][T25231] netlink: 176 bytes leftover after parsing attributes in process `syz.5.6309'. [ 1627.642699][T25253] netlink: 'syz.2.6316': attribute type 10 has an invalid length. [ 1627.663794][T25253] device netdevsim0 left promiscuous mode [ 1627.758341][T25253] batman_adv: batadv0: Adding interface: netdevsim0 [ 1627.771371][T25253] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1627.866156][T25253] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 1630.516616][T25258] device veth1_macvtap left promiscuous mode [ 1632.202116][T25304] netlink: 'syz.5.6330': attribute type 2 has an invalid length. [ 1632.284384][T25304] netlink: 'syz.5.6330': attribute type 3 has an invalid length. [ 1632.292248][T25304] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6330'. [ 1634.434153][T25326] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6335'. [ 1635.599518][T25344] netlink: 'syz.5.6340': attribute type 29 has an invalid length. [ 1635.638261][T25344] netlink: 'syz.5.6340': attribute type 29 has an invalid length. [ 1635.672963][T25345] netlink: 'syz.5.6340': attribute type 29 has an invalid length. [ 1636.252299][T25359] netlink: 'syz.3.6343': attribute type 3 has an invalid length. [ 1636.269612][T25359] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.6343'. [ 1636.437807][T25367] netlink: 'syz.2.6348': attribute type 46 has an invalid length. [ 1636.450165][T25368] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.6346'. [ 1636.479187][T25367] netlink: 'syz.2.6348': attribute type 46 has an invalid length. [ 1636.787367][T25373] netlink: 'syz.2.6348': attribute type 3 has an invalid length. [ 1636.853482][T25381] delete_channel: no stack [ 1637.211033][T25386] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.6351'. [ 1637.365064][T25386] debugfs: Directory '.!' with parent 'ieee80211' already present! [ 1637.618614][T25393] netlink: 14 bytes leftover after parsing attributes in process `syz.0.6354'. [ 1637.636432][T25393] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1639.914070][ T4333] Bluetooth: hci0: command 0x0406 tx timeout [ 1640.751579][T25420] device syzkaller0 entered promiscuous mode [ 1644.028510][T25435] netlink: 'syz.2.6368': attribute type 21 has an invalid length. [ 1644.037035][T25435] netlink: 16166 bytes leftover after parsing attributes in process `syz.2.6368'. [ 1644.049179][T25436] netlink: 'syz.2.6368': attribute type 21 has an invalid length. [ 1644.057479][T25436] netlink: 16166 bytes leftover after parsing attributes in process `syz.2.6368'. [ 1644.307849][T25462] netlink: 'syz.2.6374': attribute type 3 has an invalid length. [ 1644.316496][T25462] netlink: 118424 bytes leftover after parsing attributes in process `syz.2.6374'. [ 1647.308478][T25475] netlink: 'syz.0.6379': attribute type 33 has an invalid length. [ 1647.341402][T25475] netlink: 164 bytes leftover after parsing attributes in process `syz.0.6379'. [ 1648.545811][T25519] netlink: 65015 bytes leftover after parsing attributes in process `syz.4.6393'. [ 1649.959316][T25549] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6400'. [ 1650.176340][T25568] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.6406'. [ 1650.419909][T25567] netlink: 'syz.4.6405': attribute type 3 has an invalid length. [ 1650.490533][T25567] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.6405'. [ 1652.063492][T25600] netlink: 'syz.0.6416': attribute type 27 has an invalid length. [ 1652.087616][T25601] netlink: 1041 bytes leftover after parsing attributes in process `syz.3.6414'. [ 1652.859751][T25600] bond0: (slave bond_slave_0): Releasing backup interface [ 1652.878209][T25600] device bond_slave_0 left promiscuous mode [ 1653.513004][T25625] netlink: 'syz.3.6420': attribute type 22 has an invalid length. [ 1653.953387][T25636] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.6425'. [ 1655.170969][T25669] netlink: 'syz.5.6434': attribute type 10 has an invalid length. [ 1655.462223][T25669] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1655.604278][T25683] netlink: 'syz.3.6438': attribute type 29 has an invalid length. [ 1655.616499][T25683] netlink: 'syz.3.6438': attribute type 29 has an invalid length. [ 1655.628626][T25682] netlink: 'syz.3.6438': attribute type 29 has an invalid length. [ 1655.653024][T25682] netlink: 'syz.3.6438': attribute type 29 has an invalid length. [ 1655.713279][T25683] netlink: 'syz.3.6438': attribute type 29 has an invalid length. [ 1656.044326][T25697] netlink: 'syz.4.6443': attribute type 21 has an invalid length. [ 1656.128498][T25697] netlink: 'syz.4.6443': attribute type 1 has an invalid length. [ 1656.200225][T25697] netlink: 16090 bytes leftover after parsing attributes in process `syz.4.6443'. [ 1657.106433][ T4333] Bluetooth: hci4: ACL packet for unknown connection handle 0 [ 1658.083101][T25742] netlink: 'syz.0.6456': attribute type 21 has an invalid length. [ 1658.145809][T25742] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6456'. [ 1659.419571][T25777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6465'. [ 1659.447622][T25777] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6465'. [ 1659.793197][T25786] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6469'. [ 1660.291068][T25799] netlink: 'syz.0.6473': attribute type 29 has an invalid length. [ 1660.362864][T25799] netlink: 'syz.0.6473': attribute type 29 has an invalid length. [ 1662.851936][T25851] validate_nla: 1 callbacks suppressed [ 1662.851957][T25851] netlink: 'syz.0.6486': attribute type 13 has an invalid length. [ 1663.437482][ C0] bridge0: received packet on bond0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1663.471071][T25867] netlink: 14 bytes leftover after parsing attributes in process `syz.5.6493'. [ 1664.097940][T25891] netlink: 'syz.3.6498': attribute type 3 has an invalid length. [ 1664.155397][T25891] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.6498'. [ 1664.410220][T25897] netlink: 63219 bytes leftover after parsing attributes in process `syz.5.6501'. [ 1664.440898][T25897] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6501'. [ 1664.655308][T25884] netlink: 'syz.3.6498': attribute type 10 has an invalid length. [ 1664.794989][T25884] team0: Device ipvlan1 failed to register rx_handler [ 1665.318047][T25921] netlink: 144 bytes leftover after parsing attributes in process `syz.4.6507'. [ 1666.069898][T25945] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6514'. [ 1666.936335][T25969] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.385013][T25983] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.6521'. [ 1667.704398][T25973] netlink: 148 bytes leftover after parsing attributes in process `syz.0.6524'. [ 1667.756389][T25975] netlink: 'syz.0.6524': attribute type 21 has an invalid length. [ 1667.775789][T25991] netlink: 830 bytes leftover after parsing attributes in process `syz.4.6521'. [ 1667.798565][T25984] netlink: 128 bytes leftover after parsing attributes in process `syz.0.6524'. [ 1667.869991][T25984] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1667.901945][T25984] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1667.959378][T25983] debugfs: Directory '!!!' with parent 'ieee80211' already present! [ 1668.221745][ T4333] Bluetooth: hci0: ISO packet for unknown connection handle 3 [ 1668.590856][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.597317][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.753408][T26020] netlink: 'syz.5.6534': attribute type 21 has an invalid length. [ 1668.761688][T26020] netlink: 'syz.5.6534': attribute type 1 has an invalid length. [ 1668.827070][T26020] netlink: 3752 bytes leftover after parsing attributes in process `syz.5.6534'. [ 1669.168883][T26029] netlink: 176 bytes leftover after parsing attributes in process `syz.5.6537'. [ 1669.201669][T26027] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.6538'. [ 1669.216477][T26027] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.6538'. [ 1669.235058][T26027] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.6538'. [ 1669.253516][T26027] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.6538'. [ 1669.292042][T26027] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.6538'. [ 1669.451783][T26037] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1669.496521][T26037] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1669.740872][T26040] netlink: 'syz.3.6541': attribute type 2 has an invalid length. [ 1669.795697][T26040] netlink: 'syz.3.6541': attribute type 8 has an invalid length. [ 1669.827545][T26040] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6541'. [ 1670.875337][T26078] netlink: 'syz.0.6550': attribute type 10 has an invalid length. [ 1671.150381][T26082] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.6556'. [ 1671.253723][T26082] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.6556'. [ 1671.969538][T26107] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1672.028641][T26107] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1672.566264][T26123] netlink: 'syz.5.6569': attribute type 7 has an invalid length. [ 1673.328276][T26153] sysfs: cannot create duplicate filename '/class/ieee80211/!!!' [ 1673.421851][T26153] CPU: 1 PID: 26153 Comm: syz.5.6575 Not tainted syzkaller #0 [ 1673.429413][T26153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1673.439521][T26153] Call Trace: [ 1673.442845][T26153] [ 1673.445829][T26153] dump_stack_lvl+0x188/0x24e [ 1673.450586][T26153] ? show_regs_print_info+0x12/0x12 [ 1673.455860][T26153] ? load_image+0x410/0x410 [ 1673.460449][T26153] sysfs_warn_dup+0x8a/0xa0 [ 1673.465016][T26153] sysfs_do_create_link_sd+0xc0/0x110 [ 1673.470456][T26153] device_add+0x83b/0x1050 [ 1673.474930][T26153] wiphy_register+0x1d8b/0x2aa0 [ 1673.479874][T26153] ? cfg80211_event_work+0x40/0x40 [ 1673.485030][T26153] ? minstrel_ht_alloc+0x894/0xa20 [ 1673.490210][T26153] ? ieee80211_init_rate_ctrl_alg+0x55e/0x5e0 [ 1673.496333][T26153] ieee80211_register_hw+0x2d48/0x39f0 [ 1673.501841][T26153] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1673.508044][T26153] ? ieee80211_register_hw+0xee1/0x39f0 [ 1673.513631][T26153] ? ieee80211_register_hw+0xee1/0x39f0 [ 1673.519255][T26153] ? ieee80211_tasklet_handler+0x20/0x20 [ 1673.524941][T26153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1673.530886][T26153] ? __debug_object_init+0xed/0x440 [ 1673.536142][T26153] ? memset+0x1e/0x40 [ 1673.540150][T26153] ? __hrtimer_init+0x189/0x270 [ 1673.545037][T26153] mac80211_hwsim_new_radio+0x2927/0x4cd0 [ 1673.550808][T26153] ? memcpy+0x3c/0x60 [ 1673.554837][T26153] hwsim_new_radio_nl+0xab7/0xc90 [ 1673.559917][T26153] genl_family_rcv_msg_doit+0x22f/0x350 [ 1673.565499][T26153] ? end_current_label_crit_section+0x170/0x170 [ 1673.571784][T26153] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 1673.577721][T26153] ? bpf_lsm_capable+0x5/0x10 [ 1673.582440][T26153] ? security_capable+0x85/0xb0 [ 1673.587422][T26153] genl_rcv_msg+0x601/0x790 [ 1673.591965][T26153] ? genl_bind+0x360/0x360 [ 1673.596498][T26153] ? hwsim_tx_info_frame_received_nl+0xe30/0xe30 [ 1673.602872][T26153] netlink_rcv_skb+0x1ef/0x440 [ 1673.607680][T26153] ? genl_bind+0x360/0x360 [ 1673.612128][T26153] ? netlink_ack+0x1160/0x1160 [ 1673.616938][T26153] ? down_read+0x1a8/0x2d0 [ 1673.621408][T26153] genl_rcv+0x24/0x40 [ 1673.625459][T26153] netlink_unicast+0x7ad/0x920 [ 1673.630267][T26153] netlink_sendmsg+0x8ad/0xbd0 [ 1673.635089][T26153] ? netlink_getsockopt+0x550/0x550 [ 1673.640325][T26153] ? apparmor_socket_sendmsg+0x8a/0x330 [ 1673.645907][T26153] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1673.651218][T26153] ? security_socket_sendmsg+0x7c/0xa0 [ 1673.656715][T26153] ? netlink_getsockopt+0x550/0x550 [ 1673.661960][T26153] ____sys_sendmsg+0x5ed/0x9a0 [ 1673.666771][T26153] ? __sys_sendmsg_sock+0x30/0x30 [ 1673.671846][T26153] ? __import_iovec+0x306/0x510 [ 1673.676742][T26153] ? import_iovec+0x6f/0xa0 [ 1673.681294][T26153] ___sys_sendmsg+0x2a2/0x360 [ 1673.686008][T26153] ? __sys_sendmsg+0x2a0/0x2a0 [ 1673.690825][T26153] ? ktime_get+0x7b/0x270 [ 1673.695222][T26153] __se_sys_sendmsg+0x1c3/0x2b0 [ 1673.700130][T26153] ? perf_trace_preemptirq_template+0x268/0x320 [ 1673.706446][T26153] ? __x64_sys_sendmsg+0x80/0x80 [ 1673.711447][T26153] ? lockdep_hardirqs_on+0x94/0x140 [ 1673.716687][T26153] do_syscall_64+0x4c/0xa0 [ 1673.721147][T26153] ? clear_bhb_loop+0x60/0xb0 [ 1673.725861][T26153] ? clear_bhb_loop+0x60/0xb0 [ 1673.730584][T26153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1673.736522][T26153] RIP: 0033:0x7f53cd79e0d9 [ 1673.740973][T26153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1673.760617][T26153] RSP: 002b:00007f53ce600028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1673.769061][T26153] RAX: ffffffffffffffda RBX: 00007f53cda26090 RCX: 00007f53cd79e0d9 [ 1673.777059][T26153] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000009 [ 1673.785056][T26153] RBP: 00007f53cd835024 R08: 0000000000000000 R09: 0000000000000000 [ 1673.793090][T26153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1673.801110][T26153] R13: 00007f53cda26128 R14: 00007f53cda26090 R15: 00007ffd7465fcd8 [ 1673.809122][T26153] [ 1673.974053][T26164] __nla_validate_parse: 5 callbacks suppressed [ 1673.974074][T26164] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6580'. [ 1674.065191][T13641] device 0 left promiscuous mode [ 1674.220954][T13641] tipc: Left network mode [ 1674.698878][T26198] netlink: 'syz.5.6588': attribute type 10 has an invalid length. [ 1674.765128][T26198] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1675.189921][T26212] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6591'. [ 1675.213655][T26212] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6591'. [ 1675.235227][T26213] netlink: 'syz.4.6593': attribute type 3 has an invalid length. [ 1675.255515][T26213] netlink: 105116 bytes leftover after parsing attributes in process `syz.4.6593'. [ 1675.266562][T26206] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6591'. [ 1675.347845][T26206] netlink: 'syz.5.6591': attribute type 2 has an invalid length. [ 1675.494727][T26216] netlink: 14 bytes leftover after parsing attributes in process `syz.0.6592'. [ 1675.792847][T26226] netlink: 'syz.0.6592': attribute type 10 has an invalid length. [ 1675.815354][T26226] bridge0: port 2(bridge_slave_1) entered disabled state [ 1675.849734][T26226] device bridge_slave_1 left promiscuous mode [ 1675.857119][T26226] bridge0: port 2(bridge_slave_1) entered disabled state [ 1675.869782][T26226] team0: Port device bridge_slave_1 added [ 1675.904110][T26229] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6596'. [ 1676.069766][T26238] netlink: 'syz.3.6600': attribute type 1 has an invalid length. [ 1676.095425][T26238] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.6600'. [ 1677.232607][T26277] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6609'. [ 1678.073494][T13641] device veth1_vlan left promiscuous mode [ 1678.087834][T13641] device veth0_vlan left promiscuous mode [ 1678.157610][T26295] netlink: 'syz.4.6614': attribute type 29 has an invalid length. [ 1678.358642][T13641] device geneve1 left promiscuous mode [ 1678.382053][T13641] team0 (unregistering): Port device geneve1 removed [ 1679.748971][T13641] device team_slave_1 left promiscuous mode [ 1679.756366][T13641] team0 (unregistering): Port device team_slave_1 removed [ 1679.805301][T13641] device C left promiscuous mode [ 1679.811460][T13641] team0 (unregistering): Port device C removed [ 1679.857331][T13641] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1679.866160][T13641] device bond_slave_1 left promiscuous mode [ 1679.912222][T13641] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1679.921151][T13641] device bond_slave_0 left promiscuous mode [ 1679.966628][T13641] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1680.265939][T13641] bond0 (unregistering): Released all slaves [ 1680.320360][T26295] netlink: 'syz.4.6614': attribute type 29 has an invalid length. [ 1680.329059][T26303] netlink: 'syz.5.6615': attribute type 10 has an invalid length. [ 1680.354184][T26303] netlink: 40 bytes leftover after parsing attributes in process `syz.5.6615'. [ 1680.363526][T26303] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 1681.533265][T26341] netlink: 'syz.5.6624': attribute type 11 has an invalid length. [ 1681.563578][T26341] netlink: 168 bytes leftover after parsing attributes in process `syz.5.6624'. [ 1681.739977][T26336] can: request_module (can-proto-0) failed. [ 1682.907554][T26374] netlink: 'syz.3.6634': attribute type 29 has an invalid length. [ 1683.050099][T26374] netlink: 'syz.3.6634': attribute type 29 has an invalid length. [ 1683.467778][T26394] netlink: 'syz.5.6640': attribute type 1 has an invalid length. [ 1683.635429][T26399] netlink: 'syz.4.6643': attribute type 21 has an invalid length. [ 1683.663856][T26399] netlink: 144 bytes leftover after parsing attributes in process `syz.4.6643'. [ 1684.326417][T26429] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6649'. [ 1684.594557][T26429] device hsr_slave_0 left promiscuous mode [ 1685.178925][T26429] device hsr0 left promiscuous mode [ 1685.191688][T26429] nr0: port 1(hsr0) entered disabled state [ 1685.281061][T26436] netlink: 152 bytes leftover after parsing attributes in process `syz.3.6651'. [ 1685.309240][T26438] netlink: 10 bytes leftover after parsing attributes in process `syz.2.6649'. [ 1685.335911][T26439] netlink: 'syz.3.6651': attribute type 10 has an invalid length. [ 1685.667887][T26439] team0 (unregistering): Port device team_slave_0 removed [ 1685.728237][T26439] team0 (unregistering): Port device team_slave_1 removed [ 1686.416466][T26467] netlink: 143932 bytes leftover after parsing attributes in process `syz.4.6659'. [ 1686.533127][T26467] netlink: zone id is out of range [ 1686.608629][T26467] netlink: zone id is out of range [ 1686.676099][T26475] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.6662'. [ 1686.701060][T26467] netlink: zone id is out of range [ 1686.720090][T26469] device sit0 entered promiscuous mode [ 1686.795539][T26467] netlink: zone id is out of range [ 1686.906760][T26467] netlink: zone id is out of range [ 1686.944146][T26467] netlink: zone id is out of range [ 1686.955000][T26467] netlink: zone id is out of range [ 1686.976524][T26467] netlink: zone id is out of range [ 1687.004578][T26467] netlink: zone id is out of range [ 1687.021482][T26467] netlink: zone id is out of range [ 1687.217925][T26484] netlink: 196 bytes leftover after parsing attributes in process `syz.3.6664'. [ 1687.610648][T26494] netlink: 'syz.2.6666': attribute type 21 has an invalid length. [ 1691.724811][T26523] netlink: 144 bytes leftover after parsing attributes in process `syz.5.6674'. [ 1691.804186][T26523] team0: Port device team_slave_0 removed [ 1691.828528][T26523] net_ratelimit: 3547 callbacks suppressed [ 1691.828550][T26523] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1692.595114][T26554] netlink: 16098 bytes leftover after parsing attributes in process `syz.4.6683'. [ 1692.820024][T26557] netlink: 164 bytes leftover after parsing attributes in process `syz.3.6684'. Stopping sshd: stopped /usr/sbin/sshd (pid 4032) OK [ 1694.778181][T26615] netlink: 'syz.5.6699': attribute type 6 has an invalid length. [ 1694.823374][T26612] netlink: 180900 bytes leftover after parsing attributes in process `syz.3.6701'. Stopping crond: [ 1694.911406][T26615] netlink: 1034 bytes leftover after parsing attributes in process `syz.5.6699'. [ 1694.950713][T26612] openvswitch: netlink: Flow actions attr not present in new flow. stopped /usr/sbin/crond (pid 4015) OK [ 1695.381245][T26629] netlink: 'syz.0.6704': attribute type 10 has an invalid length. [ 1695.393351][T26629] bridge0: port 4(hsr0) entered disabled state [ 1695.400871][T26629] bridge0: port 3(bond0) entered disabled state [ 1695.410320][T26629] bridge0: port 1(bridge_slave_0) entered disabled state [ 1695.452735][T26636] netlink: 'syz.0.6704': attribute type 29 has an invalid length. [ 1695.859286][T26629] bridge0: port 4(hsr0) entered blocking state [ 1695.889030][T26629] bridge0: port 4(hsr0) entered forwarding state [ 1695.920468][T26629] bridge0: port 3(bond0) entered blocking state [ 1695.951959][T26629] bridge0: port 3(bond0) entered forwarding state [ 1696.029709][T26629] bridge0: port 1(bridge_slave_0) entered blocking state [ 1696.084595][T26629] bridge0: port 1(bridge_slave_0) entered forwarding state Stopping dhcpcd... [ 1696.225650][T26629] team0: Port device bridge0 added [ 1696.232379][T26635] netlink: 'syz.5.6707': attribute type 39 has an invalid length. [ 1696.277129][T26635] bond0: (slave syz_tun): Releasing backup interface [ 1696.291938][T26636] netlink: 'syz.0.6704': attribute type 29 has an invalid length. [ 1696.310204][T26641] netlink: 'syz.3.6708': attribute type 46 has an invalid length. [ 1696.324554][T26641] netlink: 55 bytes leftover after parsing attributes in process `syz.3.6708'. stopped /sbin/dhcpcd (pid 3934) Stopping network: OK [ 1698.838398][T26690] device syzkaller0 entered promiscuous mode Stopping iptables: [ 1698.989496][T26707] netlink: 'syz.5.6721': attribute type 10 has an invalid length. [ 1699.066283][T26707] team0: Device hsr_slave_0 failed to register rx_handler [ 1699.260301][T26714] netlink: 122896 bytes leftover after parsing attributes in process `syz.0.6722'. OK [ 1699.331853][T26714] debugfs: Directory '.!' with parent 'ieee80211' already present! Stopping system message bus: done [ 1701.354447][ T48] Bluetooth: hci5: command 0x0406 tx timeout Stopping klogd: OK Stopping acpid: OK Stopping syslogd: stopped /sbin/syslogd (pid 3622) OK umount: can't remount debugfs read-only umount: can't remount tmpfs read-only [ 1705.859855][T26764] netlink: 105 bytes leftover after parsing attributes in process `syz.2.6727'. [ 1705.952892][T26764] netlink: 125520 bytes leftover after parsing attributes in process `syz.2.6727'. umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only [ 1706.111430][T26773] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1706.119017][T26773] IPv6: NLM_F_CREATE should be set when creating new route [ 1706.126847][T26773] IPv6: NLM_F_CREATE should be set when creating new route [ 1706.134355][T26773] IPv6: NLM_F_CREATE should be set when creating new route umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes Connection to 10.128.0.66 closed by remote host. Sent SIGKILL to all processes Requesting system poweroff [ 1707.610095][T17733] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.705158][T17733] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.760428][T17733] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.797160][T17733] batman_adv: batadv0: Removing interface: netdevsim0 [ 1708.597323][T26783] kvm: exiting hardware virtualization [ 1708.613760][T26783] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 1708.626264][T26783] ACPI: PM: Preparing to enter system sleep state S5 [ 1708.636220][T26783] reboot: Power down serialport: VM disconnected.