INFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:51 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0xffffff7f, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:51 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x32340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:16:51 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d98e, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 941.377832][T21915] CPU: 1 PID: 21915 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 941.386757][T21915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 941.396913][T21915] Call Trace: [ 941.400207][T21915] [ 941.403150][T21915] dump_stack_lvl+0xcd/0x134 [ 941.407771][T21915] dump_header+0x106/0x624 [ 941.412205][T21915] oom_kill_process.cold+0x10/0x15 [ 941.417338][T21915] out_of_memory+0x358/0x1460 [ 941.422048][T21915] ? find_held_lock+0x2d/0x110 [ 941.426837][T21915] ? oom_killer_disable+0x270/0x270 [ 941.432066][T21915] ? find_held_lock+0x2d/0x110 [ 941.436856][T21915] mem_cgroup_out_of_memory+0x206/0x270 [ 941.442423][T21915] ? mem_cgroup_margin+0x130/0x130 [ 941.447551][T21915] ? lock_downgrade+0x6e0/0x6e0 [ 941.452440][T21915] try_charge_memcg+0xed2/0x1270 [ 941.457547][T21915] ? find_held_lock+0x2d/0x110 [ 941.462339][T21915] ? mem_cgroup_oom_trylock+0x220/0x220 [ 941.467913][T21915] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 941.473485][T21915] ? lock_downgrade+0x6e0/0x6e0 [ 941.478381][T21915] charge_memcg+0xae/0x360 [ 941.482823][T21915] __mem_cgroup_charge+0x27/0x90 [ 941.487785][T21915] wp_page_copy+0x294/0x2280 [ 941.492409][T21915] ? do_page_mkwrite+0x550/0x550 [ 941.497373][T21915] ? lock_downgrade+0x6e0/0x6e0 [ 941.502248][T21915] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 941.507996][T21915] ? vm_normal_page+0x146/0x2a0 [ 941.512887][T21915] do_wp_page+0x2cb/0x1ae0 [ 941.517329][T21915] __handle_mm_fault+0x1f41/0x5120 [ 941.522483][T21915] ? vm_iomap_memory+0x190/0x190 [ 941.527468][T21915] handle_mm_fault+0x1c8/0x790 [ 941.532252][T21915] do_user_addr_fault+0x489/0x11c0 [ 941.537390][T21915] exc_page_fault+0x9e/0x180 [ 941.541348][T21932] device macvtap2 entered promiscuous mode [ 941.542010][T21915] ? asm_exc_page_fault+0x8/0x30 [ 941.542049][T21915] asm_exc_page_fault+0x1e/0x30 [ 941.542079][T21915] RIP: 0033:0x7f67b6426eab [ 941.562065][T21915] Code: 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 <64> 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 [ 941.574733][T21932] device virt_wifi0 entered promiscuous mode [ 941.581689][T21915] RSP: 002b:00007f67b6a6db98 EFLAGS: 00010213 [ 941.581717][T21915] RAX: 000000000000006e RBX: 00007f67b653a1dc RCX: ffffffffffffffbc [ 941.581735][T21915] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f67b653a1dc [ 941.581752][T21915] RBP: 00007f67b6539f60 R08: 00007ffef6d2f080 R09: 0000000000000270 [ 941.581770][T21915] R10: 00007f67b6a6dc80 R11: 0000000000000246 R12: 00000000000e5b63 18:16:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) [ 941.581787][T21915] R13: 00007f67b6a6dc80 R14: 00007f67b6a6dca0 R15: 0000000000000032 [ 941.581823][T21915] [ 941.641926][T21915] memory: usage 307200kB, limit 307200kB, failcnt 12385 [ 941.650331][T21915] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 941.663083][T21915] Memory cgroup stats for /syz1: [ 941.663313][T21915] anon 290123776 [ 941.663313][T21915] file 155648 [ 941.663313][T21915] kernel_stack 393216 [ 941.663313][T21915] pagetables 10223616 [ 941.663313][T21915] percpu 0 [ 941.663313][T21915] sock 0 [ 941.663313][T21915] shmem 155648 [ 941.663313][T21915] file_mapped 155648 [ 941.663313][T21915] file_dirty 0 [ 941.663313][T21915] file_writeback 0 [ 941.663313][T21915] swapcached 0 [ 941.663313][T21915] anon_thp 232783872 [ 941.663313][T21915] file_thp 0 [ 941.663313][T21915] shmem_thp 0 [ 941.663313][T21915] inactive_anon 290131968 [ 941.663313][T21915] active_anon 147456 [ 941.663313][T21915] inactive_file 0 [ 941.663313][T21915] active_file 0 [ 941.663313][T21915] unevictable 0 [ 941.663313][T21915] slab_reclaimable 584616 [ 941.663313][T21915] slab_unreclaimable 10743344 [ 941.663313][T21915] slab 11327960 [ 941.663313][T21915] workingset_refault_anon 0 [ 941.663313][T21915] workingset_refault_file 0 [ 941.663313][T21915] workingset_activate_anon 0 [ 941.665263][T21932] team0: Device macvtap2 failed to register rx_handler [ 941.672970][T21915] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=21904,uid=0 [ 941.804312][T21932] device virt_wifi0 left promiscuous mode [ 941.808503][T21915] Memory cgroup out of memory: Killed process 21904 (syz-executor.1) total-vm:57332kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 942.098475][T21937] cgroup2: Unknown parameter '@[-}+' 18:16:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x5, 0x80, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xc, 0xffffffffffffffff, 0x3) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x2de0c0, 0x0) ioctl$int_in(r1, 0x0, &(0x7f0000000300)=0xffffffffffffffef) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x94) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000100)) r3 = open(&(0x7f0000000040)='./file0\x00', 0x408000, 0x69) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2fd965762f30c0"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) 18:16:52 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0xffffff9e, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:52 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d98f, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:52 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x33340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:16:52 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304d6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:52 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:16:52 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d990, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:52 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304d7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 942.374676][T21947] device macvtap2 entered promiscuous mode 18:16:52 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0xffffffc3, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 942.414815][T21951] cgroup2: Unknown parameter '@[-}+' [ 942.421128][T21947] device virt_wifi0 entered promiscuous mode [ 942.436673][T21947] team0: Device macvtap2 failed to register rx_handler [ 942.462519][T21947] device virt_wifi0 left promiscuous mode 18:16:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x5, 0x80, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xc, 0xffffffffffffffff, 0x3) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x2de0c0, 0x0) ioctl$int_in(r1, 0x0, &(0x7f0000000300)=0xffffffffffffffef) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x94) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000100)) r3 = open(&(0x7f0000000040)='./file0\x00', 0x408000, 0x69) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2fd965762f30c0"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x80, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xc, 0xffffffffffffffff, 0x3) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x2de0c0, 0x0) (async) ioctl$int_in(r1, 0x0, &(0x7f0000000300)=0xffffffffffffffef) (async) close_range(r1, r2, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x94) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000100)) (async) open(&(0x7f0000000040)='./file0\x00', 0x408000, 0x69) (async) openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2fd965762f30c0"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) (async) [ 942.637585][T21954] cgroup2: Unknown parameter '@[-}+' 18:16:53 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d991, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:53 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304d8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0xffffffe4, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 942.765945][T21960] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 18:16:53 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x34340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 942.842228][T21960] CPU: 0 PID: 21960 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 942.851046][T21960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 942.861117][T21960] Call Trace: [ 942.864410][T21960] [ 942.867354][T21960] dump_stack_lvl+0xcd/0x134 [ 942.871968][T21960] dump_header+0x106/0x624 [ 942.876409][T21960] oom_kill_process.cold+0x10/0x15 [ 942.881544][T21960] out_of_memory+0x358/0x1460 [ 942.886253][T21960] ? find_held_lock+0x2d/0x110 [ 942.891041][T21960] ? oom_killer_disable+0x270/0x270 [ 942.896279][T21960] ? find_held_lock+0x2d/0x110 [ 942.901153][T21960] mem_cgroup_out_of_memory+0x206/0x270 [ 942.906709][T21960] ? mem_cgroup_margin+0x130/0x130 [ 942.911924][T21960] ? lock_downgrade+0x6e0/0x6e0 [ 942.916820][T21960] try_charge_memcg+0xed2/0x1270 [ 942.921787][T21960] ? mem_cgroup_oom_trylock+0x220/0x220 [ 942.927350][T21960] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 942.933178][T21960] ? lock_downgrade+0x6e0/0x6e0 [ 942.938059][T21960] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 942.943805][T21960] obj_cgroup_charge_pages+0x1e/0x90 [ 942.949278][T21960] __memcg_kmem_charge_page+0x392/0x5f0 [ 942.954849][T21960] copy_process+0x80a/0x75a0 [ 942.959455][T21960] ? lock_chain_count+0x20/0x20 [ 942.964320][T21960] ? lock_chain_count+0x20/0x20 [ 942.969203][T21960] ? __cleanup_sighand+0xb0/0xb0 [ 942.974166][T21960] ? __lock_acquire+0x1655/0x5470 [ 942.979214][T21960] ? kernel_clone+0x314/0xab0 [ 942.983906][T21960] kernel_clone+0xe7/0xab0 [ 942.988335][T21960] ? create_io_thread+0xf0/0xf0 [ 942.993197][T21960] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 942.999187][T21960] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 943.005199][T21960] ? find_held_lock+0x2d/0x110 [ 943.009993][T21960] __do_sys_clone+0xc8/0x110 [ 943.014600][T21960] ? kernel_clone+0xab0/0xab0 [ 943.019320][T21960] ? lock_downgrade+0x6e0/0x6e0 [ 943.024204][T21960] ? syscall_enter_from_user_mode+0x21/0x70 [ 943.030128][T21960] do_syscall_64+0x35/0xb0 [ 943.034565][T21960] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 943.040480][T21960] RIP: 0033:0x7f67b64282c1 [ 943.044907][T21960] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 943.064536][T21960] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 943.072967][T21960] RAX: ffffffffffffffda RBX: 00007f67b4d9c700 RCX: 00007f67b64282c1 [ 943.080963][T21960] RDX: 00007f67b4d9c9d0 RSI: 00007f67b4d9c2f0 RDI: 00000000003d0f00 18:16:53 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d992, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0xfffffff0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 943.088956][T21960] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d9c700 R09: 00007f67b4d9c700 [ 943.096946][T21960] R10: 00007f67b4d9c9d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 943.104940][T21960] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 943.112966][T21960] [ 943.170509][T21960] memory: usage 307196kB, limit 307200kB, failcnt 12469 [ 943.188892][T21960] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 943.226225][T21960] Memory cgroup stats for /syz1: [ 943.226456][T21960] anon 290205696 [ 943.226456][T21960] file 155648 [ 943.226456][T21960] kernel_stack 262144 [ 943.226456][T21960] pagetables 10219520 [ 943.226456][T21960] percpu 0 [ 943.226456][T21960] sock 0 [ 943.226456][T21960] shmem 155648 [ 943.226456][T21960] file_mapped 155648 [ 943.226456][T21960] file_dirty 0 [ 943.226456][T21960] file_writeback 0 [ 943.226456][T21960] swapcached 0 [ 943.226456][T21960] anon_thp 232783872 [ 943.226456][T21960] file_thp 0 18:16:53 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x35340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 943.226456][T21960] shmem_thp 0 [ 943.226456][T21960] inactive_anon 290213888 [ 943.226456][T21960] active_anon 147456 [ 943.226456][T21960] inactive_file 0 [ 943.226456][T21960] active_file 0 [ 943.226456][T21960] unevictable 0 [ 943.226456][T21960] slab_reclaimable 598152 [ 943.226456][T21960] slab_unreclaimable 10760064 [ 943.226456][T21960] slab 11358216 [ 943.226456][T21960] workingset_refault_anon 0 [ 943.226456][T21960] workingset_refault_file 0 [ 943.226456][T21960] workingset_activate_anon 0 [ 943.420296][T21960] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=21952,uid=0 [ 943.443211][T22173] device macvtap2 entered promiscuous mode [ 943.449884][T22173] device virt_wifi0 entered promiscuous mode [ 943.457197][T22173] team0: Device macvtap2 failed to register rx_handler [ 943.466019][T22173] device virt_wifi0 left promiscuous mode [ 943.472858][T21960] Memory cgroup out of memory: Killed process 21952 (syz-executor.1) total-vm:60644kB, anon-rss:2484kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:16:53 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) 18:16:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0xfffffffc, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:53 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d993, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:53 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304d9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 943.552112][T22191] cgroup2: Unknown parameter '@[-}+' [ 943.734153][T22191] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 943.750927][T22191] CPU: 1 PID: 22191 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 943.759732][T22191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 943.769810][T22191] Call Trace: [ 943.773100][T22191] [ 943.776037][T22191] dump_stack_lvl+0xcd/0x134 [ 943.780648][T22191] dump_header+0x106/0x624 [ 943.785082][T22191] oom_kill_process.cold+0x10/0x15 [ 943.790209][T22191] out_of_memory+0x358/0x1460 [ 943.794917][T22191] ? find_held_lock+0x2d/0x110 [ 943.799708][T22191] ? oom_killer_disable+0x270/0x270 [ 943.804931][T22191] ? find_held_lock+0x2d/0x110 [ 943.809715][T22191] mem_cgroup_out_of_memory+0x206/0x270 [ 943.815383][T22191] ? mem_cgroup_margin+0x130/0x130 [ 943.820511][T22191] ? lock_downgrade+0x6e0/0x6e0 [ 943.825397][T22191] try_charge_memcg+0xed2/0x1270 [ 943.830359][T22191] ? mem_cgroup_oom_trylock+0x220/0x220 [ 943.835921][T22191] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 943.841657][T22191] ? lock_downgrade+0x6e0/0x6e0 [ 943.846532][T22191] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 943.852281][T22191] obj_cgroup_charge_pages+0x1e/0x90 [ 943.857585][T22191] __memcg_kmem_charge_page+0x392/0x5f0 [ 943.863150][T22191] copy_process+0x80a/0x75a0 [ 943.867756][T22191] ? find_held_lock+0x2d/0x110 [ 943.872550][T22191] ? __cleanup_sighand+0xb0/0xb0 [ 943.877501][T22191] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 943.883757][T22191] ? _copy_from_user+0x5d/0x180 [ 943.888628][T22191] ? kernel_clone+0x314/0xab0 [ 943.893317][T22191] kernel_clone+0xe7/0xab0 [ 943.897750][T22191] ? create_io_thread+0xf0/0xf0 [ 943.902621][T22191] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 943.908623][T22191] __do_sys_clone3+0x1dd/0x2f0 [ 943.913401][T22191] ? __do_sys_clone+0x110/0x110 [ 943.918278][T22191] ? lock_downgrade+0x6e0/0x6e0 [ 943.923144][T22191] ? lock_downgrade+0x6e0/0x6e0 [ 943.928017][T22191] ? syscall_enter_from_user_mode+0x21/0x70 [ 943.933931][T22191] do_syscall_64+0x35/0xb0 [ 943.938357][T22191] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 943.944265][T22191] RIP: 0033:0x7f67b6426e99 [ 943.948686][T22191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 943.968312][T22191] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 943.976738][T22191] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 943.984719][T22191] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 943.992700][T22191] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 944.000675][T22191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 944.008655][T22191] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 944.016654][T22191] [ 944.056453][T22191] memory: usage 307156kB, limit 307200kB, failcnt 12548 [ 944.084043][T22191] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 944.084764][T22203] cgroup2: Unknown parameter '@[-}+' [ 944.101245][T22191] Memory cgroup stats for /syz1: [ 944.101465][T22191] anon 290181120 [ 944.101465][T22191] file 155648 [ 944.101465][T22191] kernel_stack 360448 [ 944.101465][T22191] pagetables 10223616 [ 944.101465][T22191] percpu 0 [ 944.101465][T22191] sock 0 [ 944.101465][T22191] shmem 155648 [ 944.101465][T22191] file_mapped 155648 [ 944.101465][T22191] file_dirty 0 [ 944.101465][T22191] file_writeback 0 [ 944.101465][T22191] swapcached 0 [ 944.101465][T22191] anon_thp 232783872 [ 944.101465][T22191] file_thp 0 [ 944.101465][T22191] shmem_thp 0 [ 944.101465][T22191] inactive_anon 290189312 [ 944.101465][T22191] active_anon 147456 [ 944.101465][T22191] inactive_file 0 [ 944.101465][T22191] active_file 0 [ 944.101465][T22191] unevictable 0 [ 944.101465][T22191] slab_reclaimable 582320 [ 944.101465][T22191] slab_unreclaimable 10675600 [ 944.101465][T22191] slab 11257920 [ 944.101465][T22191] workingset_refault_anon 0 [ 944.101465][T22191] workingset_refault_file 0 [ 944.101465][T22191] workingset_activate_anon 0 [ 944.228921][T22191] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=21927,uid=0 [ 944.253306][T22191] Memory cgroup out of memory: Killed process 21927 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 944.312247][T22206] cgroup2: Unknown parameter '@[-}+' 18:16:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x5, 0x80, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xc, 0xffffffffffffffff, 0x3) (async) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x2de0c0, 0x0) ioctl$int_in(r1, 0x0, &(0x7f0000000300)=0xffffffffffffffef) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x94) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000100)) (async, rerun: 32) r3 = open(&(0x7f0000000040)='./file0\x00', 0x408000, 0x69) (rerun: 32) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) (async) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async, rerun: 32) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async, rerun: 32) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2fd965762f30c0"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) 18:16:54 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x36030000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:16:54 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d994, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:54 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304da, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:54 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0xffffffff, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:54 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) [ 944.435093][T22209] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 944.454975][T22209] CPU: 1 PID: 22209 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 944.463776][T22209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 944.473840][T22209] Call Trace: [ 944.477124][T22209] [ 944.480060][T22209] dump_stack_lvl+0xcd/0x134 [ 944.482401][T22215] device macvtap2 entered promiscuous mode [ 944.484670][T22209] dump_header+0x106/0x624 [ 944.484706][T22209] oom_kill_process.cold+0x10/0x15 [ 944.484735][T22209] out_of_memory+0x358/0x1460 [ 944.504688][T22209] ? find_held_lock+0x2d/0x110 [ 944.509478][T22209] ? oom_killer_disable+0x270/0x270 [ 944.511081][T22215] device virt_wifi0 entered promiscuous mode [ 944.514696][T22209] ? find_held_lock+0x2d/0x110 [ 944.514733][T22209] mem_cgroup_out_of_memory+0x206/0x270 [ 944.514763][T22209] ? mem_cgroup_margin+0x130/0x130 [ 944.526637][T22215] team0: Device macvtap2 failed to register rx_handler [ 944.531001][T22209] ? lock_downgrade+0x6e0/0x6e0 [ 944.531054][T22209] try_charge_memcg+0xed2/0x1270 [ 944.531092][T22209] ? mem_cgroup_oom_trylock+0x220/0x220 [ 944.558410][T22209] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 944.564149][T22209] ? lock_downgrade+0x6e0/0x6e0 [ 944.569020][T22209] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 944.574777][T22209] obj_cgroup_charge_pages+0x1e/0x90 [ 944.580090][T22209] __memcg_kmem_charge_page+0x392/0x5f0 [ 944.585665][T22209] copy_process+0x80a/0x75a0 [ 944.590280][T22209] ? lock_chain_count+0x20/0x20 [ 944.595151][T22209] ? lock_chain_count+0x20/0x20 [ 944.600042][T22209] ? __cleanup_sighand+0xb0/0xb0 [ 944.605003][T22209] ? lock_downgrade+0x6e0/0x6e0 [ 944.609882][T22209] ? __lock_acquire+0x1655/0x5470 [ 944.614929][T22209] ? kernel_clone+0x314/0xab0 [ 944.619625][T22209] kernel_clone+0xe7/0xab0 [ 944.624055][T22209] ? create_io_thread+0xf0/0xf0 [ 944.628917][T22209] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 944.634919][T22209] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 944.641029][T22209] ? find_held_lock+0x2d/0x110 [ 944.645813][T22209] __do_sys_clone+0xc8/0x110 [ 944.650418][T22209] ? kernel_clone+0xab0/0xab0 [ 944.655103][T22209] ? lock_downgrade+0x6e0/0x6e0 [ 944.659986][T22209] ? syscall_enter_from_user_mode+0x21/0x70 [ 944.665909][T22209] do_syscall_64+0x35/0xb0 [ 944.670341][T22209] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 944.676251][T22209] RIP: 0033:0x7f67b64282c1 [ 944.680673][T22209] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 944.700304][T22209] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 944.708743][T22209] RAX: ffffffffffffffda RBX: 00007f67b4d7b700 RCX: 00007f67b64282c1 [ 944.716737][T22209] RDX: 00007f67b4d7b9d0 RSI: 00007f67b4d7b2f0 RDI: 00000000003d0f00 [ 944.724812][T22209] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d7b700 R09: 00007f67b4d7b700 18:16:54 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304db, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 944.732801][T22209] R10: 00007f67b4d7b9d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 944.740789][T22209] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 944.748888][T22209] [ 944.754934][T22215] device virt_wifi0 left promiscuous mode [ 944.846175][T22221] cgroup2: Unknown parameter '@[-}+' 18:16:55 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:55 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x36340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:16:55 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d995, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:55 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304dc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 945.148170][T22209] memory: usage 307080kB, limit 307200kB, failcnt 12604 [ 945.162592][T22229] device macvtap2 entered promiscuous mode [ 945.169163][T22209] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 945.198388][T22229] device virt_wifi0 entered promiscuous mode [ 945.204204][T22209] Memory cgroup stats for /syz1: [ 945.204538][T22209] anon 290168832 [ 945.204538][T22209] file 155648 [ 945.204538][T22209] kernel_stack 294912 [ 945.204538][T22209] pagetables 10223616 [ 945.204538][T22209] percpu 0 [ 945.204538][T22209] sock 0 [ 945.204538][T22209] shmem 155648 [ 945.204538][T22209] file_mapped 155648 [ 945.204538][T22209] file_dirty 0 [ 945.204538][T22209] file_writeback 0 [ 945.204538][T22209] swapcached 0 [ 945.204538][T22209] anon_thp 232783872 [ 945.204538][T22209] file_thp 0 [ 945.204538][T22209] shmem_thp 0 [ 945.204538][T22209] inactive_anon 290177024 [ 945.204538][T22209] active_anon 147456 [ 945.204538][T22209] inactive_file 0 [ 945.204538][T22209] active_file 0 [ 945.204538][T22209] unevictable 0 [ 945.204538][T22209] slab_reclaimable 586632 [ 945.204538][T22209] slab_unreclaimable 10672472 [ 945.204538][T22209] slab 11259104 [ 945.204538][T22209] workingset_refault_anon 0 [ 945.204538][T22209] workingset_refault_file 0 18:16:55 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 945.204538][T22209] workingset_activate_anon 0 [ 945.205144][T22229] team0: Device macvtap2 failed to register rx_handler [ 945.406400][T22229] device virt_wifi0 left promiscuous mode [ 945.417642][T22209] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22208,uid=0 [ 945.448087][T22209] Memory cgroup out of memory: Killed process 22208 (syz-executor.1) total-vm:57332kB, anon-rss:2472kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 945.691641][T22210] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 945.730105][T22210] CPU: 1 PID: 22210 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 945.738918][T22210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 945.748988][T22210] Call Trace: [ 945.752279][T22210] [ 945.755207][T22210] dump_stack_lvl+0xcd/0x134 [ 945.759808][T22210] dump_header+0x106/0x624 [ 945.764226][T22210] oom_kill_process.cold+0x10/0x15 [ 945.769513][T22210] out_of_memory+0x358/0x1460 [ 945.774197][T22210] ? find_held_lock+0x2d/0x110 [ 945.778962][T22210] ? oom_killer_disable+0x270/0x270 [ 945.784164][T22210] ? find_held_lock+0x2d/0x110 [ 945.788932][T22210] mem_cgroup_out_of_memory+0x206/0x270 [ 945.794478][T22210] ? mem_cgroup_margin+0x130/0x130 [ 945.799585][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 945.804452][T22210] try_charge_memcg+0xed2/0x1270 [ 945.809397][T22210] ? mem_cgroup_oom_trylock+0x220/0x220 [ 945.814944][T22210] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 945.820659][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 945.825517][T22210] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 945.831250][T22210] obj_cgroup_charge_pages+0x1e/0x90 [ 945.836630][T22210] __memcg_kmem_charge_page+0x392/0x5f0 [ 945.842181][T22210] __alloc_pages+0x1da/0x500 [ 945.846770][T22210] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 945.853543][T22210] ? copy_page_range+0x24ef/0x42c0 [ 945.858657][T22210] alloc_pages+0x1a7/0x300 [ 945.863080][T22210] get_zeroed_page+0x10/0x40 [ 945.867669][T22210] __pud_alloc+0x37/0x170 [ 945.872004][T22210] copy_page_range+0x2635/0x42c0 [ 945.876943][T22210] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 945.882951][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 945.887808][T22210] ? handle_mm_fault+0x790/0x790 [ 945.892756][T22210] ? __vma_link_rb+0x553/0x710 [ 945.897527][T22210] dup_mm+0xa4e/0x13e0 [ 945.901605][T22210] ? replace_mm_exe_file+0x490/0x490 [ 945.906891][T22210] ? __raw_spin_lock_init+0x36/0x110 [ 945.912181][T22210] copy_process+0x6fed/0x75a0 [ 945.916858][T22210] ? find_held_lock+0x2d/0x110 [ 945.921635][T22210] ? __cleanup_sighand+0xb0/0xb0 [ 945.926580][T22210] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 945.932824][T22210] ? _copy_from_user+0x5d/0x180 [ 945.937677][T22210] ? kernel_clone+0x314/0xab0 [ 945.942354][T22210] kernel_clone+0xe7/0xab0 [ 945.946771][T22210] ? create_io_thread+0xf0/0xf0 [ 945.951636][T22210] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 945.957621][T22210] __do_sys_clone3+0x1dd/0x2f0 [ 945.962381][T22210] ? __do_sys_clone+0x110/0x110 [ 945.967243][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 945.972089][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 945.976957][T22210] ? syscall_enter_from_user_mode+0x21/0x70 [ 945.982861][T22210] do_syscall_64+0x35/0xb0 [ 945.987278][T22210] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 945.993175][T22210] RIP: 0033:0x7f67b6426e99 [ 945.997586][T22210] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 946.017195][T22210] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 946.025607][T22210] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 946.033572][T22210] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 946.041539][T22210] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 946.049505][T22210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 946.057470][T22210] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 946.065452][T22210] [ 946.086211][T22210] memory: usage 307172kB, limit 307200kB, failcnt 12670 [ 946.093559][T22210] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 946.101176][T22210] Memory cgroup stats for /syz1: [ 946.101342][T22210] anon 290156544 [ 946.101342][T22210] file 155648 [ 946.101342][T22210] kernel_stack 425984 [ 946.101342][T22210] pagetables 10240000 [ 946.101342][T22210] percpu 0 [ 946.101342][T22210] sock 0 [ 946.101342][T22210] shmem 155648 [ 946.101342][T22210] file_mapped 155648 [ 946.101342][T22210] file_dirty 0 [ 946.101342][T22210] file_writeback 0 [ 946.101342][T22210] swapcached 0 [ 946.101342][T22210] anon_thp 232783872 [ 946.101342][T22210] file_thp 0 [ 946.101342][T22210] shmem_thp 0 [ 946.101342][T22210] inactive_anon 290164736 [ 946.101342][T22210] active_anon 147456 [ 946.101342][T22210] inactive_file 0 [ 946.101342][T22210] active_file 0 [ 946.101342][T22210] unevictable 0 [ 946.101342][T22210] slab_reclaimable 571944 [ 946.101342][T22210] slab_unreclaimable 10633536 [ 946.101342][T22210] slab 11205480 [ 946.101342][T22210] workingset_refault_anon 0 [ 946.101342][T22210] workingset_refault_file 0 [ 946.101342][T22210] workingset_activate_anon 0 [ 946.199829][T22210] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22237,uid=0 [ 946.216317][T22210] Memory cgroup out of memory: Killed process 22237 (syz-executor.1) total-vm:56936kB, anon-rss:2456kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 946.236660][ T28] oom_reaper: reaped process 22237 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 946.267872][T22210] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 946.278585][T22210] CPU: 1 PID: 22210 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 946.287360][T22210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 946.297407][T22210] Call Trace: [ 946.300686][T22210] [ 946.303619][T22210] dump_stack_lvl+0xcd/0x134 [ 946.308231][T22210] dump_header+0x106/0x624 [ 946.312657][T22210] oom_kill_process.cold+0x10/0x15 [ 946.317766][T22210] out_of_memory+0x358/0x1460 [ 946.322465][T22210] ? find_held_lock+0x2d/0x110 [ 946.327237][T22210] ? oom_killer_disable+0x270/0x270 [ 946.332451][T22210] ? find_held_lock+0x2d/0x110 [ 946.337205][T22210] mem_cgroup_out_of_memory+0x206/0x270 [ 946.342741][T22210] ? mem_cgroup_margin+0x130/0x130 [ 946.347870][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 946.352755][T22210] try_charge_memcg+0xed2/0x1270 [ 946.357720][T22210] ? mem_cgroup_oom_trylock+0x220/0x220 [ 946.363276][T22210] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 946.369002][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 946.373861][T22210] obj_cgroup_charge_pages+0x1e/0x90 [ 946.379139][T22210] obj_cgroup_charge+0xf3/0x280 [ 946.384004][T22210] ? alloc_pid+0xcf/0xd70 [ 946.388338][T22210] kmem_cache_alloc+0x92/0x3a0 [ 946.393094][T22210] alloc_pid+0xcf/0xd70 [ 946.397238][T22210] ? copy_thread+0x57b/0x8b0 [ 946.401821][T22210] ? copy_namespaces+0x1c1/0x450 [ 946.406765][T22210] copy_process+0x2ff0/0x75a0 [ 946.411426][T22210] ? find_held_lock+0x2d/0x110 [ 946.416226][T22210] ? __cleanup_sighand+0xb0/0xb0 [ 946.421166][T22210] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 946.427426][T22210] ? _copy_from_user+0x5d/0x180 [ 946.432290][T22210] ? kernel_clone+0x314/0xab0 [ 946.436956][T22210] kernel_clone+0xe7/0xab0 [ 946.441373][T22210] ? create_io_thread+0xf0/0xf0 [ 946.446235][T22210] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 946.452214][T22210] __do_sys_clone3+0x1dd/0x2f0 [ 946.456968][T22210] ? __do_sys_clone+0x110/0x110 [ 946.461826][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 946.466688][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 946.471557][T22210] ? syscall_enter_from_user_mode+0x21/0x70 [ 946.477456][T22210] do_syscall_64+0x35/0xb0 [ 946.481888][T22210] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 946.487794][T22210] RIP: 0033:0x7f67b6426e99 [ 946.492209][T22210] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 946.511800][T22210] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 946.520204][T22210] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 946.528181][T22210] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 946.536155][T22210] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 946.544117][T22210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 946.552089][T22210] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 946.560070][T22210] [ 946.574816][T22210] memory: usage 307104kB, limit 307200kB, failcnt 12796 [ 946.582250][T22210] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 946.590129][T22210] Memory cgroup stats for /syz1: [ 946.590296][T22210] anon 290103296 [ 946.590296][T22210] file 155648 [ 946.590296][T22210] kernel_stack 393216 [ 946.590296][T22210] pagetables 10293248 [ 946.590296][T22210] percpu 0 [ 946.590296][T22210] sock 0 [ 946.590296][T22210] shmem 155648 [ 946.590296][T22210] file_mapped 155648 [ 946.590296][T22210] file_dirty 0 [ 946.590296][T22210] file_writeback 0 [ 946.590296][T22210] swapcached 0 [ 946.590296][T22210] anon_thp 232783872 [ 946.590296][T22210] file_thp 0 [ 946.590296][T22210] shmem_thp 0 [ 946.590296][T22210] inactive_anon 290111488 [ 946.590296][T22210] active_anon 147456 [ 946.590296][T22210] inactive_file 0 [ 946.590296][T22210] active_file 0 [ 946.590296][T22210] unevictable 0 [ 946.590296][T22210] slab_reclaimable 571944 [ 946.590296][T22210] slab_unreclaimable 10644504 [ 946.590296][T22210] slab 11216448 [ 946.590296][T22210] workingset_refault_anon 0 [ 946.590296][T22210] workingset_refault_file 0 [ 946.590296][T22210] workingset_activate_anon 0 [ 946.692824][T22210] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=12545,uid=0 [ 946.708836][T22210] Memory cgroup out of memory: Killed process 12545 (syz-executor.1) total-vm:56936kB, anon-rss:2456kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 946.728382][ T28] oom_reaper: reaped process 12545 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 946.736690][T22235] cgroup2: Unknown parameter '@[-}+' [ 946.775962][T22236] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 946.786864][T22236] CPU: 0 PID: 22236 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 946.795646][T22236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 946.805711][T22236] Call Trace: [ 946.808976][T22236] [ 946.811893][T22236] dump_stack_lvl+0xcd/0x134 [ 946.816476][T22236] dump_header+0x106/0x624 [ 946.820876][T22236] oom_kill_process.cold+0x10/0x15 [ 946.825975][T22236] out_of_memory+0x358/0x1460 [ 946.830643][T22236] ? find_held_lock+0x2d/0x110 [ 946.835393][T22236] ? oom_killer_disable+0x270/0x270 [ 946.840677][T22236] ? find_held_lock+0x2d/0x110 [ 946.845451][T22236] mem_cgroup_out_of_memory+0x206/0x270 [ 946.851013][T22236] ? mem_cgroup_margin+0x130/0x130 [ 946.856111][T22236] ? lock_downgrade+0x6e0/0x6e0 [ 946.860959][T22236] try_charge_memcg+0xed2/0x1270 [ 946.865890][T22236] ? find_held_lock+0x2d/0x110 [ 946.870637][T22236] ? mem_cgroup_oom_trylock+0x220/0x220 [ 946.876174][T22236] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 946.881727][T22236] ? lock_downgrade+0x6e0/0x6e0 [ 946.886580][T22236] charge_memcg+0xae/0x360 [ 946.890985][T22236] __mem_cgroup_charge+0x27/0x90 [ 946.896087][T22236] wp_page_copy+0x294/0x2280 [ 946.900669][T22236] ? do_page_mkwrite+0x550/0x550 [ 946.905592][T22236] ? lock_downgrade+0x6e0/0x6e0 [ 946.910428][T22236] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 946.916136][T22236] ? vm_normal_page+0x146/0x2a0 [ 946.920984][T22236] do_wp_page+0x2cb/0x1ae0 [ 946.925412][T22236] __handle_mm_fault+0x1f41/0x5120 [ 946.930512][T22236] ? vm_iomap_memory+0x190/0x190 [ 946.935446][T22236] handle_mm_fault+0x1c8/0x790 [ 946.940202][T22236] do_user_addr_fault+0x489/0x11c0 [ 946.945306][T22236] exc_page_fault+0x9e/0x180 [ 946.949884][T22236] ? asm_exc_page_fault+0x8/0x30 [ 946.954806][T22236] asm_exc_page_fault+0x1e/0x30 [ 946.959645][T22236] RIP: 0033:0x7f67b6426eab [ 946.964043][T22236] Code: 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 <64> 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 [ 946.983636][T22236] RSP: 002b:00007f67b4d5a168 EFLAGS: 00010213 [ 946.989689][T22236] RAX: 000000000000000e RBX: 00007f67b653a100 RCX: ffffffffffffffbc [ 946.997646][T22236] RDX: 0000000000000000 RSI: 0000000040605346 RDI: 0000000000000003 [ 947.005600][T22236] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 947.013554][T22236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 947.021506][T22236] R13: 00007f67b6a6db1f R14: 00007f67b4d5a300 R15: 0000000000022000 [ 947.029470][T22236] [ 947.045881][T22236] memory: usage 307200kB, limit 307200kB, failcnt 12955 [ 947.053174][T22236] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 947.060370][T22236] Memory cgroup stats for /syz1: [ 947.060538][T22236] anon 290045952 [ 947.060538][T22236] file 155648 [ 947.060538][T22236] kernel_stack 425984 [ 947.060538][T22236] pagetables 10305536 [ 947.060538][T22236] percpu 0 [ 947.060538][T22236] sock 0 [ 947.060538][T22236] shmem 155648 [ 947.060538][T22236] file_mapped 155648 [ 947.060538][T22236] file_dirty 0 [ 947.060538][T22236] file_writeback 0 [ 947.060538][T22236] swapcached 0 [ 947.060538][T22236] anon_thp 232783872 [ 947.060538][T22236] file_thp 0 [ 947.060538][T22236] shmem_thp 0 [ 947.060538][T22236] inactive_anon 290050048 [ 947.060538][T22236] active_anon 147456 [ 947.060538][T22236] inactive_file 0 [ 947.060538][T22236] active_file 0 [ 947.060538][T22236] unevictable 0 [ 947.060538][T22236] slab_reclaimable 571944 [ 947.060538][T22236] slab_unreclaimable 10687296 [ 947.060538][T22236] slab 11259240 [ 947.060538][T22236] workingset_refault_anon 0 [ 947.060538][T22236] workingset_refault_file 0 [ 947.060538][T22236] workingset_activate_anon 0 [ 947.156678][T22236] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22239,uid=0 [ 947.178407][T22236] Memory cgroup out of memory: Killed process 22239 (syz-executor.1) total-vm:57068kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 947.200094][ T28] oom_reaper: reaped process 22239 (syz-executor.1), now anon-rss:0kB, file-rss:14208kB, shmem-rss:0kB [ 947.211869][T22238] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 947.224115][T22238] CPU: 1 PID: 22238 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 947.232891][T22238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 947.242953][T22238] Call Trace: [ 947.246221][T22238] [ 947.249145][T22238] dump_stack_lvl+0xcd/0x134 [ 947.253753][T22238] dump_header+0x106/0x624 [ 947.258185][T22238] oom_kill_process.cold+0x10/0x15 [ 947.263309][T22238] out_of_memory+0x358/0x1460 [ 947.267989][T22238] ? find_held_lock+0x2d/0x110 [ 947.272767][T22238] ? oom_killer_disable+0x270/0x270 [ 947.278000][T22238] ? find_held_lock+0x2d/0x110 [ 947.282784][T22238] mem_cgroup_out_of_memory+0x206/0x270 [ 947.288343][T22238] ? mem_cgroup_margin+0x130/0x130 [ 947.293461][T22238] ? lock_downgrade+0x6e0/0x6e0 [ 947.298326][T22238] try_charge_memcg+0xc76/0x1270 [ 947.303281][T22238] ? mem_cgroup_oom_trylock+0x220/0x220 [ 947.308820][T22238] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 947.314561][T22238] ? lock_downgrade+0x6e0/0x6e0 [ 947.319430][T22238] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 947.325164][T22238] obj_cgroup_charge_pages+0x1e/0x90 [ 947.330448][T22238] __memcg_kmem_charge_page+0x392/0x5f0 [ 947.336000][T22238] __alloc_pages+0x1da/0x500 [ 947.340588][T22238] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 947.347353][T22238] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 947.353336][T22238] ? find_held_lock+0x2d/0x110 [ 947.358115][T22238] alloc_pages+0x1a7/0x300 [ 947.362533][T22238] pte_alloc_one+0x16/0x230 [ 947.367038][T22238] __pte_alloc+0x69/0x250 [ 947.371367][T22238] ? pmd_install+0x150/0x150 [ 947.375969][T22238] copy_page_range+0x186e/0x42c0 [ 947.380948][T22238] ? handle_mm_fault+0x790/0x790 [ 947.385893][T22238] ? __vma_link_rb+0x553/0x710 [ 947.390667][T22238] dup_mm+0xa4e/0x13e0 [ 947.394752][T22238] ? replace_mm_exe_file+0x490/0x490 [ 947.400050][T22238] ? __raw_spin_lock_init+0x36/0x110 [ 947.405343][T22238] copy_process+0x6fed/0x75a0 [ 947.410058][T22238] ? find_held_lock+0x2d/0x110 [ 947.414843][T22238] ? __cleanup_sighand+0xb0/0xb0 [ 947.419785][T22238] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 947.426025][T22238] ? _copy_from_user+0x5d/0x180 [ 947.430878][T22238] ? kernel_clone+0x314/0xab0 [ 947.435554][T22238] kernel_clone+0xe7/0xab0 [ 947.439967][T22238] ? create_io_thread+0xf0/0xf0 [ 947.444836][T22238] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 947.450831][T22238] __do_sys_clone3+0x1dd/0x2f0 [ 947.455610][T22238] ? __do_sys_clone+0x110/0x110 [ 947.460483][T22238] ? lock_downgrade+0x6e0/0x6e0 [ 947.465339][T22238] ? lock_downgrade+0x6e0/0x6e0 [ 947.470207][T22238] ? syscall_enter_from_user_mode+0x21/0x70 [ 947.476112][T22238] do_syscall_64+0x35/0xb0 [ 947.480529][T22238] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 947.486428][T22238] RIP: 0033:0x7f67b6426e99 [ 947.490843][T22238] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 947.510447][T22238] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 947.518862][T22238] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 947.526830][T22238] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 947.534802][T22238] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 947.542765][T22238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 947.550731][T22238] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 947.558712][T22238] [ 947.569617][T22238] memory: usage 307084kB, limit 307200kB, failcnt 12964 [ 947.576599][T22238] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 947.583988][T22238] Memory cgroup stats for /syz1: [ 947.585564][T22238] anon 290045952 [ 947.585564][T22238] file 155648 [ 947.585564][T22238] kernel_stack 393216 [ 947.585564][T22238] pagetables 10211328 [ 947.585564][T22238] percpu 0 [ 947.585564][T22238] sock 0 [ 947.585564][T22238] shmem 155648 [ 947.585564][T22238] file_mapped 155648 [ 947.585564][T22238] file_dirty 0 [ 947.585564][T22238] file_writeback 0 [ 947.585564][T22238] swapcached 0 [ 947.585564][T22238] anon_thp 232783872 [ 947.585564][T22238] file_thp 0 [ 947.585564][T22238] shmem_thp 0 [ 947.585564][T22238] inactive_anon 290054144 [ 947.585564][T22238] active_anon 147456 [ 947.585564][T22238] inactive_file 0 [ 947.585564][T22238] active_file 0 [ 947.585564][T22238] unevictable 0 [ 947.585564][T22238] slab_reclaimable 571944 [ 947.585564][T22238] slab_unreclaimable 10712776 [ 947.585564][T22238] slab 11284720 [ 947.585564][T22238] workingset_refault_anon 0 [ 947.585564][T22238] workingset_refault_file 0 [ 947.585564][T22238] workingset_activate_anon 0 [ 947.683616][T22238] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22238,uid=0 [ 947.700472][T22238] Memory cgroup out of memory: Killed process 22238 (syz-executor.1) total-vm:57068kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 947.757053][T22210] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 947.770053][T22210] CPU: 0 PID: 22210 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 947.778839][T22210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 947.788913][T22210] Call Trace: [ 947.792195][T22210] [ 947.795113][T22210] dump_stack_lvl+0xcd/0x134 [ 947.799706][T22210] dump_header+0x106/0x624 [ 947.804138][T22210] oom_kill_process.cold+0x10/0x15 [ 947.809240][T22210] out_of_memory+0x358/0x1460 [ 947.813914][T22210] ? find_held_lock+0x2d/0x110 [ 947.818667][T22210] ? oom_killer_disable+0x270/0x270 [ 947.823875][T22210] ? find_held_lock+0x2d/0x110 [ 947.828651][T22210] mem_cgroup_out_of_memory+0x206/0x270 [ 947.834209][T22210] ? mem_cgroup_margin+0x130/0x130 [ 947.839312][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 947.844169][T22210] try_charge_memcg+0xed2/0x1270 [ 947.849118][T22210] ? mem_cgroup_oom_trylock+0x220/0x220 [ 947.854774][T22210] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 947.860481][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 947.865326][T22210] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 947.871049][T22210] obj_cgroup_charge_pages+0x1e/0x90 [ 947.876335][T22210] __memcg_kmem_charge_page+0x392/0x5f0 [ 947.882043][T22210] __alloc_pages+0x1da/0x500 [ 947.886634][T22210] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 947.893394][T22210] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 947.899437][T22210] ? memcg_slab_post_alloc_hook+0x22f/0x430 [ 947.905353][T22210] alloc_pages+0x1a7/0x300 [ 947.909768][T22210] pte_alloc_one+0x16/0x230 [ 947.914386][T22210] __pte_alloc+0x69/0x250 [ 947.918715][T22210] ? pmd_install+0x150/0x150 [ 947.923308][T22210] copy_page_range+0x186e/0x42c0 [ 947.928259][T22210] ? dup_mm+0x7b9/0x13e0 [ 947.932494][T22210] ? handle_mm_fault+0x790/0x790 [ 947.937438][T22210] ? validate_mm_rb+0x46/0x2d0 [ 947.942196][T22210] ? down_write+0xde/0x150 [ 947.946698][T22210] ? __vma_link_rb+0x553/0x710 [ 947.951486][T22210] dup_mm+0xa4e/0x13e0 [ 947.955571][T22210] ? replace_mm_exe_file+0x490/0x490 [ 947.960841][T22210] ? __raw_spin_lock_init+0x36/0x110 [ 947.966121][T22210] copy_process+0x6fed/0x75a0 [ 947.970802][T22210] ? find_held_lock+0x2d/0x110 [ 947.975610][T22210] ? __cleanup_sighand+0xb0/0xb0 [ 947.980563][T22210] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 947.986800][T22210] ? _copy_from_user+0x5d/0x180 [ 947.991653][T22210] ? kernel_clone+0x314/0xab0 [ 947.996328][T22210] kernel_clone+0xe7/0xab0 [ 948.000755][T22210] ? create_io_thread+0xf0/0xf0 [ 948.005619][T22210] ? find_held_lock+0x2d/0x110 [ 948.010396][T22210] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 948.016392][T22210] __do_sys_clone3+0x1dd/0x2f0 [ 948.021164][T22210] ? __do_sys_clone+0x110/0x110 [ 948.026014][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 948.030877][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 948.035761][T22210] ? syscall_enter_from_user_mode+0x21/0x70 [ 948.041668][T22210] do_syscall_64+0x35/0xb0 [ 948.046079][T22210] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 948.051965][T22210] RIP: 0033:0x7f67b6426e99 [ 948.056377][T22210] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 948.075973][T22210] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 948.084378][T22210] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 948.092350][T22210] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 948.100324][T22210] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 948.108289][T22210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 948.116252][T22210] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 948.124224][T22210] [ 948.130731][T22210] memory: usage 307200kB, limit 307200kB, failcnt 13134 [ 948.137725][T22210] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 948.144585][T22210] Memory cgroup stats for /syz1: [ 948.144752][T22210] anon 290021376 [ 948.144752][T22210] file 155648 [ 948.144752][T22210] kernel_stack 393216 [ 948.144752][T22210] pagetables 10264576 [ 948.144752][T22210] percpu 0 [ 948.144752][T22210] sock 0 [ 948.144752][T22210] shmem 155648 [ 948.144752][T22210] file_mapped 155648 [ 948.144752][T22210] file_dirty 0 [ 948.144752][T22210] file_writeback 0 [ 948.144752][T22210] swapcached 0 [ 948.144752][T22210] anon_thp 232783872 [ 948.144752][T22210] file_thp 0 [ 948.144752][T22210] shmem_thp 0 [ 948.144752][T22210] inactive_anon 290009088 [ 948.144752][T22210] active_anon 147456 [ 948.144752][T22210] inactive_file 0 [ 948.144752][T22210] active_file 0 [ 948.144752][T22210] unevictable 0 [ 948.144752][T22210] slab_reclaimable 571944 [ 948.144752][T22210] slab_unreclaimable 10786448 [ 948.144752][T22210] slab 11358392 [ 948.144752][T22210] workingset_refault_anon 0 [ 948.144752][T22210] workingset_refault_file 0 [ 948.144752][T22210] workingset_activate_anon 0 [ 948.240285][T22210] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22240,uid=0 [ 948.257910][T22210] Memory cgroup out of memory: Killed process 22240 (syz-executor.1) total-vm:57068kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 948.278747][ T28] oom_reaper: reaped process 22240 (syz-executor.1), now anon-rss:0kB, file-rss:14080kB, shmem-rss:0kB [ 948.336503][T22210] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 948.348988][T22210] CPU: 0 PID: 22210 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 948.357770][T22210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 948.367815][T22210] Call Trace: [ 948.371098][T22210] [ 948.374033][T22210] dump_stack_lvl+0xcd/0x134 [ 948.378646][T22210] dump_header+0x106/0x624 [ 948.383123][T22210] oom_kill_process.cold+0x10/0x15 [ 948.388242][T22210] out_of_memory+0x358/0x1460 [ 948.392958][T22210] ? find_held_lock+0x2d/0x110 [ 948.397740][T22210] ? oom_killer_disable+0x270/0x270 [ 948.402946][T22210] ? find_held_lock+0x2d/0x110 [ 948.407711][T22210] mem_cgroup_out_of_memory+0x206/0x270 [ 948.413258][T22210] ? mem_cgroup_margin+0x130/0x130 [ 948.418368][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 948.423244][T22210] try_charge_memcg+0xed2/0x1270 [ 948.428189][T22210] ? mem_cgroup_oom_trylock+0x220/0x220 [ 948.433736][T22210] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 948.439457][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 948.444317][T22210] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 948.450048][T22210] obj_cgroup_charge_pages+0x1e/0x90 [ 948.455334][T22210] __memcg_kmem_charge_page+0x392/0x5f0 [ 948.460887][T22210] __alloc_pages+0x1da/0x500 [ 948.465479][T22210] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 948.472246][T22210] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 948.478228][T22210] ? memcg_slab_post_alloc_hook+0x22f/0x430 [ 948.484136][T22210] alloc_pages+0x1a7/0x300 [ 948.488563][T22210] pte_alloc_one+0x16/0x230 [ 948.493067][T22210] __pte_alloc+0x69/0x250 [ 948.497397][T22210] ? pmd_install+0x150/0x150 [ 948.501999][T22210] copy_page_range+0x186e/0x42c0 [ 948.506972][T22210] ? dup_mm+0x7b9/0x13e0 [ 948.511221][T22210] ? handle_mm_fault+0x790/0x790 [ 948.516162][T22210] ? validate_mm_rb+0x46/0x2d0 [ 948.520923][T22210] ? down_write+0xde/0x150 [ 948.525360][T22210] ? __vma_link_rb+0x553/0x710 [ 948.530131][T22210] dup_mm+0xa4e/0x13e0 [ 948.534214][T22210] ? replace_mm_exe_file+0x490/0x490 [ 948.539502][T22210] ? __raw_spin_lock_init+0x36/0x110 [ 948.544793][T22210] copy_process+0x6fed/0x75a0 [ 948.549482][T22210] ? find_held_lock+0x2d/0x110 [ 948.554260][T22210] ? __cleanup_sighand+0xb0/0xb0 [ 948.559209][T22210] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 948.565451][T22210] ? _copy_from_user+0x5d/0x180 [ 948.570306][T22210] ? kernel_clone+0x314/0xab0 [ 948.574980][T22210] kernel_clone+0xe7/0xab0 [ 948.579399][T22210] ? create_io_thread+0xf0/0xf0 [ 948.584279][T22210] ? find_held_lock+0x2d/0x110 [ 948.589045][T22210] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 948.595028][T22210] __do_sys_clone3+0x1dd/0x2f0 [ 948.599791][T22210] ? __do_sys_clone+0x110/0x110 [ 948.604650][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 948.609496][T22210] ? lock_downgrade+0x6e0/0x6e0 [ 948.614361][T22210] ? syscall_enter_from_user_mode+0x21/0x70 [ 948.620261][T22210] do_syscall_64+0x35/0xb0 [ 948.624690][T22210] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 948.630598][T22210] RIP: 0033:0x7f67b6426e99 [ 948.635019][T22210] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 948.654634][T22210] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 948.663138][T22210] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 948.671102][T22210] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 948.679067][T22210] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 948.687030][T22210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 948.694996][T22210] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 948.702979][T22210] [ 948.711245][T22210] memory: usage 307200kB, limit 307200kB, failcnt 13272 [ 948.757723][T22210] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 948.764920][T22210] Memory cgroup stats for /syz1: [ 948.765142][T22210] anon 290033664 [ 948.765142][T22210] file 155648 [ 948.765142][T22210] kernel_stack 393216 [ 948.765142][T22210] pagetables 10211328 [ 948.765142][T22210] percpu 0 [ 948.765142][T22210] sock 0 [ 948.765142][T22210] shmem 155648 [ 948.765142][T22210] file_mapped 155648 [ 948.765142][T22210] file_dirty 0 [ 948.765142][T22210] file_writeback 0 [ 948.765142][T22210] swapcached 0 [ 948.765142][T22210] anon_thp 232783872 [ 948.765142][T22210] file_thp 0 [ 948.765142][T22210] shmem_thp 0 [ 948.765142][T22210] inactive_anon 290041856 [ 948.765142][T22210] active_anon 147456 [ 948.765142][T22210] inactive_file 0 [ 948.765142][T22210] active_file 0 [ 948.765142][T22210] unevictable 0 [ 948.765142][T22210] slab_reclaimable 558024 [ 948.765142][T22210] slab_unreclaimable 10795096 [ 948.765142][T22210] slab 11353120 [ 948.765142][T22210] workingset_refault_anon 0 [ 948.765142][T22210] workingset_refault_file 0 18:16:59 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304dd, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:59 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000100)=0x3) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:16:59 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:16:59 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x37340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:16:59 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) 18:16:59 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d996, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 948.765142][T22210] workingset_activate_anon 0 [ 948.860878][T22210] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22209,uid=0 [ 948.885111][T22210] Memory cgroup out of memory: Killed process 22209 (syz-executor.1) total-vm:57068kB, anon-rss:2456kB, file-rss:15104kB, shmem-rss:68kB, UID:0 pgtables:104kB oom_score_adj:1000 [ 949.028484][T22249] device macvtap2 entered promiscuous mode [ 949.068724][T22249] device virt_wifi0 entered promiscuous mode 18:16:59 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d997, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 949.124720][T22249] team0: Device macvtap2 failed to register rx_handler [ 949.184834][T22249] device virt_wifi0 left promiscuous mode [ 949.207059][T22252] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 949.267984][T22252] CPU: 1 PID: 22252 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 949.276798][T22252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 949.282695][T22247] cgroup2: Unknown parameter '@[-}+' [ 949.286860][T22252] Call Trace: [ 949.286872][T22252] [ 949.286883][T22252] dump_stack_lvl+0xcd/0x134 [ 949.286920][T22252] dump_header+0x106/0x624 [ 949.286949][T22252] oom_kill_process.cold+0x10/0x15 [ 949.286979][T22252] out_of_memory+0x358/0x1460 [ 949.287015][T22252] ? find_held_lock+0x2d/0x110 [ 949.287046][T22252] ? oom_killer_disable+0x270/0x270 [ 949.287082][T22252] ? find_held_lock+0x2d/0x110 [ 949.287113][T22252] mem_cgroup_out_of_memory+0x206/0x270 [ 949.287142][T22252] ? mem_cgroup_margin+0x130/0x130 [ 949.287167][T22252] ? lock_downgrade+0x6e0/0x6e0 [ 949.287212][T22252] try_charge_memcg+0xed2/0x1270 [ 949.287249][T22252] ? mem_cgroup_oom_trylock+0x220/0x220 [ 949.287279][T22252] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 949.287306][T22252] ? lock_downgrade+0x6e0/0x6e0 [ 949.287339][T22252] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 949.287389][T22252] obj_cgroup_charge_pages+0x1e/0x90 [ 949.287417][T22252] __memcg_kmem_charge_page+0x392/0x5f0 [ 949.287452][T22252] copy_process+0x80a/0x75a0 [ 949.287480][T22252] ? find_held_lock+0x2d/0x110 [ 949.287525][T22252] ? __cleanup_sighand+0xb0/0xb0 [ 949.287559][T22252] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 949.405849][T22252] ? _copy_from_user+0x5d/0x180 [ 949.410732][T22252] ? kernel_clone+0x314/0xab0 [ 949.415431][T22252] kernel_clone+0xe7/0xab0 [ 949.419865][T22252] ? create_io_thread+0xf0/0xf0 [ 949.424747][T22252] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 949.430755][T22252] __do_sys_clone3+0x1dd/0x2f0 [ 949.435539][T22252] ? __do_sys_clone+0x110/0x110 [ 949.440418][T22252] ? lock_downgrade+0x6e0/0x6e0 [ 949.445287][T22252] ? lock_downgrade+0x6e0/0x6e0 [ 949.450170][T22252] ? syscall_enter_from_user_mode+0x21/0x70 [ 949.456094][T22252] do_syscall_64+0x35/0xb0 [ 949.460533][T22252] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 949.466455][T22252] RIP: 0033:0x7f67b6426e99 [ 949.470884][T22252] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 949.490514][T22252] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 949.498957][T22252] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 949.506952][T22252] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 949.514951][T22252] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 949.522941][T22252] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 949.530927][T22252] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 949.538938][T22252] [ 949.549605][T22252] memory: usage 307180kB, limit 307200kB, failcnt 13419 [ 949.557378][T22252] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 949.565302][T22252] Memory cgroup stats for /syz1: [ 949.566025][T22252] anon 290025472 [ 949.566025][T22252] file 155648 [ 949.566025][T22252] kernel_stack 327680 [ 949.566025][T22252] pagetables 10268672 [ 949.566025][T22252] percpu 0 [ 949.566025][T22252] sock 0 [ 949.566025][T22252] shmem 155648 [ 949.566025][T22252] file_mapped 155648 [ 949.566025][T22252] file_dirty 0 [ 949.566025][T22252] file_writeback 0 [ 949.566025][T22252] swapcached 0 [ 949.566025][T22252] anon_thp 232783872 [ 949.566025][T22252] file_thp 0 [ 949.566025][T22252] shmem_thp 0 [ 949.566025][T22252] inactive_anon 290033664 [ 949.566025][T22252] active_anon 147456 [ 949.566025][T22252] inactive_file 0 [ 949.566025][T22252] active_file 0 [ 949.566025][T22252] unevictable 0 [ 949.566025][T22252] slab_reclaimable 561104 [ 949.566025][T22252] slab_unreclaimable 10828744 [ 949.566025][T22252] slab 11389848 [ 949.566025][T22252] workingset_refault_anon 0 [ 949.566025][T22252] workingset_refault_file 0 [ 949.566025][T22252] workingset_activate_anon 0 18:16:59 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d998, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 949.704226][T22252] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22252,uid=0 18:16:59 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304de, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:00 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x38340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:00 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:00 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, 0x0) [ 949.827585][T22252] Memory cgroup out of memory: Killed process 22252 (syz-executor.1) total-vm:57068kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 949.925920][ T28] oom_reaper: reaped process 22252 (syz-executor.1), now anon-rss:0kB, file-rss:14080kB, shmem-rss:0kB 18:17:00 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d999, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 949.979144][T22370] device macvtap2 entered promiscuous mode [ 949.997019][T22241] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 950.008407][T22370] device virt_wifi0 entered promiscuous mode [ 950.026641][T22370] team0: Device macvtap2 failed to register rx_handler [ 950.087385][T22370] device virt_wifi0 left promiscuous mode [ 950.118135][T22241] CPU: 1 PID: 22241 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 950.126945][T22241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 950.137012][T22241] Call Trace: [ 950.140302][T22241] [ 950.143245][T22241] dump_stack_lvl+0xcd/0x134 [ 950.147862][T22241] dump_header+0x106/0x624 [ 950.152305][T22241] oom_kill_process.cold+0x10/0x15 [ 950.157519][T22241] out_of_memory+0x358/0x1460 [ 950.162218][T22241] ? find_held_lock+0x2d/0x110 [ 950.167003][T22241] ? oom_killer_disable+0x270/0x270 [ 950.172230][T22241] ? find_held_lock+0x2d/0x110 [ 950.177023][T22241] mem_cgroup_out_of_memory+0x206/0x270 [ 950.182585][T22241] ? mem_cgroup_margin+0x130/0x130 [ 950.187717][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 950.192607][T22241] try_charge_memcg+0xed2/0x1270 [ 950.197573][T22241] ? mem_cgroup_oom_trylock+0x220/0x220 [ 950.203140][T22241] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 950.208881][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 950.213775][T22241] obj_cgroup_charge_pages+0x1e/0x90 [ 950.219083][T22241] obj_cgroup_charge+0xf3/0x280 [ 950.223958][T22241] ? vm_area_dup+0x88/0x2b0 [ 950.228481][T22241] kmem_cache_alloc+0x92/0x3a0 [ 950.233267][T22241] vm_area_dup+0x88/0x2b0 [ 950.237637][T22241] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 950.243902][T22241] ? copy_page_range+0x2236/0x42c0 [ 950.249072][T22241] ? vm_area_alloc+0x110/0x110 [ 950.253872][T22241] ? dup_mm+0x7b9/0x13e0 [ 950.258130][T22241] ? handle_mm_fault+0x790/0x790 [ 950.263098][T22241] ? validate_mm_rb+0x46/0x2d0 [ 950.268002][T22241] ? down_write+0xde/0x150 [ 950.272438][T22241] ? __vma_link_rb+0x553/0x710 [ 950.277233][T22241] dup_mm+0x5fa/0x13e0 [ 950.281319][T22241] ? replace_mm_exe_file+0x490/0x490 [ 950.286601][T22241] ? __raw_spin_lock_init+0x36/0x110 [ 950.291905][T22241] copy_process+0x6fed/0x75a0 [ 950.296574][T22241] ? find_held_lock+0x2d/0x110 [ 950.301337][T22241] ? __cleanup_sighand+0xb0/0xb0 [ 950.306268][T22241] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 950.312500][T22241] ? _copy_from_user+0x5d/0x180 [ 950.317343][T22241] ? kernel_clone+0x314/0xab0 [ 950.322013][T22241] kernel_clone+0xe7/0xab0 [ 950.326427][T22241] ? create_io_thread+0xf0/0xf0 [ 950.331278][T22241] ? find_held_lock+0x2d/0x110 [ 950.336040][T22241] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 950.342021][T22241] __do_sys_clone3+0x1dd/0x2f0 [ 950.346795][T22241] ? __do_sys_clone+0x110/0x110 [ 950.351650][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 950.356494][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 950.361347][T22241] ? syscall_enter_from_user_mode+0x21/0x70 [ 950.367240][T22241] do_syscall_64+0x35/0xb0 [ 950.371648][T22241] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 950.377532][T22241] RIP: 0033:0x7f67b6426e99 [ 950.381933][T22241] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 950.401525][T22241] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 950.409928][T22241] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 950.417887][T22241] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 950.425843][T22241] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 950.433900][T22241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 950.441878][T22241] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 950.449866][T22241] [ 950.457031][T22241] memory: usage 307200kB, limit 307200kB, failcnt 13561 [ 950.465212][T22241] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 950.480972][T22241] Memory cgroup stats for /syz1: [ 950.481183][T22241] anon 290041856 [ 950.481183][T22241] file 155648 [ 950.481183][T22241] kernel_stack 327680 [ 950.481183][T22241] pagetables 10248192 [ 950.481183][T22241] percpu 0 [ 950.481183][T22241] sock 0 [ 950.481183][T22241] shmem 155648 [ 950.481183][T22241] file_mapped 155648 [ 950.481183][T22241] file_dirty 0 [ 950.481183][T22241] file_writeback 0 [ 950.481183][T22241] swapcached 0 [ 950.481183][T22241] anon_thp 232783872 [ 950.481183][T22241] file_thp 0 [ 950.481183][T22241] shmem_thp 0 [ 950.481183][T22241] inactive_anon 290050048 [ 950.481183][T22241] active_anon 147456 [ 950.481183][T22241] inactive_file 0 [ 950.481183][T22241] active_file 0 [ 950.481183][T22241] unevictable 0 [ 950.481183][T22241] slab_reclaimable 552584 [ 950.481183][T22241] slab_unreclaimable 10862344 [ 950.481183][T22241] slab 11414928 [ 950.481183][T22241] workingset_refault_anon 0 [ 950.481183][T22241] workingset_refault_file 0 [ 950.481183][T22241] workingset_activate_anon 0 [ 950.580146][T22241] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22242,uid=0 [ 950.609552][T22241] Memory cgroup out of memory: Killed process 22242 (syz-executor.1) total-vm:57068kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 950.765228][T22488] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 950.777102][T22488] CPU: 1 PID: 22488 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 950.785886][T22488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 950.795927][T22488] Call Trace: [ 950.799193][T22488] [ 950.802110][T22488] dump_stack_lvl+0xcd/0x134 [ 950.806696][T22488] dump_header+0x106/0x624 [ 950.811104][T22488] oom_kill_process.cold+0x10/0x15 [ 950.816209][T22488] out_of_memory+0x358/0x1460 [ 950.820881][T22488] ? find_held_lock+0x2d/0x110 [ 950.825638][T22488] ? oom_killer_disable+0x270/0x270 [ 950.830826][T22488] ? find_held_lock+0x2d/0x110 [ 950.835580][T22488] mem_cgroup_out_of_memory+0x206/0x270 [ 950.841113][T22488] ? mem_cgroup_margin+0x130/0x130 [ 950.846208][T22488] ? lock_downgrade+0x6e0/0x6e0 [ 950.851059][T22488] try_charge_memcg+0xed2/0x1270 [ 950.855987][T22488] ? mem_cgroup_oom_trylock+0x220/0x220 [ 950.861521][T22488] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 950.867230][T22488] ? lock_downgrade+0x6e0/0x6e0 [ 950.872100][T22488] obj_cgroup_charge_pages+0x1e/0x90 [ 950.877380][T22488] obj_cgroup_charge+0xf3/0x280 [ 950.882240][T22488] ? __d_alloc+0x2a/0x950 [ 950.886675][T22488] kmem_cache_alloc+0x92/0x3a0 [ 950.891428][T22488] ? __d_lookup+0x400/0x720 [ 950.895923][T22488] __d_alloc+0x2a/0x950 [ 950.900076][T22488] d_alloc+0x4a/0x230 [ 950.904068][T22488] __lookup_hash+0xc8/0x180 [ 950.908561][T22488] filename_create+0x184/0x480 [ 950.913488][T22488] ? filename_parentat+0x5a0/0x5a0 [ 950.918612][T22488] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 950.924843][T22488] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 950.931071][T22488] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 950.937301][T22488] ? __phys_addr_symbol+0x2c/0x70 [ 950.942327][T22488] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 950.948295][T22488] ? __check_object_size+0x16e/0x3f0 [ 950.953572][T22488] do_symlinkat+0xc4/0x2e0 [ 950.957979][T22488] ? __ia32_sys_unlink+0x110/0x110 [ 950.963075][T22488] ? getname_flags.part.0+0x1dd/0x4f0 [ 950.968461][T22488] __x64_sys_symlink+0x75/0x90 [ 950.973237][T22488] do_syscall_64+0x35/0xb0 [ 950.977645][T22488] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 950.983550][T22488] RIP: 0033:0x7f67b64267a7 [ 950.987947][T22488] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 951.007539][T22488] RSP: 002b:00007f67b6a6dd78 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 [ 951.015939][T22488] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f67b64267a7 [ 951.023897][T22488] RDX: 00007f67b6a6de53 RSI: 00007f67b64810a6 RDI: 00007f67b6a6de40 [ 951.031862][T22488] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f67b6a6dc10 [ 951.039832][T22488] R10: 00007f67b6a6dac7 R11: 0000000000000206 R12: 0000000000000001 [ 951.047789][T22488] R13: 0000000000000000 R14: 0000000000000001 R15: 00007f67b6a6de40 [ 951.055763][T22488] [ 951.065503][T22488] memory: usage 307200kB, limit 307200kB, failcnt 13717 [ 951.072524][T22488] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 951.081317][T22488] Memory cgroup stats for /syz1: [ 951.082191][T22488] anon 290070528 [ 951.082191][T22488] file 155648 [ 951.082191][T22488] kernel_stack 294912 [ 951.082191][T22488] pagetables 10235904 [ 951.082191][T22488] percpu 0 [ 951.082191][T22488] sock 0 [ 951.082191][T22488] shmem 155648 [ 951.082191][T22488] file_mapped 155648 [ 951.082191][T22488] file_dirty 0 [ 951.082191][T22488] file_writeback 0 [ 951.082191][T22488] swapcached 0 [ 951.082191][T22488] anon_thp 232783872 [ 951.082191][T22488] file_thp 0 [ 951.082191][T22488] shmem_thp 0 [ 951.082191][T22488] inactive_anon 290078720 [ 951.082191][T22488] active_anon 147456 [ 951.082191][T22488] inactive_file 0 [ 951.082191][T22488] active_file 0 [ 951.082191][T22488] unevictable 0 [ 951.082191][T22488] slab_reclaimable 552968 [ 951.082191][T22488] slab_unreclaimable 10889480 [ 951.082191][T22488] slab 11442448 [ 951.082191][T22488] workingset_refault_anon 0 [ 951.082191][T22488] workingset_refault_file 0 [ 951.082191][T22488] workingset_activate_anon 0 [ 951.180787][T22488] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22489,uid=0 [ 951.198377][T22488] Memory cgroup out of memory: Killed process 22489 (syz-executor.1) total-vm:57068kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 951.220968][ T28] oom_reaper: reaped process 22489 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 951.245347][T22241] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 951.258091][T22241] CPU: 0 PID: 22241 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 951.266873][T22241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 951.276919][T22241] Call Trace: [ 951.280191][T22241] [ 951.283130][T22241] dump_stack_lvl+0xcd/0x134 [ 951.287744][T22241] dump_header+0x106/0x624 [ 951.292180][T22241] oom_kill_process.cold+0x10/0x15 [ 951.297304][T22241] out_of_memory+0x358/0x1460 [ 951.301991][T22241] ? find_held_lock+0x2d/0x110 [ 951.306766][T22241] ? oom_killer_disable+0x270/0x270 [ 951.311957][T22241] ? find_held_lock+0x2d/0x110 [ 951.316711][T22241] mem_cgroup_out_of_memory+0x206/0x270 [ 951.322253][T22241] ? mem_cgroup_margin+0x130/0x130 [ 951.327374][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 951.332239][T22241] try_charge_memcg+0xed2/0x1270 [ 951.337172][T22241] ? mem_cgroup_oom_trylock+0x220/0x220 [ 951.342714][T22241] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 951.348453][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 951.353331][T22241] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 951.359064][T22241] obj_cgroup_charge_pages+0x1e/0x90 [ 951.364363][T22241] __memcg_kmem_charge_page+0x392/0x5f0 [ 951.369901][T22241] __alloc_pages+0x1da/0x500 [ 951.374487][T22241] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 951.381273][T22241] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 951.387267][T22241] ? memcg_slab_post_alloc_hook+0x22f/0x430 [ 951.393174][T22241] alloc_pages+0x1a7/0x300 [ 951.397605][T22241] pte_alloc_one+0x16/0x230 [ 951.402133][T22241] __pte_alloc+0x69/0x250 [ 951.406478][T22241] ? pmd_install+0x150/0x150 [ 951.411069][T22241] copy_page_range+0x186e/0x42c0 [ 951.416018][T22241] ? dup_mm+0x7b9/0x13e0 [ 951.420253][T22241] ? handle_mm_fault+0x790/0x790 [ 951.425203][T22241] ? validate_mm_rb+0x46/0x2d0 [ 951.429961][T22241] ? down_write+0xde/0x150 [ 951.434391][T22241] ? __vma_link_rb+0x553/0x710 [ 951.439159][T22241] dup_mm+0xa4e/0x13e0 [ 951.443264][T22241] ? replace_mm_exe_file+0x490/0x490 [ 951.448573][T22241] ? __raw_spin_lock_init+0x36/0x110 [ 951.453890][T22241] copy_process+0x6fed/0x75a0 [ 951.458588][T22241] ? find_held_lock+0x2d/0x110 [ 951.463387][T22241] ? __cleanup_sighand+0xb0/0xb0 [ 951.468352][T22241] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 951.474617][T22241] ? _copy_from_user+0x5d/0x180 [ 951.479479][T22241] ? kernel_clone+0x314/0xab0 [ 951.484175][T22241] kernel_clone+0xe7/0xab0 [ 951.488612][T22241] ? create_io_thread+0xf0/0xf0 [ 951.493496][T22241] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 951.499624][T22241] __do_sys_clone3+0x1dd/0x2f0 [ 951.504407][T22241] ? __do_sys_clone+0x110/0x110 [ 951.509290][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 951.514268][T22241] ? lock_downgrade+0x6e0/0x6e0 [ 951.519136][T22241] ? syscall_enter_from_user_mode+0x21/0x70 [ 951.525050][T22241] do_syscall_64+0x35/0xb0 [ 951.529459][T22241] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 951.535351][T22241] RIP: 0033:0x7f67b6426e99 [ 951.539763][T22241] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 951.559558][T22241] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 951.568166][T22241] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 951.576266][T22241] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 951.584281][T22241] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 951.592247][T22241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 951.600230][T22241] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 951.608239][T22241] [ 951.613100][T22241] memory: usage 307100kB, limit 307200kB, failcnt 13795 [ 951.621886][T22241] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 951.630715][T22241] Memory cgroup stats for /syz1: [ 951.630845][T22241] anon 290066432 [ 951.630845][T22241] file 155648 [ 951.630845][T22241] kernel_stack 262144 [ 951.630845][T22241] pagetables 10162176 [ 951.630845][T22241] percpu 0 [ 951.630845][T22241] sock 0 [ 951.630845][T22241] shmem 155648 [ 951.630845][T22241] file_mapped 155648 [ 951.630845][T22241] file_dirty 0 [ 951.630845][T22241] file_writeback 0 [ 951.630845][T22241] swapcached 0 [ 951.630845][T22241] anon_thp 232783872 [ 951.630845][T22241] file_thp 0 [ 951.630845][T22241] shmem_thp 0 [ 951.630845][T22241] inactive_anon 290074624 [ 951.630845][T22241] active_anon 147456 [ 951.630845][T22241] inactive_file 0 [ 951.630845][T22241] active_file 0 [ 951.630845][T22241] unevictable 0 [ 951.630845][T22241] slab_reclaimable 553736 [ 951.630845][T22241] slab_unreclaimable 10864864 [ 951.630845][T22241] slab 11418600 [ 951.630845][T22241] workingset_refault_anon 0 [ 951.630845][T22241] workingset_refault_file 0 [ 951.630845][T22241] workingset_activate_anon 0 [ 951.732235][T22241] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22241,uid=0 [ 951.748150][T22241] Memory cgroup out of memory: Killed process 22241 (syz-executor.1) total-vm:57068kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:02 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000100)=0x3) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000100)=0x3) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:17:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:02 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304df, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:02 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x39340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:02 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d99a, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:02 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, 0x0) [ 951.834840][T22492] cgroup2: Unknown parameter '@[-}+' [ 951.994945][T22498] device macvtap2 entered promiscuous mode 18:17:02 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 952.049101][T22498] device virt_wifi0 entered promiscuous mode 18:17:02 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d99b, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 952.091243][T22498] team0: Device macvtap2 failed to register rx_handler [ 952.112873][T22498] device virt_wifi0 left promiscuous mode [ 952.129082][T22507] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 952.140162][T22507] CPU: 1 PID: 22507 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 952.148985][T22507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 952.159146][T22507] Call Trace: [ 952.162444][T22507] [ 952.165385][T22507] dump_stack_lvl+0xcd/0x134 [ 952.170008][T22507] dump_header+0x106/0x624 [ 952.174448][T22507] oom_kill_process.cold+0x10/0x15 [ 952.179624][T22507] out_of_memory+0x358/0x1460 [ 952.183435][T22506] cgroup2: Unknown parameter '@[-}+' [ 952.184335][T22507] ? find_held_lock+0x2d/0x110 [ 952.184375][T22507] ? oom_killer_disable+0x270/0x270 [ 952.184415][T22507] ? find_held_lock+0x2d/0x110 [ 952.184465][T22507] mem_cgroup_out_of_memory+0x206/0x270 [ 952.184499][T22507] ? mem_cgroup_margin+0x130/0x130 [ 952.215110][T22507] ? lock_downgrade+0x6e0/0x6e0 [ 952.220006][T22507] try_charge_memcg+0xed2/0x1270 [ 952.224984][T22507] ? mem_cgroup_oom_trylock+0x220/0x220 [ 952.230709][T22507] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 952.236458][T22507] ? lock_downgrade+0x6e0/0x6e0 [ 952.241343][T22507] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 952.247106][T22507] obj_cgroup_charge_pages+0x1e/0x90 [ 952.252421][T22507] __memcg_kmem_charge_page+0x392/0x5f0 [ 952.258009][T22507] copy_process+0x80a/0x75a0 [ 952.262727][T22507] ? find_held_lock+0x2d/0x110 [ 952.267538][T22507] ? __cleanup_sighand+0xb0/0xb0 [ 952.272512][T22507] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 952.278785][T22507] ? _copy_from_user+0x5d/0x180 [ 952.283669][T22507] ? kernel_clone+0x314/0xab0 18:17:02 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000100)=0x3) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 952.288371][T22507] kernel_clone+0xe7/0xab0 [ 952.292817][T22507] ? create_io_thread+0xf0/0xf0 [ 952.297702][T22507] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 952.303813][T22507] __do_sys_clone3+0x1dd/0x2f0 [ 952.308590][T22507] ? __do_sys_clone+0x110/0x110 [ 952.313449][T22507] ? lock_downgrade+0x6e0/0x6e0 [ 952.318298][T22507] ? lock_downgrade+0x6e0/0x6e0 [ 952.323150][T22507] ? syscall_enter_from_user_mode+0x21/0x70 [ 952.329103][T22507] do_syscall_64+0x35/0xb0 [ 952.333515][T22507] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 952.339411][T22507] RIP: 0033:0x7f462bb41e99 [ 952.343835][T22507] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 952.363540][T22507] RSP: 002b:00007f462a496168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 952.371951][T22507] RAX: ffffffffffffffda RBX: 00007f462bc55030 RCX: 00007f462bb41e99 [ 952.379913][T22507] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 952.387875][T22507] RBP: 00007f462bb9bff1 R08: 0000000000000000 R09: 0000000000000000 [ 952.395838][T22507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 952.403799][T22507] R13: 00007f462c188b1f R14: 00007f462a496300 R15: 0000000000022000 [ 952.411775][T22507] [ 952.430628][T22507] memory: usage 307200kB, limit 307200kB, failcnt 962 [ 952.466362][T22507] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 952.482437][T22507] Memory cgroup stats for /syz5: [ 952.482611][T22507] anon 289910784 [ 952.482611][T22507] file 90112 [ 952.482611][T22507] kernel_stack 1015808 [ 952.482611][T22507] pagetables 9822208 [ 952.482611][T22507] percpu 0 [ 952.482611][T22507] sock 0 [ 952.482611][T22507] shmem 90112 [ 952.482611][T22507] file_mapped 90112 [ 952.482611][T22507] file_dirty 0 [ 952.482611][T22507] file_writeback 0 [ 952.482611][T22507] swapcached 0 [ 952.482611][T22507] anon_thp 224395264 [ 952.482611][T22507] file_thp 0 [ 952.482611][T22507] shmem_thp 0 [ 952.482611][T22507] inactive_anon 289914880 [ 952.482611][T22507] active_anon 86016 [ 952.482611][T22507] inactive_file 0 [ 952.482611][T22507] active_file 0 [ 952.482611][T22507] unevictable 0 [ 952.482611][T22507] slab_reclaimable 512792 [ 952.482611][T22507] slab_unreclaimable 10810856 [ 952.482611][T22507] slab 11323648 [ 952.482611][T22507] workingset_refault_anon 0 [ 952.482611][T22507] workingset_refault_file 0 [ 952.482611][T22507] workingset_activate_anon 0 [ 952.584407][T22507] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=6929,uid=0 18:17:02 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:02 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 952.626812][T22507] Memory cgroup out of memory: Killed process 6929 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:15060kB, shmem-rss:96kB, UID:0 pgtables:100kB oom_score_adj:1000 18:17:02 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3a340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:02 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d99c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 952.757907][T22532] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 952.784473][T22533] cgroup2: Unknown parameter '@[-}+' [ 952.807317][T22532] CPU: 1 PID: 22532 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 952.816134][T22532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 952.826209][T22532] Call Trace: [ 952.829499][T22532] [ 952.832444][T22532] dump_stack_lvl+0xcd/0x134 [ 952.837060][T22532] dump_header+0x106/0x624 [ 952.841504][T22532] oom_kill_process.cold+0x10/0x15 [ 952.846643][T22532] out_of_memory+0x358/0x1460 [ 952.851353][T22532] ? find_held_lock+0x2d/0x110 [ 952.856139][T22532] ? oom_killer_disable+0x270/0x270 [ 952.861365][T22532] ? find_held_lock+0x2d/0x110 [ 952.866152][T22532] mem_cgroup_out_of_memory+0x206/0x270 [ 952.870735][T22536] device macvtap2 entered promiscuous mode [ 952.871746][T22532] ? mem_cgroup_margin+0x130/0x130 [ 952.871776][T22532] ? lock_downgrade+0x6e0/0x6e0 [ 952.871822][T22532] try_charge_memcg+0xed2/0x1270 [ 952.878425][T22536] device virt_wifi0 entered promiscuous mode [ 952.882738][T22532] ? mem_cgroup_oom_trylock+0x220/0x220 18:17:03 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 952.882773][T22532] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 952.882801][T22532] ? lock_downgrade+0x6e0/0x6e0 [ 952.891264][T22536] team0: Device macvtap2 failed to register rx_handler [ 952.892575][T22532] obj_cgroup_charge_pages+0x1e/0x90 [ 952.892611][T22532] obj_cgroup_charge+0xf3/0x280 [ 952.931592][T22532] ? dup_fd+0x89/0xca0 [ 952.935675][T22532] kmem_cache_alloc+0x92/0x3a0 [ 952.940463][T22532] dup_fd+0x89/0xca0 [ 952.944377][T22532] ? find_held_lock+0x2d/0x110 [ 952.949160][T22532] unshare_fd+0x15e/0x1c0 [ 952.953478][T22532] ? walk_process_tree+0x2c0/0x2c0 [ 952.958586][T22532] __close_range+0x128/0x730 [ 952.963166][T22532] ? __get_unused_fd_flags+0x20/0x20 [ 952.968443][T22532] __x64_sys_close_range+0x6f/0xb0 [ 952.973542][T22532] ? syscall_enter_from_user_mode+0x21/0x70 [ 952.979430][T22532] do_syscall_64+0x35/0xb0 [ 952.983846][T22532] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 952.989756][T22532] RIP: 0033:0x7f67b6426e99 [ 952.994164][T22532] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 953.013793][T22532] RSP: 002b:00007f67b4d39168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 953.022234][T22532] RAX: ffffffffffffffda RBX: 00007f67b653a1d0 RCX: 00007f67b6426e99 [ 953.030230][T22532] RDX: 0000000000000002 RSI: ffffffffffffffff RDI: ffffffffffffffff [ 953.038219][T22532] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 953.046305][T22532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 18:17:03 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, 0x0) 18:17:03 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:03 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 953.054278][T22532] R13: 00007f67b6a6db1f R14: 00007f67b4d39300 R15: 0000000000022000 [ 953.062272][T22532] [ 953.081801][T22536] device virt_wifi0 left promiscuous mode [ 953.176934][T22532] memory: usage 307108kB, limit 307200kB, failcnt 13917 [ 953.186741][T22532] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 18:17:03 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d99d, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 953.238744][T22532] Memory cgroup stats for /syz1: [ 953.238984][T22532] anon 290230272 [ 953.238984][T22532] file 155648 [ 953.238984][T22532] kernel_stack 360448 [ 953.238984][T22532] pagetables 10084352 [ 953.238984][T22532] percpu 0 [ 953.238984][T22532] sock 0 [ 953.238984][T22532] shmem 155648 [ 953.238984][T22532] file_mapped 155648 [ 953.238984][T22532] file_dirty 0 [ 953.238984][T22532] file_writeback 0 [ 953.238984][T22532] swapcached 0 [ 953.238984][T22532] anon_thp 232783872 [ 953.238984][T22532] file_thp 0 [ 953.238984][T22532] shmem_thp 0 [ 953.238984][T22532] inactive_anon 290238464 [ 953.238984][T22532] active_anon 147456 [ 953.238984][T22532] inactive_file 0 [ 953.238984][T22532] active_file 0 [ 953.238984][T22532] unevictable 0 [ 953.238984][T22532] slab_reclaimable 553016 [ 953.238984][T22532] slab_unreclaimable 10772280 [ 953.238984][T22532] slab 11325296 [ 953.238984][T22532] workingset_refault_anon 0 [ 953.238984][T22532] workingset_refault_file 0 [ 953.238984][T22532] workingset_activate_anon 0 18:17:03 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3b340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:03 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 953.544254][T22658] device macvtap2 entered promiscuous mode [ 953.576553][T22658] device virt_wifi0 entered promiscuous mode [ 953.593716][T22658] team0: Device macvtap2 failed to register rx_handler [ 953.605259][T22658] device virt_wifi0 left promiscuous mode [ 953.628793][T22653] cgroup2: Unknown parameter '@[-}+' [ 953.668782][T22532] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=8899,uid=0 [ 953.685146][T22532] Memory cgroup out of memory: Killed process 8899 (syz-executor.1) total-vm:56936kB, anon-rss:2456kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 953.720285][ T28] oom_reaper: reaped process 8899 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 953.762003][T22525] cgroup2: Unknown parameter '@[-}+' 18:17:04 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xfffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000100)=0x18819, 0x4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:04 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:04 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d99e, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:04 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:04 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:04 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3c340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 953.928470][T22675] cgroup2: Unknown parameter '@[-}+' [ 953.952152][T22671] device macvtap2 entered promiscuous mode [ 953.966652][T22671] device virt_wifi0 entered promiscuous mode 18:17:04 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 954.006351][T22671] team0: Device macvtap2 failed to register rx_handler 18:17:04 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d99f, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 954.070496][T22671] device virt_wifi0 left promiscuous mode 18:17:04 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:04 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3d340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:04 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 954.365758][ T3647] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 954.401143][T22678] cgroup2: Unknown parameter '@[-}+' 18:17:04 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 954.421469][ T3647] CPU: 1 PID: 3647 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 954.430184][ T3647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 954.440258][ T3647] Call Trace: [ 954.443549][ T3647] [ 954.446489][ T3647] dump_stack_lvl+0xcd/0x134 [ 954.451102][ T3647] dump_header+0x106/0x624 [ 954.455544][ T3647] oom_kill_process.cold+0x10/0x15 [ 954.460676][ T3647] out_of_memory+0x358/0x1460 [ 954.465389][ T3647] ? find_held_lock+0x2d/0x110 [ 954.470175][ T3647] ? oom_killer_disable+0x270/0x270 [ 954.475400][ T3647] ? find_held_lock+0x2d/0x110 [ 954.480184][ T3647] mem_cgroup_out_of_memory+0x206/0x270 [ 954.485777][ T3647] ? mem_cgroup_margin+0x130/0x130 [ 954.490910][ T3647] ? lock_downgrade+0x6e0/0x6e0 [ 954.495809][ T3647] try_charge_memcg+0xed2/0x1270 [ 954.500778][ T3647] ? find_held_lock+0x2d/0x110 [ 954.505565][ T3647] ? mem_cgroup_oom_trylock+0x220/0x220 [ 954.511142][ T3647] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 954.516708][ T3647] ? lock_downgrade+0x6e0/0x6e0 [ 954.521600][ T3647] charge_memcg+0xae/0x360 [ 954.526041][ T3647] __mem_cgroup_charge+0x27/0x90 [ 954.531005][ T3647] wp_page_copy+0x294/0x2280 [ 954.535623][ T3647] ? do_page_mkwrite+0x550/0x550 [ 954.540587][ T3647] ? lock_downgrade+0x6e0/0x6e0 [ 954.545460][ T3647] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 954.551205][ T3647] ? vm_normal_page+0x146/0x2a0 [ 954.556085][ T3647] do_wp_page+0x2cb/0x1ae0 [ 954.560532][ T3647] __handle_mm_fault+0x1f41/0x5120 [ 954.565675][ T3647] ? vm_iomap_memory+0x190/0x190 [ 954.570674][ T3647] handle_mm_fault+0x1c8/0x790 [ 954.575475][ T3647] do_user_addr_fault+0x489/0x11c0 [ 954.580615][ T3647] exc_page_fault+0x9e/0x180 [ 954.585226][ T3647] ? asm_exc_page_fault+0x8/0x30 [ 954.590187][ T3647] asm_exc_page_fault+0x1e/0x30 [ 954.595057][ T3647] RIP: 0033:0x7f462bb11c1a [ 954.599482][ T3647] Code: 44 89 c8 87 07 83 f8 01 7e d5 45 31 d2 ba 01 00 00 00 be 81 00 00 00 89 d8 0f 05 eb c2 0f 1f 00 c3 0f 1f 80 00 00 00 00 31 c0 <87> 05 b8 1d 08 01 83 f8 01 7e c9 45 31 d2 ba 01 00 00 00 be 81 00 [ 954.619115][ T3647] RSP: 002b:00007f462c188d50 EFLAGS: 00010246 [ 954.625199][ T3647] RAX: 0000000000000000 RBX: 00000000000000ca RCX: 00007f462bb4048b [ 954.633181][ T3647] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f462bc275e0 [ 954.641169][ T3647] RBP: 0000000000000001 R08: 00007f462bc275e0 R09: 0000000000000000 [ 954.649151][ T3647] R10: 000055555673a6d0 R11: 0000000000000246 R12: 0000000000000001 [ 954.657135][ T3647] R13: 0000000000005d42 R14: 0000000000000001 R15: 00007f462c188e40 [ 954.665137][ T3647] [ 954.725598][T22692] device macvtap2 entered promiscuous mode [ 954.741763][T22692] device virt_wifi0 entered promiscuous mode [ 954.758928][T22692] team0: Device macvtap2 failed to register rx_handler [ 954.777740][T22692] device virt_wifi0 left promiscuous mode 18:17:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xfffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async, rerun: 64) close_range(r0, r1, 0x2) (rerun: 64) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async, rerun: 32) r4 = socket$xdp(0x2c, 0x3, 0x0) (rerun: 32) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000100)=0x18819, 0x4) (async, rerun: 32) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (rerun: 32) 18:17:05 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:05 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:05 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 954.853956][ T3647] memory: usage 307200kB, limit 307200kB, failcnt 1091 18:17:05 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 954.906977][ T3647] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 954.953252][ T3647] Memory cgroup stats for /syz5: [ 954.953425][ T3647] anon 290050048 [ 954.953425][ T3647] file 90112 [ 954.953425][ T3647] kernel_stack 917504 [ 954.953425][ T3647] pagetables 9736192 [ 954.953425][ T3647] percpu 0 [ 954.953425][ T3647] sock 0 [ 954.953425][ T3647] shmem 90112 [ 954.953425][ T3647] file_mapped 90112 [ 954.953425][ T3647] file_dirty 0 [ 954.953425][ T3647] file_writeback 0 [ 954.953425][ T3647] swapcached 0 [ 954.953425][ T3647] anon_thp 224395264 [ 954.953425][ T3647] file_thp 0 18:17:05 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:05 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3e340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:05 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 954.953425][ T3647] shmem_thp 0 [ 954.953425][ T3647] inactive_anon 290054144 [ 954.953425][ T3647] active_anon 86016 [ 954.953425][ T3647] inactive_file 0 [ 954.953425][ T3647] active_file 0 [ 954.953425][ T3647] unevictable 0 [ 954.953425][ T3647] slab_reclaimable 523624 [ 954.953425][ T3647] slab_unreclaimable 10878008 [ 954.953425][ T3647] slab 11401632 [ 954.953425][ T3647] workingset_refault_anon 0 [ 954.953425][ T3647] workingset_refault_file 0 [ 954.953425][ T3647] workingset_activate_anon 0 [ 955.078915][ T3647] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7077,uid=0 [ 955.157909][ T3647] Memory cgroup out of memory: Killed process 7077 (syz-executor.5) total-vm:60908kB, anon-rss:2496kB, file-rss:15060kB, shmem-rss:84kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 955.189380][T22707] device macvtap2 entered promiscuous mode [ 955.189931][ T28] oom_reaper: reaped process 7077 (syz-executor.5), now anon-rss:0kB, file-rss:14336kB, shmem-rss:36kB [ 955.204510][T22707] device virt_wifi0 entered promiscuous mode [ 955.215422][T22707] team0: Device macvtap2 failed to register rx_handler [ 955.235496][T22707] device virt_wifi0 left promiscuous mode [ 955.236837][T22699] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=1, oom_score_adj=1000 [ 955.304934][T22699] CPU: 1 PID: 22699 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 955.313738][T22699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 955.323808][T22699] Call Trace: [ 955.327094][T22699] [ 955.330029][T22699] dump_stack_lvl+0xcd/0x134 [ 955.334646][T22699] dump_header+0x106/0x624 [ 955.339086][T22699] oom_kill_process.cold+0x10/0x15 [ 955.344219][T22699] out_of_memory+0x358/0x1460 [ 955.348924][T22699] ? find_held_lock+0x2d/0x110 [ 955.353704][T22699] ? oom_killer_disable+0x270/0x270 [ 955.358927][T22699] ? find_held_lock+0x2d/0x110 [ 955.363708][T22699] mem_cgroup_out_of_memory+0x206/0x270 [ 955.369268][T22699] ? mem_cgroup_margin+0x130/0x130 [ 955.374488][T22699] ? lock_downgrade+0x6e0/0x6e0 [ 955.379376][T22699] try_charge_memcg+0xed2/0x1270 [ 955.384340][T22699] ? mem_cgroup_oom_trylock+0x220/0x220 [ 955.389902][T22699] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 955.395632][T22699] ? lock_downgrade+0x6e0/0x6e0 [ 955.400527][T22699] obj_cgroup_charge_pages+0x1e/0x90 [ 955.405824][T22699] obj_cgroup_charge+0xf3/0x280 [ 955.410693][T22699] kmem_cache_alloc_node+0x99/0x3f0 [ 955.415907][T22699] ? copy_process+0x5c4/0x75a0 [ 955.420687][T22699] copy_process+0x5c4/0x75a0 [ 955.425295][T22699] ? lock_chain_count+0x20/0x20 [ 955.430163][T22699] ? lock_chain_count+0x20/0x20 [ 955.435043][T22699] ? __cleanup_sighand+0xb0/0xb0 [ 955.439998][T22699] ? __lock_acquire+0x1655/0x5470 [ 955.445039][T22699] ? kernel_clone+0x314/0xab0 [ 955.449727][T22699] kernel_clone+0xe7/0xab0 [ 955.454156][T22699] ? create_io_thread+0xf0/0xf0 [ 955.459017][T22699] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 955.465018][T22699] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 955.471032][T22699] ? find_held_lock+0x2d/0x110 [ 955.475928][T22699] __do_sys_clone+0xc8/0x110 [ 955.480538][T22699] ? kernel_clone+0xab0/0xab0 [ 955.485226][T22699] ? lock_downgrade+0x6e0/0x6e0 [ 955.490115][T22699] ? syscall_enter_from_user_mode+0x21/0x70 [ 955.496043][T22699] do_syscall_64+0x35/0xb0 [ 955.500483][T22699] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 955.506396][T22699] RIP: 0033:0x7f67b64282c1 [ 955.510823][T22699] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 955.530446][T22699] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 955.538883][T22699] RAX: ffffffffffffffda RBX: 00007f67b4d39700 RCX: 00007f67b64282c1 [ 955.546877][T22699] RDX: 00007f67b4d399d0 RSI: 00007f67b4d392f0 RDI: 00000000003d0f00 [ 955.554864][T22699] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d39700 R09: 00007f67b4d39700 [ 955.562836][T22699] R10: 00007f67b4d399d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 955.570806][T22699] R13: 00007f67b6a6db1f R14: 00007f67b4d39300 R15: 0000000000022000 [ 955.578788][T22699] [ 955.598343][T22711] cgroup2: Unknown parameter '@[-}+' [ 955.655428][T22699] memory: usage 307200kB, limit 307200kB, failcnt 14074 [ 955.662894][T22699] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 955.670275][T22699] Memory cgroup stats for /syz1: [ 955.670494][T22699] anon 290369536 [ 955.670494][T22699] file 155648 [ 955.670494][T22699] kernel_stack 327680 [ 955.670494][T22699] pagetables 10141696 [ 955.670494][T22699] percpu 0 [ 955.670494][T22699] sock 0 [ 955.670494][T22699] shmem 155648 [ 955.670494][T22699] file_mapped 155648 [ 955.670494][T22699] file_dirty 0 [ 955.670494][T22699] file_writeback 0 [ 955.670494][T22699] swapcached 0 [ 955.670494][T22699] anon_thp 232783872 [ 955.670494][T22699] file_thp 0 [ 955.670494][T22699] shmem_thp 0 [ 955.670494][T22699] inactive_anon 290377728 [ 955.670494][T22699] active_anon 147456 [ 955.670494][T22699] inactive_file 0 [ 955.670494][T22699] active_file 0 [ 955.670494][T22699] unevictable 0 [ 955.670494][T22699] slab_reclaimable 550704 [ 955.670494][T22699] slab_unreclaimable 10693008 [ 955.670494][T22699] slab 11243712 [ 955.670494][T22699] workingset_refault_anon 0 [ 955.670494][T22699] workingset_refault_file 0 [ 955.670494][T22699] workingset_activate_anon 0 [ 955.782490][T22699] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22684,uid=0 [ 955.801745][T22699] Memory cgroup out of memory: Killed process 22684 (syz-executor.1) total-vm:60776kB, anon-rss:2488kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:06 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:06 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:06 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304e9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:06 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 956.325015][T22722] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 956.341448][T22722] CPU: 1 PID: 22722 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 956.350238][T22722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 956.360304][T22722] Call Trace: [ 956.363585][T22722] [ 956.366522][T22722] dump_stack_lvl+0xcd/0x134 [ 956.371129][T22722] dump_header+0x106/0x624 [ 956.375561][T22722] oom_kill_process.cold+0x10/0x15 [ 956.380689][T22722] out_of_memory+0x358/0x1460 [ 956.385388][T22722] ? find_held_lock+0x2d/0x110 [ 956.390167][T22722] ? oom_killer_disable+0x270/0x270 [ 956.395383][T22722] ? find_held_lock+0x2d/0x110 [ 956.400164][T22722] mem_cgroup_out_of_memory+0x206/0x270 [ 956.405726][T22722] ? mem_cgroup_margin+0x130/0x130 [ 956.410852][T22722] ? lock_downgrade+0x6e0/0x6e0 [ 956.415740][T22722] try_charge_memcg+0xed2/0x1270 [ 956.420701][T22722] ? mem_cgroup_oom_trylock+0x220/0x220 [ 956.426259][T22722] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 956.431995][T22722] ? lock_downgrade+0x6e0/0x6e0 [ 956.436870][T22722] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 956.442639][T22722] obj_cgroup_charge_pages+0x1e/0x90 [ 956.447946][T22722] __memcg_kmem_charge_page+0x392/0x5f0 [ 956.453515][T22722] copy_process+0x80a/0x75a0 [ 956.458122][T22722] ? lock_chain_count+0x20/0x20 [ 956.462992][T22722] ? lock_chain_count+0x20/0x20 [ 956.467870][T22722] ? __cleanup_sighand+0xb0/0xb0 [ 956.472814][T22722] ? lock_downgrade+0x6e0/0x6e0 [ 956.482458][T22722] ? __lock_acquire+0x1655/0x5470 [ 956.487498][T22722] ? kernel_clone+0x314/0xab0 [ 956.492187][T22722] kernel_clone+0xe7/0xab0 [ 956.496621][T22722] ? create_io_thread+0xf0/0xf0 [ 956.501480][T22722] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 956.507474][T22722] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 956.513484][T22722] ? find_held_lock+0x2d/0x110 [ 956.518267][T22722] __do_sys_clone+0xc8/0x110 [ 956.522873][T22722] ? kernel_clone+0xab0/0xab0 18:17:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xfffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async, rerun: 32) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (rerun: 32) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000100)=0x18819, 0x4) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:06 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3f000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:06 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x10, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:06 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304ea, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:06 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 956.527558][T22722] ? lock_downgrade+0x6e0/0x6e0 [ 956.532448][T22722] ? syscall_enter_from_user_mode+0x21/0x70 [ 956.538365][T22722] do_syscall_64+0x35/0xb0 [ 956.542796][T22722] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 956.548710][T22722] RIP: 0033:0x7f462bb432c1 [ 956.553140][T22722] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 956.572774][T22722] RSP: 002b:00007f462c188a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 956.581220][T22722] RAX: ffffffffffffffda RBX: 00007f462a496700 RCX: 00007f462bb432c1 [ 956.589211][T22722] RDX: 00007f462a4969d0 RSI: 00007f462a4962f0 RDI: 00000000003d0f00 [ 956.597198][T22722] RBP: 00007f462c188cb0 R08: 00007f462a496700 R09: 00007f462a496700 [ 956.605189][T22722] R10: 00007f462a4969d0 R11: 0000000000000206 R12: 00007f462c188b1e [ 956.613174][T22722] R13: 00007f462c188b1f R14: 00007f462a496300 R15: 0000000000022000 [ 956.621188][T22722] 18:17:06 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 956.664182][T22722] memory: usage 307200kB, limit 307200kB, failcnt 1143 [ 956.673500][T22734] device macvtap2 entered promiscuous mode [ 956.690240][T22734] device virt_wifi0 entered promiscuous mode [ 956.704505][T22734] team0: Device macvtap2 failed to register rx_handler [ 956.705119][T22722] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 956.719609][T22722] Memory cgroup stats for /syz5: [ 956.719829][T22722] anon 290140160 [ 956.719829][T22722] file 90112 [ 956.719829][T22722] kernel_stack 917504 [ 956.719829][T22722] pagetables 9650176 [ 956.719829][T22722] percpu 0 [ 956.719829][T22722] sock 0 [ 956.719829][T22722] shmem 90112 [ 956.719829][T22722] file_mapped 90112 [ 956.719829][T22722] file_dirty 0 [ 956.719829][T22722] file_writeback 0 [ 956.719829][T22722] swapcached 0 [ 956.719829][T22722] anon_thp 224395264 [ 956.719829][T22722] file_thp 0 [ 956.719829][T22722] shmem_thp 0 [ 956.719829][T22722] inactive_anon 290144256 [ 956.719829][T22722] active_anon 86016 [ 956.719829][T22722] inactive_file 0 [ 956.719829][T22722] active_file 0 [ 956.719829][T22722] unevictable 0 [ 956.719829][T22722] slab_reclaimable 524776 [ 956.719829][T22722] slab_unreclaimable 10896816 [ 956.719829][T22722] slab 11421592 [ 956.719829][T22722] workingset_refault_anon 0 [ 956.719829][T22722] workingset_refault_file 0 [ 956.719829][T22722] workingset_activate_anon 0 [ 956.815599][T22734] device virt_wifi0 left promiscuous mode [ 956.821013][T22722] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=6988,uid=0 [ 956.838102][T22722] Memory cgroup out of memory: Killed process 6988 (syz-executor.5) total-vm:60908kB, anon-rss:2496kB, file-rss:15060kB, shmem-rss:84kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 956.872489][T22728] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 956.904990][T22728] CPU: 0 PID: 22728 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 956.913790][T22728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 956.923861][T22728] Call Trace: [ 956.927143][T22728] [ 956.930068][T22728] dump_stack_lvl+0xcd/0x134 [ 956.934663][T22728] dump_header+0x106/0x624 [ 956.939078][T22728] oom_kill_process.cold+0x10/0x15 [ 956.944192][T22728] out_of_memory+0x358/0x1460 [ 956.948877][T22728] ? find_held_lock+0x2d/0x110 [ 956.953641][T22728] ? oom_killer_disable+0x270/0x270 [ 956.958848][T22728] ? find_held_lock+0x2d/0x110 [ 956.963614][T22728] mem_cgroup_out_of_memory+0x206/0x270 [ 956.969156][T22728] ? mem_cgroup_margin+0x130/0x130 [ 956.974263][T22728] ? lock_downgrade+0x6e0/0x6e0 [ 956.979130][T22728] try_charge_memcg+0xed2/0x1270 [ 956.984088][T22728] ? mem_cgroup_oom_trylock+0x220/0x220 [ 956.989638][T22728] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 956.995362][T22728] ? lock_downgrade+0x6e0/0x6e0 [ 957.000299][T22728] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 957.006029][T22728] obj_cgroup_charge_pages+0x1e/0x90 [ 957.011317][T22728] __memcg_kmem_charge_page+0x392/0x5f0 [ 957.016865][T22728] copy_process+0x80a/0x75a0 [ 957.021453][T22728] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 957.027697][T22728] ? wp_page_copy+0x55d/0x2280 [ 957.032464][T22728] ? lock_chain_count+0x20/0x20 [ 957.037319][T22728] ? lock_chain_count+0x20/0x20 [ 957.042199][T22728] ? __cleanup_sighand+0xb0/0xb0 [ 957.047140][T22728] ? __lock_acquire+0x1655/0x5470 [ 957.052167][T22728] ? kernel_clone+0x314/0xab0 [ 957.056843][T22728] kernel_clone+0xe7/0xab0 [ 957.061257][T22728] ? create_io_thread+0xf0/0xf0 [ 957.066100][T22728] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 957.072079][T22728] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 957.078067][T22728] ? find_held_lock+0x2d/0x110 [ 957.082831][T22728] __do_sys_clone+0xc8/0x110 [ 957.087433][T22728] ? kernel_clone+0xab0/0xab0 [ 957.092104][T22728] ? lock_downgrade+0x6e0/0x6e0 [ 957.096968][T22728] ? syscall_enter_from_user_mode+0x21/0x70 [ 957.102870][T22728] do_syscall_64+0x35/0xb0 [ 957.107283][T22728] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 957.113178][T22728] RIP: 0033:0x7f67b64282c1 [ 957.117589][T22728] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 957.137192][T22728] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 957.145601][T22728] RAX: ffffffffffffffda RBX: 00007f67b4d9c700 RCX: 00007f67b64282c1 [ 957.153567][T22728] RDX: 00007f67b4d9c9d0 RSI: 00007f67b4d9c2f0 RDI: 00000000003d0f00 [ 957.161548][T22728] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d9c700 R09: 00007f67b4d9c700 [ 957.169524][T22728] R10: 00007f67b4d9c9d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 957.177498][T22728] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 957.185491][T22728] 18:17:07 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304eb, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 957.216279][T22728] memory: usage 307136kB, limit 307200kB, failcnt 14134 18:17:07 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x12, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 957.462189][T22737] cgroup2: Unknown parameter '@[-}+' [ 957.470412][T22728] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 957.478021][T22728] Memory cgroup stats for /syz1: [ 957.478248][T22728] anon 290316288 [ 957.478248][T22728] file 155648 [ 957.478248][T22728] kernel_stack 229376 [ 957.478248][T22728] pagetables 10137600 [ 957.478248][T22728] percpu 0 [ 957.478248][T22728] sock 0 [ 957.478248][T22728] shmem 155648 [ 957.478248][T22728] file_mapped 155648 [ 957.478248][T22728] file_dirty 0 [ 957.478248][T22728] file_writeback 0 [ 957.478248][T22728] swapcached 0 [ 957.478248][T22728] anon_thp 232783872 [ 957.478248][T22728] file_thp 0 [ 957.478248][T22728] shmem_thp 0 [ 957.478248][T22728] inactive_anon 290324480 [ 957.478248][T22728] active_anon 147456 [ 957.478248][T22728] inactive_file 0 [ 957.478248][T22728] active_file 0 [ 957.478248][T22728] unevictable 0 [ 957.478248][T22728] slab_reclaimable 612784 [ 957.478248][T22728] slab_unreclaimable 10702808 [ 957.478248][T22728] slab 11315592 [ 957.478248][T22728] workingset_refault_anon 0 [ 957.478248][T22728] workingset_refault_file 0 [ 957.478248][T22728] workingset_activate_anon 0 [ 957.601475][T22728] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22724,uid=0 [ 957.626175][T22728] Memory cgroup out of memory: Killed process 22724 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 957.722988][T22748] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 957.745652][T22748] CPU: 1 PID: 22748 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 957.754466][T22748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 957.764529][T22748] Call Trace: [ 957.767816][T22748] [ 957.770754][T22748] dump_stack_lvl+0xcd/0x134 [ 957.775363][T22748] dump_header+0x106/0x624 [ 957.779795][T22748] oom_kill_process.cold+0x10/0x15 [ 957.784922][T22748] out_of_memory+0x358/0x1460 [ 957.789620][T22748] ? find_held_lock+0x2d/0x110 [ 957.794404][T22748] ? oom_killer_disable+0x270/0x270 [ 957.799628][T22748] ? find_held_lock+0x2d/0x110 [ 957.804385][T22748] mem_cgroup_out_of_memory+0x206/0x270 [ 957.809917][T22748] ? mem_cgroup_margin+0x130/0x130 [ 957.815012][T22748] ? lock_downgrade+0x6e0/0x6e0 [ 957.819856][T22748] try_charge_memcg+0xed2/0x1270 [ 957.824787][T22748] ? mem_cgroup_oom_trylock+0x220/0x220 [ 957.830317][T22748] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 957.836025][T22748] ? lock_downgrade+0x6e0/0x6e0 [ 957.840872][T22748] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 957.846591][T22748] obj_cgroup_charge_pages+0x1e/0x90 [ 957.851863][T22748] __memcg_kmem_charge_page+0x392/0x5f0 [ 957.857406][T22748] __alloc_pages+0x1da/0x500 [ 957.862007][T22748] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 957.868755][T22748] ? find_held_lock+0x2d/0x110 [ 957.873518][T22748] ? lock_downgrade+0x6e0/0x6e0 [ 957.878358][T22748] ? do_raw_spin_lock+0x120/0x2b0 [ 957.883372][T22748] alloc_pages+0x1a7/0x300 [ 957.887796][T22748] __pmd_alloc+0x3b/0x5c0 [ 957.892111][T22748] ? __pud_alloc+0xdd/0x170 [ 957.896606][T22748] copy_page_range+0x299e/0x42c0 [ 957.901555][T22748] ? handle_mm_fault+0x790/0x790 [ 957.906483][T22748] ? __vma_link_rb+0x553/0x710 [ 957.911238][T22748] dup_mm+0xa4e/0x13e0 [ 957.915297][T22748] ? replace_mm_exe_file+0x490/0x490 [ 957.920567][T22748] ? __raw_spin_lock_init+0x36/0x110 [ 957.925842][T22748] copy_process+0x6fed/0x75a0 [ 957.930503][T22748] ? find_held_lock+0x2d/0x110 [ 957.935273][T22748] ? __cleanup_sighand+0xb0/0xb0 [ 957.940220][T22748] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 957.946453][T22748] ? _copy_from_user+0x5d/0x180 [ 957.951297][T22748] ? kernel_clone+0x314/0xab0 [ 957.955961][T22748] kernel_clone+0xe7/0xab0 [ 957.960363][T22748] ? create_io_thread+0xf0/0xf0 [ 957.965204][T22748] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 957.971182][T22748] __do_sys_clone3+0x1dd/0x2f0 [ 957.975949][T22748] ? __do_sys_clone+0x110/0x110 [ 957.980791][T22748] ? lock_downgrade+0x6e0/0x6e0 [ 957.985625][T22748] ? lock_downgrade+0x6e0/0x6e0 [ 957.990469][T22748] ? syscall_enter_from_user_mode+0x21/0x70 [ 957.996353][T22748] do_syscall_64+0x35/0xb0 [ 958.000754][T22748] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 958.006635][T22748] RIP: 0033:0x7f67b6426e99 [ 958.011039][T22748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 958.030641][T22748] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 958.039040][T22748] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 958.046997][T22748] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 958.054954][T22748] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 958.062923][T22748] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 18:17:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:08 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:08 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x3f340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:08 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304ec, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 958.070876][T22748] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 958.078849][T22748] [ 958.100334][T22748] memory: usage 307196kB, limit 307200kB, failcnt 14163 [ 958.135576][T22748] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 958.146686][T22748] Memory cgroup stats for /syz1: [ 958.146844][T22748] anon 290242560 [ 958.146844][T22748] file 155648 [ 958.146844][T22748] kernel_stack 393216 [ 958.146844][T22748] pagetables 10076160 [ 958.146844][T22748] percpu 0 [ 958.146844][T22748] sock 0 [ 958.146844][T22748] shmem 155648 [ 958.146844][T22748] file_mapped 155648 [ 958.146844][T22748] file_dirty 0 [ 958.146844][T22748] file_writeback 0 [ 958.146844][T22748] swapcached 0 [ 958.146844][T22748] anon_thp 232783872 [ 958.146844][T22748] file_thp 0 [ 958.146844][T22748] shmem_thp 0 [ 958.146844][T22748] inactive_anon 290250752 [ 958.146844][T22748] active_anon 147456 [ 958.146844][T22748] inactive_file 0 [ 958.146844][T22748] active_file 0 [ 958.146844][T22748] unevictable 0 [ 958.146844][T22748] slab_reclaimable 615480 [ 958.146844][T22748] slab_unreclaimable 10757856 [ 958.146844][T22748] slab 11373336 [ 958.146844][T22748] workingset_refault_anon 0 [ 958.146844][T22748] workingset_refault_file 0 [ 958.146844][T22748] workingset_activate_anon 0 [ 958.273070][T22748] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22662,uid=0 [ 958.297947][T22748] Memory cgroup out of memory: Killed process 22662 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 958.372245][T22745] cgroup2: Unknown parameter '@[-}+' [ 958.381481][T22756] device macvtap2 entered promiscuous mode [ 958.411960][T22756] device virt_wifi0 entered promiscuous mode [ 958.461718][T22756] team0: Device macvtap2 failed to register rx_handler [ 958.497040][T22756] device virt_wifi0 left promiscuous mode [ 958.609641][T22759] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 958.636440][T22759] CPU: 0 PID: 22759 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 958.645236][T22759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 958.655304][T22759] Call Trace: [ 958.658590][T22759] [ 958.661526][T22759] dump_stack_lvl+0xcd/0x134 [ 958.666221][T22759] dump_header+0x106/0x624 [ 958.670655][T22759] oom_kill_process.cold+0x10/0x15 [ 958.675783][T22759] out_of_memory+0x358/0x1460 [ 958.680482][T22759] ? find_held_lock+0x2d/0x110 [ 958.685364][T22759] ? oom_killer_disable+0x270/0x270 [ 958.690580][T22759] ? find_held_lock+0x2d/0x110 [ 958.695361][T22759] mem_cgroup_out_of_memory+0x206/0x270 [ 958.700923][T22759] ? mem_cgroup_margin+0x130/0x130 [ 958.706050][T22759] ? lock_downgrade+0x6e0/0x6e0 [ 958.710934][T22759] try_charge_memcg+0xed2/0x1270 [ 958.715907][T22759] ? mem_cgroup_oom_trylock+0x220/0x220 [ 958.721470][T22759] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 958.727636][T22759] ? lock_downgrade+0x6e0/0x6e0 [ 958.732612][T22759] obj_cgroup_charge_pages+0x1e/0x90 [ 958.738093][T22759] obj_cgroup_charge+0xf3/0x280 [ 958.743056][T22759] ? prepare_creds+0x3f/0x7b0 [ 958.747743][T22759] kmem_cache_alloc+0x92/0x3a0 [ 958.752520][T22759] ? __validate_process_creds+0x20c/0x370 [ 958.758241][T22759] prepare_creds+0x3f/0x7b0 [ 958.762739][T22759] copy_creds+0x9f/0xb60 [ 958.767082][T22759] copy_process+0x1443/0x75a0 [ 958.771748][T22759] ? find_held_lock+0x2d/0x110 [ 958.776652][T22759] ? __cleanup_sighand+0xb0/0xb0 [ 958.781581][T22759] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 958.787813][T22759] ? _copy_from_user+0x5d/0x180 [ 958.792655][T22759] ? kernel_clone+0x314/0xab0 [ 958.797345][T22759] kernel_clone+0xe7/0xab0 [ 958.801748][T22759] ? create_io_thread+0xf0/0xf0 [ 958.806593][T22759] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 958.812564][T22759] __do_sys_clone3+0x1dd/0x2f0 [ 958.817317][T22759] ? __do_sys_clone+0x110/0x110 [ 958.822162][T22759] ? lock_downgrade+0x6e0/0x6e0 [ 958.826999][T22759] ? lock_downgrade+0x6e0/0x6e0 [ 958.831843][T22759] ? syscall_enter_from_user_mode+0x21/0x70 [ 958.837728][T22759] do_syscall_64+0x35/0xb0 [ 958.842132][T22759] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 958.848019][T22759] RIP: 0033:0x7f67b6426e99 [ 958.852436][T22759] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 958.872042][T22759] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 958.880443][T22759] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 958.888399][T22759] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 958.896356][T22759] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 958.904400][T22759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 958.912361][T22759] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 958.920343][T22759] [ 958.947821][T22759] memory: usage 307144kB, limit 307200kB, failcnt 14249 [ 958.955133][T22759] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 958.962920][T22759] Memory cgroup stats for /syz1: [ 958.963118][T22759] anon 290181120 [ 958.963118][T22759] file 155648 [ 958.963118][T22759] kernel_stack 425984 [ 958.963118][T22759] pagetables 10121216 [ 958.963118][T22759] percpu 0 [ 958.963118][T22759] sock 0 [ 958.963118][T22759] shmem 155648 [ 958.963118][T22759] file_mapped 155648 [ 958.963118][T22759] file_dirty 0 [ 958.963118][T22759] file_writeback 0 [ 958.963118][T22759] swapcached 0 [ 958.963118][T22759] anon_thp 232783872 [ 958.963118][T22759] file_thp 0 [ 958.963118][T22759] shmem_thp 0 [ 958.963118][T22759] inactive_anon 290189312 [ 958.963118][T22759] active_anon 147456 [ 958.963118][T22759] inactive_file 0 [ 958.963118][T22759] active_file 0 [ 958.963118][T22759] unevictable 0 [ 958.963118][T22759] slab_reclaimable 609656 [ 958.963118][T22759] slab_unreclaimable 10693736 [ 958.963118][T22759] slab 11303392 [ 958.963118][T22759] workingset_refault_anon 0 [ 958.963118][T22759] workingset_refault_file 0 [ 958.963118][T22759] workingset_activate_anon 0 [ 959.061512][T22759] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22759,uid=0 [ 959.077646][T22759] Memory cgroup out of memory: Killed process 22759 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 959.098122][ T28] oom_reaper: reaped process 22759 (syz-executor.1), now anon-rss:0kB, file-rss:14020kB, shmem-rss:0kB 18:17:09 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304ed, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:09 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x21, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:09 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:09 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) [ 959.134657][ T28] oom_reaper: reaped process 22728 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:4kB 18:17:09 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x40000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:09 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x4b4a41, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x1000, 0x1000, 0xffffffdf}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000600)=ANY=[@ANYBLOB="2f64650600000000000000941a7bc5cac257b2c20c292e1a9126cc4e5e3573cfd4dcd53d8f303103945e4a585c509f593b8344cc17fcdf97faf6e22830d3c043d5fc974d7443ae7bad8d00396ef0b0402fc477bac30014576f5072faf627076c2fe458a4df332c72b460107b59cf6255b6d8e90b0b1efc69330b8753dc05a86e05e670c719266543b3f4abab3ce450c6af42f8e5fddb1e4ba8c4d61c98161f45f6780cf26f4f21a4984b53401cf671f69881083598c29496d410dfc3ad694501399ac9088281c857be597b75970a76a7029032f63b057dc64c56f1414843ab6691cce7726b1fe26dcf7c2b90bd97893649a0ffdac4ab4cae992b4e018216fb3915b40f446e2dd4be8a4c61473d46374ebccb5de05d5e00"/293], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') pidfd_send_signal(0xffffffffffffffff, 0x2a, &(0x7f0000000400)={0x21, 0x1ff, 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 959.273691][T22763] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 959.284609][T22763] CPU: 1 PID: 22763 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 959.293400][T22763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 959.303469][T22763] Call Trace: [ 959.306759][T22763] [ 959.309707][T22763] dump_stack_lvl+0xcd/0x134 [ 959.314331][T22763] dump_header+0x106/0x624 [ 959.318777][T22763] oom_kill_process.cold+0x10/0x15 [ 959.323914][T22763] out_of_memory+0x358/0x1460 [ 959.328630][T22763] ? find_held_lock+0x2d/0x110 [ 959.333422][T22763] ? oom_killer_disable+0x270/0x270 [ 959.338654][T22763] ? find_held_lock+0x2d/0x110 [ 959.343449][T22763] mem_cgroup_out_of_memory+0x206/0x270 [ 959.349015][T22763] ? mem_cgroup_margin+0x130/0x130 [ 959.354144][T22763] ? lock_downgrade+0x6e0/0x6e0 [ 959.356824][T22773] device macvtap2 entered promiscuous mode [ 959.359029][T22763] try_charge_memcg+0xed2/0x1270 [ 959.369786][T22763] ? mem_cgroup_oom_trylock+0x220/0x220 [ 959.375348][T22763] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 959.381096][T22763] ? lock_downgrade+0x6e0/0x6e0 [ 959.385993][T22763] obj_cgroup_charge_pages+0x1e/0x90 [ 959.391305][T22763] obj_cgroup_charge+0xf3/0x280 [ 959.396177][T22763] ? vm_area_dup+0x88/0x2b0 [ 959.400703][T22763] kmem_cache_alloc+0x92/0x3a0 [ 959.401032][T22773] device virt_wifi0 entered promiscuous mode [ 959.405475][T22763] vm_area_dup+0x88/0x2b0 [ 959.415779][T22763] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 959.422040][T22763] ? copy_page_range+0x2236/0x42c0 [ 959.427206][T22763] ? vm_area_alloc+0x110/0x110 [ 959.431996][T22763] ? dup_mm+0x7b9/0x13e0 [ 959.436256][T22763] ? handle_mm_fault+0x790/0x790 [ 959.441221][T22763] ? validate_mm_rb+0x46/0x2d0 [ 959.446011][T22763] ? down_write+0xde/0x150 [ 959.448390][T22773] team0: Device macvtap2 failed to register rx_handler [ 959.450449][T22763] ? __vma_link_rb+0x553/0x710 [ 959.462072][T22763] dup_mm+0x5fa/0x13e0 [ 959.466171][T22763] ? replace_mm_exe_file+0x490/0x490 [ 959.471469][T22763] ? __raw_spin_lock_init+0x36/0x110 [ 959.476778][T22763] copy_process+0x6fed/0x75a0 [ 959.481475][T22763] ? find_held_lock+0x2d/0x110 [ 959.486283][T22763] ? __cleanup_sighand+0xb0/0xb0 [ 959.491250][T22763] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 959.497511][T22763] ? _copy_from_user+0x5d/0x180 [ 959.502394][T22763] ? kernel_clone+0x314/0xab0 [ 959.507097][T22763] kernel_clone+0xe7/0xab0 [ 959.511532][T22763] ? create_io_thread+0xf0/0xf0 [ 959.516412][T22763] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 959.522421][T22763] __do_sys_clone3+0x1dd/0x2f0 [ 959.527211][T22763] ? __do_sys_clone+0x110/0x110 [ 959.532100][T22763] ? lock_downgrade+0x6e0/0x6e0 [ 959.536959][T22763] ? lock_downgrade+0x6e0/0x6e0 [ 959.541840][T22763] ? syscall_enter_from_user_mode+0x21/0x70 [ 959.547757][T22763] do_syscall_64+0x35/0xb0 [ 959.552187][T22763] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 959.558101][T22763] RIP: 0033:0x7f67b6426e99 [ 959.562532][T22763] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 959.582149][T22763] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 959.590590][T22763] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 959.598570][T22763] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 959.606548][T22763] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 959.614522][T22763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 18:17:09 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:09 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304ee, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 959.622501][T22763] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 959.630502][T22763] [ 959.659110][T22773] device virt_wifi0 left promiscuous mode [ 959.668681][T22763] memory: usage 307200kB, limit 307200kB, failcnt 14459 18:17:09 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x48, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 959.690184][T22763] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 959.707064][T22763] Memory cgroup stats for /syz1: [ 959.707305][T22763] anon 290172928 [ 959.707305][T22763] file 155648 [ 959.707305][T22763] kernel_stack 262144 [ 959.707305][T22763] pagetables 10186752 [ 959.707305][T22763] percpu 0 [ 959.707305][T22763] sock 0 [ 959.707305][T22763] shmem 155648 [ 959.707305][T22763] file_mapped 155648 [ 959.707305][T22763] file_dirty 0 [ 959.707305][T22763] file_writeback 0 [ 959.707305][T22763] swapcached 0 [ 959.707305][T22763] anon_thp 232783872 [ 959.707305][T22763] file_thp 0 [ 959.707305][T22763] shmem_thp 0 [ 959.707305][T22763] inactive_anon 290181120 [ 959.707305][T22763] active_anon 147456 [ 959.707305][T22763] inactive_file 0 [ 959.707305][T22763] active_file 0 [ 959.707305][T22763] unevictable 0 [ 959.707305][T22763] slab_reclaimable 608888 [ 959.707305][T22763] slab_unreclaimable 10831640 [ 959.707305][T22763] slab 11440528 [ 959.707305][T22763] workingset_refault_anon 0 [ 959.707305][T22763] workingset_refault_file 0 [ 959.707305][T22763] workingset_activate_anon 0 [ 959.837050][T22763] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22774,uid=0 [ 959.865126][T22763] Memory cgroup out of memory: Killed process 22774 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:10 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) [ 959.989870][ T28] oom_reaper: reaped process 22774 (syz-executor.1), now anon-rss:0kB, file-rss:14208kB, shmem-rss:0kB [ 960.001395][ T3755] syz-executor.1 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=0, oom_score_adj=0 [ 960.071522][ T3755] CPU: 1 PID: 3755 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 960.080246][ T3755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 960.090317][ T3755] Call Trace: [ 960.093613][ T3755] [ 960.096555][ T3755] dump_stack_lvl+0xcd/0x134 [ 960.101177][ T3755] dump_header+0x106/0x624 [ 960.105618][ T3755] oom_kill_process.cold+0x10/0x15 [ 960.110753][ T3755] out_of_memory+0x358/0x1460 [ 960.115454][ T3755] ? find_held_lock+0x2d/0x110 [ 960.120239][ T3755] ? oom_killer_disable+0x270/0x270 [ 960.125465][ T3755] ? find_held_lock+0x2d/0x110 [ 960.130254][ T3755] mem_cgroup_out_of_memory+0x206/0x270 [ 960.135821][ T3755] ? mem_cgroup_margin+0x130/0x130 [ 960.140948][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 960.145835][ T3755] try_charge_memcg+0xc76/0x1270 [ 960.150800][ T3755] ? mem_cgroup_oom_trylock+0x220/0x220 [ 960.156385][ T3755] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 960.162219][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 960.167099][ T3755] ? kvmalloc_node+0x61/0x120 [ 960.171788][ T3755] obj_cgroup_charge_pages+0x1e/0x90 [ 960.177103][ T3755] obj_cgroup_charge+0xf3/0x280 [ 960.181973][ T3755] ? kvmalloc_node+0x61/0x120 [ 960.186670][ T3755] ? kvmalloc_node+0x61/0x120 [ 960.191358][ T3755] __kmalloc_node+0xa7/0x390 [ 960.195974][ T3755] kvmalloc_node+0x61/0x120 [ 960.200494][ T3755] xt_alloc_table_info+0x3c/0xa0 [ 960.205532][ T3755] do_ip6t_set_ctl+0x500/0xb90 [ 960.210390][ T3755] ? __mutex_lock+0x21a/0x12f0 [ 960.215172][ T3755] ? compat_do_replace.constprop.0+0x470/0x470 [ 960.221364][ T3755] ? wait_for_completion_io+0x270/0x270 [ 960.226948][ T3755] ? nf_sockopt_find.constprop.0+0x22d/0x2a0 [ 960.233021][ T3755] nf_setsockopt+0x83/0xe0 [ 960.237463][ T3755] ipv6_setsockopt+0x122/0x180 [ 960.242314][ T3755] tcp_setsockopt+0x136/0x2520 [ 960.247160][ T3755] ? tcp_sock_set_keepidle+0x40/0x40 [ 960.252471][ T3755] ? aa_sk_perm+0x30f/0xaa0 [ 960.256998][ T3755] ? aa_af_perm+0x230/0x230 [ 960.261514][ T3755] ? lockdep_hardirqs_on_prepare+0x400/0x400 18:17:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4a, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x60, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 960.267507][ T3755] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 960.273518][ T3755] ? sock_common_setsockopt+0x2b/0x100 [ 960.279003][ T3755] __sys_setsockopt+0x2db/0x610 [ 960.283877][ T3755] ? sock_common_recvmsg+0x1a0/0x1a0 [ 960.289182][ T3755] ? __ia32_sys_recv+0x100/0x100 [ 960.294138][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 960.299015][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 960.303904][ T3755] __x64_sys_setsockopt+0xba/0x150 [ 960.309037][ T3755] ? syscall_enter_from_user_mode+0x21/0x70 [ 960.314951][ T3755] do_syscall_64+0x35/0xb0 18:17:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x68, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 960.319379][ T3755] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 960.325303][ T3755] RIP: 0033:0x7f67b64284ea [ 960.329730][ T3755] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 960.349364][ T3755] RSP: 002b:00007f67b6a6d688 EFLAGS: 00000202 ORIG_RAX: 0000000000000036 [ 960.357796][ T3755] RAX: ffffffffffffffda RBX: 0000000000000029 RCX: 00007f67b64284ea 18:17:10 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x40340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:10 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9a9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 960.365790][ T3755] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 960.373946][ T3755] RBP: 00007f67b6a6d6b0 R08: 00000000000002e8 R09: ffffffffffff0000 [ 960.381938][ T3755] R10: 00007f67b6509000 R11: 0000000000000202 R12: 00007f67b6a6d710 [ 960.389926][ T3755] R13: 0000000000000003 R14: 00007f67b6a6d6ac R15: 00007f67b6508fa0 [ 960.397933][ T3755] [ 960.444447][ T3755] memory: usage 306956kB, limit 307200kB, failcnt 14510 [ 960.456412][ T3755] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 960.464197][ T3755] Memory cgroup stats for /syz1: [ 960.464402][ T3755] anon 290172928 [ 960.464402][ T3755] file 155648 [ 960.464402][ T3755] kernel_stack 229376 [ 960.464402][ T3755] pagetables 10104832 [ 960.464402][ T3755] percpu 0 [ 960.464402][ T3755] sock 0 [ 960.464402][ T3755] shmem 155648 [ 960.464402][ T3755] file_mapped 155648 [ 960.464402][ T3755] file_dirty 0 [ 960.464402][ T3755] file_writeback 0 [ 960.464402][ T3755] swapcached 0 [ 960.464402][ T3755] anon_thp 232783872 [ 960.464402][ T3755] file_thp 0 [ 960.464402][ T3755] shmem_thp 0 [ 960.464402][ T3755] inactive_anon 290181120 [ 960.464402][ T3755] active_anon 147456 [ 960.464402][ T3755] inactive_file 0 [ 960.464402][ T3755] active_file 0 [ 960.464402][ T3755] unevictable 0 [ 960.464402][ T3755] slab_reclaimable 602728 [ 960.464402][ T3755] slab_unreclaimable 10722112 [ 960.464402][ T3755] slab 11324840 [ 960.464402][ T3755] workingset_refault_anon 0 [ 960.464402][ T3755] workingset_refault_file 0 [ 960.464402][ T3755] workingset_activate_anon 0 [ 960.472265][T22801] device macvtap2 entered promiscuous mode [ 960.563095][ T3755] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22763,uid=0 [ 960.581520][ T3755] Memory cgroup out of memory: Killed process 22763 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 960.618227][T22801] device virt_wifi0 entered promiscuous mode [ 960.629812][T22801] team0: Device macvtap2 failed to register rx_handler [ 960.656114][T22801] device virt_wifi0 left promiscuous mode [ 960.722237][T22762] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 960.773363][T22762] CPU: 0 PID: 22762 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 960.782163][T22762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 960.792238][T22762] Call Trace: [ 960.795528][T22762] [ 960.798466][T22762] dump_stack_lvl+0xcd/0x134 [ 960.803082][T22762] dump_header+0x106/0x624 [ 960.807522][T22762] oom_kill_process.cold+0x10/0x15 [ 960.812655][T22762] out_of_memory+0x358/0x1460 [ 960.817368][T22762] ? find_held_lock+0x2d/0x110 [ 960.822151][T22762] ? oom_killer_disable+0x270/0x270 [ 960.827384][T22762] ? find_held_lock+0x2d/0x110 [ 960.832167][T22762] mem_cgroup_out_of_memory+0x206/0x270 [ 960.837737][T22762] ? mem_cgroup_margin+0x130/0x130 [ 960.842863][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 960.847748][T22762] try_charge_memcg+0xed2/0x1270 [ 960.852717][T22762] ? mem_cgroup_oom_trylock+0x220/0x220 [ 960.858281][T22762] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 960.864105][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 960.868975][T22762] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 960.874728][T22762] obj_cgroup_charge_pages+0x1e/0x90 [ 960.880031][T22762] __memcg_kmem_charge_page+0x392/0x5f0 [ 960.885602][T22762] __alloc_pages+0x1da/0x500 [ 960.890209][T22762] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 960.896214][T22762] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 960.903019][T22762] alloc_pages+0x1a7/0x300 [ 960.907462][T22762] __get_free_pages+0x8/0x40 [ 960.912071][T22762] pgd_alloc+0x81/0x360 [ 960.916240][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 960.921104][T22762] ? pgd_page_get_mm+0x40/0x40 [ 960.925883][T22762] ? lockdep_init_map_type+0x2c3/0x7b0 [ 960.931361][T22762] ? lockdep_init_map_type+0x2c3/0x7b0 [ 960.936849][T22762] mm_init+0x60a/0xab0 [ 960.940946][T22762] dup_mm+0xd8/0x13e0 [ 960.944949][T22762] ? copy_process+0x2998/0x75a0 [ 960.949859][T22762] ? replace_mm_exe_file+0x490/0x490 [ 960.955160][T22762] ? __raw_spin_lock_init+0x36/0x110 [ 960.960480][T22762] copy_process+0x6fed/0x75a0 [ 960.965175][T22762] ? find_held_lock+0x2d/0x110 [ 960.969977][T22762] ? __cleanup_sighand+0xb0/0xb0 [ 960.974940][T22762] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 960.981202][T22762] ? _copy_from_user+0x5d/0x180 [ 960.986078][T22762] ? kernel_clone+0x314/0xab0 [ 960.990788][T22762] kernel_clone+0xe7/0xab0 [ 960.995313][T22762] ? create_io_thread+0xf0/0xf0 [ 961.000201][T22762] ? find_held_lock+0x2d/0x110 [ 961.004993][T22762] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 961.010999][T22762] __do_sys_clone3+0x1dd/0x2f0 [ 961.015779][T22762] ? __do_sys_clone+0x110/0x110 [ 961.020659][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 961.025527][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 961.030416][T22762] ? syscall_enter_from_user_mode+0x21/0x70 [ 961.036349][T22762] do_syscall_64+0x35/0xb0 [ 961.040782][T22762] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 961.046696][T22762] RIP: 0033:0x7f67b6426e99 [ 961.051125][T22762] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 961.070756][T22762] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 961.079212][T22762] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 961.087200][T22762] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 961.095191][T22762] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 961.103180][T22762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 961.111169][T22762] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 961.119178][T22762] [ 961.148303][T22762] memory: usage 307172kB, limit 307200kB, failcnt 14622 [ 961.162947][T22762] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 961.172614][T22762] Memory cgroup stats for /syz1: [ 961.177066][T22762] anon 290177024 [ 961.177066][T22762] file 155648 [ 961.177066][T22762] kernel_stack 294912 [ 961.177066][T22762] pagetables 10170368 [ 961.177066][T22762] percpu 0 [ 961.177066][T22762] sock 0 [ 961.177066][T22762] shmem 155648 [ 961.177066][T22762] file_mapped 155648 [ 961.177066][T22762] file_dirty 0 [ 961.177066][T22762] file_writeback 0 [ 961.177066][T22762] swapcached 0 [ 961.177066][T22762] anon_thp 232783872 [ 961.177066][T22762] file_thp 0 [ 961.177066][T22762] shmem_thp 0 [ 961.177066][T22762] inactive_anon 290185216 [ 961.177066][T22762] active_anon 147456 [ 961.177066][T22762] inactive_file 0 [ 961.177066][T22762] active_file 0 [ 961.177066][T22762] unevictable 0 [ 961.177066][T22762] slab_reclaimable 590728 [ 961.177066][T22762] slab_unreclaimable 10796968 [ 961.177066][T22762] slab 11387696 [ 961.177066][T22762] workingset_refault_anon 0 [ 961.177066][T22762] workingset_refault_file 0 [ 961.177066][T22762] workingset_activate_anon 0 [ 961.275606][T22762] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22804,uid=0 [ 961.304822][T22762] Memory cgroup out of memory: Killed process 22804 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 961.334943][T22803] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 961.345647][T22803] CPU: 1 PID: 22803 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 961.354439][T22803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 961.364484][T22803] Call Trace: [ 961.367749][T22803] [ 961.370670][T22803] dump_stack_lvl+0xcd/0x134 [ 961.375256][T22803] dump_header+0x106/0x624 [ 961.379664][T22803] oom_kill_process.cold+0x10/0x15 [ 961.384762][T22803] out_of_memory+0x358/0x1460 [ 961.389430][T22803] ? find_held_lock+0x2d/0x110 [ 961.394182][T22803] ? oom_killer_disable+0x270/0x270 [ 961.399368][T22803] ? find_held_lock+0x2d/0x110 [ 961.404117][T22803] mem_cgroup_out_of_memory+0x206/0x270 [ 961.409653][T22803] ? mem_cgroup_margin+0x130/0x130 [ 961.414768][T22803] ? lock_downgrade+0x6e0/0x6e0 [ 961.419617][T22803] try_charge_memcg+0xc76/0x1270 [ 961.424575][T22803] ? mem_cgroup_oom_trylock+0x220/0x220 [ 961.430133][T22803] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 961.435869][T22803] ? lock_downgrade+0x6e0/0x6e0 [ 961.440724][T22803] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 961.446448][T22803] obj_cgroup_charge_pages+0x1e/0x90 [ 961.451722][T22803] __memcg_kmem_charge_page+0x392/0x5f0 [ 961.457262][T22803] copy_process+0x80a/0x75a0 [ 961.461841][T22803] ? find_held_lock+0x2d/0x110 [ 961.466603][T22803] ? __cleanup_sighand+0xb0/0xb0 [ 961.471535][T22803] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 961.477776][T22803] ? _copy_from_user+0x5d/0x180 [ 961.482619][T22803] ? kernel_clone+0x314/0xab0 [ 961.487282][T22803] kernel_clone+0xe7/0xab0 [ 961.491684][T22803] ? create_io_thread+0xf0/0xf0 [ 961.496527][T22803] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 961.502499][T22803] __do_sys_clone3+0x1dd/0x2f0 [ 961.507247][T22803] ? __do_sys_clone+0x110/0x110 [ 961.512100][T22803] ? lock_downgrade+0x6e0/0x6e0 [ 961.516936][T22803] ? lock_downgrade+0x6e0/0x6e0 [ 961.521783][T22803] ? syscall_enter_from_user_mode+0x21/0x70 [ 961.527676][T22803] do_syscall_64+0x35/0xb0 [ 961.532087][T22803] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 961.537980][T22803] RIP: 0033:0x7f67b6426e99 [ 961.542385][T22803] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 961.561988][T22803] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 961.570399][T22803] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 961.578454][T22803] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 961.586424][T22803] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 961.594390][T22803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 961.602352][T22803] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 961.610322][T22803] [ 961.617464][T22803] memory: usage 307068kB, limit 307200kB, failcnt 14655 [ 961.625713][T22803] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 961.632657][T22803] Memory cgroup stats for /syz1: [ 961.632877][T22803] anon 290172928 [ 961.632877][T22803] file 155648 [ 961.632877][T22803] kernel_stack 262144 [ 961.632877][T22803] pagetables 10125312 [ 961.632877][T22803] percpu 0 [ 961.632877][T22803] sock 0 [ 961.632877][T22803] shmem 155648 [ 961.632877][T22803] file_mapped 155648 [ 961.632877][T22803] file_dirty 0 [ 961.632877][T22803] file_writeback 0 [ 961.632877][T22803] swapcached 0 [ 961.632877][T22803] anon_thp 232783872 [ 961.632877][T22803] file_thp 0 [ 961.632877][T22803] shmem_thp 0 [ 961.632877][T22803] inactive_anon 290181120 [ 961.632877][T22803] active_anon 147456 [ 961.632877][T22803] inactive_file 0 [ 961.632877][T22803] active_file 0 [ 961.632877][T22803] unevictable 0 [ 961.632877][T22803] slab_reclaimable 583752 [ 961.632877][T22803] slab_unreclaimable 10778904 [ 961.632877][T22803] slab 11362656 [ 961.632877][T22803] workingset_refault_anon 0 [ 961.632877][T22803] workingset_refault_file 0 [ 961.632877][T22803] workingset_activate_anon 0 [ 961.730400][T22803] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22803,uid=0 [ 961.747653][T22803] Memory cgroup out of memory: Killed process 22803 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 961.768270][ T28] oom_reaper: reaped process 22803 (syz-executor.1), now anon-rss:0kB, file-rss:14080kB, shmem-rss:0kB [ 961.791967][T22762] syz-executor.1 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 961.825586][T22762] CPU: 0 PID: 22762 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 961.834395][T22762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 961.844447][T22762] Call Trace: [ 961.847726][T22762] [ 961.850643][T22762] dump_stack_lvl+0xcd/0x134 [ 961.855239][T22762] dump_header+0x106/0x624 [ 961.859644][T22762] oom_kill_process.cold+0x10/0x15 [ 961.864746][T22762] out_of_memory+0x358/0x1460 [ 961.869421][T22762] ? find_held_lock+0x2d/0x110 [ 961.874172][T22762] ? oom_killer_disable+0x270/0x270 [ 961.879358][T22762] ? find_held_lock+0x2d/0x110 [ 961.884110][T22762] mem_cgroup_out_of_memory+0x206/0x270 [ 961.889648][T22762] ? mem_cgroup_margin+0x130/0x130 [ 961.894741][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 961.899588][T22762] try_charge_memcg+0xed2/0x1270 [ 961.904595][T22762] ? mem_cgroup_oom_trylock+0x220/0x220 [ 961.910131][T22762] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 961.915853][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 961.920732][T22762] ? kvmalloc_node+0x61/0x120 [ 961.925393][T22762] obj_cgroup_charge_pages+0x1e/0x90 [ 961.930674][T22762] obj_cgroup_charge+0xf3/0x280 [ 961.935555][T22762] ? kvmalloc_node+0x61/0x120 [ 961.940233][T22762] ? kvmalloc_node+0x61/0x120 [ 961.944908][T22762] __kmalloc_node+0xa7/0x390 [ 961.949501][T22762] kvmalloc_node+0x61/0x120 [ 961.954015][T22762] alloc_fdtable+0xee/0x2a0 [ 961.958512][T22762] dup_fd+0x718/0xca0 [ 961.962482][T22762] copy_process+0x21e9/0x75a0 [ 961.967146][T22762] ? find_held_lock+0x2d/0x110 [ 961.971906][T22762] ? __cleanup_sighand+0xb0/0xb0 [ 961.976834][T22762] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 961.983069][T22762] ? _copy_from_user+0x5d/0x180 [ 961.987912][T22762] ? kernel_clone+0x314/0xab0 [ 961.992571][T22762] kernel_clone+0xe7/0xab0 [ 961.996974][T22762] ? create_io_thread+0xf0/0xf0 [ 962.001815][T22762] ? find_held_lock+0x2d/0x110 [ 962.006565][T22762] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 962.012542][T22762] __do_sys_clone3+0x1dd/0x2f0 [ 962.017291][T22762] ? __do_sys_clone+0x110/0x110 [ 962.022137][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 962.026973][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 962.031833][T22762] ? syscall_enter_from_user_mode+0x21/0x70 [ 962.037765][T22762] do_syscall_64+0x35/0xb0 [ 962.042175][T22762] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 962.048059][T22762] RIP: 0033:0x7f67b6426e99 [ 962.052461][T22762] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 962.072057][T22762] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 962.080459][T22762] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 962.088421][T22762] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 962.096375][T22762] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 962.104331][T22762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 962.112300][T22762] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 962.120272][T22762] [ 962.132741][T22762] memory: usage 307200kB, limit 307200kB, failcnt 14817 [ 962.140890][T22762] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 962.148187][T22762] Memory cgroup stats for /syz1: [ 962.148357][T22762] anon 290201600 [ 962.148357][T22762] file 155648 [ 962.148357][T22762] kernel_stack 294912 [ 962.148357][T22762] pagetables 10141696 [ 962.148357][T22762] percpu 0 [ 962.148357][T22762] sock 0 [ 962.148357][T22762] shmem 155648 [ 962.148357][T22762] file_mapped 155648 [ 962.148357][T22762] file_dirty 0 [ 962.148357][T22762] file_writeback 0 [ 962.148357][T22762] swapcached 0 [ 962.148357][T22762] anon_thp 232783872 [ 962.148357][T22762] file_thp 0 [ 962.148357][T22762] shmem_thp 0 [ 962.148357][T22762] inactive_anon 290181120 [ 962.148357][T22762] active_anon 147456 [ 962.148357][T22762] inactive_file 0 [ 962.148357][T22762] active_file 0 [ 962.148357][T22762] unevictable 0 [ 962.148357][T22762] slab_reclaimable 576808 [ 962.148357][T22762] slab_unreclaimable 10825800 [ 962.148357][T22762] slab 11402608 [ 962.148357][T22762] workingset_refault_anon 0 [ 962.148357][T22762] workingset_refault_file 0 [ 962.148357][T22762] workingset_activate_anon 0 [ 962.246677][T22762] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22807,uid=0 [ 962.262340][T22762] Memory cgroup out of memory: Killed process 22807 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 962.304587][T22762] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 962.316003][T22762] CPU: 1 PID: 22762 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 962.324789][T22762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 962.334844][T22762] Call Trace: [ 962.338109][T22762] [ 962.341031][T22762] dump_stack_lvl+0xcd/0x134 [ 962.345673][T22762] dump_header+0x106/0x624 [ 962.350085][T22762] oom_kill_process.cold+0x10/0x15 [ 962.355185][T22762] out_of_memory+0x358/0x1460 [ 962.359859][T22762] ? find_held_lock+0x2d/0x110 [ 962.364609][T22762] ? oom_killer_disable+0x270/0x270 [ 962.369796][T22762] ? find_held_lock+0x2d/0x110 [ 962.374645][T22762] mem_cgroup_out_of_memory+0x206/0x270 [ 962.380181][T22762] ? mem_cgroup_margin+0x130/0x130 [ 962.385285][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 962.390145][T22762] try_charge_memcg+0xed2/0x1270 [ 962.395085][T22762] ? mem_cgroup_oom_trylock+0x220/0x220 [ 962.400632][T22762] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 962.406400][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 962.411260][T22762] obj_cgroup_charge_pages+0x1e/0x90 [ 962.416540][T22762] obj_cgroup_charge+0xf3/0x280 [ 962.421384][T22762] ? vm_area_dup+0x88/0x2b0 [ 962.425885][T22762] kmem_cache_alloc+0x92/0x3a0 [ 962.430649][T22762] vm_area_dup+0x88/0x2b0 [ 962.434974][T22762] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 962.441208][T22762] ? copy_page_range+0x2236/0x42c0 [ 962.446349][T22762] ? vm_area_alloc+0x110/0x110 [ 962.451116][T22762] ? handle_mm_fault+0x790/0x790 [ 962.456053][T22762] ? __vma_link_rb+0x553/0x710 [ 962.460819][T22762] dup_mm+0x5fa/0x13e0 [ 962.464881][T22762] ? replace_mm_exe_file+0x490/0x490 [ 962.470420][T22762] ? __raw_spin_lock_init+0x36/0x110 [ 962.475702][T22762] copy_process+0x6fed/0x75a0 [ 962.480363][T22762] ? find_held_lock+0x2d/0x110 [ 962.485121][T22762] ? __cleanup_sighand+0xb0/0xb0 [ 962.490047][T22762] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 962.496281][T22762] ? _copy_from_user+0x5d/0x180 [ 962.501124][T22762] ? kernel_clone+0x314/0xab0 [ 962.505791][T22762] kernel_clone+0xe7/0xab0 [ 962.510193][T22762] ? create_io_thread+0xf0/0xf0 [ 962.515035][T22762] ? find_held_lock+0x2d/0x110 [ 962.519822][T22762] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 962.525794][T22762] __do_sys_clone3+0x1dd/0x2f0 [ 962.530546][T22762] ? __do_sys_clone+0x110/0x110 [ 962.535476][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 962.540311][T22762] ? lock_downgrade+0x6e0/0x6e0 [ 962.545160][T22762] ? syscall_enter_from_user_mode+0x21/0x70 [ 962.551059][T22762] do_syscall_64+0x35/0xb0 [ 962.555462][T22762] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 962.561343][T22762] RIP: 0033:0x7f67b6426e99 [ 962.565744][T22762] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 962.585454][T22762] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 962.593918][T22762] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 962.601887][T22762] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 962.609845][T22762] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 962.617808][T22762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 962.625764][T22762] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 962.633734][T22762] [ 962.643431][T22762] memory: usage 307064kB, limit 307200kB, failcnt 14888 [ 962.653000][T22762] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 962.660633][T22762] Memory cgroup stats for /syz1: [ 962.660733][T22762] anon 290201600 [ 962.660733][T22762] file 155648 [ 962.660733][T22762] kernel_stack 229376 [ 962.660733][T22762] pagetables 10076160 [ 962.660733][T22762] percpu 0 [ 962.660733][T22762] sock 0 [ 962.660733][T22762] shmem 155648 [ 962.660733][T22762] file_mapped 155648 [ 962.660733][T22762] file_dirty 0 [ 962.660733][T22762] file_writeback 0 [ 962.660733][T22762] swapcached 0 [ 962.660733][T22762] anon_thp 232783872 [ 962.660733][T22762] file_thp 0 [ 962.660733][T22762] shmem_thp 0 [ 962.660733][T22762] inactive_anon 290205696 [ 962.660733][T22762] active_anon 147456 [ 962.660733][T22762] inactive_file 0 [ 962.660733][T22762] active_file 0 [ 962.660733][T22762] unevictable 0 [ 962.660733][T22762] slab_reclaimable 581864 [ 962.660733][T22762] slab_unreclaimable 10839384 [ 962.660733][T22762] slab 11421248 [ 962.660733][T22762] workingset_refault_anon 0 [ 962.660733][T22762] workingset_refault_file 0 [ 962.660733][T22762] workingset_activate_anon 0 [ 962.757213][T22762] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22762,uid=0 [ 962.776215][T22762] Memory cgroup out of memory: Killed process 22762 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 962.834930][T22809] cgroup2: Unknown parameter '@[-}+' 18:17:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:13 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304ef, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:13 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9aa, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:13 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) (async) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x4b4a41, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async, rerun: 32) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (rerun: 32) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 32) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x1000, 0x1000, 0xffffffdf}, 0x20) (rerun: 32) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000600)=ANY=[@ANYBLOB="2f64650600000000000000941a7bc5cac257b2c20c292e1a9126cc4e5e3573cfd4dcd53d8f303103945e4a585c509f593b8344cc17fcdf97faf6e22830d3c043d5fc974d7443ae7bad8d00396ef0b0402fc477bac30014576f5072faf627076c2fe458a4df332c72b460107b59cf6255b6d8e90b0b1efc69330b8753dc05a86e05e670c719266543b3f4abab3ce450c6af42f8e5fddb1e4ba8c4d61c98161f45f6780cf26f4f21a4984b53401cf671f69881083598c29496d410dfc3ad694501399ac9088281c857be597b75970a76a7029032f63b057dc64c56f1414843ab6691cce7726b1fe26dcf7c2b90bd97893649a0ffdac4ab4cae992b4e018216fb3915b40f446e2dd4be8a4c61473d46374ebccb5de05d5e00"/293], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') pidfd_send_signal(0xffffffffffffffff, 0x2a, &(0x7f0000000400)={0x21, 0x1ff, 0x1}, 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async, rerun: 32) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (rerun: 32) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:13 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x41340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:13 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 962.999541][T22818] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 963.004153][T22817] device macvtap2 entered promiscuous mode [ 963.014154][T22818] CPU: 0 PID: 22818 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 963.024132][T22818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 963.034204][T22818] Call Trace: [ 963.037493][T22818] [ 963.040435][T22818] dump_stack_lvl+0xcd/0x134 [ 963.045053][T22818] dump_header+0x106/0x624 [ 963.049496][T22818] oom_kill_process.cold+0x10/0x15 [ 963.052093][T22817] device virt_wifi0 entered promiscuous mode [ 963.054632][T22818] out_of_memory+0x358/0x1460 [ 963.054674][T22818] ? find_held_lock+0x2d/0x110 [ 963.070068][T22818] ? oom_killer_disable+0x270/0x270 [ 963.075301][T22818] ? find_held_lock+0x2d/0x110 [ 963.080087][T22818] mem_cgroup_out_of_memory+0x206/0x270 [ 963.085656][T22818] ? mem_cgroup_margin+0x130/0x130 [ 963.090782][T22818] ? lock_downgrade+0x6e0/0x6e0 [ 963.095667][T22818] try_charge_memcg+0xed2/0x1270 [ 963.100634][T22818] ? find_held_lock+0x2d/0x110 [ 963.104989][T22817] team0: Device macvtap2 failed to register rx_handler [ 963.105411][T22818] ? mem_cgroup_oom_trylock+0x220/0x220 [ 963.117775][T22818] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 963.123349][T22818] ? lock_downgrade+0x6e0/0x6e0 [ 963.128237][T22818] charge_memcg+0xae/0x360 [ 963.132685][T22818] __mem_cgroup_charge+0x27/0x90 [ 963.137644][T22818] wp_page_copy+0x294/0x2280 [ 963.142273][T22818] ? do_page_mkwrite+0x550/0x550 [ 963.147224][T22818] ? lock_downgrade+0x6e0/0x6e0 [ 963.152089][T22818] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 963.157922][T22818] ? vm_normal_page+0x146/0x2a0 [ 963.162806][T22818] do_wp_page+0x2cb/0x1ae0 [ 963.167245][T22818] __handle_mm_fault+0x1f41/0x5120 [ 963.172385][T22818] ? vm_iomap_memory+0x190/0x190 [ 963.177372][T22818] handle_mm_fault+0x1c8/0x790 [ 963.182156][T22818] do_user_addr_fault+0x489/0x11c0 [ 963.187294][T22818] exc_page_fault+0x9e/0x180 [ 963.191901][T22818] ? asm_exc_page_fault+0x8/0x30 [ 963.196859][T22818] asm_exc_page_fault+0x1e/0x30 [ 963.201727][T22818] RIP: 0033:0x7f462baf0d1a [ 963.206156][T22818] Code: 04 62 13 00 48 89 05 f5 61 13 00 c7 05 db 61 13 00 01 00 00 00 48 c7 05 c8 d6 09 01 00 00 00 00 c7 05 c6 d6 09 01 00 00 00 00 05 24 17 0a 01 00 00 00 00 c3 0f 1f 00 48 8d 7e 58 89 f1 48 8d [ 963.225782][T22818] RSP: 002b:00007f462c188d28 EFLAGS: 00010202 [ 963.231868][T22818] RAX: 000055555673a6c0 RBX: 0000000000000001 RCX: 00007f462cb8e3c0 [ 963.239850][T22818] RDX: 0000000000000001 RSI: 00007f462bc26ef0 RDI: 0000000000000001 18:17:13 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9ab, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 963.247834][T22818] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f462bc26ef0 [ 963.255816][T22818] R10: 000055555673a400 R11: 0000000000000202 R12: 0000000000000001 [ 963.263891][T22818] R13: 0000000000000001 R14: 0000000000000001 R15: 00007f462c188e40 [ 963.271893][T22818] [ 963.287599][T22817] device virt_wifi0 left promiscuous mode [ 963.317794][T22818] memory: usage 307200kB, limit 307200kB, failcnt 1267 [ 963.341551][T22818] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 963.349652][T22818] Memory cgroup stats for /syz5: [ 963.349808][T22818] anon 290496512 [ 963.349808][T22818] file 90112 [ 963.349808][T22818] kernel_stack 851968 [ 963.349808][T22818] pagetables 9543680 [ 963.349808][T22818] percpu 0 [ 963.349808][T22818] sock 0 [ 963.349808][T22818] shmem 90112 [ 963.349808][T22818] file_mapped 90112 [ 963.349808][T22818] file_dirty 0 [ 963.349808][T22818] file_writeback 0 [ 963.349808][T22818] swapcached 0 [ 963.349808][T22818] anon_thp 224395264 [ 963.349808][T22818] file_thp 0 [ 963.349808][T22818] shmem_thp 0 [ 963.349808][T22818] inactive_anon 290500608 [ 963.349808][T22818] active_anon 86016 [ 963.349808][T22818] inactive_file 0 [ 963.349808][T22818] active_file 0 [ 963.349808][T22818] unevictable 0 [ 963.349808][T22818] slab_reclaimable 504256 [ 963.349808][T22818] slab_unreclaimable 10763632 [ 963.349808][T22818] slab 11267888 [ 963.349808][T22818] workingset_refault_anon 0 [ 963.349808][T22818] workingset_refault_file 0 [ 963.349808][T22818] workingset_activate_anon 0 [ 963.507980][T22818] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7035,uid=0 18:17:13 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x74, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 963.568102][T22818] Memory cgroup out of memory: Killed process 7035 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:15060kB, shmem-rss:84kB, UID:0 pgtables:100kB oom_score_adj:1000 18:17:13 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x42340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:13 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9ac, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 963.670735][ T28] oom_reaper: reaped process 7035 (syz-executor.5), now anon-rss:0kB, file-rss:14336kB, shmem-rss:36kB [ 963.684722][T22820] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=1, oom_score_adj=1000 [ 963.717864][T22820] CPU: 0 PID: 22820 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 963.726843][T22820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 963.736914][T22820] Call Trace: [ 963.740208][T22820] [ 963.743153][T22820] dump_stack_lvl+0xcd/0x134 [ 963.747771][T22820] dump_header+0x106/0x624 [ 963.752214][T22820] oom_kill_process.cold+0x10/0x15 [ 963.757357][T22820] out_of_memory+0x358/0x1460 [ 963.762076][T22820] ? find_held_lock+0x2d/0x110 [ 963.766889][T22820] ? oom_killer_disable+0x270/0x270 [ 963.772116][T22820] ? find_held_lock+0x2d/0x110 [ 963.776906][T22820] mem_cgroup_out_of_memory+0x206/0x270 [ 963.782473][T22820] ? mem_cgroup_margin+0x130/0x130 [ 963.787607][T22820] ? lock_downgrade+0x6e0/0x6e0 [ 963.792494][T22820] try_charge_memcg+0xc76/0x1270 [ 963.797459][T22820] ? mem_cgroup_oom_trylock+0x220/0x220 [ 963.803037][T22820] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 963.808777][T22820] ? lock_downgrade+0x6e0/0x6e0 [ 963.813675][T22820] obj_cgroup_charge_pages+0x1e/0x90 [ 963.818979][T22820] obj_cgroup_charge+0xf3/0x280 [ 963.823856][T22820] kmem_cache_alloc_node+0x99/0x3f0 [ 963.829070][T22820] ? copy_process+0x5c4/0x75a0 [ 963.833856][T22820] copy_process+0x5c4/0x75a0 [ 963.838467][T22820] ? lock_chain_count+0x20/0x20 [ 963.843338][T22820] ? lock_chain_count+0x20/0x20 [ 963.848222][T22820] ? __cleanup_sighand+0xb0/0xb0 [ 963.853181][T22820] ? __lock_acquire+0x1655/0x5470 [ 963.858232][T22820] ? kernel_clone+0x314/0xab0 [ 963.863020][T22820] kernel_clone+0xe7/0xab0 [ 963.867455][T22820] ? create_io_thread+0xf0/0xf0 [ 963.872667][T22820] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 963.878665][T22820] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 963.884708][T22820] ? find_held_lock+0x2d/0x110 [ 963.889533][T22820] __do_sys_clone+0xc8/0x110 [ 963.894139][T22820] ? kernel_clone+0xab0/0xab0 [ 963.898829][T22820] ? lock_downgrade+0x6e0/0x6e0 [ 963.903710][T22820] ? syscall_enter_from_user_mode+0x21/0x70 [ 963.909628][T22820] do_syscall_64+0x35/0xb0 [ 963.914058][T22820] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 963.920057][T22820] RIP: 0033:0x7f67b64282c1 [ 963.924481][T22820] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 963.944101][T22820] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 963.952534][T22820] RAX: ffffffffffffffda RBX: 00007f67b4d18700 RCX: 00007f67b64282c1 [ 963.960518][T22820] RDX: 00007f67b4d189d0 RSI: 00007f67b4d182f0 RDI: 00000000003d0f00 [ 963.968504][T22820] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d18700 R09: 00007f67b4d18700 [ 963.976490][T22820] R10: 00007f67b4d189d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 963.984475][T22820] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 963.992480][T22820] [ 964.014862][T22840] cgroup2: Unknown parameter '@[-}+' 18:17:14 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 964.052350][T22834] device macvtap2 entered promiscuous mode [ 964.073872][T22834] device virt_wifi0 entered promiscuous mode 18:17:14 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7a, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 964.097666][T22834] team0: Device macvtap2 failed to register rx_handler [ 964.105839][T22834] device virt_wifi0 left promiscuous mode [ 964.232310][T22820] memory: usage 307040kB, limit 307200kB, failcnt 15022 [ 964.296543][T22820] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 964.367559][T22820] Memory cgroup stats for /syz1: [ 964.367718][T22820] anon 290254848 [ 964.367718][T22820] file 155648 [ 964.367718][T22820] kernel_stack 327680 [ 964.367718][T22820] pagetables 9977856 [ 964.367718][T22820] percpu 0 [ 964.367718][T22820] sock 0 [ 964.367718][T22820] shmem 155648 [ 964.367718][T22820] file_mapped 155648 [ 964.367718][T22820] file_dirty 0 [ 964.367718][T22820] file_writeback 0 [ 964.367718][T22820] swapcached 0 [ 964.367718][T22820] anon_thp 232783872 [ 964.367718][T22820] file_thp 0 [ 964.367718][T22820] shmem_thp 0 [ 964.367718][T22820] inactive_anon 290263040 [ 964.367718][T22820] active_anon 147456 [ 964.367718][T22820] inactive_file 0 [ 964.367718][T22820] active_file 0 [ 964.367718][T22820] unevictable 0 [ 964.367718][T22820] slab_reclaimable 593808 [ 964.367718][T22820] slab_unreclaimable 10806720 [ 964.367718][T22820] slab 11400528 [ 964.367718][T22820] workingset_refault_anon 0 [ 964.367718][T22820] workingset_refault_file 0 [ 964.367718][T22820] workingset_activate_anon 0 [ 965.043109][T22820] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=8820,uid=0 [ 965.065107][T22820] Memory cgroup out of memory: Killed process 8820 (syz-executor.1) total-vm:56936kB, anon-rss:2456kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 965.153702][T22845] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 965.199325][T22845] CPU: 1 PID: 22845 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 965.208128][T22845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 965.218198][T22845] Call Trace: [ 965.221490][T22845] [ 965.224422][T22845] dump_stack_lvl+0xcd/0x134 [ 965.229031][T22845] dump_header+0x106/0x624 [ 965.233463][T22845] oom_kill_process.cold+0x10/0x15 [ 965.238585][T22845] out_of_memory+0x358/0x1460 [ 965.243295][T22845] ? find_held_lock+0x2d/0x110 [ 965.248074][T22845] ? oom_killer_disable+0x270/0x270 [ 965.253301][T22845] ? find_held_lock+0x2d/0x110 [ 965.258081][T22845] mem_cgroup_out_of_memory+0x206/0x270 [ 965.263640][T22845] ? mem_cgroup_margin+0x130/0x130 [ 965.268761][T22845] ? lock_downgrade+0x6e0/0x6e0 [ 965.273657][T22845] try_charge_memcg+0xed2/0x1270 [ 965.278627][T22845] ? find_held_lock+0x2d/0x110 [ 965.283418][T22845] ? mem_cgroup_oom_trylock+0x220/0x220 [ 965.288993][T22845] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 965.294568][T22845] ? lock_downgrade+0x6e0/0x6e0 [ 965.299461][T22845] charge_memcg+0xae/0x360 [ 965.303895][T22845] __mem_cgroup_charge+0x27/0x90 [ 965.308859][T22845] wp_page_copy+0x294/0x2280 [ 965.313516][T22845] ? do_page_mkwrite+0x550/0x550 [ 965.318472][T22845] ? lock_downgrade+0x6e0/0x6e0 [ 965.323340][T22845] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 965.329080][T22845] ? vm_normal_page+0x146/0x2a0 [ 965.333970][T22845] do_wp_page+0x2cb/0x1ae0 [ 965.338406][T22845] __handle_mm_fault+0x1f41/0x5120 [ 965.343544][T22845] ? vm_iomap_memory+0x190/0x190 [ 965.348524][T22845] handle_mm_fault+0x1c8/0x790 [ 965.353395][T22845] do_user_addr_fault+0x489/0x11c0 [ 965.358533][T22845] exc_page_fault+0x9e/0x180 [ 965.363138][T22845] ? asm_exc_page_fault+0x8/0x30 [ 965.368088][T22845] asm_exc_page_fault+0x1e/0x30 [ 965.372951][T22845] RIP: 0033:0x7f67b63cdfea [ 965.377375][T22845] Code: ff ff 48 83 c4 70 5b 5d 41 5c c3 0f 1f 44 00 00 48 8b 44 24 28 48 8b 5c 24 08 48 8b 70 38 8b 78 08 48 8d 53 30 e8 96 9b ff ff <48> 89 83 88 00 00 00 e9 27 fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 [ 965.397266][T22845] RSP: 002b:00007f67b4d7b190 EFLAGS: 00010206 [ 965.403367][T22845] RAX: 0000000000000000 RBX: 00007f67b653a030 RCX: 00007f67b6480ff1 [ 965.411351][T22845] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 965.419335][T22845] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 965.427321][T22845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 965.435309][T22845] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 965.443322][T22845] [ 965.475263][T22845] memory: usage 307140kB, limit 307200kB, failcnt 15115 [ 965.490532][T22845] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 965.566529][T22821] cgroup2: Unknown parameter '@[-}+' [ 965.587853][T22845] Memory cgroup stats for /syz1: [ 965.588023][T22845] anon 290217984 [ 965.588023][T22845] file 155648 [ 965.588023][T22845] kernel_stack 327680 [ 965.588023][T22845] pagetables 9977856 [ 965.588023][T22845] percpu 0 [ 965.588023][T22845] sock 0 [ 965.588023][T22845] shmem 155648 [ 965.588023][T22845] file_mapped 155648 [ 965.588023][T22845] file_dirty 0 [ 965.588023][T22845] file_writeback 0 [ 965.588023][T22845] swapcached 0 [ 965.588023][T22845] anon_thp 232783872 [ 965.588023][T22845] file_thp 0 [ 965.588023][T22845] shmem_thp 0 [ 965.588023][T22845] inactive_anon 290205696 [ 965.588023][T22845] active_anon 147456 [ 965.588023][T22845] inactive_file 0 [ 965.588023][T22845] active_file 0 [ 965.588023][T22845] unevictable 0 [ 965.588023][T22845] slab_reclaimable 645864 [ 965.588023][T22845] slab_unreclaimable 10877616 [ 965.588023][T22845] slab 11523480 [ 965.588023][T22845] workingset_refault_anon 0 [ 965.588023][T22845] workingset_refault_file 0 [ 965.588023][T22845] workingset_activate_anon 0 [ 965.883108][T22845] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22845,uid=0 [ 965.900339][T22845] Memory cgroup out of memory: Killed process 22845 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 965.925677][ T28] oom_reaper: reaped process 22845 (syz-executor.1), now anon-rss:0kB, file-rss:14208kB, shmem-rss:0kB [ 965.931391][T22838] syz-executor.5 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 965.963154][T22838] CPU: 0 PID: 22838 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 965.971962][T22838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 965.982032][T22838] Call Trace: [ 965.985319][T22838] [ 965.988249][T22838] dump_stack_lvl+0xcd/0x134 [ 965.992864][T22838] dump_header+0x106/0x624 [ 965.997299][T22838] oom_kill_process.cold+0x10/0x15 [ 966.002422][T22838] out_of_memory+0x358/0x1460 [ 966.007144][T22838] ? find_held_lock+0x2d/0x110 [ 966.011909][T22838] ? oom_killer_disable+0x270/0x270 [ 966.017108][T22838] ? find_held_lock+0x2d/0x110 [ 966.021882][T22838] mem_cgroup_out_of_memory+0x206/0x270 [ 966.027452][T22838] ? mem_cgroup_margin+0x130/0x130 [ 966.032596][T22838] ? lock_downgrade+0x6e0/0x6e0 [ 966.037493][T22838] try_charge_memcg+0xed2/0x1270 [ 966.042467][T22838] ? mem_cgroup_oom_trylock+0x220/0x220 [ 966.048032][T22838] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 966.053961][T22838] ? lock_downgrade+0x6e0/0x6e0 [ 966.058825][T22838] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 966.064573][T22838] obj_cgroup_charge_pages+0x1e/0x90 [ 966.069858][T22838] __memcg_kmem_charge_page+0x392/0x5f0 [ 966.075424][T22838] __alloc_pages+0x1da/0x500 [ 966.080021][T22838] ? lock_chain_count+0x20/0x20 [ 966.084889][T22838] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 966.091642][T22838] ? mark_held_locks+0x9f/0xe0 [ 966.096397][T22838] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 966.102549][T22838] ? lockdep_hardirqs_on+0x79/0x100 [ 966.107748][T22838] alloc_pages+0x1a7/0x300 [ 966.112192][T22838] ? copy_page_range+0x2eb7/0x42c0 [ 966.117318][T22838] get_zeroed_page+0x10/0x40 [ 966.121902][T22838] __pud_alloc+0x37/0x170 [ 966.126248][T22838] copy_page_range+0x2635/0x42c0 [ 966.131195][T22838] ? mark_held_locks+0x9f/0xe0 [ 966.135985][T22838] ? validate_mm_rb+0x1c0/0x2d0 [ 966.140837][T22838] ? validate_mm_rb+0x3e/0x2d0 [ 966.145619][T22838] ? rb_next+0x4e/0x140 [ 966.149838][T22838] ? handle_mm_fault+0x790/0x790 [ 966.154778][T22838] ? __sanitizer_cov_trace_pc+0x31/0x60 [ 966.160331][T22838] ? __vma_link_rb+0x553/0x710 [ 966.165112][T22838] dup_mm+0xa4e/0x13e0 [ 966.169189][T22838] ? replace_mm_exe_file+0x490/0x490 [ 966.174484][T22838] ? copy_process+0x2b53/0x75a0 [ 966.179334][T22838] copy_process+0x6fed/0x75a0 [ 966.184017][T22838] ? find_held_lock+0x2d/0x110 [ 966.188800][T22838] ? __cleanup_sighand+0xb0/0xb0 [ 966.193769][T22838] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 966.200031][T22838] ? _copy_from_user+0x5d/0x180 [ 966.204904][T22838] ? kernel_clone+0x314/0xab0 [ 966.209586][T22838] kernel_clone+0xe7/0xab0 [ 966.213992][T22838] ? create_io_thread+0xf0/0xf0 [ 966.218834][T22838] ? lockdep_hardirqs_on+0x79/0x100 [ 966.224045][T22838] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 966.230203][T22838] ? __do_sys_clone3+0x1c5/0x2f0 [ 966.235167][T22838] ? __do_sys_clone3+0x1d3/0x2f0 [ 966.240105][T22838] __do_sys_clone3+0x1dd/0x2f0 [ 966.244877][T22838] ? __do_sys_clone+0x110/0x110 [ 966.250157][T22838] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 966.256305][T22838] ? lockdep_hardirqs_on+0x79/0x100 [ 966.261497][T22838] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 966.267774][T22838] ? trace_hardirqs_on+0x38/0x1c0 [ 966.272821][T22838] ? syscall_enter_from_user_mode+0x2b/0x70 [ 966.278721][T22838] do_syscall_64+0x35/0xb0 [ 966.283155][T22838] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 966.289069][T22838] RIP: 0033:0x7f462bb41e99 [ 966.293477][T22838] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 966.313076][T22838] RSP: 002b:00007f462a4b7168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 966.321485][T22838] RAX: ffffffffffffffda RBX: 00007f462bc54f60 RCX: 00007f462bb41e99 [ 966.329468][T22838] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 966.337436][T22838] RBP: 00007f462bb9bff1 R08: 0000000000000000 R09: 0000000000000000 [ 966.345419][T22838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 966.353382][T22838] R13: 00007f462c188b1f R14: 00007f462a4b7300 R15: 0000000000022000 [ 966.361382][T22838] [ 966.397638][T22838] memory: usage 307188kB, limit 307200kB, failcnt 1400 [ 966.410313][T22838] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 966.418000][T22838] Memory cgroup stats for /syz5: [ 966.418769][T22838] anon 290508800 [ 966.418769][T22838] file 90112 [ 966.418769][T22838] kernel_stack 950272 [ 966.418769][T22838] pagetables 9547776 [ 966.418769][T22838] percpu 0 [ 966.418769][T22838] sock 0 [ 966.418769][T22838] shmem 90112 [ 966.418769][T22838] file_mapped 90112 [ 966.418769][T22838] file_dirty 0 [ 966.418769][T22838] file_writeback 0 [ 966.418769][T22838] swapcached 0 [ 966.418769][T22838] anon_thp 224395264 [ 966.418769][T22838] file_thp 0 [ 966.418769][T22838] shmem_thp 0 [ 966.418769][T22838] inactive_anon 290508800 [ 966.418769][T22838] active_anon 86016 [ 966.418769][T22838] inactive_file 0 [ 966.418769][T22838] active_file 0 [ 966.418769][T22838] unevictable 0 [ 966.418769][T22838] slab_reclaimable 480320 [ 966.418769][T22838] slab_unreclaimable 10659704 [ 966.418769][T22838] slab 11140024 [ 966.418769][T22838] workingset_refault_anon 0 [ 966.418769][T22838] workingset_refault_file 0 [ 966.418769][T22838] workingset_activate_anon 0 [ 966.527970][T22838] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7024,uid=0 [ 966.548221][T22838] Memory cgroup out of memory: Killed process 7024 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:15060kB, shmem-rss:84kB, UID:0 pgtables:100kB oom_score_adj:1000 18:17:16 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:16 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9ad, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:16 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xad, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:16 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x43340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:16 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:16 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x4b4a41, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async, rerun: 64) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (rerun: 64) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x1000, 0x1000, 0xffffffdf}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) (async) mount(&(0x7f0000000600)=ANY=[@ANYBLOB="2f64650600000000000000941a7bc5cac257b2c20c292e1a9126cc4e5e3573cfd4dcd53d8f303103945e4a585c509f593b8344cc17fcdf97faf6e22830d3c043d5fc974d7443ae7bad8d00396ef0b0402fc477bac30014576f5072faf627076c2fe458a4df332c72b460107b59cf6255b6d8e90b0b1efc69330b8753dc05a86e05e670c719266543b3f4abab3ce450c6af42f8e5fddb1e4ba8c4d61c98161f45f6780cf26f4f21a4984b53401cf671f69881083598c29496d410dfc3ad694501399ac9088281c857be597b75970a76a7029032f63b057dc64c56f1414843ab6691cce7726b1fe26dcf7c2b90bd97893649a0ffdac4ab4cae992b4e018216fb3915b40f446e2dd4be8a4c61473d46374ebccb5de05d5e00"/293], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async, rerun: 32) pidfd_send_signal(0xffffffffffffffff, 0x2a, &(0x7f0000000400)={0x21, 0x1ff, 0x1}, 0x0) (rerun: 32) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:16 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:16 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9ae, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:17 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 966.744666][T22852] device macvtap2 entered promiscuous mode [ 966.784389][T22852] device virt_wifi0 entered promiscuous mode [ 966.831328][T22852] team0: Device macvtap2 failed to register rx_handler [ 966.861799][T22852] device virt_wifi0 left promiscuous mode 18:17:17 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x110, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 966.983918][T22868] cgroup2: Unknown parameter '@[-}+' 18:17:17 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:17 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x44340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:17 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9af, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 967.169414][T22868] cgroup2: Unknown parameter '@[-}+' 18:17:17 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x128, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 967.305111][T22871] cgroup2: Unknown parameter '@[-}+' [ 967.308638][T22868] cgroup2: Unknown parameter '@[-}+' [ 967.333257][T22880] device macvtap2 entered promiscuous mode [ 967.368691][T22880] device virt_wifi0 entered promiscuous mode [ 967.408229][T22868] cgroup2: Unknown parameter '@[-}+' 18:17:17 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 967.411857][T22880] team0: Device macvtap2 failed to register rx_handler [ 967.414121][T22868] cgroup2: Unknown parameter '@[-}+' [ 967.500435][T22880] device virt_wifi0 left promiscuous mode 18:17:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:18 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 968.039124][T22893] cgroup2: Unknown parameter '@[-}+' 18:17:18 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x163, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:18 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x45340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:18 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:18 executing program 1: perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2809, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) lchown(&(0x7f0000000100)='./file0\x00', 0xee01, 0xee01) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000480)=ANY=[@ANYBLOB="a36729ea3e72aeb1ca2f81205f02742e187cfa9a0b6b5bb7343bad87c24c15a40369b788be6ed97736072d851db4f6b313d98a31b707c6f4f19394ac56791487fc2ff4e017c953b10fc6a1eebb025bcd5dcde0dc9fef23a523ebebc17ffd7d9f9cc95dff0ff764acbd9652ce332df12464752f51e6167730fb59a0aff6888285a09fd609"], &(0x7f0000000300)='./file0\x00', &(0x7f00000001c0)='openpromfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:18 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:18 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 968.276667][T22899] device macvtap2 entered promiscuous mode 18:17:18 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x180, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:18 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 968.323405][T22899] device virt_wifi0 entered promiscuous mode [ 968.334708][T22907] cgroup2: Unknown parameter '@[-}+' [ 968.354086][T22899] team0: Device macvtap2 failed to register rx_handler 18:17:18 executing program 1: perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2809, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) lchown(&(0x7f0000000100)='./file0\x00', 0xee01, 0xee01) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000480)=ANY=[@ANYBLOB="a36729ea3e72aeb1ca2f81205f02742e187cfa9a0b6b5bb7343bad87c24c15a40369b788be6ed97736072d851db4f6b313d98a31b707c6f4f19394ac56791487fc2ff4e017c953b10fc6a1eebb025bcd5dcde0dc9fef23a523ebebc17ffd7d9f9cc95dff0ff764acbd9652ce332df12464752f51e6167730fb59a0aff6888285a09fd609"], &(0x7f0000000300)='./file0\x00', &(0x7f00000001c0)='openpromfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 968.395836][T22899] device virt_wifi0 left promiscuous mode 18:17:18 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304f9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:18 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:18 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1b0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:19 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x46340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 968.845529][T22918] syz-executor.1 invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=0, oom_score_adj=1000 [ 968.857345][T22905] cgroup2: Unknown parameter '@[-}+' [ 968.895135][T22918] CPU: 0 PID: 22918 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 968.903942][T22918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 968.913998][T22918] Call Trace: [ 968.917273][T22918] [ 968.920213][T22918] dump_stack_lvl+0xcd/0x134 [ 968.924808][T22918] dump_header+0x106/0x624 [ 968.929224][T22918] oom_kill_process.cold+0x10/0x15 [ 968.934334][T22918] out_of_memory+0x358/0x1460 [ 968.939018][T22918] ? find_held_lock+0x2d/0x110 [ 968.943780][T22918] ? oom_killer_disable+0x270/0x270 [ 968.948987][T22918] ? find_held_lock+0x2d/0x110 [ 968.953753][T22918] mem_cgroup_out_of_memory+0x206/0x270 [ 968.959298][T22918] ? mem_cgroup_margin+0x130/0x130 [ 968.964407][T22918] ? lock_downgrade+0x6e0/0x6e0 [ 968.969271][T22918] try_charge_memcg+0xed2/0x1270 [ 968.974213][T22918] ? mem_cgroup_oom_trylock+0x220/0x220 [ 968.979760][T22918] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 968.985476][T22918] ? lock_downgrade+0x6e0/0x6e0 [ 968.990346][T22918] obj_cgroup_charge_pages+0x1e/0x90 [ 968.995634][T22918] obj_cgroup_charge+0xf3/0x280 [ 969.000489][T22918] ? __alloc_file+0x21/0x280 [ 969.005082][T22918] kmem_cache_alloc+0x92/0x3a0 [ 969.009859][T22918] __alloc_file+0x21/0x280 [ 969.014274][T22918] alloc_empty_file+0x6d/0x170 [ 969.019037][T22918] path_openat+0xe1/0x2750 [ 969.023456][T22918] ? __lock_acquire+0x1655/0x5470 [ 969.028497][T22918] ? path_lookupat+0x860/0x860 [ 969.033264][T22918] ? mark_lock+0xef/0x17b0 [ 969.037683][T22918] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 969.043675][T22918] do_filp_open+0x1aa/0x400 [ 969.048179][T22918] ? may_open_dev+0xf0/0xf0 [ 969.052684][T22918] ? alloc_fd+0x2f0/0x670 [ 969.057012][T22918] ? lock_downgrade+0x6e0/0x6e0 [ 969.061865][T22918] ? rwlock_bug.part.0+0x90/0x90 [ 969.066802][T22918] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 969.073044][T22918] ? _find_next_bit+0x1e3/0x260 [ 969.077903][T22918] ? _raw_spin_unlock+0x24/0x40 [ 969.082752][T22918] ? alloc_fd+0x2f0/0x670 [ 969.087085][T22918] do_sys_openat2+0x16d/0x4d0 [ 969.091766][T22918] ? build_open_flags+0x6f0/0x6f0 [ 969.096793][T22918] ? __context_tracking_exit+0xb8/0xe0 [ 969.102252][T22918] ? lock_downgrade+0x6e0/0x6e0 [ 969.107112][T22918] __x64_sys_openat+0x13f/0x1f0 [ 969.111963][T22918] ? __ia32_sys_open+0x1c0/0x1c0 [ 969.116905][T22918] ? syscall_enter_from_user_mode+0x21/0x70 [ 969.122805][T22918] do_syscall_64+0x35/0xb0 [ 969.127216][T22918] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 969.133111][T22918] RIP: 0033:0x7f67b6426e99 [ 969.137527][T22918] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 969.157129][T22918] RSP: 002b:00007f67b4d5a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 969.165545][T22918] RAX: ffffffffffffffda RBX: 00007f67b653a100 RCX: 00007f67b6426e99 [ 969.173510][T22918] RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 969.181482][T22918] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 969.189446][T22918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 969.197415][T22918] R13: 00007f67b6a6db1f R14: 00007f67b4d5a300 R15: 0000000000022000 [ 969.205398][T22918] 18:17:19 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304fa, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 969.243080][T22918] memory: usage 307140kB, limit 307200kB, failcnt 15254 [ 969.273667][T22918] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 969.296408][T22918] Memory cgroup stats for /syz1: [ 969.296640][T22918] anon 290422784 [ 969.296640][T22918] file 155648 [ 969.296640][T22918] kernel_stack 327680 [ 969.296640][T22918] pagetables 9977856 [ 969.296640][T22918] percpu 0 [ 969.296640][T22918] sock 0 [ 969.296640][T22918] shmem 155648 [ 969.296640][T22918] file_mapped 155648 [ 969.296640][T22918] file_dirty 0 [ 969.296640][T22918] file_writeback 0 [ 969.296640][T22918] swapcached 0 [ 969.296640][T22918] anon_thp 232783872 [ 969.296640][T22918] file_thp 0 [ 969.296640][T22918] shmem_thp 0 [ 969.296640][T22918] inactive_anon 290430976 [ 969.296640][T22918] active_anon 147456 [ 969.296640][T22918] inactive_file 0 [ 969.296640][T22918] active_file 0 [ 969.296640][T22918] unevictable 0 [ 969.296640][T22918] slab_reclaimable 672880 [ 969.296640][T22918] slab_unreclaimable 10658976 [ 969.296640][T22918] slab 11331856 [ 969.296640][T22918] workingset_refault_anon 0 [ 969.296640][T22918] workingset_refault_file 0 [ 969.296640][T22918] workingset_activate_anon 0 [ 969.438023][T22928] device macvtap2 entered promiscuous mode [ 969.456026][T22918] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22875,uid=0 [ 969.478210][T22928] device virt_wifi0 entered promiscuous mode [ 969.508901][T22928] team0: Device macvtap2 failed to register rx_handler [ 969.526200][T22928] device virt_wifi0 left promiscuous mode [ 969.532944][T22917] cgroup2: Unknown parameter '@[-}+' [ 969.597860][T22918] Memory cgroup out of memory: Killed process 22875 (syz-executor.1) total-vm:57464kB, anon-rss:2472kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:19 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:19 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1c8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:19 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304fb, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:19 executing program 1: perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2809, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async, rerun: 32) close_range(r0, r1, 0x2) (rerun: 32) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async, rerun: 32) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async, rerun: 32) lchown(&(0x7f0000000100)='./file0\x00', 0xee01, 0xee01) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) mount(&(0x7f0000000480)=ANY=[@ANYBLOB="a36729ea3e72aeb1ca2f81205f02742e187cfa9a0b6b5bb7343bad87c24c15a40369b788be6ed97736072d851db4f6b313d98a31b707c6f4f19394ac56791487fc2ff4e017c953b10fc6a1eebb025bcd5dcde0dc9fef23a523ebebc17ffd7d9f9cc95dff0ff764acbd9652ce332df12464752f51e6167730fb59a0aff6888285a09fd609"], &(0x7f0000000300)='./file0\x00', &(0x7f00000001c0)='openpromfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:19 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x47340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 969.764872][T23039] cgroup2: Unknown parameter '@[-}+' 18:17:20 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000440)=ANY=[@ANYBLOB="2f6465762f6cb96d703000cb2ebc860800000000aa7bf7281c23709404633737cb377e9ef3868ebc1c9acb933358189c1714805eb18657c7263162f1584765a42378304b8750658c9a5e4bb7d929614b0e9227ed561f1a3688a2ec32e4f2b81e0ed8c938a8e84dfc661b1a930beaa4eb37da19ed86981476fb1c92ab8ecd59cd1a3c1957d4c7839b81686c6b4663daa510b039795d392a9b"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000400)=0xf4, 0x7) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:20 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:20 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x20b, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:20 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304fc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 969.898580][T23049] cgroup2: Unknown parameter '@[-}+' [ 969.970411][T23050] device macvtap2 entered promiscuous mode [ 970.010963][T23050] device virt_wifi0 entered promiscuous mode [ 970.043043][T23050] team0: Device macvtap2 failed to register rx_handler [ 970.081125][T23050] device virt_wifi0 left promiscuous mode 18:17:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:20 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x240, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:20 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:20 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x48000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:20 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304fd, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 970.407059][T23052] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 970.561991][T23052] CPU: 0 PID: 23052 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 970.570802][T23052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 970.580858][T23052] Call Trace: [ 970.584133][T23052] [ 970.587058][T23052] dump_stack_lvl+0xcd/0x134 [ 970.591656][T23052] dump_header+0x106/0x624 [ 970.596073][T23052] oom_kill_process.cold+0x10/0x15 [ 970.601187][T23052] out_of_memory+0x358/0x1460 [ 970.605871][T23052] ? find_held_lock+0x2d/0x110 [ 970.610643][T23052] ? oom_killer_disable+0x270/0x270 [ 970.615854][T23052] ? find_held_lock+0x2d/0x110 [ 970.620620][T23052] mem_cgroup_out_of_memory+0x206/0x270 [ 970.626166][T23052] ? mem_cgroup_margin+0x130/0x130 [ 970.631271][T23052] ? lock_downgrade+0x6e0/0x6e0 [ 970.636140][T23052] try_charge_memcg+0xed2/0x1270 [ 970.641098][T23052] ? mem_cgroup_oom_trylock+0x220/0x220 [ 970.646659][T23052] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 970.652383][T23052] ? lock_downgrade+0x6e0/0x6e0 [ 970.657253][T23052] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 970.663000][T23052] obj_cgroup_charge_pages+0x1e/0x90 [ 970.668291][T23052] __memcg_kmem_charge_page+0x392/0x5f0 [ 970.673845][T23052] copy_process+0x80a/0x75a0 [ 970.678439][T23052] ? lock_chain_count+0x20/0x20 [ 970.683288][T23052] ? lock_chain_count+0x20/0x20 [ 970.688171][T23052] ? __cleanup_sighand+0xb0/0xb0 [ 970.693115][T23052] ? __lock_acquire+0x1655/0x5470 [ 970.698142][T23052] ? kernel_clone+0x314/0xab0 [ 970.702895][T23052] kernel_clone+0xe7/0xab0 [ 970.707333][T23052] ? create_io_thread+0xf0/0xf0 [ 970.712198][T23052] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 970.718188][T23052] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 970.724186][T23052] ? find_held_lock+0x2d/0x110 [ 970.728957][T23052] __do_sys_clone+0xc8/0x110 [ 970.733550][T23052] ? kernel_clone+0xab0/0xab0 [ 970.738223][T23052] ? lock_downgrade+0x6e0/0x6e0 [ 970.743092][T23052] ? syscall_enter_from_user_mode+0x21/0x70 [ 970.748995][T23052] do_syscall_64+0x35/0xb0 [ 970.753409][T23052] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 970.759306][T23052] RIP: 0033:0x7f67b64282c1 [ 970.763722][T23052] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 970.783332][T23052] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 970.791763][T23052] RAX: ffffffffffffffda RBX: 00007f67b4d5a700 RCX: 00007f67b64282c1 [ 970.799743][T23052] RDX: 00007f67b4d5a9d0 RSI: 00007f67b4d5a2f0 RDI: 00000000003d0f00 [ 970.807736][T23052] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d5a700 R09: 00007f67b4d5a700 [ 970.815720][T23052] R10: 00007f67b4d5a9d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 970.823699][T23052] R13: 00007f67b6a6db1f R14: 00007f67b4d5a300 R15: 0000000000022000 [ 970.831773][T23052] 18:17:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x279, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:21 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304fe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 970.867833][T23070] device macvtap2 entered promiscuous mode [ 970.903354][T23070] device virt_wifi0 entered promiscuous mode 18:17:21 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 970.918990][T23070] team0: Device macvtap2 failed to register rx_handler [ 970.933013][T23071] cgroup2: Unknown parameter '@[-}+' [ 970.986651][T23070] device virt_wifi0 left promiscuous mode [ 971.207918][T23052] memory: usage 307056kB, limit 307200kB, failcnt 15314 [ 971.235044][T23052] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 971.278718][T23052] Memory cgroup stats for /syz1: [ 971.278948][T23052] anon 290484224 [ 971.278948][T23052] file 155648 [ 971.278948][T23052] kernel_stack 229376 [ 971.278948][T23052] pagetables 9977856 [ 971.278948][T23052] percpu 0 [ 971.278948][T23052] sock 0 [ 971.278948][T23052] shmem 155648 [ 971.278948][T23052] file_mapped 155648 [ 971.278948][T23052] file_dirty 0 [ 971.278948][T23052] file_writeback 0 [ 971.278948][T23052] swapcached 0 [ 971.278948][T23052] anon_thp 232783872 [ 971.278948][T23052] file_thp 0 [ 971.278948][T23052] shmem_thp 0 [ 971.278948][T23052] inactive_anon 290492416 [ 971.278948][T23052] active_anon 147456 [ 971.278948][T23052] inactive_file 0 [ 971.278948][T23052] active_file 0 [ 971.278948][T23052] unevictable 0 [ 971.278948][T23052] slab_reclaimable 665160 [ 971.278948][T23052] slab_unreclaimable 10619704 [ 971.278948][T23052] slab 11284864 [ 971.278948][T23052] workingset_refault_anon 0 [ 971.278948][T23052] workingset_refault_file 0 [ 971.278948][T23052] workingset_activate_anon 0 [ 971.402792][T23052] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=22193,uid=0 [ 971.428279][T23052] Memory cgroup out of memory: Killed process 22193 (syz-executor.1) total-vm:56804kB, anon-rss:2452kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x284, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:21 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x304ff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:21 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x48340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:21 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 971.459950][ T28] oom_reaper: reaped process 22193 (syz-executor.1), now anon-rss:0kB, file-rss:14144kB, shmem-rss:0kB [ 971.480241][T23059] cgroup2: Unknown parameter '@[-}+' 18:17:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) mount(&(0x7f0000000440)=ANY=[@ANYBLOB="2f6465762f6cb96d703000cb2ebc860800000000aa7bf7281c23709404633737cb377e9ef3868ebc1c9acb933358189c1714805eb18657c7263162f1584765a42378304b8750658c9a5e4bb7d929614b0e9227ed561f1a3688a2ec32e4f2b81e0ed8c938a8e84dfc661b1a930beaa4eb37da19ed86981476fb1c92ab8ecd59cd1a3c1957d4c7839b81686c6b4663daa510b039795d392a9b"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000400)=0xf4, 0x7) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x290, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:21 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30500, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:22 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9b9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 971.752814][T23089] device macvtap2 entered promiscuous mode [ 971.803154][T23089] device virt_wifi0 entered promiscuous mode [ 971.821009][T23093] cgroup2: Unknown parameter '@[-}+' [ 971.838739][T23089] team0: Device macvtap2 failed to register rx_handler [ 971.856468][T23089] device virt_wifi0 left promiscuous mode [ 971.903077][T23083] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 971.940231][T23083] CPU: 1 PID: 23083 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 971.949054][T23083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 971.959223][T23083] Call Trace: [ 971.962513][T23083] [ 971.965456][T23083] dump_stack_lvl+0xcd/0x134 [ 971.970074][T23083] dump_header+0x106/0x624 [ 971.974516][T23083] oom_kill_process.cold+0x10/0x15 [ 971.979661][T23083] out_of_memory+0x358/0x1460 [ 971.984378][T23083] ? find_held_lock+0x2d/0x110 [ 971.989165][T23083] ? oom_killer_disable+0x270/0x270 [ 971.994392][T23083] ? find_held_lock+0x2d/0x110 [ 971.999189][T23083] mem_cgroup_out_of_memory+0x206/0x270 [ 972.004755][T23083] ? mem_cgroup_margin+0x130/0x130 [ 972.009884][T23083] ? lock_downgrade+0x6e0/0x6e0 [ 972.014773][T23083] try_charge_memcg+0xed2/0x1270 [ 972.019735][T23083] ? find_held_lock+0x2d/0x110 [ 972.024520][T23083] ? mem_cgroup_oom_trylock+0x220/0x220 [ 972.030092][T23083] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 972.035669][T23083] ? lock_downgrade+0x6e0/0x6e0 [ 972.040558][T23083] charge_memcg+0xae/0x360 [ 972.044996][T23083] __mem_cgroup_charge+0x27/0x90 [ 972.050388][T23083] wp_page_copy+0x294/0x2280 [ 972.055005][T23083] ? do_page_mkwrite+0x550/0x550 [ 972.059967][T23083] ? lock_downgrade+0x6e0/0x6e0 [ 972.065269][T23083] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 972.071011][T23083] ? vm_normal_page+0x146/0x2a0 [ 972.075901][T23083] do_wp_page+0x2cb/0x1ae0 [ 972.080347][T23083] __handle_mm_fault+0x1f41/0x5120 [ 972.085488][T23083] ? vm_iomap_memory+0x190/0x190 [ 972.090471][T23083] handle_mm_fault+0x1c8/0x790 [ 972.095262][T23083] do_user_addr_fault+0x489/0x11c0 [ 972.100405][T23083] exc_page_fault+0x9e/0x180 [ 972.105014][T23083] ? asm_exc_page_fault+0x8/0x30 [ 972.109972][T23083] asm_exc_page_fault+0x1e/0x30 [ 972.114840][T23083] RIP: 0033:0x7f462bb41eab [ 972.119273][T23083] Code: 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 <64> 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 [ 972.138908][T23083] RSP: 002b:00007f462c188b98 EFLAGS: 00010213 [ 972.144993][T23083] RAX: 000000000000006e RBX: 00007f462bc5503c RCX: ffffffffffffffbc [ 972.152985][T23083] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f462bc5503c [ 972.160971][T23083] RBP: 00007f462bc54f60 R08: 00007ffcba5f6080 R09: 00000000000000d0 [ 972.168955][T23083] R10: 00007f462c188c80 R11: 0000000000000246 R12: 00000000000ed380 [ 972.176941][T23083] R13: 00007f462c188c80 R14: 00007f462c188ca0 R15: 0000000000000032 [ 972.185126][T23083] [ 972.254031][T23083] memory: usage 307200kB, limit 307200kB, failcnt 1515 [ 972.261412][T23083] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 972.268771][T23083] Memory cgroup stats for /syz5: [ 972.268997][T23083] anon 291102720 [ 972.268997][T23083] file 90112 [ 972.268997][T23083] kernel_stack 950272 [ 972.268997][T23083] pagetables 9625600 [ 972.268997][T23083] percpu 0 [ 972.268997][T23083] sock 0 [ 972.268997][T23083] shmem 90112 [ 972.268997][T23083] file_mapped 90112 [ 972.268997][T23083] file_dirty 0 18:17:22 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x29b, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 972.268997][T23083] file_writeback 0 [ 972.268997][T23083] swapcached 0 [ 972.268997][T23083] anon_thp 224395264 [ 972.268997][T23083] file_thp 0 [ 972.268997][T23083] shmem_thp 0 [ 972.268997][T23083] inactive_anon 291106816 [ 972.268997][T23083] active_anon 86016 [ 972.268997][T23083] inactive_file 0 [ 972.268997][T23083] active_file 0 [ 972.268997][T23083] unevictable 0 [ 972.268997][T23083] slab_reclaimable 482232 [ 972.268997][T23083] slab_unreclaimable 9973376 [ 972.268997][T23083] slab 10455608 [ 972.268997][T23083] workingset_refault_anon 0 [ 972.268997][T23083] workingset_refault_file 0 [ 972.268997][T23083] workingset_activate_anon 0 18:17:22 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30501, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:22 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9ba, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 972.402020][T23083] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=6172,uid=0 18:17:22 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x49340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 972.487786][T23083] Memory cgroup out of memory: Killed process 6172 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:15060kB, shmem-rss:80kB, UID:0 pgtables:100kB oom_score_adj:1000 18:17:22 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2a3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:22 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9bb, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 972.591173][T23110] device macvtap2 entered promiscuous mode [ 972.611933][T23110] device virt_wifi0 entered promiscuous mode 18:17:22 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30502, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 972.645829][T23110] team0: Device macvtap2 failed to register rx_handler [ 972.653919][T23093] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 972.696287][T23110] device virt_wifi0 left promiscuous mode [ 972.696367][T23093] CPU: 0 PID: 23093 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 972.710798][T23093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 972.720868][T23093] Call Trace: [ 972.724168][T23093] [ 972.727110][T23093] dump_stack_lvl+0xcd/0x134 [ 972.731724][T23093] dump_header+0x106/0x624 [ 972.736166][T23093] oom_kill_process.cold+0x10/0x15 [ 972.741305][T23093] out_of_memory+0x358/0x1460 [ 972.746102][T23093] ? find_held_lock+0x2d/0x110 [ 972.750887][T23093] ? oom_killer_disable+0x270/0x270 [ 972.756113][T23093] ? find_held_lock+0x2d/0x110 [ 972.760899][T23093] mem_cgroup_out_of_memory+0x206/0x270 [ 972.766729][T23093] ? mem_cgroup_margin+0x130/0x130 [ 972.771855][T23093] ? lock_downgrade+0x6e0/0x6e0 [ 972.776738][T23093] try_charge_memcg+0xc76/0x1270 [ 972.781704][T23093] ? find_held_lock+0x2d/0x110 [ 972.786491][T23093] ? mem_cgroup_oom_trylock+0x220/0x220 [ 972.792069][T23093] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 972.797641][T23093] ? lock_downgrade+0x6e0/0x6e0 [ 972.802535][T23093] charge_memcg+0xae/0x360 [ 972.806974][T23093] __mem_cgroup_charge+0x27/0x90 [ 972.811975][T23093] wp_page_copy+0x294/0x2280 [ 972.816599][T23093] ? do_page_mkwrite+0x550/0x550 [ 972.821554][T23093] ? lock_downgrade+0x6e0/0x6e0 [ 972.826423][T23093] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 972.828298][T23086] cgroup2: Unknown parameter '@[-}+' [ 972.832157][T23093] ? vm_normal_page+0x146/0x2a0 [ 972.832207][T23093] do_wp_page+0x2cb/0x1ae0 [ 972.832242][T23093] __handle_mm_fault+0x1f41/0x5120 [ 972.832283][T23093] ? vm_iomap_memory+0x190/0x190 [ 972.832338][T23093] handle_mm_fault+0x1c8/0x790 [ 972.832372][T23093] do_user_addr_fault+0x489/0x11c0 [ 972.832412][T23093] exc_page_fault+0x9e/0x180 [ 972.832443][T23093] ? asm_exc_page_fault+0x8/0x30 [ 972.832475][T23093] asm_exc_page_fault+0x1e/0x30 [ 972.832504][T23093] RIP: 0033:0x7f67b6426eab [ 972.832534][T23093] Code: 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 <64> 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 [ 972.832562][T23093] RSP: 002b:00007f67b4d7b168 EFLAGS: 00010213 [ 972.832586][T23093] RAX: 0000000000000016 RBX: 00007f67b653a030 RCX: ffffffffffffffbc [ 972.832605][T23093] RDX: 0000000020000380 RSI: 0000000020000300 RDI: 0000000020000440 [ 972.832622][T23093] RBP: 00007f67b6480ff1 R08: 00000000200003c0 R09: 0000000000000000 [ 972.832639][T23093] R10: 00000000002e402f R11: 0000000000000246 R12: 0000000000000000 [ 972.832656][T23093] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 972.832692][T23093] [ 972.852854][T23093] memory: usage 307200kB, limit 307200kB, failcnt 15464 [ 973.004543][T23093] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 973.014065][T23093] Memory cgroup stats for /syz1: [ 973.014234][T23093] anon 290488320 [ 973.014234][T23093] file 155648 [ 973.014234][T23093] kernel_stack 294912 [ 973.014234][T23093] pagetables 9977856 [ 973.014234][T23093] percpu 0 [ 973.014234][T23093] sock 0 [ 973.014234][T23093] shmem 155648 [ 973.014234][T23093] file_mapped 155648 [ 973.014234][T23093] file_dirty 0 [ 973.014234][T23093] file_writeback 0 [ 973.014234][T23093] swapcached 0 [ 973.014234][T23093] anon_thp 232783872 [ 973.014234][T23093] file_thp 0 [ 973.014234][T23093] shmem_thp 0 [ 973.014234][T23093] inactive_anon 290496512 [ 973.014234][T23093] active_anon 147456 [ 973.014234][T23093] inactive_file 0 [ 973.014234][T23093] active_file 0 [ 973.014234][T23093] unevictable 0 [ 973.014234][T23093] slab_reclaimable 668240 [ 973.014234][T23093] slab_unreclaimable 10687960 [ 973.014234][T23093] slab 11356200 [ 973.014234][T23093] workingset_refault_anon 0 [ 973.014234][T23093] workingset_refault_file 0 [ 973.014234][T23093] workingset_activate_anon 0 [ 973.119510][T23093] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23079,uid=0 [ 973.137508][T23093] Memory cgroup out of memory: Killed process 23079 (syz-executor.1) total-vm:60776kB, anon-rss:2488kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000440)=ANY=[@ANYBLOB="2f6465762f6cb96d703000cb2ebc860800000000aa7bf7281c23709404633737cb377e9ef3868ebc1c9acb933358189c1714805eb18657c7263162f1584765a42378304b8750658c9a5e4bb7d929614b0e9227ed561f1a3688a2ec32e4f2b81e0ed8c938a8e84dfc661b1a930beaa4eb37da19ed86981476fb1c92ab8ecd59cd1a3c1957d4c7839b81686c6b4663daa510b039795d392a9b"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000400)=0xf4, 0x7) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000440)=ANY=[@ANYBLOB="2f6465762f6cb96d703000cb2ebc860800000000aa7bf7281c23709404633737cb377e9ef3868ebc1c9acb933358189c1714805eb18657c7263162f1584765a42378304b8750658c9a5e4bb7d929614b0e9227ed561f1a3688a2ec32e4f2b81e0ed8c938a8e84dfc661b1a930beaa4eb37da19ed86981476fb1c92ab8ecd59cd1a3c1957d4c7839b81686c6b4663daa510b039795d392a9b"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000400)=0xf4, 0x7) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:17:23 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2b8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:23 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9bc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:23 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30503, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:23 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4a000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:23 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 973.572766][T23128] device macvtap2 entered promiscuous mode [ 973.608833][T23128] device virt_wifi0 entered promiscuous mode 18:17:23 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9bd, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 973.646631][T23128] team0: Device macvtap2 failed to register rx_handler [ 973.651027][T23130] syz-executor.5 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 973.666095][T23128] device virt_wifi0 left promiscuous mode [ 973.734518][T23130] CPU: 1 PID: 23130 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 973.743338][T23130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 973.753426][T23130] Call Trace: [ 973.756728][T23130] [ 973.759688][T23130] dump_stack_lvl+0xcd/0x134 [ 973.764305][T23130] dump_header+0x106/0x624 [ 973.768742][T23130] oom_kill_process.cold+0x10/0x15 [ 973.773883][T23130] out_of_memory+0x358/0x1460 [ 973.778774][T23130] ? find_held_lock+0x2d/0x110 [ 973.783571][T23130] ? oom_killer_disable+0x270/0x270 [ 973.788806][T23130] ? find_held_lock+0x2d/0x110 [ 973.793598][T23130] mem_cgroup_out_of_memory+0x206/0x270 [ 973.799170][T23130] ? mem_cgroup_margin+0x130/0x130 [ 973.804301][T23130] ? lock_downgrade+0x6e0/0x6e0 [ 973.809205][T23130] try_charge_memcg+0xed2/0x1270 [ 973.814183][T23130] ? mem_cgroup_oom_trylock+0x220/0x220 [ 973.819753][T23130] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 973.825496][T23130] ? lock_downgrade+0x6e0/0x6e0 [ 973.830386][T23130] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 973.836156][T23130] obj_cgroup_charge_pages+0x1e/0x90 [ 973.841469][T23130] __memcg_kmem_charge_page+0x392/0x5f0 [ 973.847142][T23130] __alloc_pages+0x1da/0x500 [ 973.851753][T23130] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 973.858549][T23130] ? find_held_lock+0x2d/0x110 [ 973.863348][T23130] alloc_pages+0x1a7/0x300 [ 973.867793][T23130] ? do_raw_spin_lock+0x120/0x2b0 [ 973.872845][T23130] pte_alloc_one+0x16/0x230 [ 973.877375][T23130] __pte_alloc+0x69/0x250 [ 973.881727][T23130] ? pmd_install+0x150/0x150 [ 973.886336][T23130] ? _raw_spin_unlock+0x24/0x40 [ 973.891205][T23130] ? __pmd_alloc+0x2ff/0x5c0 [ 973.895823][T23130] copy_page_range+0x186e/0x42c0 [ 973.900833][T23130] ? handle_mm_fault+0x790/0x790 [ 973.905810][T23130] ? __vma_link_rb+0x553/0x710 [ 973.910608][T23130] dup_mm+0xa4e/0x13e0 [ 973.914716][T23130] ? replace_mm_exe_file+0x490/0x490 [ 973.920023][T23130] ? __raw_spin_lock_init+0x36/0x110 [ 973.925341][T23130] copy_process+0x6fed/0x75a0 [ 973.930040][T23130] ? find_held_lock+0x2d/0x110 [ 973.934843][T23130] ? __cleanup_sighand+0xb0/0xb0 [ 973.939812][T23130] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 973.946082][T23130] ? _copy_from_user+0x5d/0x180 [ 973.950964][T23130] ? kernel_clone+0x314/0xab0 [ 973.955661][T23130] kernel_clone+0xe7/0xab0 [ 973.960107][T23130] ? create_io_thread+0xf0/0xf0 [ 973.964994][T23130] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 973.971008][T23130] __do_sys_clone3+0x1dd/0x2f0 [ 973.975797][T23130] ? __do_sys_clone+0x110/0x110 [ 973.980684][T23130] ? lock_downgrade+0x6e0/0x6e0 [ 973.985566][T23130] ? lock_downgrade+0x6e0/0x6e0 [ 973.990464][T23130] ? syscall_enter_from_user_mode+0x21/0x70 [ 973.996394][T23130] do_syscall_64+0x35/0xb0 [ 974.000843][T23130] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 974.006762][T23130] RIP: 0033:0x7f462bb41e99 [ 974.011196][T23130] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 974.031086][T23130] RSP: 002b:00007f462a496168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 974.039526][T23130] RAX: ffffffffffffffda RBX: 00007f462bc55030 RCX: 00007f462bb41e99 [ 974.047516][T23130] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 974.055506][T23130] RBP: 00007f462bb9bff1 R08: 0000000000000000 R09: 0000000000000000 [ 974.063497][T23130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 974.071661][T23130] R13: 00007f462c188b1f R14: 00007f462a496300 R15: 0000000000022000 [ 974.079673][T23130] [ 974.106598][T23130] memory: usage 307180kB, limit 307200kB, failcnt 1570 [ 974.123092][T23132] cgroup2: Unknown parameter '@[-}+' [ 974.133226][T23130] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 974.145204][T23130] Memory cgroup stats for /syz5: [ 974.145455][T23130] anon 291164160 [ 974.145455][T23130] file 90112 [ 974.145455][T23130] kernel_stack 950272 [ 974.145455][T23130] pagetables 9560064 [ 974.145455][T23130] percpu 0 [ 974.145455][T23130] sock 0 [ 974.145455][T23130] shmem 90112 [ 974.145455][T23130] file_mapped 90112 [ 974.145455][T23130] file_dirty 0 [ 974.145455][T23130] file_writeback 0 [ 974.145455][T23130] swapcached 0 [ 974.145455][T23130] anon_thp 224395264 [ 974.145455][T23130] file_thp 0 [ 974.145455][T23130] shmem_thp 0 [ 974.145455][T23130] inactive_anon 291168256 [ 974.145455][T23130] active_anon 86016 [ 974.145455][T23130] inactive_file 0 [ 974.145455][T23130] active_file 0 [ 974.145455][T23130] unevictable 0 [ 974.145455][T23130] slab_reclaimable 479144 [ 974.145455][T23130] slab_unreclaimable 9940752 [ 974.145455][T23130] slab 10419896 [ 974.145455][T23130] workingset_refault_anon 0 [ 974.145455][T23130] workingset_refault_file 0 [ 974.145455][T23130] workingset_activate_anon 0 [ 974.177681][T23132] cgroup2: Unknown parameter '@[-}+' 18:17:24 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30504, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 974.246525][T23130] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7089,uid=0 [ 974.285607][T23130] Memory cgroup out of memory: Killed process 7089 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:15060kB, shmem-rss:76kB, UID:0 pgtables:100kB oom_score_adj:1000 18:17:24 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9be, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:24 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4a340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 974.333529][ T28] oom_reaper: reaped process 7089 (syz-executor.5), now anon-rss:0kB, file-rss:14336kB, shmem-rss:28kB 18:17:24 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 974.375627][T23122] cgroup2: Unknown parameter '@[-}+' [ 974.443472][T23157] device macvtap2 entered promiscuous mode [ 974.489793][T23157] device virt_wifi0 entered promiscuous mode 18:17:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x901, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000500)='cgroup2\x00', 0x6400, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000429bd7000ffdbdf25530069cab5c0e90e", @ANYRES32=0x0, @ANYBLOB="0c009900050000003d000000060095001f00000006009500b200000006009500000000000600950040000000"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x8044) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f6465763f6cb96d703000f19b101b34eda9324e24c0a8991ef1da6dc653d830d4c1ecdf19247acb01c2eae70f560a9386465e486c8baa3a513f3a94e864584dfd1cf9307e6eb320d1daf8bc42593b82485a510fe0e2"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:24 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9bf, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 974.536028][T23157] team0: Device macvtap2 failed to register rx_handler [ 974.581912][T23157] device virt_wifi0 left promiscuous mode 18:17:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) 18:17:25 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30505, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:25 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4b340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:25 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x37c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:25 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 975.080967][T23172] device macvtap2 entered promiscuous mode [ 975.088153][T23172] device virt_wifi0 entered promiscuous mode 18:17:25 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x381, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 975.133370][T23172] team0: Device macvtap2 failed to register rx_handler [ 975.193771][T23172] device virt_wifi0 left promiscuous mode 18:17:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x901, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000500)='cgroup2\x00', 0x6400, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) (async) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000429bd7000ffdbdf25530069cab5c0e90e", @ANYRES32=0x0, @ANYBLOB="0c009900050000003d000000060095001f00000006009500b200000006009500000000000600950040000000"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x8044) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f6465763f6cb96d703000f19b101b34eda9324e24c0a8991ef1da6dc653d830d4c1ecdf19247acb01c2eae70f560a9386465e486c8baa3a513f3a94e864584dfd1cf9307e6eb320d1daf8bc42593b82485a510fe0e2"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async, rerun: 64) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async, rerun: 64) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:25 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30506, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:25 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:25 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4c000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:25 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3a4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) 18:17:25 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30507, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 975.601235][T23178] cgroup2: Unknown parameter '@[-}+' 18:17:25 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 975.666040][T23194] device macvtap2 entered promiscuous mode [ 975.715865][T23194] device virt_wifi0 entered promiscuous mode [ 975.736151][T23182] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 975.769227][T23194] team0: Device macvtap2 failed to register rx_handler [ 975.781823][T23182] CPU: 0 PID: 23182 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 975.790622][T23182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 975.800707][T23182] Call Trace: [ 975.803995][T23182] [ 975.806939][T23182] dump_stack_lvl+0xcd/0x134 [ 975.811561][T23182] dump_header+0x106/0x624 [ 975.816008][T23182] oom_kill_process.cold+0x10/0x15 [ 975.821148][T23182] out_of_memory+0x358/0x1460 [ 975.825860][T23182] ? find_held_lock+0x2d/0x110 [ 975.830644][T23182] ? oom_killer_disable+0x270/0x270 [ 975.835871][T23182] ? find_held_lock+0x2d/0x110 [ 975.840681][T23182] mem_cgroup_out_of_memory+0x206/0x270 [ 975.846259][T23182] ? mem_cgroup_margin+0x130/0x130 [ 975.851386][T23182] ? lock_downgrade+0x6e0/0x6e0 [ 975.856276][T23182] try_charge_memcg+0xed2/0x1270 [ 975.861239][T23182] ? mem_cgroup_oom_trylock+0x220/0x220 [ 975.866802][T23182] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 975.872537][T23182] ? lock_downgrade+0x6e0/0x6e0 [ 975.877409][T23182] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 975.883252][T23182] obj_cgroup_charge_pages+0x1e/0x90 [ 975.888646][T23182] __memcg_kmem_charge_page+0x392/0x5f0 [ 975.894220][T23182] copy_process+0x80a/0x75a0 [ 975.898841][T23182] ? lock_chain_count+0x20/0x20 [ 975.903709][T23182] ? lock_chain_count+0x20/0x20 [ 975.908601][T23182] ? __cleanup_sighand+0xb0/0xb0 [ 975.913550][T23182] ? lock_downgrade+0x6e0/0x6e0 [ 975.918433][T23182] ? __lock_acquire+0x1655/0x5470 [ 975.923480][T23182] ? kernel_clone+0x314/0xab0 [ 975.928259][T23182] kernel_clone+0xe7/0xab0 [ 975.932694][T23182] ? create_io_thread+0xf0/0xf0 [ 975.937557][T23182] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 975.943560][T23182] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 975.949592][T23182] ? find_held_lock+0x2d/0x110 [ 975.954379][T23182] __do_sys_clone+0xc8/0x110 [ 975.958988][T23182] ? kernel_clone+0xab0/0xab0 [ 975.963678][T23182] ? lock_downgrade+0x6e0/0x6e0 [ 975.968559][T23182] ? syscall_enter_from_user_mode+0x21/0x70 [ 975.974482][T23182] do_syscall_64+0x35/0xb0 [ 975.978924][T23182] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 975.984846][T23182] RIP: 0033:0x7f67b64282c1 [ 975.989280][T23182] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 976.008918][T23182] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 976.017353][T23182] RAX: ffffffffffffffda RBX: 00007f67b4d18700 RCX: 00007f67b64282c1 [ 976.025345][T23182] RDX: 00007f67b4d189d0 RSI: 00007f67b4d182f0 RDI: 00000000003d0f00 [ 976.033332][T23182] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d18700 R09: 00007f67b4d18700 [ 976.041583][T23182] R10: 00007f67b4d189d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 976.049576][T23182] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 976.057593][T23182] [ 976.086223][T23194] device virt_wifi0 left promiscuous mode [ 976.108119][T23205] cgroup2: Unknown parameter '@[-}+' [ 976.109332][T23182] memory: usage 307180kB, limit 307200kB, failcnt 15529 [ 976.121075][T23182] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 976.131555][T23182] Memory cgroup stats for /syz1: [ 976.131779][T23182] anon 290652160 [ 976.131779][T23182] file 155648 [ 976.131779][T23182] kernel_stack 294912 [ 976.131779][T23182] pagetables 9977856 [ 976.131779][T23182] percpu 0 [ 976.131779][T23182] sock 0 [ 976.131779][T23182] shmem 155648 [ 976.131779][T23182] file_mapped 155648 [ 976.131779][T23182] file_dirty 0 [ 976.131779][T23182] file_writeback 0 [ 976.131779][T23182] swapcached 0 [ 976.131779][T23182] anon_thp 232783872 [ 976.131779][T23182] file_thp 0 [ 976.131779][T23182] shmem_thp 0 18:17:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) [ 976.131779][T23182] inactive_anon 290660352 [ 976.131779][T23182] active_anon 147456 [ 976.131779][T23182] inactive_file 0 [ 976.131779][T23182] active_file 0 [ 976.131779][T23182] unevictable 0 [ 976.131779][T23182] slab_reclaimable 615456 [ 976.131779][T23182] slab_unreclaimable 10539472 [ 976.131779][T23182] slab 11154928 [ 976.131779][T23182] workingset_refault_anon 0 [ 976.131779][T23182] workingset_refault_file 0 [ 976.131779][T23182] workingset_activate_anon 0 [ 976.239556][T23182] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23179,uid=0 [ 976.262938][T23182] Memory cgroup out of memory: Killed process 23179 (syz-executor.1) total-vm:60776kB, anon-rss:2488kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:26 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3ae, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:26 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30508, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:26 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4c340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 976.543953][T23215] cgroup2: Unknown parameter '@[-}+' [ 976.612594][T23218] device macvtap2 entered promiscuous mode [ 976.643843][T23218] device virt_wifi0 entered promiscuous mode [ 976.673192][T23218] team0: Device macvtap2 failed to register rx_handler [ 976.704815][T23218] device virt_wifi0 left promiscuous mode 18:17:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async, rerun: 64) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x901, 0x0) (rerun: 64) ioctl$int_in(r1, 0x5452, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async, rerun: 32) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000500)='cgroup2\x00', 0x6400, 0x0) (async, rerun: 32) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async, rerun: 64) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async, rerun: 64) clone3(0x0, 0x0) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000429bd7000ffdbdf25530069cab5c0e90e", @ANYRES32=0x0, @ANYBLOB="0c009900050000003d000000060095001f00000006009500b200000006009500000000000600950040000000"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x8044) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f6465763f6cb96d703000f19b101b34eda9324e24c0a8991ef1da6dc653d830d4c1ecdf19247acb01c2eae70f560a9386465e486c8baa3a513f3a94e864584dfd1cf9307e6eb320d1daf8bc42593b82485a510fe0e2"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:27 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:27 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30509, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:27 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3d1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:27 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3050a, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:27 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:27 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4d340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:27 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3d7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 977.101406][T23228] syz-executor.1 invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=0, oom_score_adj=1000 [ 977.179001][T23228] CPU: 1 PID: 23228 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 977.187888][T23228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 977.197955][T23228] Call Trace: [ 977.201239][T23228] [ 977.204179][T23228] dump_stack_lvl+0xcd/0x134 [ 977.208796][T23228] dump_header+0x106/0x624 [ 977.213233][T23228] oom_kill_process.cold+0x10/0x15 [ 977.218357][T23228] out_of_memory+0x358/0x1460 [ 977.223046][T23228] ? find_held_lock+0x2d/0x110 [ 977.227812][T23228] ? oom_killer_disable+0x270/0x270 [ 977.233023][T23228] ? find_held_lock+0x2d/0x110 [ 977.237790][T23228] mem_cgroup_out_of_memory+0x206/0x270 [ 977.243332][T23228] ? mem_cgroup_margin+0x130/0x130 [ 977.248438][T23228] ? lock_downgrade+0x6e0/0x6e0 [ 977.253300][T23228] try_charge_memcg+0xed2/0x1270 [ 977.258245][T23228] ? mem_cgroup_oom_trylock+0x220/0x220 [ 977.263787][T23228] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 977.269501][T23228] ? lock_downgrade+0x6e0/0x6e0 [ 977.274367][T23228] obj_cgroup_charge_pages+0x1e/0x90 [ 977.279673][T23228] obj_cgroup_charge+0xf3/0x280 [ 977.284526][T23228] ? __alloc_file+0x21/0x280 [ 977.289121][T23228] kmem_cache_alloc+0x92/0x3a0 [ 977.293903][T23228] __alloc_file+0x21/0x280 [ 977.298319][T23228] alloc_empty_file+0x6d/0x170 [ 977.303087][T23228] path_openat+0xe1/0x2750 [ 977.307503][T23228] ? __lock_acquire+0x1655/0x5470 [ 977.312534][T23228] ? path_lookupat+0x860/0x860 [ 977.317303][T23228] ? mark_lock+0xef/0x17b0 [ 977.321718][T23228] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 977.327708][T23228] do_filp_open+0x1aa/0x400 [ 977.332213][T23228] ? may_open_dev+0xf0/0xf0 [ 977.336717][T23228] ? alloc_fd+0x2f0/0x670 [ 977.341045][T23228] ? lock_downgrade+0x6e0/0x6e0 [ 977.345898][T23228] ? rwlock_bug.part.0+0x90/0x90 [ 977.350836][T23228] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 977.357076][T23228] ? _find_next_bit+0x1e3/0x260 [ 977.361931][T23228] ? _raw_spin_unlock+0x24/0x40 [ 977.366781][T23228] ? alloc_fd+0x2f0/0x670 [ 977.371113][T23228] do_sys_openat2+0x16d/0x4d0 [ 977.375793][T23228] ? build_open_flags+0x6f0/0x6f0 [ 977.380823][T23228] ? __context_tracking_exit+0xb8/0xe0 [ 977.386291][T23228] ? lock_downgrade+0x6e0/0x6e0 [ 977.391144][T23228] __x64_sys_openat+0x13f/0x1f0 [ 977.395998][T23228] ? __ia32_sys_open+0x1c0/0x1c0 [ 977.400939][T23228] ? syscall_enter_from_user_mode+0x21/0x70 [ 977.406840][T23228] do_syscall_64+0x35/0xb0 [ 977.411257][T23228] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 977.417162][T23228] RIP: 0033:0x7f67b6426e99 [ 977.421605][T23228] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 977.441221][T23228] RSP: 002b:00007f67b4d5a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 977.449642][T23228] RAX: ffffffffffffffda RBX: 00007f67b653a100 RCX: 00007f67b6426e99 [ 977.457611][T23228] RDX: 0000000000000901 RSI: 0000000020000180 RDI: ffffffffffffff9c [ 977.465576][T23228] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 977.483267][T23228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 977.491241][T23228] R13: 00007f67b6a6db1f R14: 00007f67b4d5a300 R15: 0000000000022000 [ 977.499235][T23228] 18:17:27 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 977.532583][T23236] device macvtap2 entered promiscuous mode [ 977.550331][T23236] device virt_wifi0 entered promiscuous mode [ 977.563912][T23236] team0: Device macvtap2 failed to register rx_handler 18:17:27 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3050b, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 977.585431][T23236] device virt_wifi0 left promiscuous mode [ 977.599645][T23228] memory: usage 307200kB, limit 307200kB, failcnt 15641 [ 977.694204][T23228] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 18:17:28 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3e0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 977.867886][T23240] cgroup2: Unknown parameter '@[-}+' [ 977.947092][T23228] Memory cgroup stats for /syz1: [ 977.947313][T23228] anon 290680832 [ 977.947313][T23228] file 155648 [ 977.947313][T23228] kernel_stack 262144 [ 977.947313][T23228] pagetables 10059776 [ 977.947313][T23228] percpu 0 [ 977.947313][T23228] sock 0 [ 977.947313][T23228] shmem 155648 [ 977.947313][T23228] file_mapped 155648 [ 977.947313][T23228] file_dirty 0 [ 977.947313][T23228] file_writeback 0 [ 977.947313][T23228] swapcached 0 [ 977.947313][T23228] anon_thp 232783872 [ 977.947313][T23228] file_thp 0 [ 977.947313][T23228] shmem_thp 0 [ 977.947313][T23228] inactive_anon 290689024 [ 977.947313][T23228] active_anon 147456 [ 977.947313][T23228] inactive_file 0 [ 977.947313][T23228] active_file 0 [ 977.947313][T23228] unevictable 0 [ 977.947313][T23228] slab_reclaimable 619688 [ 977.947313][T23228] slab_unreclaimable 10390872 [ 977.947313][T23228] slab 11010560 [ 977.947313][T23228] workingset_refault_anon 0 [ 977.947313][T23228] workingset_refault_file 0 [ 977.947313][T23228] workingset_activate_anon 0 [ 978.166257][T23228] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23217,uid=0 [ 978.183777][T23228] Memory cgroup out of memory: Killed process 23217 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 978.207739][ T28] oom_reaper: reaped process 23217 (syz-executor.1), now anon-rss:0kB, file-rss:14144kB, shmem-rss:0kB 18:17:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000600)=ANY=[@ANYBLOB="2f6465090000006d7030002cbca6360525af908105b452a1729ff2cb1a6fd86afb32482c5004379ea455ca39c4749819497669bb584c0ca8a6ecf10db9fd4ad9a26d370d6601433171bafd0d021e1bd813c623a9adc95021225d2d118b5bccb3cbd7bf8ef5ffc45a99f6f8eebe7259b15ddfbf9081bcbc475664458c90eace6f1ab60100cafb9705abbd07eacf678c2ad5240e7028077521fd14db7188ba4bcabf0e7f3b6647a693511299ec11bcc873ec1b82fb97b89ded53bd3b9742716ee4f06e6a360c7cfbdd52628abf2d933f259cce7dd22948aaa5fb9af8fa22dd1dd22715b4f7dc67cd591df6405d4096b3d5ddda8e21ed7f980f3b9f81fca3605795e3e2955225eefd39c530ae24ba7ce29a5ac0c84db8d7466b4be6c9c591f096e0c39169ec3d5ebfa724309d1f71633979c0372c187d2aa77096b5c93cbc8900df98d6"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000400)={0x0, 0xad, "21cdeebc498a30443bc675290fa1247e2eba33ef51efd580707b785c16500dfd12fe8abb67282ae217eaafcaabb4472af88630a806201b05766a14b1fb75d57b3b2d078b97e21166a9c5d0c779a5f90c5cb5ce8d4756be3827c190fd47b2a4bc97e88fbcbd3275f7e66b97a04596032afaf470081d3e27f5f0f900f48ee3f186c1f61e29a4cc1da76538ca23f9492f7d9382e0d469a69b9aab15315043b2a662ae440135963b4d65d3e021a1ab"}, &(0x7f00000001c0)=0xb5) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:28 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:28 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3050c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:28 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4e340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:28 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3eb, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 978.465174][ T3755] syz-executor.1 invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=0, oom_score_adj=0 [ 978.478867][T23259] device macvtap2 entered promiscuous mode [ 978.485119][T23259] device virt_wifi0 entered promiscuous mode [ 978.505816][T23259] team0: Device macvtap2 failed to register rx_handler [ 978.514222][ T3755] CPU: 1 PID: 3755 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 978.522928][ T3755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 978.532993][ T3755] Call Trace: [ 978.536266][ T3755] [ 978.539191][ T3755] dump_stack_lvl+0xcd/0x134 [ 978.543789][ T3755] dump_header+0x106/0x624 [ 978.548231][ T3755] oom_kill_process.cold+0x10/0x15 [ 978.553340][ T3755] out_of_memory+0x358/0x1460 [ 978.558027][ T3755] ? find_held_lock+0x2d/0x110 [ 978.562792][ T3755] ? oom_killer_disable+0x270/0x270 [ 978.567995][ T3755] ? find_held_lock+0x2d/0x110 [ 978.572767][ T3755] mem_cgroup_out_of_memory+0x206/0x270 [ 978.578312][ T3755] ? mem_cgroup_margin+0x130/0x130 [ 978.583421][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 978.588285][ T3755] try_charge_memcg+0xed2/0x1270 [ 978.593313][ T3755] ? mem_cgroup_oom_trylock+0x220/0x220 [ 978.598857][ T3755] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 978.604574][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 978.609440][ T3755] obj_cgroup_charge_pages+0x1e/0x90 [ 978.614727][ T3755] obj_cgroup_charge+0xf3/0x280 [ 978.619579][ T3755] ? __alloc_file+0x21/0x280 [ 978.624184][ T3755] kmem_cache_alloc+0x92/0x3a0 [ 978.628952][ T3755] __alloc_file+0x21/0x280 [ 978.633375][ T3755] alloc_empty_file+0x6d/0x170 [ 978.638151][ T3755] path_openat+0xe1/0x2750 [ 978.642679][ T3755] ? __lock_acquire+0x1655/0x5470 [ 978.647735][ T3755] ? path_lookupat+0x860/0x860 [ 978.652518][ T3755] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 978.658521][ T3755] do_filp_open+0x1aa/0x400 [ 978.663030][ T3755] ? may_open_dev+0xf0/0xf0 [ 978.667543][ T3755] ? alloc_fd+0x2f0/0x670 [ 978.671867][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 978.676719][ T3755] ? rwlock_bug.part.0+0x90/0x90 [ 978.681663][ T3755] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 978.687906][ T3755] ? _find_next_bit+0x1e3/0x260 [ 978.692763][ T3755] ? _raw_spin_unlock+0x24/0x40 [ 978.697623][ T3755] ? alloc_fd+0x2f0/0x670 [ 978.701959][ T3755] do_sys_openat2+0x16d/0x4d0 [ 978.706730][ T3755] ? build_open_flags+0x6f0/0x6f0 [ 978.711776][ T3755] ? __context_tracking_exit+0xb8/0xe0 [ 978.717249][ T3755] ? lock_downgrade+0x6e0/0x6e0 [ 978.722111][ T3755] __x64_sys_openat+0x13f/0x1f0 [ 978.726974][ T3755] ? __ia32_sys_open+0x1c0/0x1c0 [ 978.731931][ T3755] ? syscall_enter_from_user_mode+0x21/0x70 [ 978.737836][ T3755] do_syscall_64+0x35/0xb0 [ 978.742254][ T3755] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 978.748150][ T3755] RIP: 0033:0x7f67b63d9db4 [ 978.752560][ T3755] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 978.772163][ T3755] RSP: 002b:00007f67b6a6dd00 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 978.780570][ T3755] RAX: ffffffffffffffda RBX: 00007f67b6a6de00 RCX: 00007f67b63d9db4 [ 978.788537][ T3755] RDX: 0000000000000002 RSI: 00007f67b6a6de40 RDI: 00000000ffffff9c [ 978.796517][ T3755] RBP: 00007f67b6a6de40 R08: 0000000000000000 R09: 00007f67b6a6dc10 [ 978.804481][ T3755] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 18:17:29 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 978.812446][ T3755] R13: 00000000000eebe5 R14: 0000000000000014 R15: 00007f67b6a6de40 [ 978.820426][ T3755] [ 978.835052][T23259] device virt_wifi0 left promiscuous mode 18:17:29 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3050d, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 978.928745][ T3755] memory: usage 307200kB, limit 307200kB, failcnt 15864 [ 978.953185][ T3755] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 978.961204][ T3755] Memory cgroup stats for /syz1: [ 978.968081][ T3755] anon 290549760 [ 978.968081][ T3755] file 155648 [ 978.968081][ T3755] kernel_stack 262144 [ 978.968081][ T3755] pagetables 10125312 [ 978.968081][ T3755] percpu 0 [ 978.968081][ T3755] sock 0 [ 978.968081][ T3755] shmem 155648 [ 978.968081][ T3755] file_mapped 155648 [ 978.968081][ T3755] file_dirty 0 [ 978.968081][ T3755] file_writeback 0 [ 978.968081][ T3755] swapcached 0 [ 978.968081][ T3755] anon_thp 232783872 [ 978.968081][ T3755] file_thp 0 [ 978.968081][ T3755] shmem_thp 0 [ 978.968081][ T3755] inactive_anon 290557952 [ 978.968081][ T3755] active_anon 147456 [ 978.968081][ T3755] inactive_file 0 [ 978.968081][ T3755] active_file 0 [ 978.968081][ T3755] unevictable 0 [ 978.968081][ T3755] slab_reclaimable 620840 [ 978.968081][ T3755] slab_unreclaimable 10519808 [ 978.968081][ T3755] slab 11140648 [ 978.968081][ T3755] workingset_refault_anon 0 [ 978.968081][ T3755] workingset_refault_file 0 [ 978.968081][ T3755] workingset_activate_anon 0 18:17:29 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:29 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3050e, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:29 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x4f340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 979.166618][ T3755] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23257,uid=0 [ 979.183159][T23268] cgroup2: Unknown parameter '@[-}+' 18:17:29 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3fc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 979.288782][ T3755] Memory cgroup out of memory: Killed process 23257 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 979.396024][T23278] device macvtap2 entered promiscuous mode [ 979.438104][T23278] device virt_wifi0 entered promiscuous mode [ 979.488030][T23278] team0: Device macvtap2 failed to register rx_handler [ 979.560817][T23278] device virt_wifi0 left promiscuous mode [ 979.598709][T23251] syz-executor.1 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 979.617747][T23251] CPU: 1 PID: 23251 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 979.626547][T23251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 979.636591][T23251] Call Trace: [ 979.639853][T23251] [ 979.642770][T23251] dump_stack_lvl+0xcd/0x134 [ 979.647354][T23251] dump_header+0x106/0x624 [ 979.651770][T23251] oom_kill_process.cold+0x10/0x15 [ 979.656871][T23251] out_of_memory+0x358/0x1460 [ 979.661542][T23251] ? find_held_lock+0x2d/0x110 [ 979.666292][T23251] ? oom_killer_disable+0x270/0x270 [ 979.671480][T23251] ? find_held_lock+0x2d/0x110 [ 979.676229][T23251] mem_cgroup_out_of_memory+0x206/0x270 [ 979.681803][T23251] ? mem_cgroup_margin+0x130/0x130 [ 979.686918][T23251] ? lock_downgrade+0x6e0/0x6e0 [ 979.691784][T23251] try_charge_memcg+0xed2/0x1270 [ 979.696719][T23251] ? mem_cgroup_oom_trylock+0x220/0x220 [ 979.702251][T23251] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 979.707961][T23251] ? lock_downgrade+0x6e0/0x6e0 [ 979.712808][T23251] ? kvmalloc_node+0x61/0x120 [ 979.717468][T23251] obj_cgroup_charge_pages+0x1e/0x90 [ 979.722737][T23251] obj_cgroup_charge+0xf3/0x280 [ 979.727581][T23251] ? kvmalloc_node+0x61/0x120 [ 979.732275][T23251] ? kvmalloc_node+0x61/0x120 [ 979.736939][T23251] __kmalloc_node+0xa7/0x390 [ 979.741525][T23251] kvmalloc_node+0x61/0x120 [ 979.746018][T23251] alloc_fdtable+0xee/0x2a0 [ 979.750520][T23251] dup_fd+0x718/0xca0 [ 979.754499][T23251] copy_process+0x21e9/0x75a0 [ 979.759159][T23251] ? find_held_lock+0x2d/0x110 [ 979.763937][T23251] ? __cleanup_sighand+0xb0/0xb0 [ 979.768864][T23251] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 979.775093][T23251] ? _copy_from_user+0x5d/0x180 [ 979.780108][T23251] ? kernel_clone+0x314/0xab0 [ 979.784770][T23251] kernel_clone+0xe7/0xab0 [ 979.789174][T23251] ? create_io_thread+0xf0/0xf0 [ 979.794015][T23251] ? find_held_lock+0x2d/0x110 [ 979.798783][T23251] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 979.804754][T23251] __do_sys_clone3+0x1dd/0x2f0 [ 979.809504][T23251] ? __do_sys_clone+0x110/0x110 [ 979.814353][T23251] ? lock_downgrade+0x6e0/0x6e0 [ 979.819186][T23251] ? lock_downgrade+0x6e0/0x6e0 [ 979.824032][T23251] ? syscall_enter_from_user_mode+0x21/0x70 [ 979.829920][T23251] do_syscall_64+0x35/0xb0 [ 979.834322][T23251] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 979.840205][T23251] RIP: 0033:0x7f67b6426e99 [ 979.844608][T23251] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 979.864244][T23251] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 979.872649][T23251] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 979.880619][T23251] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 979.888584][T23251] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 979.896712][T23251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 979.904662][T23251] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 979.912627][T23251] [ 979.921244][T23251] memory: usage 307200kB, limit 307200kB, failcnt 16004 [ 979.928598][T23251] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 979.935865][T23251] Memory cgroup stats for /syz1: [ 979.936647][T23251] anon 290549760 [ 979.936647][T23251] file 155648 [ 979.936647][T23251] kernel_stack 262144 [ 979.936647][T23251] pagetables 10133504 [ 979.936647][T23251] percpu 0 [ 979.936647][T23251] sock 0 [ 979.936647][T23251] shmem 155648 [ 979.936647][T23251] file_mapped 155648 [ 979.936647][T23251] file_dirty 0 [ 979.936647][T23251] file_writeback 0 [ 979.936647][T23251] swapcached 0 [ 979.936647][T23251] anon_thp 232783872 [ 979.936647][T23251] file_thp 0 [ 979.936647][T23251] shmem_thp 0 [ 979.936647][T23251] inactive_anon 290557952 [ 979.936647][T23251] active_anon 147456 [ 979.936647][T23251] inactive_file 0 [ 979.936647][T23251] active_file 0 [ 979.936647][T23251] unevictable 0 [ 979.936647][T23251] slab_reclaimable 620840 [ 979.936647][T23251] slab_unreclaimable 10517712 [ 979.936647][T23251] slab 11138552 [ 979.936647][T23251] workingset_refault_anon 0 [ 979.936647][T23251] workingset_refault_file 0 [ 979.936647][T23251] workingset_activate_anon 0 [ 980.055769][T23251] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23280,uid=0 [ 980.071915][T23251] Memory cgroup out of memory: Killed process 23280 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 980.093176][ T28] oom_reaper: reaped process 23280 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 980.107482][T23244] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 980.126594][T23244] CPU: 0 PID: 23244 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 980.135402][T23244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 980.145469][T23244] Call Trace: [ 980.148755][T23244] [ 980.151696][T23244] dump_stack_lvl+0xcd/0x134 [ 980.156310][T23244] dump_header+0x106/0x624 [ 980.160745][T23244] oom_kill_process.cold+0x10/0x15 [ 980.165878][T23244] out_of_memory+0x358/0x1460 [ 980.170580][T23244] ? find_held_lock+0x2d/0x110 [ 980.175360][T23244] ? oom_killer_disable+0x270/0x270 [ 980.180666][T23244] ? find_held_lock+0x2d/0x110 [ 980.185459][T23244] mem_cgroup_out_of_memory+0x206/0x270 [ 980.191022][T23244] ? mem_cgroup_margin+0x130/0x130 [ 980.196142][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 980.201006][T23244] try_charge_memcg+0xc76/0x1270 [ 980.205984][T23244] ? find_held_lock+0x2d/0x110 [ 980.210747][T23244] ? mem_cgroup_oom_trylock+0x220/0x220 [ 980.216282][T23244] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 980.221821][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 980.226693][T23244] charge_memcg+0xae/0x360 [ 980.231097][T23244] __mem_cgroup_charge+0x27/0x90 [ 980.236053][T23244] wp_page_copy+0x294/0x2280 [ 980.240648][T23244] ? do_page_mkwrite+0x550/0x550 [ 980.245599][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 980.250443][T23244] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 980.256174][T23244] ? vm_normal_page+0x146/0x2a0 [ 980.261041][T23244] do_wp_page+0x2cb/0x1ae0 [ 980.265476][T23244] __handle_mm_fault+0x1f41/0x5120 [ 980.270581][T23244] ? vm_iomap_memory+0x190/0x190 [ 980.275526][T23244] handle_mm_fault+0x1c8/0x790 [ 980.280288][T23244] do_user_addr_fault+0x489/0x11c0 [ 980.285412][T23244] exc_page_fault+0x9e/0x180 [ 980.289994][T23244] ? asm_exc_page_fault+0x8/0x30 [ 980.294923][T23244] asm_exc_page_fault+0x1e/0x30 [ 980.299767][T23244] RIP: 0033:0x7f67b63ce0a9 [ 980.304187][T23244] Code: 00 00 00 00 48 8d b8 f0 fe ff ff e8 b1 2a 01 00 85 c0 75 16 48 8b 44 24 28 48 8b 54 24 20 48 8b 70 38 8b 78 08 e8 d7 9a ff ff <64> f0 83 2c 25 b8 ff ff ff 01 83 44 24 14 01 e9 0e fe ff ff 0f 1f [ 980.323953][T23244] RSP: 002b:00007f67b4d7b190 EFLAGS: 00010206 [ 980.330007][T23244] RAX: 0000000000004b39 RBX: 00007f67b653a030 RCX: 00007f67b6480ff1 [ 980.337967][T23244] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 980.345936][T23244] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 980.353894][T23244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 980.361859][T23244] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 980.369849][T23244] [ 980.375401][T23244] memory: usage 307200kB, limit 307200kB, failcnt 16115 [ 980.382727][T23244] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 980.389787][T23244] Memory cgroup stats for /syz1: [ 980.389947][T23244] anon 290566144 [ 980.389947][T23244] file 155648 [ 980.389947][T23244] kernel_stack 229376 [ 980.389947][T23244] pagetables 10133504 [ 980.389947][T23244] percpu 0 [ 980.389947][T23244] sock 0 [ 980.389947][T23244] shmem 155648 [ 980.389947][T23244] file_mapped 155648 [ 980.389947][T23244] file_dirty 0 [ 980.389947][T23244] file_writeback 0 [ 980.389947][T23244] swapcached 0 [ 980.389947][T23244] anon_thp 232783872 [ 980.389947][T23244] file_thp 0 [ 980.389947][T23244] shmem_thp 0 [ 980.389947][T23244] inactive_anon 290557952 [ 980.389947][T23244] active_anon 147456 [ 980.389947][T23244] inactive_file 0 [ 980.389947][T23244] active_file 0 [ 980.389947][T23244] unevictable 0 [ 980.389947][T23244] slab_reclaimable 626624 [ 980.389947][T23244] slab_unreclaimable 10517856 [ 980.389947][T23244] slab 11144480 [ 980.389947][T23244] workingset_refault_anon 0 [ 980.389947][T23244] workingset_refault_file 0 [ 980.389947][T23244] workingset_activate_anon 0 [ 980.489756][T23244] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23279,uid=0 [ 980.505391][T23244] Memory cgroup out of memory: Killed process 23279 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 980.525214][ T28] oom_reaper: reaped process 23279 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 980.547564][T23281] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=1, oom_score_adj=1000 [ 980.569455][T23281] CPU: 0 PID: 23281 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 980.578253][T23281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 980.588322][T23281] Call Trace: [ 980.591604][T23281] [ 980.594538][T23281] dump_stack_lvl+0xcd/0x134 [ 980.599149][T23281] dump_header+0x106/0x624 [ 980.603584][T23281] oom_kill_process.cold+0x10/0x15 [ 980.608698][T23281] out_of_memory+0x358/0x1460 [ 980.613394][T23281] ? find_held_lock+0x2d/0x110 [ 980.618171][T23281] ? oom_killer_disable+0x270/0x270 [ 980.623360][T23281] ? find_held_lock+0x2d/0x110 [ 980.628127][T23281] mem_cgroup_out_of_memory+0x206/0x270 [ 980.633691][T23281] ? mem_cgroup_margin+0x130/0x130 [ 980.638819][T23281] ? lock_downgrade+0x6e0/0x6e0 [ 980.643670][T23281] try_charge_memcg+0xed2/0x1270 [ 980.648622][T23281] ? mem_cgroup_oom_trylock+0x220/0x220 [ 980.654182][T23281] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 980.659913][T23281] ? lock_downgrade+0x6e0/0x6e0 [ 980.664764][T23281] obj_cgroup_charge_pages+0x1e/0x90 [ 980.670047][T23281] obj_cgroup_charge+0xf3/0x280 [ 980.674923][T23281] kmem_cache_alloc_node+0x99/0x3f0 [ 980.680128][T23281] ? copy_process+0x5c4/0x75a0 [ 980.684878][T23281] copy_process+0x5c4/0x75a0 [ 980.689463][T23281] ? find_held_lock+0x2d/0x110 [ 980.694256][T23281] ? __cleanup_sighand+0xb0/0xb0 [ 980.699204][T23281] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 980.705433][T23281] ? _copy_from_user+0x5d/0x180 [ 980.710282][T23281] ? kernel_clone+0x314/0xab0 [ 980.714987][T23281] kernel_clone+0xe7/0xab0 [ 980.719408][T23281] ? create_io_thread+0xf0/0xf0 [ 980.724250][T23281] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 980.730230][T23281] __do_sys_clone3+0x1dd/0x2f0 [ 980.734998][T23281] ? __do_sys_clone+0x110/0x110 [ 980.739840][T23281] ? lock_downgrade+0x6e0/0x6e0 [ 980.744676][T23281] ? lock_downgrade+0x6e0/0x6e0 [ 980.749542][T23281] ? syscall_enter_from_user_mode+0x21/0x70 [ 980.755455][T23281] do_syscall_64+0x35/0xb0 [ 980.759871][T23281] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 980.765848][T23281] RIP: 0033:0x7f67b6426e99 [ 980.770265][T23281] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 980.790168][T23281] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 980.798609][T23281] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 980.806572][T23281] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 980.814534][T23281] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 980.822511][T23281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 980.830472][T23281] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 980.838462][T23281] [ 980.845518][T23281] memory: usage 307200kB, limit 307200kB, failcnt 16258 [ 980.852571][T23281] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 980.859490][T23281] Memory cgroup stats for /syz1: [ 980.859651][T23281] anon 290566144 [ 980.859651][T23281] file 155648 [ 980.859651][T23281] kernel_stack 262144 [ 980.859651][T23281] pagetables 10149888 [ 980.859651][T23281] percpu 0 [ 980.859651][T23281] sock 0 [ 980.859651][T23281] shmem 155648 [ 980.859651][T23281] file_mapped 155648 [ 980.859651][T23281] file_dirty 0 [ 980.859651][T23281] file_writeback 0 [ 980.859651][T23281] swapcached 0 [ 980.859651][T23281] anon_thp 232783872 [ 980.859651][T23281] file_thp 0 [ 980.859651][T23281] shmem_thp 0 [ 980.859651][T23281] inactive_anon 290570240 [ 980.859651][T23281] active_anon 147456 [ 980.859651][T23281] inactive_file 0 [ 980.859651][T23281] active_file 0 [ 980.859651][T23281] unevictable 0 [ 980.859651][T23281] slab_reclaimable 597704 [ 980.859651][T23281] slab_unreclaimable 10489280 [ 980.859651][T23281] slab 11086984 [ 980.859651][T23281] workingset_refault_anon 0 [ 980.859651][T23281] workingset_refault_file 0 [ 980.859651][T23281] workingset_activate_anon 0 [ 980.957657][T23281] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23281,uid=0 [ 980.973393][T23281] Memory cgroup out of memory: Killed process 23281 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 980.995179][ T28] oom_reaper: reaped process 23281 (syz-executor.1), now anon-rss:0kB, file-rss:14080kB, shmem-rss:0kB [ 981.007687][T23244] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 981.018487][T23244] CPU: 0 PID: 23244 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 981.027277][T23244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 981.037341][T23244] Call Trace: [ 981.040619][T23244] [ 981.043560][T23244] dump_stack_lvl+0xcd/0x134 [ 981.048178][T23244] dump_header+0x106/0x624 [ 981.052671][T23244] oom_kill_process.cold+0x10/0x15 [ 981.057785][T23244] out_of_memory+0x358/0x1460 [ 981.062484][T23244] ? find_held_lock+0x2d/0x110 [ 981.067339][T23244] ? oom_killer_disable+0x270/0x270 [ 981.072633][T23244] ? find_held_lock+0x2d/0x110 [ 981.077410][T23244] mem_cgroup_out_of_memory+0x206/0x270 [ 981.082983][T23244] ? mem_cgroup_margin+0x130/0x130 [ 981.088119][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 981.092994][T23244] try_charge_memcg+0xc76/0x1270 [ 981.097944][T23244] ? find_held_lock+0x2d/0x110 [ 981.102716][T23244] ? mem_cgroup_oom_trylock+0x220/0x220 [ 981.108273][T23244] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 981.113821][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 981.118688][T23244] charge_memcg+0xae/0x360 [ 981.123111][T23244] __mem_cgroup_charge+0x27/0x90 [ 981.128055][T23244] wp_page_copy+0x294/0x2280 [ 981.132654][T23244] ? do_page_mkwrite+0x550/0x550 [ 981.137592][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 981.142444][T23244] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 981.148254][T23244] ? vm_normal_page+0x146/0x2a0 [ 981.153119][T23244] do_wp_page+0x2cb/0x1ae0 [ 981.157543][T23244] __handle_mm_fault+0x1f41/0x5120 [ 981.162668][T23244] ? vm_iomap_memory+0x190/0x190 [ 981.167629][T23244] handle_mm_fault+0x1c8/0x790 [ 981.172397][T23244] do_user_addr_fault+0x489/0x11c0 [ 981.177524][T23244] exc_page_fault+0x9e/0x180 [ 981.182120][T23244] ? asm_exc_page_fault+0x8/0x30 [ 981.187062][T23244] asm_exc_page_fault+0x1e/0x30 [ 981.191917][T23244] RIP: 0033:0x7f67b63ce0a9 [ 981.196338][T23244] Code: 00 00 00 00 48 8d b8 f0 fe ff ff e8 b1 2a 01 00 85 c0 75 16 48 8b 44 24 28 48 8b 54 24 20 48 8b 70 38 8b 78 08 e8 d7 9a ff ff <64> f0 83 2c 25 b8 ff ff ff 01 83 44 24 14 01 e9 0e fe ff ff 0f 1f [ 981.215942][T23244] RSP: 002b:00007f67b4d7b190 EFLAGS: 00010206 [ 981.222007][T23244] RAX: 0000000000004b39 RBX: 00007f67b653a030 RCX: 00007f67b6480ff1 [ 981.229977][T23244] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 981.237952][T23244] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 981.245925][T23244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 981.253890][T23244] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 981.261874][T23244] [ 981.279159][T23244] memory: usage 307008kB, limit 307200kB, failcnt 16297 [ 981.286561][T23244] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 981.293822][T23244] Memory cgroup stats for /syz1: [ 981.294446][T23244] anon 290578432 [ 981.294446][T23244] file 155648 [ 981.294446][T23244] kernel_stack 229376 [ 981.294446][T23244] pagetables 10055680 [ 981.294446][T23244] percpu 0 [ 981.294446][T23244] sock 0 [ 981.294446][T23244] shmem 155648 [ 981.294446][T23244] file_mapped 155648 [ 981.294446][T23244] file_dirty 0 [ 981.294446][T23244] file_writeback 0 [ 981.294446][T23244] swapcached 0 [ 981.294446][T23244] anon_thp 232783872 [ 981.294446][T23244] file_thp 0 [ 981.294446][T23244] shmem_thp 0 [ 981.294446][T23244] inactive_anon 290586624 [ 981.294446][T23244] active_anon 147456 [ 981.294446][T23244] inactive_file 0 [ 981.294446][T23244] active_file 0 [ 981.294446][T23244] unevictable 0 [ 981.294446][T23244] slab_reclaimable 551400 [ 981.294446][T23244] slab_unreclaimable 10436632 [ 981.294446][T23244] slab 10988032 [ 981.294446][T23244] workingset_refault_anon 0 [ 981.294446][T23244] workingset_refault_file 0 [ 981.294446][T23244] workingset_activate_anon 0 [ 981.394352][T23244] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23251,uid=0 [ 981.411534][T23244] Memory cgroup out of memory: Killed process 23251 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 981.466201][T23244] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 981.489107][T23244] CPU: 0 PID: 23244 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 981.497916][T23244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 981.507988][T23244] Call Trace: [ 981.511270][T23244] [ 981.514187][T23244] dump_stack_lvl+0xcd/0x134 [ 981.518780][T23244] dump_header+0x106/0x624 [ 981.523214][T23244] oom_kill_process.cold+0x10/0x15 [ 981.528342][T23244] out_of_memory+0x358/0x1460 [ 981.533139][T23244] ? find_held_lock+0x2d/0x110 [ 981.537900][T23244] ? oom_killer_disable+0x270/0x270 [ 981.543108][T23244] ? find_held_lock+0x2d/0x110 [ 981.547879][T23244] mem_cgroup_out_of_memory+0x206/0x270 [ 981.553433][T23244] ? mem_cgroup_margin+0x130/0x130 [ 981.558543][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 981.563416][T23244] try_charge_memcg+0xed2/0x1270 [ 981.568396][T23244] ? mem_cgroup_oom_trylock+0x220/0x220 [ 981.573958][T23244] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 981.579699][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 981.584587][T23244] obj_cgroup_charge_pages+0x1e/0x90 [ 981.589887][T23244] obj_cgroup_charge+0xf3/0x280 [ 981.594754][T23244] ? anon_vma_clone+0x33e/0x5f0 [ 981.599610][T23244] kmem_cache_alloc+0x92/0x3a0 [ 981.604385][T23244] anon_vma_clone+0x33e/0x5f0 [ 981.609077][T23244] anon_vma_fork+0x82/0x630 [ 981.613584][T23244] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 981.619309][T23244] ? __vm_enough_memory+0x184/0x360 [ 981.624525][T23244] dup_mm+0xa07/0x13e0 [ 981.628635][T23244] ? replace_mm_exe_file+0x490/0x490 [ 981.633939][T23244] ? __raw_spin_lock_init+0x36/0x110 [ 981.639248][T23244] copy_process+0x6fed/0x75a0 [ 981.643934][T23244] ? find_held_lock+0x2d/0x110 [ 981.648726][T23244] ? __cleanup_sighand+0xb0/0xb0 [ 981.653700][T23244] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 981.659950][T23244] ? _copy_from_user+0x5d/0x180 [ 981.664816][T23244] ? kernel_clone+0x314/0xab0 [ 981.669499][T23244] kernel_clone+0xe7/0xab0 [ 981.673923][T23244] ? create_io_thread+0xf0/0xf0 [ 981.678789][T23244] ? find_held_lock+0x2d/0x110 [ 981.683553][T23244] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 981.689544][T23244] __do_sys_clone3+0x1dd/0x2f0 [ 981.694305][T23244] ? __do_sys_clone+0x110/0x110 [ 981.699167][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 981.704019][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 981.708892][T23244] ? syscall_enter_from_user_mode+0x21/0x70 [ 981.714799][T23244] do_syscall_64+0x35/0xb0 [ 981.719217][T23244] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 981.725115][T23244] RIP: 0033:0x7f67b6426e99 [ 981.729537][T23244] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 981.749143][T23244] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 981.757555][T23244] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 981.765526][T23244] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 981.773588][T23244] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 981.781555][T23244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 981.789528][T23244] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 981.797522][T23244] [ 981.808952][T23244] memory: usage 307172kB, limit 307200kB, failcnt 16430 [ 981.815935][T23244] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 981.823532][T23244] Memory cgroup stats for /syz1: [ 981.823709][T23244] anon 290603008 [ 981.823709][T23244] file 155648 [ 981.823709][T23244] kernel_stack 229376 [ 981.823709][T23244] pagetables 10067968 [ 981.823709][T23244] percpu 0 [ 981.823709][T23244] sock 0 [ 981.823709][T23244] shmem 155648 [ 981.823709][T23244] file_mapped 155648 [ 981.823709][T23244] file_dirty 0 [ 981.823709][T23244] file_writeback 0 [ 981.823709][T23244] swapcached 0 [ 981.823709][T23244] anon_thp 232783872 [ 981.823709][T23244] file_thp 0 [ 981.823709][T23244] shmem_thp 0 [ 981.823709][T23244] inactive_anon 290594816 [ 981.823709][T23244] active_anon 147456 [ 981.823709][T23244] inactive_file 0 [ 981.823709][T23244] active_file 0 [ 981.823709][T23244] unevictable 0 [ 981.823709][T23244] slab_reclaimable 553368 [ 981.823709][T23244] slab_unreclaimable 10495416 [ 981.823709][T23244] slab 11048784 [ 981.823709][T23244] workingset_refault_anon 0 [ 981.823709][T23244] workingset_refault_file 0 [ 981.823709][T23244] workingset_activate_anon 0 [ 981.921243][T23244] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23283,uid=0 [ 981.937046][T23244] Memory cgroup out of memory: Killed process 23283 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 981.985781][T23244] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 981.998124][T23244] CPU: 1 PID: 23244 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 982.006903][T23244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 982.016958][T23244] Call Trace: [ 982.020242][T23244] [ 982.023162][T23244] dump_stack_lvl+0xcd/0x134 [ 982.027758][T23244] dump_header+0x106/0x624 [ 982.032188][T23244] oom_kill_process.cold+0x10/0x15 [ 982.037290][T23244] out_of_memory+0x358/0x1460 [ 982.041980][T23244] ? find_held_lock+0x2d/0x110 [ 982.046744][T23244] ? oom_killer_disable+0x270/0x270 [ 982.051945][T23244] ? find_held_lock+0x2d/0x110 [ 982.056716][T23244] mem_cgroup_out_of_memory+0x206/0x270 [ 982.062273][T23244] ? mem_cgroup_margin+0x130/0x130 [ 982.067371][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 982.072300][T23244] try_charge_memcg+0xed2/0x1270 [ 982.077299][T23244] ? mem_cgroup_oom_trylock+0x220/0x220 [ 982.082834][T23244] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 982.088544][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 982.093386][T23244] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 982.099104][T23244] obj_cgroup_charge_pages+0x1e/0x90 [ 982.104382][T23244] __memcg_kmem_charge_page+0x392/0x5f0 [ 982.109925][T23244] __alloc_pages+0x1da/0x500 [ 982.114504][T23244] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 982.121263][T23244] ? find_held_lock+0x2d/0x110 [ 982.126025][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 982.130861][T23244] ? do_raw_spin_lock+0x120/0x2b0 [ 982.135886][T23244] alloc_pages+0x1a7/0x300 [ 982.140297][T23244] __pmd_alloc+0x3b/0x5c0 [ 982.144620][T23244] ? __pud_alloc+0xdd/0x170 [ 982.149133][T23244] copy_page_range+0x299e/0x42c0 [ 982.154195][T23244] ? handle_mm_fault+0x790/0x790 [ 982.159160][T23244] ? __vma_link_rb+0x553/0x710 [ 982.163958][T23244] dup_mm+0xa4e/0x13e0 [ 982.168134][T23244] ? replace_mm_exe_file+0x490/0x490 [ 982.173509][T23244] ? __raw_spin_lock_init+0x36/0x110 [ 982.178811][T23244] copy_process+0x6fed/0x75a0 [ 982.183476][T23244] ? find_held_lock+0x2d/0x110 [ 982.188240][T23244] ? __cleanup_sighand+0xb0/0xb0 [ 982.193171][T23244] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 982.199457][T23244] ? _copy_from_user+0x5d/0x180 [ 982.204312][T23244] ? kernel_clone+0x314/0xab0 [ 982.209043][T23244] kernel_clone+0xe7/0xab0 [ 982.213464][T23244] ? create_io_thread+0xf0/0xf0 [ 982.218344][T23244] ? find_held_lock+0x2d/0x110 [ 982.223121][T23244] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 982.229125][T23244] __do_sys_clone3+0x1dd/0x2f0 [ 982.233902][T23244] ? __do_sys_clone+0x110/0x110 [ 982.238856][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 982.243700][T23244] ? lock_downgrade+0x6e0/0x6e0 [ 982.248637][T23244] ? syscall_enter_from_user_mode+0x21/0x70 [ 982.254609][T23244] do_syscall_64+0x35/0xb0 [ 982.259110][T23244] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 982.265022][T23244] RIP: 0033:0x7f67b6426e99 [ 982.269428][T23244] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 982.289023][T23244] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 982.297434][T23244] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 982.305417][T23244] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 982.313448][T23244] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 982.321430][T23244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 982.329391][T23244] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 982.337801][T23244] [ 982.352455][T23244] memory: usage 307204kB, limit 307200kB, failcnt 16521 [ 982.359559][T23244] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 982.367359][T23244] Memory cgroup stats for /syz1: [ 982.367940][T23244] anon 290648064 [ 982.367940][T23244] file 155648 [ 982.367940][T23244] kernel_stack 229376 [ 982.367940][T23244] pagetables 10059776 [ 982.367940][T23244] percpu 0 [ 982.367940][T23244] sock 0 [ 982.367940][T23244] shmem 155648 [ 982.367940][T23244] file_mapped 155648 [ 982.367940][T23244] file_dirty 0 [ 982.367940][T23244] file_writeback 0 [ 982.367940][T23244] swapcached 0 [ 982.367940][T23244] anon_thp 232783872 [ 982.367940][T23244] file_thp 0 [ 982.367940][T23244] shmem_thp 0 [ 982.367940][T23244] inactive_anon 290660352 [ 982.367940][T23244] active_anon 147456 [ 982.367940][T23244] inactive_file 0 [ 982.367940][T23244] active_file 0 [ 982.367940][T23244] unevictable 0 [ 982.367940][T23244] slab_reclaimable 551064 [ 982.367940][T23244] slab_unreclaimable 10505848 [ 982.367940][T23244] slab 11056912 [ 982.367940][T23244] workingset_refault_anon 0 [ 982.367940][T23244] workingset_refault_file 0 [ 982.367940][T23244] workingset_activate_anon 0 [ 982.472658][T23244] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23285,uid=0 [ 982.488955][T23244] Memory cgroup out of memory: Killed process 23285 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 982.489225][T23285] syz-executor.1: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) [ 982.515102][ T28] oom_reaper: reaped process 23285 (syz-executor.1), now anon-rss:0kB, file-rss:14080kB, shmem-rss:0kB [ 982.547572][T23285] ,cpuset=syz1,mems_allowed=0-1 [ 982.559840][T23285] CPU: 1 PID: 23285 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 982.564953][T23282] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 982.568626][T23285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 982.568643][T23285] Call Trace: [ 982.568650][T23285] [ 982.568660][T23285] dump_stack_lvl+0xcd/0x134 [ 982.568708][T23285] warn_alloc.cold+0x87/0x17a [ 982.568736][T23285] ? zone_watermark_ok_safe+0x290/0x290 [ 982.568763][T23285] ? __kmalloc_node+0x62/0x390 [ 982.568809][T23285] ? __vmalloc_node_range+0x571/0xab0 [ 982.568840][T23285] __vmalloc_node_range+0x880/0xab0 [ 982.568876][T23285] ? vfree_atomic+0xe0/0xe0 [ 982.630272][T23285] ? rcu_read_lock_sched_held+0x3a/0x70 [ 982.635830][T23285] ? kernel_clone+0xe7/0xab0 [ 982.640430][T23285] copy_process+0x926/0x75a0 [ 982.645027][T23285] ? kernel_clone+0xe7/0xab0 [ 982.649617][T23285] ? find_held_lock+0x2d/0x110 [ 982.654418][T23285] ? __cleanup_sighand+0xb0/0xb0 [ 982.659363][T23285] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 982.665606][T23285] ? _copy_from_user+0x5d/0x180 [ 982.670465][T23285] ? kernel_clone+0x314/0xab0 [ 982.675145][T23285] kernel_clone+0xe7/0xab0 [ 982.679574][T23285] ? create_io_thread+0xf0/0xf0 [ 982.684439][T23285] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 982.690430][T23285] __do_sys_clone3+0x1dd/0x2f0 [ 982.695195][T23285] ? __do_sys_clone+0x110/0x110 [ 982.700054][T23285] ? lock_downgrade+0x6e0/0x6e0 [ 982.704906][T23285] ? lock_downgrade+0x6e0/0x6e0 [ 982.709776][T23285] ? syscall_enter_from_user_mode+0x21/0x70 [ 982.715680][T23285] do_syscall_64+0x35/0xb0 [ 982.720105][T23285] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 982.726011][T23285] RIP: 0033:0x7f67b6426e99 [ 982.730432][T23285] Code: Unable to access opcode bytes at RIP 0x7f67b6426e6f. [ 982.737794][T23285] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 982.746653][T23285] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 982.754634][T23285] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 982.762617][T23285] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 982.770582][T23285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 982.778553][T23285] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 982.786537][T23285] [ 982.789552][T23282] CPU: 0 PID: 23282 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 982.798331][T23282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 982.800643][T23285] Mem-Info: [ 982.808389][T23282] Call Trace: [ 982.808400][T23282] [ 982.808411][T23282] dump_stack_lvl+0xcd/0x134 [ 982.808445][T23282] dump_header+0x106/0x624 [ 982.808471][T23282] oom_kill_process.cold+0x10/0x15 [ 982.808499][T23282] out_of_memory+0x358/0x1460 [ 982.811820][T23285] active_anon:641 inactive_anon:401641 isolated_anon:0 [ 982.811820][T23285] active_file:7190 inactive_file:67249 isolated_file:0 [ 982.811820][T23285] unevictable:768 dirty:0 writeback:0 [ 982.811820][T23285] slab_reclaimable:18267 slab_unreclaimable:196615 [ 982.811820][T23285] mapped:27777 shmem:2253 pagetables:32076 bounce:0 [ 982.811820][T23285] kernel_misc_reclaimable:0 [ 982.811820][T23285] free:852581 free_pcp:12055 free_cma:0 [ 982.814863][T23282] ? find_held_lock+0x2d/0x110 [ 982.814895][T23282] ? oom_killer_disable+0x270/0x270 [ 982.820744][T23285] Node 0 active_anon:2268kB inactive_anon:1528568kB active_file:28592kB inactive_file:238896kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:110808kB dirty:0kB writeback:0kB shmem:6092kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 1071104kB writeback_tmp:0kB kernel_stack:41472kB pagetables:79404kB all_unreclaimable? no [ 982.822383][T23282] ? find_held_lock+0x2d/0x110 [ 982.822421][T23282] mem_cgroup_out_of_memory+0x206/0x270 [ 982.827036][T23285] Node 1 active_anon:296kB inactive_anon:77996kB active_file:168kB inactive_file:30100kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:300kB dirty:0kB writeback:0kB shmem:2920kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:19880kB pagetables:48900kB all_unreclaimable? no [ 982.831900][T23282] ? mem_cgroup_margin+0x130/0x130 [ 982.831924][T23282] ? lock_downgrade+0x6e0/0x6e0 [ 982.831970][T23282] try_charge_memcg+0xed2/0x1270 [ 982.832001][T23282] ? find_held_lock+0x2d/0x110 [ 982.832027][T23282] ? mem_cgroup_oom_trylock+0x220/0x220 [ 982.832056][T23282] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 982.832082][T23282] ? lock_downgrade+0x6e0/0x6e0 [ 982.838607][T23285] Node 0 [ 982.878502][T23282] charge_memcg+0xae/0x360 [ 982.878539][T23282] __mem_cgroup_charge+0x27/0x90 [ 982.878568][T23282] __handle_mm_fault+0x1dff/0x5120 [ 982.878605][T23282] ? vm_iomap_memory+0x190/0x190 [ 982.878658][T23282] handle_mm_fault+0x1c8/0x790 [ 982.878689][T23282] do_user_addr_fault+0x489/0x11c0 [ 982.884724][T23285] DMA free:10812kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:1308kB active_file:0kB inactive_file:456kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:164kB local_pcp:112kB free_cma:0kB [ 982.888622][T23282] exc_page_fault+0x9e/0x180 [ 982.888668][T23282] ? asm_exc_page_fault+0x8/0x30 [ 982.888698][T23282] asm_exc_page_fault+0x1e/0x30 [ 982.924211][T23285] lowmem_reserve[]: [ 982.925103][T23282] RIP: 0033:0x7f67b64222a6 [ 982.931985][T23285] 0 [ 982.960980][T23282] Code: 82 63 01 00 00 48 89 d1 f3 a4 c3 80 fa 08 73 12 80 fa 04 73 1e 80 fa 01 77 26 72 05 0f b6 0e 88 0f c3 48 8b 4c 16 f8 48 8b 36 <48> 89 4c 17 f8 48 89 37 c3 8b 4c 16 fc 8b 36 89 4c 17 fc 89 37 c3 [ 982.961010][T23282] RSP: 002b:00007f67b6a6db98 EFLAGS: 00010206 [ 982.961031][T23282] RAX: 0000000020000180 RBX: 0000000000000000 RCX: 006f696475612f76 [ 982.961049][T23282] RDX: 000000000000000b RSI: 6475612f7665642f RDI: 0000000020000180 [ 982.961065][T23282] RBP: 00007f67b6a6dc58 R08: 00007f67b693e000 R09: 00007f67b653eb18 [ 982.961081][T23282] R10: 00007f67b6a6dc80 R11: 0000000000000246 R12: 00000000000efbb6 [ 982.961101][T23282] R13: 00007f67b6a6dc80 R14: 00007f67b6539f60 R15: 0000000000000032 [ 982.961133][T23282] [ 982.967703][T23285] 2645 [ 982.999818][T23282] memory: usage 307200kB, limit 307200kB, failcnt 16631 [ 983.004455][T23285] 2645 [ 983.017199][T23282] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 983.020039][T23285] 2645 [ 983.025204][T23282] Memory cgroup stats for [ 983.033931][T23285] 2645 [ 983.064246][T23282] /syz1 [ 983.067725][T23285] [ 983.072161][T23282] : [ 983.079928][T23285] Node 0 [ 983.080425][T23282] anon 290656256 [ 983.080425][T23282] file 155648 [ 983.080425][T23282] kernel_stack 262144 [ 983.080425][T23282] pagetables 10080256 [ 983.080425][T23282] percpu 0 [ 983.080425][T23282] sock 0 [ 983.080425][T23282] shmem 155648 [ 983.080425][T23282] file_mapped 155648 [ 983.080425][T23282] file_dirty 0 [ 983.080425][T23282] file_writeback 0 [ 983.080425][T23282] swapcached 0 [ 983.080425][T23282] anon_thp 232783872 [ 983.080425][T23282] file_thp 0 [ 983.080425][T23282] shmem_thp 0 [ 983.080425][T23282] inactive_anon 290660352 [ 983.080425][T23282] active_anon 147456 [ 983.080425][T23282] inactive_file 0 [ 983.080425][T23282] active_file 0 [ 983.080425][T23282] unevictable 0 [ 983.080425][T23282] slab_reclaimable 549144 [ 983.080425][T23282] slab_unreclaimable 10521960 [ 983.080425][T23282] slab 11071104 [ 983.080425][T23282] workingset_refault_anon 0 [ 983.080425][T23282] workingset_refault_file 0 [ 983.080425][T23282] workingset_activate_anon 0 [ 983.086368][T23285] DMA32 free:46460kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:2268kB inactive_anon:1527336kB active_file:28592kB inactive_file:238440kB unevictable:1536kB writepending:0kB present:3129332kB managed:2716748kB mlocked:0kB bounce:0kB free_pcp:37768kB local_pcp:18060kB free_cma:0kB [ 983.102322][T23282] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1 [ 983.118109][T23285] lowmem_reserve[]: [ 983.127498][T23282] ,mems_allowed=0-1 [ 983.170950][T23285] 0 [ 983.171597][T23282] ,oom_memcg= [ 983.174469][T23285] 0 [ 983.178678][T23282] /syz1,task_memcg=/syz1,task=syz-executor.1,pid=23244,uid=0 [ 983.178783][T23282] Memory cgroup out of memory: Killed process 23244 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 983.363887][T23285] 0 0 0 [ 983.367084][T23285] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 983.405039][T23285] lowmem_reserve[]: 0 0 0 0 0 [ 983.415243][T23285] Node 1 Normal free:3353052kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:296kB inactive_anon:77792kB active_file:168kB inactive_file:30100kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:11424kB local_pcp:6656kB free_cma:0kB [ 983.453963][T23285] lowmem_reserve[]: 0 0 0 0 0 [ 983.459079][T23285] Node 0 DMA: 9*4kB (UM) 5*8kB (U) 1*16kB (M) 13*32kB (U) 7*64kB (UM) 7*128kB (UM) 1*256kB (U) 1*512kB (U) 0*1024kB 2*2048kB (M) 1*4096kB (E) = 10812kB [ 983.478562][T23285] Node 0 DMA32: 225*4kB (ME) 141*8kB (UME) 153*16kB (UME) 98*32kB (UME) 401*64kB (UME) 61*128kB (UME) 5*256kB (UE) 4*512kB (ME) 0*1024kB 1*2048kB (M) 0*4096kB = 46460kB [ 983.495967][T23285] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 983.514901][T23285] Node 1 Normal: 3*4kB (E) 6*8kB (UME) 2*16kB (UM) 2*32kB (UE) 1*64kB (M) 2*128kB (ME) 2*256kB (ME) 3*512kB (UME) 2*1024kB (ME) 1*2048kB (E) 817*4096kB (M) = 3353052kB [ 983.541164][T23285] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 983.556049][T23285] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 983.565903][T23285] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 983.576246][T23285] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 983.588386][T23285] 9600 total pagecache pages [ 983.592999][T23285] 0 pages in swap cache [ 983.597152][T23285] Swap cache stats: add 0, delete 0, find 0/0 [ 983.603790][T23285] Free swap = 0kB [ 983.607809][T23285] Total swap = 0kB [ 983.611542][T23285] 2097051 pages RAM [ 983.615349][T23285] 0 pages HighMem/MovableOnly [ 983.620548][T23285] 384519 pages reserved [ 983.624737][T23285] 0 pages cma reserved 18:17:33 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9c9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:33 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x500, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:33 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3050f, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:33 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x50340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 983.664289][T23284] cgroup2: Unknown parameter '@[-}+' 18:17:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000600)=ANY=[@ANYBLOB="2f6465090000006d7030002cbca6360525af908105b452a1729ff2cb1a6fd86afb32482c5004379ea455ca39c4749819497669bb584c0ca8a6ecf10db9fd4ad9a26d370d6601433171bafd0d021e1bd813c623a9adc95021225d2d118b5bccb3cbd7bf8ef5ffc45a99f6f8eebe7259b15ddfbf9081bcbc475664458c90eace6f1ab60100cafb9705abbd07eacf678c2ad5240e7028077521fd14db7188ba4bcabf0e7f3b6647a693511299ec11bcc873ec1b82fb97b89ded53bd3b9742716ee4f06e6a360c7cfbdd52628abf2d933f259cce7dd22948aaa5fb9af8fa22dd1dd22715b4f7dc67cd591df6405d4096b3d5ddda8e21ed7f980f3b9f81fca3605795e3e2955225eefd39c530ae24ba7ce29a5ac0c84db8d7466b4be6c9c591f096e0c39169ec3d5ebfa724309d1f71633979c0372c187d2aa77096b5c93cbc8900df98d6"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000400)={0x0, 0xad, "21cdeebc498a30443bc675290fa1247e2eba33ef51efd580707b785c16500dfd12fe8abb67282ae217eaafcaabb4472af88630a806201b05766a14b1fb75d57b3b2d078b97e21166a9c5d0c779a5f90c5cb5ce8d4756be3827c190fd47b2a4bc97e88fbcbd3275f7e66b97a04596032afaf470081d3e27f5f0f900f48ee3f186c1f61e29a4cc1da76538ca23f9492f7d9382e0d469a69b9aab15315043b2a662ae440135963b4d65d3e021a1ab"}, &(0x7f00000001c0)=0xb5) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000600)=ANY=[@ANYBLOB="2f6465090000006d7030002cbca6360525af908105b452a1729ff2cb1a6fd86afb32482c5004379ea455ca39c4749819497669bb584c0ca8a6ecf10db9fd4ad9a26d370d6601433171bafd0d021e1bd813c623a9adc95021225d2d118b5bccb3cbd7bf8ef5ffc45a99f6f8eebe7259b15ddfbf9081bcbc475664458c90eace6f1ab60100cafb9705abbd07eacf678c2ad5240e7028077521fd14db7188ba4bcabf0e7f3b6647a693511299ec11bcc873ec1b82fb97b89ded53bd3b9742716ee4f06e6a360c7cfbdd52628abf2d933f259cce7dd22948aaa5fb9af8fa22dd1dd22715b4f7dc67cd591df6405d4096b3d5ddda8e21ed7f980f3b9f81fca3605795e3e2955225eefd39c530ae24ba7ce29a5ac0c84db8d7466b4be6c9c591f096e0c39169ec3d5ebfa724309d1f71633979c0372c187d2aa77096b5c93cbc8900df98d6"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000400)={0x0, 0xad, "21cdeebc498a30443bc675290fa1247e2eba33ef51efd580707b785c16500dfd12fe8abb67282ae217eaafcaabb4472af88630a806201b05766a14b1fb75d57b3b2d078b97e21166a9c5d0c779a5f90c5cb5ce8d4756be3827c190fd47b2a4bc97e88fbcbd3275f7e66b97a04596032afaf470081d3e27f5f0f900f48ee3f186c1f61e29a4cc1da76538ca23f9492f7d9382e0d469a69b9aab15315043b2a662ae440135963b4d65d3e021a1ab"}, &(0x7f00000001c0)=0xb5) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:17:34 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30510, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 983.837646][T23298] device macvtap2 entered promiscuous mode 18:17:34 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x600, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:34 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9ca, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 983.928732][T23298] device virt_wifi0 entered promiscuous mode [ 983.982328][T23298] team0: Device macvtap2 failed to register rx_handler [ 984.068591][T23298] device virt_wifi0 left promiscuous mode [ 984.140897][T23300] cgroup2: Unknown parameter '@[-}+' [ 984.219771][T23304] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 984.231719][T23304] CPU: 1 PID: 23304 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 984.240600][T23304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 984.250674][T23304] Call Trace: [ 984.253973][T23304] [ 984.257014][T23304] dump_stack_lvl+0xcd/0x134 [ 984.261636][T23304] dump_header+0x106/0x624 18:17:34 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9cb, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 984.266077][T23304] oom_kill_process.cold+0x10/0x15 [ 984.271216][T23304] out_of_memory+0x358/0x1460 [ 984.275930][T23304] ? find_held_lock+0x2d/0x110 [ 984.280718][T23304] ? oom_killer_disable+0x270/0x270 [ 984.285953][T23304] ? find_held_lock+0x2d/0x110 [ 984.291004][T23304] mem_cgroup_out_of_memory+0x206/0x270 [ 984.296571][T23304] ? mem_cgroup_margin+0x130/0x130 [ 984.301703][T23304] ? lock_downgrade+0x6e0/0x6e0 [ 984.306595][T23304] try_charge_memcg+0xed2/0x1270 [ 984.311604][T23304] ? mem_cgroup_oom_trylock+0x220/0x220 18:17:34 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9cc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 984.317175][T23304] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 984.322920][T23304] ? lock_downgrade+0x6e0/0x6e0 [ 984.327815][T23304] obj_cgroup_charge_pages+0x1e/0x90 [ 984.333125][T23304] obj_cgroup_charge+0xf3/0x280 [ 984.338003][T23304] ? __d_alloc+0x2a/0x950 [ 984.342355][T23304] kmem_cache_alloc+0x92/0x3a0 [ 984.347148][T23304] __d_alloc+0x2a/0x950 [ 984.351323][T23304] ? lockdep_init_map_type+0x2c3/0x7b0 [ 984.356813][T23304] d_alloc_pseudo+0x19/0x70 [ 984.361337][T23304] alloc_file_pseudo+0xc6/0x250 [ 984.366208][T23304] ? alloc_file+0x590/0x590 [ 984.370723][T23304] ? find_get_context+0x441/0xa40 [ 984.375790][T23304] ? perf_pending_event+0x560/0x560 [ 984.381022][T23304] anon_inode_getfile+0xb0/0x1e0 [ 984.385990][T23304] __do_sys_perf_event_open+0x107e/0x3130 [ 984.391742][T23304] ? perf_remove_from_context+0x240/0x240 [ 984.397610][T23304] ? __context_tracking_exit+0xb8/0xe0 [ 984.403098][T23304] ? lock_downgrade+0x6e0/0x6e0 [ 984.407988][T23304] ? syscall_enter_from_user_mode+0x21/0x70 [ 984.413916][T23304] do_syscall_64+0x35/0xb0 18:17:34 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9cd, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 984.418352][T23304] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 984.424261][T23304] RIP: 0033:0x7f67b6426e99 [ 984.428682][T23304] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 984.448309][T23304] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 984.456748][T23304] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 984.464744][T23304] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 000000002001d000 [ 984.472742][T23304] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 984.480735][T23304] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 984.488728][T23304] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 984.496738][T23304] [ 984.546929][T23304] memory: usage 307200kB, limit 307200kB, failcnt 16684 [ 984.574216][T23304] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 984.605281][T23304] Memory cgroup stats for /syz1: [ 984.605509][T23304] anon 290725888 [ 984.605509][T23304] file 155648 [ 984.605509][T23304] kernel_stack 262144 [ 984.605509][T23304] pagetables 9977856 [ 984.605509][T23304] percpu 0 [ 984.605509][T23304] sock 0 [ 984.605509][T23304] shmem 155648 [ 984.605509][T23304] file_mapped 155648 [ 984.605509][T23304] file_dirty 0 [ 984.605509][T23304] file_writeback 0 [ 984.605509][T23304] swapcached 0 [ 984.605509][T23304] anon_thp 232783872 [ 984.605509][T23304] file_thp 0 [ 984.605509][T23304] shmem_thp 0 [ 984.605509][T23304] inactive_anon 290734080 [ 984.605509][T23304] active_anon 147456 [ 984.605509][T23304] inactive_file 0 [ 984.605509][T23304] active_file 0 [ 984.605509][T23304] unevictable 0 [ 984.605509][T23304] slab_reclaimable 566144 [ 984.605509][T23304] slab_unreclaimable 10549856 [ 984.605509][T23304] slab 11116000 [ 984.605509][T23304] workingset_refault_anon 0 [ 984.605509][T23304] workingset_refault_file 0 [ 984.605509][T23304] workingset_activate_anon 0 [ 984.706163][T23304] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23118,uid=0 [ 984.724790][T23304] Memory cgroup out of memory: Killed process 23118 (syz-executor.1) total-vm:57332kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) mount(&(0x7f0000000600)=ANY=[@ANYBLOB="2f6465090000006d7030002cbca6360525af908105b452a1729ff2cb1a6fd86afb32482c5004379ea455ca39c4749819497669bb584c0ca8a6ecf10db9fd4ad9a26d370d6601433171bafd0d021e1bd813c623a9adc95021225d2d118b5bccb3cbd7bf8ef5ffc45a99f6f8eebe7259b15ddfbf9081bcbc475664458c90eace6f1ab60100cafb9705abbd07eacf678c2ad5240e7028077521fd14db7188ba4bcabf0e7f3b6647a693511299ec11bcc873ec1b82fb97b89ded53bd3b9742716ee4f06e6a360c7cfbdd52628abf2d933f259cce7dd22948aaa5fb9af8fa22dd1dd22715b4f7dc67cd591df6405d4096b3d5ddda8e21ed7f980f3b9f81fca3605795e3e2955225eefd39c530ae24ba7ce29a5ac0c84db8d7466b4be6c9c591f096e0c39169ec3d5ebfa724309d1f71633979c0372c187d2aa77096b5c93cbc8900df98d6"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000400)={0x0, 0xad, "21cdeebc498a30443bc675290fa1247e2eba33ef51efd580707b785c16500dfd12fe8abb67282ae217eaafcaabb4472af88630a806201b05766a14b1fb75d57b3b2d078b97e21166a9c5d0c779a5f90c5cb5ce8d4756be3827c190fd47b2a4bc97e88fbcbd3275f7e66b97a04596032afaf470081d3e27f5f0f900f48ee3f186c1f61e29a4cc1da76538ca23f9492f7d9382e0d469a69b9aab15315043b2a662ae440135963b4d65d3e021a1ab"}, &(0x7f00000001c0)=0xb5) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:35 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x700, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:35 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30511, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:35 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x510e0000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:35 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:35 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9ce, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:35 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30512, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:35 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x900, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 984.925525][T23438] device macvtap2 entered promiscuous mode 18:17:35 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9cf, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 984.980176][T23438] device virt_wifi0 entered promiscuous mode [ 985.035688][T23438] team0: Device macvtap2 failed to register rx_handler [ 985.082403][T23438] device virt_wifi0 left promiscuous mode [ 985.150609][T23432] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 985.161840][T23432] CPU: 1 PID: 23432 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 985.170635][T23432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 985.180721][T23432] Call Trace: [ 985.184022][T23432] [ 985.186965][T23432] dump_stack_lvl+0xcd/0x134 [ 985.191583][T23432] dump_header+0x106/0x624 18:17:35 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30513, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 985.196021][T23432] oom_kill_process.cold+0x10/0x15 [ 985.201152][T23432] out_of_memory+0x358/0x1460 [ 985.205855][T23432] ? find_held_lock+0x2d/0x110 [ 985.210646][T23432] ? oom_killer_disable+0x270/0x270 [ 985.215874][T23432] ? find_held_lock+0x2d/0x110 [ 985.220662][T23432] mem_cgroup_out_of_memory+0x206/0x270 [ 985.226246][T23432] ? mem_cgroup_margin+0x130/0x130 [ 985.231464][T23432] ? lock_downgrade+0x6e0/0x6e0 [ 985.236357][T23432] try_charge_memcg+0xed2/0x1270 [ 985.241324][T23432] ? mem_cgroup_oom_trylock+0x220/0x220 [ 985.246892][T23432] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 985.252641][T23432] ? lock_downgrade+0x6e0/0x6e0 [ 985.257541][T23432] obj_cgroup_charge_pages+0x1e/0x90 [ 985.262859][T23432] obj_cgroup_charge+0xf3/0x280 [ 985.267744][T23432] ? alloc_pid+0xcf/0xd70 [ 985.272100][T23432] kmem_cache_alloc+0x92/0x3a0 [ 985.276901][T23432] alloc_pid+0xcf/0xd70 [ 985.281090][T23432] ? copy_thread+0x57b/0x8b0 [ 985.285707][T23432] ? copy_namespaces+0x1c1/0x450 [ 985.290672][T23432] copy_process+0x2ff0/0x75a0 [ 985.295371][T23432] ? __free_object+0x64b/0xe00 18:17:35 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30514, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 985.300166][T23432] ? lock_chain_count+0x20/0x20 [ 985.305060][T23432] ? __cleanup_sighand+0xb0/0xb0 [ 985.310020][T23432] ? debug_object_free+0x1c0/0x350 [ 985.315177][T23432] ? __lock_acquire+0x1655/0x5470 [ 985.320232][T23432] ? kernel_clone+0x314/0xab0 [ 985.324931][T23432] kernel_clone+0xe7/0xab0 [ 985.329374][T23432] ? create_io_thread+0xf0/0xf0 [ 985.334240][T23432] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 985.340245][T23432] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 985.346270][T23432] ? find_held_lock+0x2d/0x110 18:17:35 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30515, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 985.351068][T23432] __do_sys_clone+0xc8/0x110 [ 985.355679][T23432] ? kernel_clone+0xab0/0xab0 [ 985.360372][T23432] ? lock_downgrade+0x6e0/0x6e0 [ 985.365260][T23432] ? syscall_enter_from_user_mode+0x21/0x70 [ 985.371195][T23432] do_syscall_64+0x35/0xb0 [ 985.375639][T23432] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 985.381562][T23432] RIP: 0033:0x7f462bb432c1 [ 985.387297][T23432] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 985.406927][T23432] RSP: 002b:00007f462c188a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 985.415540][T23432] RAX: ffffffffffffffda RBX: 00007f462a496700 RCX: 00007f462bb432c1 [ 985.423531][T23432] RDX: 00007f462a4969d0 RSI: 00007f462a4962f0 RDI: 00000000003d0f00 [ 985.431521][T23432] RBP: 00007f462c188cb0 R08: 00007f462a496700 R09: 00007f462a496700 [ 985.439506][T23432] R10: 00007f462a4969d0 R11: 0000000000000206 R12: 00007f462c188b1e [ 985.447469][T23432] R13: 00007f462c188b1f R14: 00007f462a496300 R15: 000055555673b940 [ 985.455443][T23432] [ 985.473082][T23432] memory: usage 307200kB, limit 307200kB, failcnt 1689 [ 985.480281][T23432] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 985.497859][T23432] Memory cgroup stats for /syz5: [ 985.498036][T23432] anon 289599488 [ 985.498036][T23432] file 90112 [ 985.498036][T23432] kernel_stack 1048576 [ 985.498036][T23432] pagetables 9842688 [ 985.498036][T23432] percpu 0 [ 985.498036][T23432] sock 0 [ 985.498036][T23432] shmem 90112 [ 985.498036][T23432] file_mapped 90112 [ 985.498036][T23432] file_dirty 0 [ 985.498036][T23432] file_writeback 0 [ 985.498036][T23432] swapcached 0 [ 985.498036][T23432] anon_thp 224395264 [ 985.498036][T23432] file_thp 0 [ 985.498036][T23432] shmem_thp 0 [ 985.498036][T23432] inactive_anon 289603584 [ 985.498036][T23432] active_anon 86016 [ 985.498036][T23432] inactive_file 0 [ 985.498036][T23432] active_file 0 [ 985.498036][T23432] unevictable 0 [ 985.498036][T23432] slab_reclaimable 479128 [ 985.498036][T23432] slab_unreclaimable 11102392 [ 985.498036][T23432] slab 11581520 [ 985.498036][T23432] workingset_refault_anon 0 [ 985.498036][T23432] workingset_refault_file 0 [ 985.498036][T23432] workingset_activate_anon 0 [ 985.597229][T23432] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7663,uid=0 [ 985.612994][T23432] Memory cgroup out of memory: Killed process 7663 (syz-executor.5) total-vm:60776kB, anon-rss:2496kB, file-rss:15060kB, shmem-rss:64kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 985.635355][ T28] oom_reaper: reaped process 7663 (syz-executor.5), now anon-rss:0kB, file-rss:14336kB, shmem-rss:16kB [ 985.651472][T23439] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 985.664689][T23439] CPU: 0 PID: 23439 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 985.673493][T23439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 985.683563][T23439] Call Trace: [ 985.686855][T23439] [ 985.690231][T23439] dump_stack_lvl+0xcd/0x134 [ 985.694814][T23439] dump_header+0x106/0x624 [ 985.699224][T23439] oom_kill_process.cold+0x10/0x15 [ 985.704353][T23439] out_of_memory+0x358/0x1460 [ 985.709055][T23439] ? find_held_lock+0x2d/0x110 [ 985.713832][T23439] ? oom_killer_disable+0x270/0x270 [ 985.719035][T23439] ? find_held_lock+0x2d/0x110 [ 985.723818][T23439] mem_cgroup_out_of_memory+0x206/0x270 [ 985.729352][T23439] ? mem_cgroup_margin+0x130/0x130 [ 985.734450][T23439] ? lock_downgrade+0x6e0/0x6e0 [ 985.739310][T23439] try_charge_memcg+0xed2/0x1270 [ 985.744259][T23439] ? find_held_lock+0x2d/0x110 [ 985.749012][T23439] ? mem_cgroup_oom_trylock+0x220/0x220 [ 985.754548][T23439] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 985.760084][T23439] ? lock_downgrade+0x6e0/0x6e0 [ 985.764948][T23439] charge_memcg+0xae/0x360 [ 985.769366][T23439] __mem_cgroup_charge+0x27/0x90 [ 985.774313][T23439] wp_page_copy+0x294/0x2280 [ 985.778913][T23439] ? do_page_mkwrite+0x550/0x550 [ 985.783851][T23439] ? lock_downgrade+0x6e0/0x6e0 [ 985.788700][T23439] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 985.794425][T23439] ? vm_normal_page+0x146/0x2a0 [ 985.799288][T23439] do_wp_page+0x2cb/0x1ae0 [ 985.803714][T23439] __handle_mm_fault+0x1f41/0x5120 [ 985.808843][T23439] ? vm_iomap_memory+0x190/0x190 [ 985.813835][T23439] handle_mm_fault+0x1c8/0x790 [ 985.818603][T23439] do_user_addr_fault+0x489/0x11c0 [ 985.823727][T23439] exc_page_fault+0x9e/0x180 [ 985.828316][T23439] ? asm_exc_page_fault+0x8/0x30 [ 985.833266][T23439] asm_exc_page_fault+0x1e/0x30 [ 985.838121][T23439] RIP: 0033:0x7f67b63d21c6 [ 985.842534][T23439] Code: 11 0a 01 00 74 17 80 3d f6 11 0a 01 00 74 0e 80 3d de 11 0a 01 00 75 05 e8 e7 f7 ff ff 8b 05 41 be 56 00 c6 43 20 00 8d 50 ff <89> 15 34 be 56 00 85 d2 0f 88 69 01 00 00 48 83 c4 18 5b 5d 41 5c [ 985.862135][T23439] RSP: 002b:00007f67b6a6db60 EFLAGS: 00010246 [ 985.868214][T23439] RAX: 0000000000000003 RBX: 00007f67b653a100 RCX: 0000001b2e320000 [ 985.876179][T23439] RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000000000000000 [ 985.884142][T23439] RBP: 00007f67b6539f60 R08: 0000001b2e360000 R09: 00000000000001a0 [ 985.892106][T23439] R10: 00007f67b6a6dc80 R11: 0000000000000246 R12: 00000000000f07d5 [ 985.900073][T23439] R13: 00007f67b6a6dc80 R14: 00007f67b653a100 R15: 0000000000000032 [ 985.908056][T23439] [ 985.927423][T23439] memory: usage 307200kB, limit 307200kB, failcnt 16797 [ 985.934469][T23439] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 985.953155][T23439] Memory cgroup stats for /syz1: [ 985.953382][T23439] anon 290684928 [ 985.953382][T23439] file 155648 [ 985.953382][T23439] kernel_stack 294912 [ 985.953382][T23439] pagetables 9977856 [ 985.953382][T23439] percpu 0 [ 985.953382][T23439] sock 0 [ 985.953382][T23439] shmem 155648 [ 985.953382][T23439] file_mapped 155648 [ 985.953382][T23439] file_dirty 0 [ 985.953382][T23439] file_writeback 0 [ 985.953382][T23439] swapcached 0 [ 985.953382][T23439] anon_thp 232783872 [ 985.953382][T23439] file_thp 0 [ 985.953382][T23439] shmem_thp 0 [ 985.953382][T23439] inactive_anon 290689024 [ 985.953382][T23439] active_anon 147456 [ 985.953382][T23439] inactive_file 0 [ 985.953382][T23439] active_file 0 [ 985.953382][T23439] unevictable 0 [ 985.953382][T23439] slab_reclaimable 555304 [ 985.953382][T23439] slab_unreclaimable 10618312 [ 985.953382][T23439] slab 11173616 [ 985.953382][T23439] workingset_refault_anon 0 [ 985.953382][T23439] workingset_refault_file 0 [ 985.953382][T23439] workingset_activate_anon 0 [ 986.067844][T23439] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23477,uid=0 [ 986.091660][T23439] Memory cgroup out of memory: Killed process 23477 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:36 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x51340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:36 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30516, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:36 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9d0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:36 executing program 1: perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x400, 0x5}, 0x0, 0x71f7, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41}, 0x0, 0xffffffffefffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(0xffffffffffffffff, 0xc00464c9, &(0x7f0000000100)) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f00000001c0)=ANY=[@ANYBLOB="42238d9148836465762d6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x6, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 986.280185][T23501] device macvtap2 entered promiscuous mode [ 986.305781][T23501] device virt_wifi0 entered promiscuous mode [ 986.341914][T23501] team0: Device macvtap2 failed to register rx_handler [ 986.351132][T23507] cgroup2: Unknown parameter '@[-}+' [ 986.383116][T23501] device virt_wifi0 left promiscuous mode 18:17:36 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:36 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:36 executing program 1: perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x400, 0x5}, 0x0, 0x71f7, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41}, 0x0, 0xffffffffefffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(0xffffffffffffffff, 0xc00464c9, &(0x7f0000000100)) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f00000001c0)=ANY=[@ANYBLOB="42238d9148836465762d6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x6, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:36 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30517, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:36 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x52340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:36 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9d1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:37 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30518, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:37 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb02, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 986.812450][T23515] device macvtap2 entered promiscuous mode 18:17:37 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9d2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 986.881083][T23515] device virt_wifi0 entered promiscuous mode [ 986.906201][T23515] team0: Device macvtap2 failed to register rx_handler [ 986.944465][T23520] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 986.955272][T23515] device virt_wifi0 left promiscuous mode [ 986.970013][T23520] CPU: 1 PID: 23520 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 986.978825][T23520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 986.988893][T23520] Call Trace: [ 986.992183][T23520] [ 986.995121][T23520] dump_stack_lvl+0xcd/0x134 [ 986.999729][T23520] dump_header+0x106/0x624 [ 987.004167][T23520] oom_kill_process.cold+0x10/0x15 [ 987.009326][T23520] out_of_memory+0x358/0x1460 [ 987.014033][T23520] ? find_held_lock+0x2d/0x110 [ 987.018820][T23520] ? oom_killer_disable+0x270/0x270 [ 987.024048][T23520] ? find_held_lock+0x2d/0x110 [ 987.028840][T23520] mem_cgroup_out_of_memory+0x206/0x270 [ 987.034409][T23520] ? mem_cgroup_margin+0x130/0x130 [ 987.039569][T23520] ? lock_downgrade+0x6e0/0x6e0 [ 987.044458][T23520] try_charge_memcg+0xed2/0x1270 [ 987.049425][T23520] ? mem_cgroup_oom_trylock+0x220/0x220 [ 987.054988][T23520] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 987.060723][T23520] ? lock_downgrade+0x6e0/0x6e0 [ 987.065597][T23520] ? lockdep_hardirqs_off+0x90/0xd0 [ 987.070838][T23520] obj_cgroup_charge_pages+0x1e/0x90 [ 987.076149][T23520] obj_cgroup_charge+0xf3/0x280 [ 987.081021][T23520] ? anon_vma_fork+0x1df/0x630 [ 987.085805][T23520] kmem_cache_alloc+0x92/0x3a0 [ 987.090679][T23520] anon_vma_fork+0x1df/0x630 [ 987.095295][T23520] dup_mm+0xa07/0x13e0 [ 987.099394][T23520] ? replace_mm_exe_file+0x490/0x490 [ 987.104698][T23520] ? __raw_spin_lock_init+0x36/0x110 [ 987.110009][T23520] copy_process+0x6fed/0x75a0 [ 987.114707][T23520] ? find_held_lock+0x2d/0x110 [ 987.119507][T23520] ? __cleanup_sighand+0xb0/0xb0 [ 987.124469][T23520] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 987.130731][T23520] ? _copy_from_user+0x5d/0x180 [ 987.135611][T23520] ? kernel_clone+0x314/0xab0 [ 987.140316][T23520] kernel_clone+0xe7/0xab0 [ 987.144771][T23520] ? create_io_thread+0xf0/0xf0 [ 987.149661][T23520] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 987.155673][T23520] __do_sys_clone3+0x1dd/0x2f0 [ 987.160458][T23520] ? __do_sys_clone+0x110/0x110 [ 987.165342][T23520] ? lock_downgrade+0x6e0/0x6e0 [ 987.170212][T23520] ? lock_downgrade+0x6e0/0x6e0 [ 987.175097][T23520] ? syscall_enter_from_user_mode+0x21/0x70 [ 987.181300][T23520] do_syscall_64+0x35/0xb0 [ 987.185735][T23520] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 987.191746][T23520] RIP: 0033:0x7f67b6426e99 [ 987.196177][T23520] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 987.216419][T23520] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 987.224857][T23520] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 987.232845][T23520] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 987.240828][T23520] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 987.248813][T23520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 987.256892][T23520] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 987.264904][T23520] [ 987.305897][T23520] memory: usage 307200kB, limit 307200kB, failcnt 16867 [ 987.317328][T23520] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 987.340887][T23520] Memory cgroup stats for /syz1: [ 987.353061][T23520] anon 290762752 [ 987.353061][T23520] file 155648 [ 987.353061][T23520] kernel_stack 294912 [ 987.353061][T23520] pagetables 9961472 [ 987.353061][T23520] percpu 0 [ 987.353061][T23520] sock 0 [ 987.353061][T23520] shmem 155648 [ 987.353061][T23520] file_mapped 155648 [ 987.353061][T23520] file_dirty 0 [ 987.353061][T23520] file_writeback 0 [ 987.353061][T23520] swapcached 0 [ 987.353061][T23520] anon_thp 232783872 [ 987.353061][T23520] file_thp 0 [ 987.353061][T23520] shmem_thp 0 [ 987.353061][T23520] inactive_anon 290770944 [ 987.353061][T23520] active_anon 147456 [ 987.353061][T23520] inactive_file 0 [ 987.353061][T23520] active_file 0 [ 987.353061][T23520] unevictable 0 [ 987.353061][T23520] slab_reclaimable 553760 [ 987.353061][T23520] slab_unreclaimable 10562656 [ 987.353061][T23520] slab 11116416 [ 987.353061][T23520] workingset_refault_anon 0 [ 987.353061][T23520] workingset_refault_file 0 [ 987.353061][T23520] workingset_activate_anon 0 18:17:37 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30519, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:37 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x530e0000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:37 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9d3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 987.683017][T23520] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23309,uid=0 [ 987.727575][T23520] Memory cgroup out of memory: Killed process 23309 (syz-executor.1) total-vm:56936kB, anon-rss:2456kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 987.761379][T23537] device macvtap2 entered promiscuous mode [ 987.788104][T23537] device virt_wifi0 entered promiscuous mode [ 987.794995][T23537] team0: Device macvtap2 failed to register rx_handler [ 987.850036][T23537] device virt_wifi0 left promiscuous mode 18:17:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:38 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb99, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:38 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3051a, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:38 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9d4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:38 executing program 1: perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x400, 0x5}, 0x0, 0x71f7, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41}, 0x0, 0xffffffffefffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(0xffffffffffffffff, 0xc00464c9, &(0x7f0000000100)) (async, rerun: 32) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (rerun: 32) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f00000001c0)=ANY=[@ANYBLOB="42238d9148836465762d6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x6, 0x0, 0x0, 'queue1\x00'}) (async, rerun: 64) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (rerun: 64) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 988.007662][T23550] cgroup2: Unknown parameter '@[-}+' 18:17:38 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:38 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x53340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:38 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9d5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:38 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x3}, 0x0, 0x6, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='sysv\x00', 0x4000, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="523d2b1be23ff09ac43000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000400), 0x290001) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:38 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3051b, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 988.270031][T23558] device macvtap2 entered promiscuous mode [ 988.295086][T23558] device virt_wifi0 entered promiscuous mode 18:17:38 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc6c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 988.318190][T23558] team0: Device macvtap2 failed to register rx_handler [ 988.357871][T23558] device virt_wifi0 left promiscuous mode [ 988.386976][T23564] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=1, oom_score_adj=1000 [ 988.414178][T23564] CPU: 1 PID: 23564 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 988.423092][T23564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 988.433214][T23564] Call Trace: [ 988.436617][T23564] [ 988.439563][T23564] dump_stack_lvl+0xcd/0x134 [ 988.444185][T23564] dump_header+0x106/0x624 [ 988.448627][T23564] oom_kill_process.cold+0x10/0x15 [ 988.454039][T23564] out_of_memory+0x358/0x1460 [ 988.458748][T23564] ? find_held_lock+0x2d/0x110 [ 988.463511][T23564] ? oom_killer_disable+0x270/0x270 [ 988.468807][T23564] ? find_held_lock+0x2d/0x110 [ 988.473569][T23564] mem_cgroup_out_of_memory+0x206/0x270 [ 988.479108][T23564] ? mem_cgroup_margin+0x130/0x130 [ 988.484225][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 988.489077][T23564] try_charge_memcg+0xed2/0x1270 [ 988.494008][T23564] ? mem_cgroup_oom_trylock+0x220/0x220 [ 988.499548][T23564] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 988.505270][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 988.510133][T23564] obj_cgroup_charge_pages+0x1e/0x90 [ 988.515525][T23564] obj_cgroup_charge+0xf3/0x280 [ 988.520465][T23564] kmem_cache_alloc_node+0x99/0x3f0 [ 988.525661][T23564] ? copy_process+0x5c4/0x75a0 [ 988.530446][T23564] copy_process+0x5c4/0x75a0 [ 988.535031][T23564] ? find_held_lock+0x2d/0x110 [ 988.540499][T23564] ? __cleanup_sighand+0xb0/0xb0 [ 988.545540][T23564] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 988.551785][T23564] ? _copy_from_user+0x5d/0x180 [ 988.556651][T23564] ? kernel_clone+0x314/0xab0 [ 988.561335][T23564] kernel_clone+0xe7/0xab0 [ 988.565867][T23564] ? create_io_thread+0xf0/0xf0 [ 988.570733][T23564] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 988.576740][T23564] __do_sys_clone3+0x1dd/0x2f0 [ 988.581497][T23564] ? __do_sys_clone+0x110/0x110 [ 988.586362][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 988.591232][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 988.596079][T23564] ? syscall_enter_from_user_mode+0x21/0x70 [ 988.601968][T23564] do_syscall_64+0x35/0xb0 [ 988.606385][T23564] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 988.612287][T23564] RIP: 0033:0x7f67b6426e99 [ 988.616691][T23564] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 988.636292][T23564] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 988.644804][T23564] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 988.652769][T23564] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 18:17:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) [ 988.660760][T23564] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 988.668735][T23564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 988.676693][T23564] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 988.684672][T23564] [ 988.702286][T23564] memory: usage 307200kB, limit 307200kB, failcnt 16950 [ 988.710761][T23564] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 988.740518][T23564] Memory cgroup stats for /syz1: [ 988.740761][T23564] anon 290885632 [ 988.740761][T23564] file 155648 [ 988.740761][T23564] kernel_stack 163840 [ 988.740761][T23564] pagetables 9895936 [ 988.740761][T23564] percpu 0 [ 988.740761][T23564] sock 0 [ 988.740761][T23564] shmem 155648 [ 988.740761][T23564] file_mapped 155648 [ 988.740761][T23564] file_dirty 0 [ 988.740761][T23564] file_writeback 0 [ 988.740761][T23564] swapcached 0 [ 988.740761][T23564] anon_thp 232783872 [ 988.740761][T23564] file_thp 0 [ 988.740761][T23564] shmem_thp 0 [ 988.740761][T23564] inactive_anon 290893824 [ 988.740761][T23564] active_anon 147456 [ 988.740761][T23564] inactive_file 0 [ 988.740761][T23564] active_file 0 [ 988.740761][T23564] unevictable 0 [ 988.740761][T23564] slab_reclaimable 570760 [ 988.740761][T23564] slab_unreclaimable 10610600 [ 988.740761][T23564] slab 11181360 18:17:39 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2d9d6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 988.740761][T23564] workingset_refault_anon 0 [ 988.740761][T23564] workingset_refault_file 0 [ 988.740761][T23564] workingset_activate_anon 0 [ 988.847531][T23564] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23538,uid=0 18:17:39 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3051c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 988.885868][T23564] Memory cgroup out of memory: Killed process 23538 (syz-executor.1) total-vm:57200kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 988.921112][ T28] oom_reaper: reaped process 23538 (syz-executor.1), now anon-rss:0kB, file-rss:14144kB, shmem-rss:0kB 18:17:39 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc6d, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:39 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x540e0000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 989.045788][T23564] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 989.079462][T23564] CPU: 1 PID: 23564 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 989.088268][T23564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 989.098347][T23564] Call Trace: [ 989.101637][T23564] [ 989.104580][T23564] dump_stack_lvl+0xcd/0x134 [ 989.109204][T23564] dump_header+0x106/0x624 [ 989.113657][T23564] oom_kill_process.cold+0x10/0x15 [ 989.118794][T23564] out_of_memory+0x358/0x1460 [ 989.123505][T23564] ? find_held_lock+0x2d/0x110 [ 989.128300][T23564] ? oom_killer_disable+0x270/0x270 [ 989.133539][T23564] ? find_held_lock+0x2d/0x110 [ 989.138335][T23564] mem_cgroup_out_of_memory+0x206/0x270 [ 989.143904][T23564] ? mem_cgroup_margin+0x130/0x130 [ 989.149039][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 989.154021][T23564] try_charge_memcg+0xed2/0x1270 [ 989.158994][T23564] ? mem_cgroup_oom_trylock+0x220/0x220 [ 989.164565][T23564] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 989.170312][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 989.175196][T23564] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 989.180960][T23564] obj_cgroup_charge_pages+0x1e/0x90 [ 989.186269][T23564] __memcg_kmem_charge_page+0x392/0x5f0 [ 989.191848][T23564] __alloc_pages+0x1da/0x500 [ 989.196465][T23564] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 989.203269][T23564] ? copy_page_range+0x24ef/0x42c0 [ 989.208418][T23564] alloc_pages+0x1a7/0x300 [ 989.212866][T23564] get_zeroed_page+0x10/0x40 [ 989.217489][T23564] __pud_alloc+0x37/0x170 [ 989.221847][T23564] copy_page_range+0x2635/0x42c0 [ 989.226847][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 989.231737][T23564] ? handle_mm_fault+0x790/0x790 [ 989.236717][T23564] ? __vma_link_rb+0x553/0x710 [ 989.241518][T23564] dup_mm+0xa4e/0x13e0 [ 989.247160][T23564] ? replace_mm_exe_file+0x490/0x490 [ 989.252481][T23564] ? __raw_spin_lock_init+0x36/0x110 [ 989.257812][T23564] copy_process+0x6fed/0x75a0 [ 989.262519][T23564] ? find_held_lock+0x2d/0x110 [ 989.267347][T23564] ? __cleanup_sighand+0xb0/0xb0 [ 989.272316][T23564] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 989.278583][T23564] ? _copy_from_user+0x5d/0x180 [ 989.283468][T23564] ? kernel_clone+0x314/0xab0 [ 989.288604][T23564] kernel_clone+0xe7/0xab0 [ 989.293051][T23564] ? create_io_thread+0xf0/0xf0 [ 989.297947][T23564] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 989.303962][T23564] __do_sys_clone3+0x1dd/0x2f0 [ 989.308751][T23564] ? __do_sys_clone+0x110/0x110 [ 989.313638][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 989.318516][T23564] ? lock_downgrade+0x6e0/0x6e0 [ 989.323408][T23564] ? syscall_enter_from_user_mode+0x21/0x70 [ 989.329338][T23564] do_syscall_64+0x35/0xb0 [ 989.333784][T23564] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 989.339705][T23564] RIP: 0033:0x7f67b6426e99 [ 989.344140][T23564] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 989.363773][T23564] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 989.372212][T23564] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 989.380202][T23564] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 989.388201][T23564] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 18:17:39 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3ffff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:39 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3051d, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 989.396195][T23564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 989.404188][T23564] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 989.412201][T23564] [ 989.461609][T23564] memory: usage 307056kB, limit 307200kB, failcnt 17028 18:17:39 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 989.511132][T23798] device macvtap2 entered promiscuous mode [ 989.523083][T23564] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 989.533391][T23798] device virt_wifi0 entered promiscuous mode [ 989.551533][T23564] Memory cgroup stats for /syz1: [ 989.556798][T23798] team0: Device macvtap2 failed to register rx_handler [ 989.575292][T23564] anon 290795520 [ 989.575292][T23564] file 155648 [ 989.575292][T23564] kernel_stack 196608 [ 989.575292][T23564] pagetables 9822208 [ 989.575292][T23564] percpu 0 [ 989.575292][T23564] sock 0 [ 989.575292][T23564] shmem 155648 [ 989.575292][T23564] file_mapped 155648 [ 989.575292][T23564] file_dirty 0 [ 989.575292][T23564] file_writeback 0 [ 989.575292][T23564] swapcached 0 [ 989.575292][T23564] anon_thp 232783872 [ 989.575292][T23564] file_thp 0 [ 989.575292][T23564] shmem_thp 0 [ 989.575292][T23564] inactive_anon 290803712 [ 989.575292][T23564] active_anon 147456 [ 989.575292][T23564] inactive_file 0 [ 989.575292][T23564] active_file 0 [ 989.575292][T23564] unevictable 0 [ 989.575292][T23564] slab_reclaimable 570760 [ 989.575292][T23564] slab_unreclaimable 10630352 [ 989.575292][T23564] slab 11201112 [ 989.575292][T23564] workingset_refault_anon 0 [ 989.575292][T23564] workingset_refault_file 0 [ 989.575292][T23564] workingset_activate_anon 0 [ 989.716971][T23798] device virt_wifi0 left promiscuous mode 18:17:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) [ 989.870505][T23564] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=20210,uid=0 [ 989.903833][T23564] Memory cgroup out of memory: Killed process 20210 (syz-executor.1) total-vm:56804kB, anon-rss:2452kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 989.930693][ T28] oom_reaper: reaped process 20210 (syz-executor.1), now anon-rss:0kB, file-rss:14144kB, shmem-rss:0kB 18:17:40 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3051e, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x3}, 0x0, 0x6, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='sysv\x00', 0x4000, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="523d2b1be23ff09ac43000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000400), 0x290001) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x3}, 0x0, 0x6, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='sysv\x00', 0x4000, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="523d2b1be23ff09ac43000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000400), 0x290001) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:17:40 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x40000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:40 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x54340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:40 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:40 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf0ffff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:40 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3051f, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 990.139384][T23821] device macvtap2 entered promiscuous mode [ 990.168656][T23821] device virt_wifi0 entered promiscuous mode [ 990.193824][T23821] team0: Device macvtap2 failed to register rx_handler [ 990.212756][T23821] device virt_wifi0 left promiscuous mode [ 990.259663][T23858] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 990.273029][T23858] CPU: 1 PID: 23858 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 990.281826][T23858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 990.291902][T23858] Call Trace: [ 990.295196][T23858] [ 990.298138][T23858] dump_stack_lvl+0xcd/0x134 [ 990.302755][T23858] dump_header+0x106/0x624 [ 990.307173][T23858] oom_kill_process.cold+0x10/0x15 [ 990.312297][T23858] out_of_memory+0x358/0x1460 [ 990.316979][T23858] ? find_held_lock+0x2d/0x110 [ 990.321762][T23858] ? oom_killer_disable+0x270/0x270 [ 990.326986][T23858] ? find_held_lock+0x2d/0x110 [ 990.331780][T23858] mem_cgroup_out_of_memory+0x206/0x270 [ 990.337345][T23858] ? mem_cgroup_margin+0x130/0x130 [ 990.342463][T23858] ? lock_downgrade+0x6e0/0x6e0 [ 990.347321][T23858] try_charge_memcg+0xed2/0x1270 [ 990.352256][T23858] ? find_held_lock+0x2d/0x110 [ 990.357014][T23858] ? mem_cgroup_oom_trylock+0x220/0x220 [ 990.362552][T23858] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 990.368086][T23858] ? lock_downgrade+0x6e0/0x6e0 [ 990.372946][T23858] charge_memcg+0xae/0x360 [ 990.377382][T23858] __mem_cgroup_charge+0x27/0x90 [ 990.382423][T23858] wp_page_copy+0x294/0x2280 [ 990.387031][T23858] ? do_page_mkwrite+0x550/0x550 [ 990.391960][T23858] ? lock_downgrade+0x6e0/0x6e0 [ 990.396827][T23858] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 990.402575][T23858] ? vm_normal_page+0x146/0x2a0 [ 990.407444][T23858] do_wp_page+0x2cb/0x1ae0 [ 990.411867][T23858] __handle_mm_fault+0x1f41/0x5120 [ 990.417207][T23858] ? vm_iomap_memory+0x190/0x190 [ 990.422187][T23858] handle_mm_fault+0x1c8/0x790 [ 990.426978][T23858] do_user_addr_fault+0x489/0x11c0 [ 990.432111][T23858] exc_page_fault+0x9e/0x180 [ 990.436722][T23858] ? asm_exc_page_fault+0x8/0x30 [ 990.441684][T23858] asm_exc_page_fault+0x1e/0x30 [ 990.446547][T23858] RIP: 0033:0x7f67b63cdfea [ 990.450954][T23858] Code: ff ff 48 83 c4 70 5b 5d 41 5c c3 0f 1f 44 00 00 48 8b 44 24 28 48 8b 5c 24 08 48 8b 70 38 8b 78 08 48 8d 53 30 e8 96 9b ff ff <48> 89 83 88 00 00 00 e9 27 fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 [ 990.470559][T23858] RSP: 002b:00007f67b4d9c190 EFLAGS: 00010206 [ 990.476651][T23858] RAX: 0000000000000000 RBX: 00007f67b6539f60 RCX: 00007f67b6480ff1 [ 990.484644][T23858] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 990.493146][T23858] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 990.501134][T23858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 990.509121][T23858] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 990.517120][T23858] [ 990.525928][T23858] memory: usage 307156kB, limit 307200kB, failcnt 17096 [ 990.546178][T23858] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 990.567096][T23858] Memory cgroup stats for /syz1: [ 990.571828][T23858] anon 290861056 [ 990.571828][T23858] file 155648 [ 990.571828][T23858] kernel_stack 163840 [ 990.571828][T23858] pagetables 9895936 [ 990.571828][T23858] percpu 0 [ 990.571828][T23858] sock 0 [ 990.571828][T23858] shmem 155648 [ 990.571828][T23858] file_mapped 155648 [ 990.571828][T23858] file_dirty 0 [ 990.571828][T23858] file_writeback 0 [ 990.571828][T23858] swapcached 0 [ 990.571828][T23858] anon_thp 232783872 [ 990.571828][T23858] file_thp 0 [ 990.571828][T23858] shmem_thp 0 [ 990.571828][T23858] inactive_anon 290869248 [ 990.571828][T23858] active_anon 147456 [ 990.571828][T23858] inactive_file 0 [ 990.571828][T23858] active_file 0 [ 990.571828][T23858] unevictable 0 [ 990.571828][T23858] slab_reclaimable 570376 [ 990.571828][T23858] slab_unreclaimable 10612832 [ 990.571828][T23858] slab 11183208 [ 990.571828][T23858] workingset_refault_anon 0 [ 990.571828][T23858] workingset_refault_file 0 [ 990.571828][T23858] workingset_activate_anon 0 18:17:40 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xffffff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:40 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1001, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 990.670874][T23858] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23809,uid=0 [ 990.686562][T23858] Memory cgroup out of memory: Killed process 23809 (syz-executor.1) total-vm:60776kB, anon-rss:2488kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 990.711326][T23807] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 990.713289][ T28] oom_reaper: reaped process 23809 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB 18:17:41 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x550e0000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 990.768759][T23807] CPU: 1 PID: 23807 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 990.777588][T23807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 990.787659][T23807] Call Trace: [ 990.790951][T23807] [ 990.793896][T23807] dump_stack_lvl+0xcd/0x134 [ 990.798513][T23807] dump_header+0x106/0x624 [ 990.802958][T23807] oom_kill_process.cold+0x10/0x15 [ 990.808094][T23807] out_of_memory+0x358/0x1460 [ 990.812806][T23807] ? find_held_lock+0x2d/0x110 [ 990.817594][T23807] ? oom_killer_disable+0x270/0x270 [ 990.822821][T23807] ? find_held_lock+0x2d/0x110 [ 990.827614][T23807] mem_cgroup_out_of_memory+0x206/0x270 [ 990.833202][T23807] ? mem_cgroup_margin+0x130/0x130 [ 990.838333][T23807] ? lock_downgrade+0x6e0/0x6e0 [ 990.843230][T23807] try_charge_memcg+0xed2/0x1270 [ 990.848196][T23807] ? mem_cgroup_oom_trylock+0x220/0x220 [ 990.853761][T23807] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 990.859500][T23807] ? lock_downgrade+0x6e0/0x6e0 [ 990.864359][T23807] obj_cgroup_charge_pages+0x1e/0x90 [ 990.869638][T23807] obj_cgroup_charge+0xf3/0x280 [ 990.874490][T23807] ? alloc_pid+0xcf/0xd70 [ 990.878828][T23807] kmem_cache_alloc+0x92/0x3a0 [ 990.883594][T23807] alloc_pid+0xcf/0xd70 [ 990.887760][T23807] ? copy_thread+0x57b/0x8b0 [ 990.892346][T23807] ? copy_namespaces+0x1c1/0x450 [ 990.897289][T23807] copy_process+0x2ff0/0x75a0 [ 990.901986][T23807] ? __free_object+0x64b/0xe00 [ 990.906759][T23807] ? lock_chain_count+0x20/0x20 [ 990.911631][T23807] ? __cleanup_sighand+0xb0/0xb0 [ 990.916562][T23807] ? debug_object_free+0x1c0/0x350 [ 990.921671][T23807] ? __lock_acquire+0x1655/0x5470 [ 990.926695][T23807] ? kernel_clone+0x314/0xab0 [ 990.931366][T23807] kernel_clone+0xe7/0xab0 [ 990.935788][T23807] ? create_io_thread+0xf0/0xf0 [ 990.940628][T23807] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 990.946627][T23807] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 990.952636][T23807] ? find_held_lock+0x2d/0x110 [ 990.957420][T23807] __do_sys_clone+0xc8/0x110 [ 990.962022][T23807] ? kernel_clone+0xab0/0xab0 [ 990.966687][T23807] ? lock_downgrade+0x6e0/0x6e0 [ 990.971535][T23807] ? syscall_enter_from_user_mode+0x21/0x70 [ 990.977426][T23807] do_syscall_64+0x35/0xb0 [ 990.981840][T23807] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 990.987756][T23807] RIP: 0033:0x7f462bb432c1 [ 990.992178][T23807] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 18:17:41 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30520, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 991.011953][T23807] RSP: 002b:00007f462c188a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 991.020363][T23807] RAX: ffffffffffffffda RBX: 00007f462a496700 RCX: 00007f462bb432c1 [ 991.028419][T23807] RDX: 00007f462a4969d0 RSI: 00007f462a4962f0 RDI: 00000000003d0f00 [ 991.036388][T23807] RBP: 00007f462c188cb0 R08: 00007f462a496700 R09: 00007f462a496700 [ 991.044381][T23807] R10: 00007f462a4969d0 R11: 0000000000000206 R12: 00007f462c188b1e [ 991.052363][T23807] R13: 00007f462c188b1f R14: 00007f462a496300 R15: 000055555673b940 [ 991.060342][T23807] [ 991.123376][T23880] device macvtap2 entered promiscuous mode [ 991.138491][T23880] device virt_wifi0 entered promiscuous mode [ 991.145725][T23880] team0: Device macvtap2 failed to register rx_handler [ 991.189452][T23807] memory: usage 307200kB, limit 307200kB, failcnt 1753 [ 991.196521][T23880] device virt_wifi0 left promiscuous mode [ 991.202376][T23807] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 991.226821][T23807] Memory cgroup stats for /syz5: [ 991.227043][T23807] anon 287506432 [ 991.227043][T23807] file 90112 [ 991.227043][T23807] kernel_stack 1048576 [ 991.227043][T23807] pagetables 9834496 [ 991.227043][T23807] percpu 0 [ 991.227043][T23807] sock 0 [ 991.227043][T23807] shmem 90112 [ 991.227043][T23807] file_mapped 90112 [ 991.227043][T23807] file_dirty 0 [ 991.227043][T23807] file_writeback 0 [ 991.227043][T23807] swapcached 0 [ 991.227043][T23807] anon_thp 222298112 [ 991.227043][T23807] file_thp 0 [ 991.227043][T23807] shmem_thp 0 [ 991.227043][T23807] inactive_anon 287510528 [ 991.227043][T23807] active_anon 86016 [ 991.227043][T23807] inactive_file 0 [ 991.227043][T23807] active_file 0 [ 991.227043][T23807] unevictable 0 [ 991.227043][T23807] slab_reclaimable 484504 [ 991.227043][T23807] slab_unreclaimable 13198952 [ 991.227043][T23807] slab 13683456 [ 991.227043][T23807] workingset_refault_anon 0 [ 991.227043][T23807] workingset_refault_file 0 [ 991.227043][T23807] workingset_activate_anon 0 [ 991.324889][T23807] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=5559,uid=0 [ 991.340735][T23807] Memory cgroup out of memory: Killed process 5559 (syz-executor.5) total-vm:60908kB, anon-rss:2496kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 [ 991.386804][T23846] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 991.450070][T23846] CPU: 0 PID: 23846 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 991.458885][T23846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 991.468958][T23846] Call Trace: [ 991.472246][T23846] [ 991.475188][T23846] dump_stack_lvl+0xcd/0x134 [ 991.479793][T23846] dump_header+0x106/0x624 [ 991.484230][T23846] oom_kill_process.cold+0x10/0x15 [ 991.489721][T23846] out_of_memory+0x358/0x1460 [ 991.494425][T23846] ? find_held_lock+0x2d/0x110 [ 991.499207][T23846] ? oom_killer_disable+0x270/0x270 [ 991.504440][T23846] ? find_held_lock+0x2d/0x110 [ 991.509236][T23846] mem_cgroup_out_of_memory+0x206/0x270 [ 991.514802][T23846] ? mem_cgroup_margin+0x130/0x130 [ 991.519932][T23846] ? lock_downgrade+0x6e0/0x6e0 [ 991.524825][T23846] try_charge_memcg+0xed2/0x1270 [ 991.529790][T23846] ? mem_cgroup_oom_trylock+0x220/0x220 [ 991.535351][T23846] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 991.541086][T23846] ? lock_downgrade+0x6e0/0x6e0 [ 991.545971][T23846] obj_cgroup_charge_pages+0x1e/0x90 [ 991.551281][T23846] obj_cgroup_charge+0xf3/0x280 [ 991.556153][T23846] ? vm_area_dup+0x88/0x2b0 [ 991.560675][T23846] kmem_cache_alloc+0x92/0x3a0 [ 991.565473][T23846] vm_area_dup+0x88/0x2b0 [ 991.569846][T23846] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 991.576122][T23846] ? copy_page_range+0x2236/0x42c0 [ 991.581294][T23846] ? vm_area_alloc+0x110/0x110 [ 991.586100][T23846] ? handle_mm_fault+0x790/0x790 [ 991.591076][T23846] ? __vma_link_rb+0x553/0x710 [ 991.595889][T23846] dup_mm+0x5fa/0x13e0 [ 991.599990][T23846] ? replace_mm_exe_file+0x490/0x490 [ 991.605294][T23846] ? __raw_spin_lock_init+0x36/0x110 [ 991.610605][T23846] copy_process+0x6fed/0x75a0 [ 991.615303][T23846] ? find_held_lock+0x2d/0x110 [ 991.620190][T23846] ? __cleanup_sighand+0xb0/0xb0 [ 991.625151][T23846] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 991.631411][T23846] ? _copy_from_user+0x5d/0x180 [ 991.636290][T23846] ? kernel_clone+0x314/0xab0 [ 991.640983][T23846] kernel_clone+0xe7/0xab0 [ 991.645420][T23846] ? create_io_thread+0xf0/0xf0 [ 991.650309][T23846] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 991.656326][T23846] __do_sys_clone3+0x1dd/0x2f0 [ 991.661111][T23846] ? __do_sys_clone+0x110/0x110 [ 991.666001][T23846] ? lock_downgrade+0x6e0/0x6e0 [ 991.670872][T23846] ? lock_downgrade+0x6e0/0x6e0 [ 991.675760][T23846] ? syscall_enter_from_user_mode+0x21/0x70 [ 991.681681][T23846] do_syscall_64+0x35/0xb0 [ 991.686119][T23846] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 991.692033][T23846] RIP: 0033:0x7f67b6426e99 [ 991.696461][T23846] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 991.716088][T23846] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 991.724526][T23846] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 991.732521][T23846] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 991.740515][T23846] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 991.748502][T23846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 991.756487][T23846] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 991.764584][T23846] [ 991.774648][T23846] memory: usage 307148kB, limit 307200kB, failcnt 17206 [ 991.782576][T23846] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 991.789997][T23846] Memory cgroup stats for /syz1: [ 991.790226][T23846] anon 290799616 [ 991.790226][T23846] file 155648 [ 991.790226][T23846] kernel_stack 229376 [ 991.790226][T23846] pagetables 9895936 [ 991.790226][T23846] percpu 0 [ 991.790226][T23846] sock 0 [ 991.790226][T23846] shmem 155648 [ 991.790226][T23846] file_mapped 155648 [ 991.790226][T23846] file_dirty 0 [ 991.790226][T23846] file_writeback 0 [ 991.790226][T23846] swapcached 0 [ 991.790226][T23846] anon_thp 232783872 [ 991.790226][T23846] file_thp 0 [ 991.790226][T23846] shmem_thp 0 [ 991.790226][T23846] inactive_anon 290807808 [ 991.790226][T23846] active_anon 147456 [ 991.790226][T23846] inactive_file 0 [ 991.790226][T23846] active_file 0 [ 991.790226][T23846] unevictable 0 [ 991.790226][T23846] slab_reclaimable 557224 [ 991.790226][T23846] slab_unreclaimable 10616112 [ 991.790226][T23846] slab 11173336 [ 991.790226][T23846] workingset_refault_anon 0 [ 991.790226][T23846] workingset_refault_file 0 [ 991.790226][T23846] workingset_activate_anon 0 [ 991.889657][T23846] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23858,uid=0 [ 991.906739][T23846] Memory cgroup out of memory: Killed process 23858 (syz-executor.1) total-vm:56804kB, anon-rss:2452kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:42 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:42 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:42 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x55340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) 18:17:42 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30521, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x3}, 0x0, 0x6, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='sysv\x00', 0x4000, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="523d2b1be23ff09ac43000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000400), 0x290001) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x3}, 0x0, 0x6, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='sysv\x00', 0x4000, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="523d2b1be23ff09ac43000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000400), 0x290001) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) [ 992.148774][T24003] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 992.163915][T24003] CPU: 1 PID: 24003 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 992.172726][T24003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 992.182801][T24003] Call Trace: [ 992.186089][T24003] [ 992.189042][T24003] dump_stack_lvl+0xcd/0x134 [ 992.193664][T24003] dump_header+0x106/0x624 18:17:42 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30522, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 992.198111][T24003] oom_kill_process.cold+0x10/0x15 [ 992.203260][T24003] out_of_memory+0x358/0x1460 [ 992.207964][T24003] ? find_held_lock+0x2d/0x110 [ 992.212745][T24003] ? oom_killer_disable+0x270/0x270 [ 992.217973][T24003] ? find_held_lock+0x2d/0x110 [ 992.222767][T24003] mem_cgroup_out_of_memory+0x206/0x270 [ 992.228335][T24003] ? mem_cgroup_margin+0x130/0x130 [ 992.233473][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 992.238368][T24003] try_charge_memcg+0xed2/0x1270 [ 992.243426][T24003] ? mem_cgroup_oom_trylock+0x220/0x220 [ 992.248996][T24003] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 992.254736][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 992.259644][T24003] obj_cgroup_charge_pages+0x1e/0x90 [ 992.264960][T24003] obj_cgroup_charge+0xf3/0x280 [ 992.269841][T24003] ? vm_area_dup+0x88/0x2b0 [ 992.274368][T24003] kmem_cache_alloc+0x92/0x3a0 [ 992.279159][T24003] vm_area_dup+0x88/0x2b0 [ 992.283533][T24003] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 992.289804][T24003] ? copy_page_range+0x2236/0x42c0 18:17:42 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30523, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 992.294971][T24003] ? vm_area_alloc+0x110/0x110 [ 992.299769][T24003] ? dup_mm+0x7b9/0x13e0 [ 992.304041][T24003] ? handle_mm_fault+0x790/0x790 [ 992.309007][T24003] ? validate_mm_rb+0x46/0x2d0 [ 992.313793][T24003] ? down_write+0xde/0x150 [ 992.318236][T24003] ? __vma_link_rb+0x553/0x710 [ 992.323034][T24003] dup_mm+0x5fa/0x13e0 [ 992.327144][T24003] ? replace_mm_exe_file+0x490/0x490 [ 992.332459][T24003] ? __raw_spin_lock_init+0x36/0x110 [ 992.337801][T24003] copy_process+0x6fed/0x75a0 [ 992.342503][T24003] ? find_held_lock+0x2d/0x110 [ 992.347305][T24003] ? __cleanup_sighand+0xb0/0xb0 [ 992.352276][T24003] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 992.358540][T24003] ? _copy_from_user+0x5d/0x180 [ 992.363417][T24003] ? kernel_clone+0x314/0xab0 [ 992.368115][T24003] kernel_clone+0xe7/0xab0 [ 992.372568][T24003] ? create_io_thread+0xf0/0xf0 [ 992.377456][T24003] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 992.383470][T24003] __do_sys_clone3+0x1dd/0x2f0 [ 992.388256][T24003] ? __do_sys_clone+0x110/0x110 [ 992.393140][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 992.398164][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 992.403061][T24003] ? syscall_enter_from_user_mode+0x21/0x70 [ 992.408992][T24003] do_syscall_64+0x35/0xb0 [ 992.413433][T24003] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 992.419455][T24003] RIP: 0033:0x7f67b6426e99 [ 992.423898][T24003] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 992.443553][T24003] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 992.451990][T24003] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 992.460046][T24003] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 992.468028][T24003] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 992.476018][T24003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 992.484011][T24003] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 992.492031][T24003] 18:17:42 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:42 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30524, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 992.526119][T24002] device macvtap2 entered promiscuous mode [ 992.538573][T24002] device virt_wifi0 entered promiscuous mode [ 992.545839][T24002] team0: Device macvtap2 failed to register rx_handler 18:17:42 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1c03, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 992.571246][T24002] device virt_wifi0 left promiscuous mode [ 992.668716][ T1227] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.675059][ T1227] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.728390][T24003] memory: usage 307192kB, limit 307200kB, failcnt 17264 [ 992.735826][T24003] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 992.746200][T24003] Memory cgroup stats for /syz1: [ 992.746423][T24003] anon 290832384 [ 992.746423][T24003] file 155648 [ 992.746423][T24003] kernel_stack 163840 [ 992.746423][T24003] pagetables 9854976 [ 992.746423][T24003] percpu 0 [ 992.746423][T24003] sock 0 [ 992.746423][T24003] shmem 155648 [ 992.746423][T24003] file_mapped 155648 [ 992.746423][T24003] file_dirty 0 [ 992.746423][T24003] file_writeback 0 [ 992.746423][T24003] swapcached 0 [ 992.746423][T24003] anon_thp 232783872 [ 992.746423][T24003] file_thp 0 [ 992.746423][T24003] shmem_thp 0 [ 992.746423][T24003] inactive_anon 290840576 [ 992.746423][T24003] active_anon 147456 [ 992.746423][T24003] inactive_file 0 [ 992.746423][T24003] active_file 0 [ 992.746423][T24003] unevictable 0 [ 992.746423][T24003] slab_reclaimable 565320 [ 992.746423][T24003] slab_unreclaimable 10672768 [ 992.746423][T24003] slab 11238088 [ 992.746423][T24003] workingset_refault_anon 0 [ 992.746423][T24003] workingset_refault_file 0 [ 992.746423][T24003] workingset_activate_anon 0 18:17:43 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:43 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x56340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:43 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1f00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 993.055550][T24070] device macvtap2 entered promiscuous mode [ 993.085057][T24070] device virt_wifi0 entered promiscuous mode [ 993.113779][T24070] team0: Device macvtap2 failed to register rx_handler [ 993.126952][T24003] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=23993,uid=0 [ 993.143568][T24003] Memory cgroup out of memory: Killed process 23993 (syz-executor.1) total-vm:57200kB, anon-rss:2460kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 993.163306][T24070] device virt_wifi0 left promiscuous mode [ 993.219807][ T28] oom_reaper: reaped process 23993 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB 18:17:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:43 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30525, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:43 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 993.464989][T24003] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 993.475945][T24003] CPU: 0 PID: 24003 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 993.484741][T24003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 993.494819][T24003] Call Trace: [ 993.498111][T24003] [ 993.501052][T24003] dump_stack_lvl+0xcd/0x134 [ 993.505671][T24003] dump_header+0x106/0x624 [ 993.510116][T24003] oom_kill_process.cold+0x10/0x15 [ 993.515241][T24003] out_of_memory+0x358/0x1460 [ 993.519933][T24003] ? find_held_lock+0x2d/0x110 [ 993.524701][T24003] ? oom_killer_disable+0x270/0x270 [ 993.529920][T24003] ? find_held_lock+0x2d/0x110 [ 993.534735][T24003] mem_cgroup_out_of_memory+0x206/0x270 [ 993.540314][T24003] ? mem_cgroup_margin+0x130/0x130 [ 993.545425][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 993.550296][T24003] try_charge_memcg+0xed2/0x1270 [ 993.555244][T24003] ? mem_cgroup_oom_trylock+0x220/0x220 [ 993.560789][T24003] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 993.566509][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 993.571379][T24003] obj_cgroup_charge_pages+0x1e/0x90 [ 993.576674][T24003] obj_cgroup_charge+0xf3/0x280 [ 993.581531][T24003] ? anon_vma_clone+0x33e/0x5f0 [ 993.586387][T24003] kmem_cache_alloc+0x92/0x3a0 [ 993.591159][T24003] anon_vma_clone+0x33e/0x5f0 [ 993.595848][T24003] anon_vma_fork+0x82/0x630 [ 993.600349][T24003] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 993.606071][T24003] ? __vm_enough_memory+0x184/0x360 [ 993.611276][T24003] dup_mm+0xa07/0x13e0 [ 993.615379][T24003] ? replace_mm_exe_file+0x490/0x490 [ 993.620694][T24003] ? __raw_spin_lock_init+0x36/0x110 [ 993.626010][T24003] copy_process+0x6fed/0x75a0 [ 993.630719][T24003] ? find_held_lock+0x2d/0x110 [ 993.635509][T24003] ? __cleanup_sighand+0xb0/0xb0 [ 993.640457][T24003] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 993.646707][T24003] ? _copy_from_user+0x5d/0x180 [ 993.651572][T24003] ? kernel_clone+0x314/0xab0 [ 993.656257][T24003] kernel_clone+0xe7/0xab0 [ 993.660682][T24003] ? create_io_thread+0xf0/0xf0 [ 993.665551][T24003] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 993.671544][T24003] __do_sys_clone3+0x1dd/0x2f0 [ 993.676314][T24003] ? __do_sys_clone+0x110/0x110 [ 993.681180][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 993.686048][T24003] ? lock_downgrade+0x6e0/0x6e0 [ 993.690926][T24003] ? syscall_enter_from_user_mode+0x21/0x70 [ 993.696835][T24003] do_syscall_64+0x35/0xb0 [ 993.701263][T24003] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 993.707165][T24003] RIP: 0033:0x7f67b6426e99 [ 993.711581][T24003] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 993.731188][T24003] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 993.739604][T24003] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 993.747585][T24003] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 993.755561][T24003] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 993.763530][T24003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 993.771498][T24003] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 993.779487][T24003] [ 993.836928][T24003] memory: usage 307200kB, limit 307200kB, failcnt 17354 [ 993.853883][T24003] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 993.870594][T24003] Memory cgroup stats for /syz1: [ 993.870764][T24003] anon 290799616 [ 993.870764][T24003] file 155648 [ 993.870764][T24003] kernel_stack 229376 [ 993.870764][T24003] pagetables 9838592 [ 993.870764][T24003] percpu 0 [ 993.870764][T24003] sock 0 [ 993.870764][T24003] shmem 155648 [ 993.870764][T24003] file_mapped 155648 [ 993.870764][T24003] file_dirty 0 [ 993.870764][T24003] file_writeback 0 [ 993.870764][T24003] swapcached 0 [ 993.870764][T24003] anon_thp 232783872 [ 993.870764][T24003] file_thp 0 [ 993.870764][T24003] shmem_thp 0 [ 993.870764][T24003] inactive_anon 290807808 [ 993.870764][T24003] active_anon 147456 [ 993.870764][T24003] inactive_file 0 [ 993.870764][T24003] active_file 0 [ 993.870764][T24003] unevictable 0 [ 993.870764][T24003] slab_reclaimable 564544 [ 993.870764][T24003] slab_unreclaimable 10717512 [ 993.870764][T24003] slab 11282056 [ 993.870764][T24003] workingset_refault_anon 0 [ 993.870764][T24003] workingset_refault_file 0 [ 993.870764][T24003] workingset_activate_anon 0 [ 993.992866][T24003] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24128,uid=0 [ 994.017756][T24003] Memory cgroup out of memory: Killed process 24128 (syz-executor.1) total-vm:56804kB, anon-rss:2452kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x472, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1000, 0x0, 0x0, 0x9, 0x3, 0xff, 0x0, 0x0, 0xfffffffc}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000480)=ANY=[@ANYBLOB="f2de2378668488632da2848c64e81e57309ff000"/31, @ANYRES32, @ANYRESDEC]) clone3(0x0, 0xfffffe75) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40201) perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x80, 0x9c, 0x4, 0x4, 0x1, 0x0, 0xb0, 0x200, 0x5, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffbb, 0x0, @perf_bp={&(0x7f0000000100), 0x1}, 0x1000, 0x9, 0x3, 0x6, 0x8, 0x0, 0x2, 0x0, 0x7, 0x0, 0xff}, r0, 0xb, 0xffffffffffffffff, 0x9) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:44 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:44 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:44 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x57340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:44 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30526, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 994.177142][T24147] cgroup2: Unknown parameter '@[-}+' 18:17:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) 18:17:44 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30527, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:44 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2100, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 994.296102][T24144] device macvtap2 entered promiscuous mode 18:17:44 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 994.338430][T24144] device virt_wifi0 entered promiscuous mode [ 994.376156][T24144] team0: Device macvtap2 failed to register rx_handler [ 994.407106][T24144] device virt_wifi0 left promiscuous mode [ 994.417019][T24149] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 994.462359][T24149] CPU: 0 PID: 24149 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 994.471174][T24149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 994.481249][T24149] Call Trace: [ 994.484542][T24149] [ 994.487483][T24149] dump_stack_lvl+0xcd/0x134 [ 994.492119][T24149] dump_header+0x106/0x624 [ 994.496560][T24149] oom_kill_process.cold+0x10/0x15 [ 994.501698][T24149] out_of_memory+0x358/0x1460 [ 994.506407][T24149] ? find_held_lock+0x2d/0x110 [ 994.511191][T24149] ? oom_killer_disable+0x270/0x270 [ 994.516413][T24149] ? find_held_lock+0x2d/0x110 [ 994.521200][T24149] mem_cgroup_out_of_memory+0x206/0x270 [ 994.526771][T24149] ? mem_cgroup_margin+0x130/0x130 [ 994.532002][T24149] ? lock_downgrade+0x6e0/0x6e0 [ 994.536897][T24149] try_charge_memcg+0xed2/0x1270 [ 994.541868][T24149] ? mem_cgroup_oom_trylock+0x220/0x220 [ 994.547435][T24149] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 994.553191][T24149] ? lock_downgrade+0x6e0/0x6e0 [ 994.558068][T24149] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 994.563833][T24149] obj_cgroup_charge_pages+0x1e/0x90 [ 994.569149][T24149] __memcg_kmem_charge_page+0x392/0x5f0 [ 994.574730][T24149] __alloc_pages+0x1da/0x500 [ 994.579346][T24149] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 994.586152][T24149] ? copy_page_range+0x24ef/0x42c0 [ 994.591305][T24149] alloc_pages+0x1a7/0x300 [ 994.595853][T24149] get_zeroed_page+0x10/0x40 [ 994.600459][T24149] __pud_alloc+0x37/0x170 [ 994.604812][T24149] copy_page_range+0x2635/0x42c0 [ 994.609803][T24149] ? lock_downgrade+0x6e0/0x6e0 [ 994.614677][T24149] ? handle_mm_fault+0x790/0x790 [ 994.619649][T24149] ? __vma_link_rb+0x553/0x710 [ 994.624443][T24149] dup_mm+0xa4e/0x13e0 [ 994.628546][T24149] ? replace_mm_exe_file+0x490/0x490 [ 994.633853][T24149] ? __raw_spin_lock_init+0x36/0x110 [ 994.639293][T24149] copy_process+0x6fed/0x75a0 [ 994.643995][T24149] ? find_held_lock+0x2d/0x110 [ 994.648806][T24149] ? __cleanup_sighand+0xb0/0xb0 [ 994.653784][T24149] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 994.660059][T24149] ? _copy_from_user+0x5d/0x180 [ 994.665030][T24149] ? kernel_clone+0x314/0xab0 [ 994.669728][T24149] kernel_clone+0xe7/0xab0 [ 994.674167][T24149] ? create_io_thread+0xf0/0xf0 [ 994.679053][T24149] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 994.685069][T24149] __do_sys_clone3+0x1dd/0x2f0 [ 994.689857][T24149] ? __do_sys_clone+0x110/0x110 [ 994.694918][T24149] ? lock_downgrade+0x6e0/0x6e0 [ 994.699790][T24149] ? lock_downgrade+0x6e0/0x6e0 [ 994.704686][T24149] ? syscall_enter_from_user_mode+0x21/0x70 [ 994.710604][T24149] do_syscall_64+0x35/0xb0 [ 994.715035][T24149] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 994.720952][T24149] RIP: 0033:0x7f67b6426e99 [ 994.725389][T24149] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 994.745110][T24149] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 994.753586][T24149] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 994.761587][T24149] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 994.769583][T24149] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 994.777572][T24149] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 994.785561][T24149] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 994.793578][T24149] [ 994.886479][T24149] memory: usage 307140kB, limit 307200kB, failcnt 17438 [ 994.891667][T24158] cgroup2: Unknown parameter '@[-}+' [ 994.894047][T24149] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 994.908124][T24149] Memory cgroup stats for /syz1: [ 994.908365][T24149] anon 290869248 [ 994.908365][T24149] file 155648 [ 994.908365][T24149] kernel_stack 163840 [ 994.908365][T24149] pagetables 9822208 [ 994.908365][T24149] percpu 0 [ 994.908365][T24149] sock 0 [ 994.908365][T24149] shmem 155648 [ 994.908365][T24149] file_mapped 155648 [ 994.908365][T24149] file_dirty 0 [ 994.908365][T24149] file_writeback 0 [ 994.908365][T24149] swapcached 0 [ 994.908365][T24149] anon_thp 232783872 [ 994.908365][T24149] file_thp 0 [ 994.908365][T24149] shmem_thp 0 [ 994.908365][T24149] inactive_anon 290877440 [ 994.908365][T24149] active_anon 147456 [ 994.908365][T24149] inactive_file 0 [ 994.908365][T24149] active_file 0 [ 994.908365][T24149] unevictable 0 [ 994.908365][T24149] slab_reclaimable 563392 [ 994.908365][T24149] slab_unreclaimable 10683384 18:17:45 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2801, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 994.908365][T24149] slab 11246776 [ 994.908365][T24149] workingset_refault_anon 0 [ 994.908365][T24149] workingset_refault_file 0 [ 994.908365][T24149] workingset_activate_anon 0 18:17:45 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30528, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:45 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x58340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 995.124081][T24149] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24137,uid=0 [ 995.143351][T24149] Memory cgroup out of memory: Killed process 24137 (syz-executor.1) total-vm:57068kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 995.188238][T24165] device macvtap2 entered promiscuous mode 18:17:45 executing program 1: perf_event_open(&(0x7f000001d000)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x472, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1000, 0x0, 0x0, 0x9, 0x3, 0xff, 0x0, 0x0, 0xfffffffc}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r1, r2, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async, rerun: 32) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (rerun: 32) openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async, rerun: 32) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000480)=ANY=[@ANYBLOB="f2de2378668488632da2848c64e81e57309ff000"/31, @ANYRES32, @ANYRESDEC]) (async) clone3(0x0, 0xfffffe75) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40201) perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x80, 0x9c, 0x4, 0x4, 0x1, 0x0, 0xb0, 0x200, 0x5, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffbb, 0x0, @perf_bp={&(0x7f0000000100), 0x1}, 0x1000, 0x9, 0x3, 0x6, 0x8, 0x0, 0x2, 0x0, 0x7, 0x0, 0xff}, r0, 0xb, 0xffffffffffffffff, 0x9) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:45 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) 18:17:45 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:45 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3f00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:45 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30529, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 995.232877][T24165] device virt_wifi0 entered promiscuous mode [ 995.242510][T24165] team0: Device macvtap2 failed to register rx_handler [ 995.251710][T24165] device virt_wifi0 left promiscuous mode [ 995.252238][T24149] cgroup2: Unknown parameter '@[-}+' 18:17:45 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x59340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:45 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3052a, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:45 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 995.466658][T24180] device macvtap2 entered promiscuous mode 18:17:45 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 995.532552][T24183] syz-executor.1 invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=0, oom_score_adj=1000 [ 995.533845][T24180] device virt_wifi0 entered promiscuous mode [ 995.591208][T24180] team0: Device macvtap2 failed to register rx_handler [ 995.603221][T24184] cgroup2: Unknown parameter '@[-}+' [ 995.613201][T24180] device virt_wifi0 left promiscuous mode [ 995.639948][T24183] CPU: 1 PID: 24183 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 995.648757][T24183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 995.659010][T24183] Call Trace: [ 995.662303][T24183] [ 995.665244][T24183] dump_stack_lvl+0xcd/0x134 [ 995.669858][T24183] dump_header+0x106/0x624 [ 995.674296][T24183] oom_kill_process.cold+0x10/0x15 [ 995.679431][T24183] out_of_memory+0x358/0x1460 [ 995.684138][T24183] ? find_held_lock+0x2d/0x110 [ 995.688923][T24183] ? oom_killer_disable+0x270/0x270 [ 995.694150][T24183] ? find_held_lock+0x2d/0x110 [ 995.698933][T24183] mem_cgroup_out_of_memory+0x206/0x270 [ 995.704508][T24183] ? mem_cgroup_margin+0x130/0x130 [ 995.709636][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 995.714522][T24183] try_charge_memcg+0xed2/0x1270 [ 995.719494][T24183] ? mem_cgroup_oom_trylock+0x220/0x220 [ 995.725082][T24183] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 995.730843][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 995.735736][T24183] obj_cgroup_charge_pages+0x1e/0x90 [ 995.741044][T24183] obj_cgroup_charge+0xf3/0x280 [ 995.745928][T24183] ? __alloc_file+0x21/0x280 [ 995.750550][T24183] kmem_cache_alloc+0x92/0x3a0 [ 995.755343][T24183] __alloc_file+0x21/0x280 [ 995.759783][T24183] alloc_empty_file+0x6d/0x170 [ 995.764571][T24183] path_openat+0xe1/0x2750 [ 995.769004][T24183] ? __lock_acquire+0x1655/0x5470 [ 995.774057][T24183] ? path_lookupat+0x860/0x860 [ 995.778842][T24183] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 995.784862][T24183] do_filp_open+0x1aa/0x400 [ 995.789386][T24183] ? may_open_dev+0xf0/0xf0 [ 995.793913][T24183] ? alloc_fd+0x2f0/0x670 [ 995.798258][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 995.803128][T24183] ? rwlock_bug.part.0+0x90/0x90 [ 995.808083][T24183] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 995.814345][T24183] ? _find_next_bit+0x1e3/0x260 [ 995.819219][T24183] ? _raw_spin_unlock+0x24/0x40 [ 995.824095][T24183] ? alloc_fd+0x2f0/0x670 [ 995.828453][T24183] do_sys_openat2+0x16d/0x4d0 [ 995.833153][T24183] ? build_open_flags+0x6f0/0x6f0 [ 995.838201][T24183] ? __context_tracking_exit+0xb8/0xe0 [ 995.843683][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 995.848557][T24183] __x64_sys_open+0x119/0x1c0 [ 995.853255][T24183] ? do_sys_open+0x140/0x140 [ 995.857870][T24183] ? syscall_enter_from_user_mode+0x21/0x70 [ 995.863792][T24183] do_syscall_64+0x35/0xb0 [ 995.868223][T24183] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 995.874142][T24183] RIP: 0033:0x7f67b6426e99 [ 995.878567][T24183] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 995.898185][T24183] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 995.906737][T24183] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 995.914723][T24183] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 995.922707][T24183] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 995.930715][T24183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 995.938700][T24183] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 995.946717][T24183] 18:17:46 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3052b, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:46 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x5a340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:46 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) [ 996.192573][T24183] memory: usage 307108kB, limit 307200kB, failcnt 17551 [ 996.200776][T24183] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 996.208626][T24183] Memory cgroup stats for /syz1: [ 996.208850][T24183] anon 290865152 [ 996.208850][T24183] file 155648 [ 996.208850][T24183] kernel_stack 163840 [ 996.208850][T24183] pagetables 9814016 [ 996.208850][T24183] percpu 0 [ 996.208850][T24183] sock 0 [ 996.208850][T24183] shmem 155648 [ 996.208850][T24183] file_mapped 155648 [ 996.208850][T24183] file_dirty 0 [ 996.208850][T24183] file_writeback 0 [ 996.208850][T24183] swapcached 0 [ 996.208850][T24183] anon_thp 232783872 [ 996.208850][T24183] file_thp 0 [ 996.208850][T24183] shmem_thp 0 [ 996.208850][T24183] inactive_anon 290873344 [ 996.208850][T24183] active_anon 147456 [ 996.208850][T24183] inactive_file 0 [ 996.208850][T24183] active_file 0 [ 996.208850][T24183] unevictable 0 [ 996.208850][T24183] slab_reclaimable 567640 [ 996.208850][T24183] slab_unreclaimable 10652576 [ 996.208850][T24183] slab 11220216 [ 996.208850][T24183] workingset_refault_anon 0 [ 996.208850][T24183] workingset_refault_file 0 [ 996.208850][T24183] workingset_activate_anon 0 [ 996.331825][T24183] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24167,uid=0 [ 996.347665][T24193] device macvtap2 entered promiscuous mode [ 996.348231][T24193] device virt_wifi0 entered promiscuous mode [ 996.357660][T24183] Memory cgroup out of memory: Killed process 24167 (syz-executor.1) total-vm:60776kB, anon-rss:2484kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 996.390571][ T28] oom_reaper: reaped process 24167 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 996.404493][T24193] team0: Device macvtap2 failed to register rx_handler [ 996.426726][T24193] device virt_wifi0 left promiscuous mode [ 996.593006][T24196] syz-executor.1 invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=0, oom_score_adj=1000 [ 996.596547][T24199] cgroup2: Unknown parameter '@[-}+' [ 996.604372][T24196] CPU: 1 PID: 24196 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 996.604404][T24196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 996.604420][T24196] Call Trace: [ 996.604428][T24196] [ 996.604437][T24196] dump_stack_lvl+0xcd/0x134 [ 996.604472][T24196] dump_header+0x106/0x624 [ 996.604500][T24196] oom_kill_process.cold+0x10/0x15 [ 996.604526][T24196] out_of_memory+0x358/0x1460 [ 996.604561][T24196] ? find_held_lock+0x2d/0x110 [ 996.604590][T24196] ? oom_killer_disable+0x270/0x270 [ 996.604626][T24196] ? find_held_lock+0x2d/0x110 [ 996.604656][T24196] mem_cgroup_out_of_memory+0x206/0x270 [ 996.674091][T24196] ? mem_cgroup_margin+0x130/0x130 [ 996.679219][T24196] ? lock_downgrade+0x6e0/0x6e0 [ 996.684114][T24196] try_charge_memcg+0xed2/0x1270 [ 996.689076][T24196] ? mem_cgroup_oom_trylock+0x220/0x220 [ 996.694641][T24196] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 996.700381][T24196] ? lock_downgrade+0x6e0/0x6e0 [ 996.705273][T24196] obj_cgroup_charge_pages+0x1e/0x90 [ 996.710579][T24196] obj_cgroup_charge+0xf3/0x280 [ 996.715454][T24196] ? __alloc_file+0x21/0x280 [ 996.720068][T24196] kmem_cache_alloc+0x92/0x3a0 [ 996.724856][T24196] __alloc_file+0x21/0x280 [ 996.729297][T24196] alloc_empty_file+0x6d/0x170 [ 996.734083][T24196] path_openat+0xe1/0x2750 [ 996.738527][T24196] ? __lock_acquire+0x1655/0x5470 [ 996.743577][T24196] ? path_lookupat+0x860/0x860 [ 996.748375][T24196] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 996.754400][T24196] do_filp_open+0x1aa/0x400 [ 996.758940][T24196] ? may_open_dev+0xf0/0xf0 [ 996.763471][T24196] ? alloc_fd+0x2f0/0x670 [ 996.767815][T24196] ? lock_downgrade+0x6e0/0x6e0 [ 996.772689][T24196] ? rwlock_bug.part.0+0x90/0x90 [ 996.777655][T24196] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 996.783916][T24196] ? _find_next_bit+0x1e3/0x260 [ 996.788793][T24196] ? _raw_spin_unlock+0x24/0x40 [ 996.793662][T24196] ? alloc_fd+0x2f0/0x670 [ 996.798020][T24196] do_sys_openat2+0x16d/0x4d0 [ 996.802721][T24196] ? build_open_flags+0x6f0/0x6f0 [ 996.807767][T24196] ? __context_tracking_exit+0xb8/0xe0 [ 996.813245][T24196] ? lock_downgrade+0x6e0/0x6e0 [ 996.818120][T24196] __x64_sys_openat+0x13f/0x1f0 [ 996.822990][T24196] ? __ia32_sys_open+0x1c0/0x1c0 [ 996.827960][T24196] ? syscall_enter_from_user_mode+0x21/0x70 [ 996.833883][T24196] do_syscall_64+0x35/0xb0 [ 996.838315][T24196] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 996.844226][T24196] RIP: 0033:0x7f67b6426e99 [ 996.848654][T24196] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 996.868275][T24196] RSP: 002b:00007f67b4d5a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 996.876711][T24196] RAX: ffffffffffffffda RBX: 00007f67b653a100 RCX: 00007f67b6426e99 [ 996.884694][T24196] RDX: 0000000000000002 RSI: 0000000020000340 RDI: ffffffffffffffff [ 996.892674][T24196] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 996.900658][T24196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 996.908636][T24196] R13: 00007f67b6a6db1f R14: 00007f67b4d5a300 R15: 0000000000022000 [ 996.916636][T24196] [ 996.924702][T24196] memory: usage 307200kB, limit 307200kB, failcnt 17665 [ 996.935462][T24196] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 996.942446][T24196] Memory cgroup stats for /syz1: [ 996.942597][T24196] anon 290783232 [ 996.942597][T24196] file 155648 [ 996.942597][T24196] kernel_stack 229376 [ 996.942597][T24196] pagetables 9814016 [ 996.942597][T24196] percpu 0 [ 996.942597][T24196] sock 0 [ 996.942597][T24196] shmem 155648 [ 996.942597][T24196] file_mapped 155648 [ 996.942597][T24196] file_dirty 0 [ 996.942597][T24196] file_writeback 0 [ 996.942597][T24196] swapcached 0 [ 996.942597][T24196] anon_thp 232783872 [ 996.942597][T24196] file_thp 0 [ 996.942597][T24196] shmem_thp 0 [ 996.942597][T24196] inactive_anon 290791424 [ 996.942597][T24196] active_anon 147456 [ 996.942597][T24196] inactive_file 0 [ 996.942597][T24196] active_file 0 [ 996.942597][T24196] unevictable 0 [ 996.942597][T24196] slab_reclaimable 569568 [ 996.942597][T24196] slab_unreclaimable 10756296 [ 996.942597][T24196] slab 11325864 [ 996.942597][T24196] workingset_refault_anon 0 [ 996.942597][T24196] workingset_refault_file 0 [ 996.942597][T24196] workingset_activate_anon 0 [ 997.041286][T24196] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24198,uid=0 [ 997.061506][T24196] Memory cgroup out of memory: Killed process 24198 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 997.082572][ T28] oom_reaper: reaped process 24198 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 997.082941][T24177] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 997.115812][T24177] CPU: 1 PID: 24177 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 997.124601][T24177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 997.134643][T24177] Call Trace: [ 997.137909][T24177] [ 997.140824][T24177] dump_stack_lvl+0xcd/0x134 [ 997.145427][T24177] dump_header+0x106/0x624 [ 997.149836][T24177] oom_kill_process.cold+0x10/0x15 [ 997.154949][T24177] out_of_memory+0x358/0x1460 [ 997.159642][T24177] ? find_held_lock+0x2d/0x110 [ 997.164398][T24177] ? oom_killer_disable+0x270/0x270 [ 997.169584][T24177] ? find_held_lock+0x2d/0x110 [ 997.174334][T24177] mem_cgroup_out_of_memory+0x206/0x270 [ 997.179865][T24177] ? mem_cgroup_margin+0x130/0x130 [ 997.185134][T24177] ? lock_downgrade+0x6e0/0x6e0 [ 997.189986][T24177] try_charge_memcg+0xc76/0x1270 [ 997.194914][T24177] ? mem_cgroup_oom_trylock+0x220/0x220 [ 997.200444][T24177] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 997.206151][T24177] ? lock_downgrade+0x6e0/0x6e0 [ 997.210991][T24177] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 997.216701][T24177] obj_cgroup_charge_pages+0x1e/0x90 [ 997.221975][T24177] __memcg_kmem_charge_page+0x392/0x5f0 [ 997.227510][T24177] copy_process+0x80a/0x75a0 [ 997.232082][T24177] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 997.238309][T24177] ? wp_page_copy+0x55d/0x2280 [ 997.243063][T24177] ? lock_chain_count+0x20/0x20 [ 997.247899][T24177] ? lock_chain_count+0x20/0x20 [ 997.252743][T24177] ? __cleanup_sighand+0xb0/0xb0 [ 997.257682][T24177] ? __lock_acquire+0x1655/0x5470 [ 997.262717][T24177] ? kernel_clone+0x314/0xab0 [ 997.267383][T24177] kernel_clone+0xe7/0xab0 [ 997.271808][T24177] ? create_io_thread+0xf0/0xf0 [ 997.276643][T24177] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 997.282622][T24177] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 997.288600][T24177] ? find_held_lock+0x2d/0x110 [ 997.293396][T24177] __do_sys_clone+0xc8/0x110 [ 997.298146][T24177] ? kernel_clone+0xab0/0xab0 [ 997.302805][T24177] ? lock_downgrade+0x6e0/0x6e0 [ 997.307648][T24177] ? syscall_enter_from_user_mode+0x21/0x70 [ 997.313548][T24177] do_syscall_64+0x35/0xb0 [ 997.317950][T24177] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 997.323831][T24177] RIP: 0033:0x7f67b64282c1 [ 997.328233][T24177] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 997.347824][T24177] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 997.356221][T24177] RAX: ffffffffffffffda RBX: 00007f67b4d18700 RCX: 00007f67b64282c1 [ 997.364180][T24177] RDX: 00007f67b4d189d0 RSI: 00007f67b4d182f0 RDI: 00000000003d0f00 [ 997.372137][T24177] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d18700 R09: 00007f67b4d18700 [ 997.380101][T24177] R10: 00007f67b4d189d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 997.388059][T24177] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 997.396038][T24177] [ 997.411477][T24177] memory: usage 307084kB, limit 307200kB, failcnt 17726 [ 997.418528][T24177] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 997.425382][T24177] Memory cgroup stats for /syz1: [ 997.425520][T24177] anon 290742272 [ 997.425520][T24177] file 155648 [ 997.425520][T24177] kernel_stack 229376 [ 997.425520][T24177] pagetables 9732096 [ 997.425520][T24177] percpu 0 [ 997.425520][T24177] sock 0 [ 997.425520][T24177] shmem 155648 [ 997.425520][T24177] file_mapped 155648 [ 997.425520][T24177] file_dirty 0 [ 997.425520][T24177] file_writeback 0 [ 997.425520][T24177] swapcached 0 [ 997.425520][T24177] anon_thp 232783872 [ 997.425520][T24177] file_thp 0 [ 997.425520][T24177] shmem_thp 0 [ 997.425520][T24177] inactive_anon 290750464 [ 997.425520][T24177] active_anon 147456 [ 997.425520][T24177] inactive_file 0 [ 997.425520][T24177] active_file 0 [ 997.425520][T24177] unevictable 0 [ 997.425520][T24177] slab_reclaimable 569568 [ 997.425520][T24177] slab_unreclaimable 10741056 [ 997.425520][T24177] slab 11310624 [ 997.425520][T24177] workingset_refault_anon 0 [ 997.425520][T24177] workingset_refault_file 0 [ 997.425520][T24177] workingset_activate_anon 0 [ 997.523832][T24177] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=20188,uid=0 [ 997.539497][T24177] Memory cgroup out of memory: Killed process 20188 (syz-executor.1) total-vm:56804kB, anon-rss:2452kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 997.558430][T24179] cgroup2: Unknown parameter '@[-}+' [ 997.560137][ T28] oom_reaper: reaped process 20188 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 997.593355][T24183] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 997.605644][T24183] CPU: 1 PID: 24183 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 997.614434][T24183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 997.624511][T24183] Call Trace: [ 997.627808][T24183] [ 997.630749][T24183] dump_stack_lvl+0xcd/0x134 [ 997.635366][T24183] dump_header+0x106/0x624 [ 997.639777][T24183] oom_kill_process.cold+0x10/0x15 [ 997.644887][T24183] out_of_memory+0x358/0x1460 [ 997.649581][T24183] ? find_held_lock+0x2d/0x110 [ 997.654336][T24183] ? oom_killer_disable+0x270/0x270 [ 997.659669][T24183] ? find_held_lock+0x2d/0x110 [ 997.664446][T24183] mem_cgroup_out_of_memory+0x206/0x270 [ 997.670022][T24183] ? mem_cgroup_margin+0x130/0x130 [ 997.675140][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 997.680003][T24183] try_charge_memcg+0xed2/0x1270 [ 997.684946][T24183] ? mem_cgroup_oom_trylock+0x220/0x220 [ 997.690494][T24183] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 997.696207][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 997.701053][T24183] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 997.706777][T24183] obj_cgroup_charge_pages+0x1e/0x90 [ 997.712067][T24183] __memcg_kmem_charge_page+0x392/0x5f0 [ 997.717618][T24183] __alloc_pages+0x1da/0x500 [ 997.722204][T24183] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 997.729042][T24183] ? copy_page_range+0x24ef/0x42c0 [ 997.734161][T24183] alloc_pages+0x1a7/0x300 [ 997.738633][T24183] get_zeroed_page+0x10/0x40 [ 997.743217][T24183] __pud_alloc+0x37/0x170 [ 997.747723][T24183] copy_page_range+0x2635/0x42c0 [ 997.752681][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 997.757527][T24183] ? handle_mm_fault+0x790/0x790 [ 997.762464][T24183] ? __vma_link_rb+0x553/0x710 [ 997.767221][T24183] dup_mm+0xa4e/0x13e0 [ 997.771292][T24183] ? replace_mm_exe_file+0x490/0x490 [ 997.776570][T24183] ? __raw_spin_lock_init+0x36/0x110 [ 997.781857][T24183] copy_process+0x6fed/0x75a0 [ 997.786545][T24183] ? find_held_lock+0x2d/0x110 [ 997.791445][T24183] ? __cleanup_sighand+0xb0/0xb0 [ 997.796396][T24183] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 997.802627][T24183] ? _copy_from_user+0x5d/0x180 [ 997.807474][T24183] ? kernel_clone+0x314/0xab0 [ 997.812144][T24183] kernel_clone+0xe7/0xab0 [ 997.816553][T24183] ? create_io_thread+0xf0/0xf0 [ 997.821401][T24183] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 997.827385][T24183] __do_sys_clone3+0x1dd/0x2f0 [ 997.832166][T24183] ? __do_sys_clone+0x110/0x110 [ 997.837021][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 997.841868][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 997.846725][T24183] ? syscall_enter_from_user_mode+0x21/0x70 [ 997.852620][T24183] do_syscall_64+0x35/0xb0 [ 997.857025][T24183] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 997.862909][T24183] RIP: 0033:0x7f67b6426e99 [ 997.867311][T24183] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 997.886907][T24183] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 997.895311][T24183] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 997.903273][T24183] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 997.911233][T24183] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 997.919197][T24183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 997.927180][T24183] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 997.935156][T24183] [ 997.942224][T24183] memory: usage 307196kB, limit 307200kB, failcnt 17837 [ 997.949368][T24183] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 997.956230][T24183] Memory cgroup stats for /syz1: [ 997.956441][T24183] anon 290648064 [ 997.956441][T24183] file 155648 [ 997.956441][T24183] kernel_stack 294912 [ 997.956441][T24183] pagetables 9814016 [ 997.956441][T24183] percpu 0 [ 997.956441][T24183] sock 0 [ 997.956441][T24183] shmem 155648 [ 997.956441][T24183] file_mapped 155648 [ 997.956441][T24183] file_dirty 0 [ 997.956441][T24183] file_writeback 0 [ 997.956441][T24183] swapcached 0 [ 997.956441][T24183] anon_thp 232783872 [ 997.956441][T24183] file_thp 0 [ 997.956441][T24183] shmem_thp 0 [ 997.956441][T24183] inactive_anon 290648064 [ 997.956441][T24183] active_anon 147456 [ 997.956441][T24183] inactive_file 0 [ 997.956441][T24183] active_file 0 [ 997.956441][T24183] unevictable 0 [ 997.956441][T24183] slab_reclaimable 569568 [ 997.956441][T24183] slab_unreclaimable 10825944 [ 997.956441][T24183] slab 11395512 [ 997.956441][T24183] workingset_refault_anon 0 [ 997.956441][T24183] workingset_refault_file 0 [ 997.956441][T24183] workingset_activate_anon 0 [ 998.055630][T24183] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24202,uid=0 [ 998.071314][T24183] Memory cgroup out of memory: Killed process 24202 (syz-executor.1) total-vm:57332kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 998.094249][ T28] oom_reaper: reaped process 24202 (syz-executor.1), now anon-rss:0kB, file-rss:14080kB, shmem-rss:0kB [ 998.116158][T24183] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 998.128511][T24183] CPU: 1 PID: 24183 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 998.137286][T24183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 998.147355][T24183] Call Trace: [ 998.150648][T24183] [ 998.153586][T24183] dump_stack_lvl+0xcd/0x134 [ 998.158197][T24183] dump_header+0x106/0x624 [ 998.162639][T24183] oom_kill_process.cold+0x10/0x15 [ 998.167790][T24183] out_of_memory+0x358/0x1460 [ 998.172468][T24183] ? find_held_lock+0x2d/0x110 [ 998.177233][T24183] ? oom_killer_disable+0x270/0x270 [ 998.182426][T24183] ? find_held_lock+0x2d/0x110 [ 998.187188][T24183] mem_cgroup_out_of_memory+0x206/0x270 [ 998.192725][T24183] ? mem_cgroup_margin+0x130/0x130 [ 998.197821][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 998.202676][T24183] try_charge_memcg+0xed2/0x1270 [ 998.207619][T24183] ? mem_cgroup_oom_trylock+0x220/0x220 [ 998.213237][T24183] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 998.218943][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 998.223793][T24183] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 998.229533][T24183] obj_cgroup_charge_pages+0x1e/0x90 [ 998.234807][T24183] __memcg_kmem_charge_page+0x392/0x5f0 [ 998.240346][T24183] __alloc_pages+0x1da/0x500 [ 998.244931][T24183] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 998.251688][T24183] ? copy_page_range+0x24ef/0x42c0 [ 998.256791][T24183] alloc_pages+0x1a7/0x300 [ 998.261206][T24183] get_zeroed_page+0x10/0x40 [ 998.265801][T24183] __pud_alloc+0x37/0x170 [ 998.270122][T24183] copy_page_range+0x2635/0x42c0 [ 998.275089][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 998.279932][T24183] ? handle_mm_fault+0x790/0x790 [ 998.284879][T24183] ? __vma_link_rb+0x553/0x710 [ 998.289641][T24183] dup_mm+0xa4e/0x13e0 [ 998.293702][T24183] ? replace_mm_exe_file+0x490/0x490 [ 998.298978][T24183] ? __raw_spin_lock_init+0x36/0x110 [ 998.304261][T24183] copy_process+0x6fed/0x75a0 [ 998.308938][T24183] ? find_held_lock+0x2d/0x110 [ 998.313703][T24183] ? __cleanup_sighand+0xb0/0xb0 [ 998.318631][T24183] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 998.324954][T24183] ? _copy_from_user+0x5d/0x180 [ 998.329819][T24183] ? kernel_clone+0x314/0xab0 [ 998.334514][T24183] kernel_clone+0xe7/0xab0 [ 998.338920][T24183] ? create_io_thread+0xf0/0xf0 [ 998.343766][T24183] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 998.349738][T24183] __do_sys_clone3+0x1dd/0x2f0 [ 998.354496][T24183] ? __do_sys_clone+0x110/0x110 [ 998.359341][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 998.364178][T24183] ? lock_downgrade+0x6e0/0x6e0 [ 998.369027][T24183] ? syscall_enter_from_user_mode+0x21/0x70 [ 998.374913][T24183] do_syscall_64+0x35/0xb0 [ 998.379318][T24183] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 998.385218][T24183] RIP: 0033:0x7f67b6426e99 [ 998.389621][T24183] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 998.409213][T24183] RSP: 002b:00007f67b4d7b168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 998.417616][T24183] RAX: ffffffffffffffda RBX: 00007f67b653a030 RCX: 00007f67b6426e99 [ 998.425578][T24183] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 998.433541][T24183] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 998.441526][T24183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 998.449505][T24183] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 998.457485][T24183] [ 998.464970][T24183] memory: usage 307104kB, limit 307200kB, failcnt 17922 [ 998.477212][T24183] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 998.484319][T24183] Memory cgroup stats for /syz1: [ 998.484538][T24183] anon 290643968 [ 998.484538][T24183] file 155648 [ 998.484538][T24183] kernel_stack 262144 [ 998.484538][T24183] pagetables 9732096 [ 998.484538][T24183] percpu 0 [ 998.484538][T24183] sock 0 [ 998.484538][T24183] shmem 155648 [ 998.484538][T24183] file_mapped 155648 [ 998.484538][T24183] file_dirty 0 [ 998.484538][T24183] file_writeback 0 [ 998.484538][T24183] swapcached 0 [ 998.484538][T24183] anon_thp 232783872 [ 998.484538][T24183] file_thp 0 [ 998.484538][T24183] shmem_thp 0 [ 998.484538][T24183] inactive_anon 290652160 [ 998.484538][T24183] active_anon 147456 [ 998.484538][T24183] inactive_file 0 [ 998.484538][T24183] active_file 0 [ 998.484538][T24183] unevictable 0 [ 998.484538][T24183] slab_reclaimable 569568 [ 998.484538][T24183] slab_unreclaimable 10833376 [ 998.484538][T24183] slab 11402944 [ 998.484538][T24183] workingset_refault_anon 0 [ 998.484538][T24183] workingset_refault_file 0 [ 998.484538][T24183] workingset_activate_anon 0 [ 998.583256][T24183] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24203,uid=0 18:17:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x472, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1000, 0x0, 0x0, 0x9, 0x3, 0xff, 0x0, 0x0, 0xfffffffc}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000480)=ANY=[@ANYBLOB="f2de2378668488632da2848c64e81e57309ff000"/31, @ANYRES32, @ANYRESDEC]) clone3(0x0, 0xfffffe75) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40201) perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x80, 0x9c, 0x4, 0x4, 0x1, 0x0, 0xb0, 0x200, 0x5, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffbb, 0x0, @perf_bp={&(0x7f0000000100), 0x1}, 0x1000, 0x9, 0x3, 0x6, 0x8, 0x0, 0x2, 0x0, 0x7, 0x0, 0xff}, r0, 0xb, 0xffffffffffffffff, 0x9) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x472, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1000, 0x0, 0x0, 0x9, 0x3, 0xff, 0x0, 0x0, 0xfffffffc}, 0x0, 0x2, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r1, r2, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000480)=ANY=[@ANYBLOB="f2de2378668488632da2848c64e81e57309ff000"/31, @ANYRES32, @ANYRESDEC]) (async) clone3(0x0, 0xfffffe75) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40201) (async) perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x80, 0x9c, 0x4, 0x4, 0x1, 0x0, 0xb0, 0x200, 0x5, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffbb, 0x0, @perf_bp={&(0x7f0000000100), 0x1}, 0x1000, 0x9, 0x3, 0x6, 0x8, 0x0, 0x2, 0x0, 0x7, 0x0, 0xff}, r0, 0xb, 0xffffffffffffffff, 0x9) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:17:48 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4002, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:48 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:48 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3052c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:48 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x5b340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:48 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) ioctl$int_in(0xffffffffffffffff, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) [ 998.600011][T24183] Memory cgroup out of memory: OOM victim 24203 (syz-executor.1) is already exiting. Skip killing the task [ 998.664604][T24211] device macvtap2 entered promiscuous mode [ 998.671873][T24211] device virt_wifi0 entered promiscuous mode [ 998.679031][T24211] team0: Device macvtap2 failed to register rx_handler [ 998.695898][T24211] device virt_wifi0 left promiscuous mode [ 998.752692][T24216] cgroup2: Unknown parameter '@[-}+' 18:17:49 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3052d, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:49 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:49 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x5c340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:49 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4800, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 999.071127][T24218] cgroup2: Unknown parameter '@[-}+' 18:17:49 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3052e, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 999.147237][T24232] cgroup2: Unknown parameter '@[-}+' [ 999.156674][T24230] device macvtap2 entered promiscuous mode 18:17:49 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb020000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 999.208784][T24230] device virt_wifi0 entered promiscuous mode [ 999.256823][T24230] team0: Device macvtap2 failed to register rx_handler [ 999.304008][T24230] device virt_wifi0 left promiscuous mode [ 999.320434][T24216] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 999.369013][T24216] CPU: 0 PID: 24216 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 999.377822][T24216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 999.387933][T24216] Call Trace: [ 999.391221][T24216] [ 999.394160][T24216] dump_stack_lvl+0xcd/0x134 [ 999.398777][T24216] dump_header+0x106/0x624 [ 999.403210][T24216] oom_kill_process.cold+0x10/0x15 [ 999.408342][T24216] out_of_memory+0x358/0x1460 [ 999.413046][T24216] ? find_held_lock+0x2d/0x110 [ 999.417828][T24216] ? oom_killer_disable+0x270/0x270 [ 999.423056][T24216] ? find_held_lock+0x2d/0x110 [ 999.427839][T24216] mem_cgroup_out_of_memory+0x206/0x270 [ 999.433400][T24216] ? mem_cgroup_margin+0x130/0x130 [ 999.438528][T24216] ? lock_downgrade+0x6e0/0x6e0 [ 999.443424][T24216] try_charge_memcg+0xed2/0x1270 [ 999.448396][T24216] ? mem_cgroup_oom_trylock+0x220/0x220 [ 999.453964][T24216] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 999.459703][T24216] ? lock_downgrade+0x6e0/0x6e0 [ 999.464597][T24216] obj_cgroup_charge_pages+0x1e/0x90 [ 999.469905][T24216] obj_cgroup_charge+0xf3/0x280 [ 999.474786][T24216] ? anon_vma_fork+0xed/0x630 [ 999.479489][T24216] kmem_cache_alloc+0x92/0x3a0 [ 999.484278][T24216] anon_vma_fork+0xed/0x630 [ 999.488811][T24216] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 999.494565][T24216] ? __vm_enough_memory+0x184/0x360 [ 999.499771][T24216] dup_mm+0xa07/0x13e0 [ 999.503862][T24216] ? replace_mm_exe_file+0x490/0x490 [ 999.509146][T24216] ? __raw_spin_lock_init+0x36/0x110 [ 999.514464][T24216] copy_process+0x6fed/0x75a0 [ 999.519167][T24216] ? find_held_lock+0x2d/0x110 [ 999.523954][T24216] ? __cleanup_sighand+0xb0/0xb0 [ 999.528897][T24216] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 999.535152][T24216] ? _copy_from_user+0x5d/0x180 [ 999.540006][T24216] ? kernel_clone+0x314/0xab0 [ 999.544736][T24216] kernel_clone+0xe7/0xab0 [ 999.549242][T24216] ? create_io_thread+0xf0/0xf0 [ 999.554149][T24216] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 999.560138][T24216] __do_sys_clone3+0x1dd/0x2f0 [ 999.564912][T24216] ? __do_sys_clone+0x110/0x110 [ 999.569775][T24216] ? lock_downgrade+0x6e0/0x6e0 [ 999.574642][T24216] ? lock_downgrade+0x6e0/0x6e0 [ 999.579505][T24216] ? syscall_enter_from_user_mode+0x21/0x70 [ 999.585425][T24216] do_syscall_64+0x35/0xb0 [ 999.589857][T24216] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 999.595768][T24216] RIP: 0033:0x7f67b6426e99 [ 999.600185][T24216] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 999.619807][T24216] RSP: 002b:00007f67b4d9c168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 999.628237][T24216] RAX: ffffffffffffffda RBX: 00007f67b6539f60 RCX: 00007f67b6426e99 [ 999.636223][T24216] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 999.644213][T24216] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 999.652195][T24216] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 999.660180][T24216] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 999.668190][T24216] [ 999.683801][T24216] memory: usage 307200kB, limit 307200kB, failcnt 18083 [ 999.701207][T24216] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 999.721776][T24216] Memory cgroup stats for /syz1: [ 999.722078][T24216] anon 290713600 [ 999.722078][T24216] file 155648 [ 999.722078][T24216] kernel_stack 294912 [ 999.722078][T24216] pagetables 9748480 [ 999.722078][T24216] percpu 0 [ 999.722078][T24216] sock 0 [ 999.722078][T24216] shmem 155648 [ 999.722078][T24216] file_mapped 155648 [ 999.722078][T24216] file_dirty 0 [ 999.722078][T24216] file_writeback 0 [ 999.722078][T24216] swapcached 0 [ 999.722078][T24216] anon_thp 232783872 [ 999.722078][T24216] file_thp 0 [ 999.722078][T24216] shmem_thp 0 [ 999.722078][T24216] inactive_anon 290721792 [ 999.722078][T24216] active_anon 147456 [ 999.722078][T24216] inactive_file 0 [ 999.722078][T24216] active_file 0 [ 999.722078][T24216] unevictable 0 [ 999.722078][T24216] slab_reclaimable 580016 [ 999.722078][T24216] slab_unreclaimable 10804384 [ 999.722078][T24216] slab 11384400 [ 999.722078][T24216] workingset_refault_anon 0 [ 999.722078][T24216] workingset_refault_file 0 [ 999.722078][T24216] workingset_activate_anon 0 [ 999.842589][T24216] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24217,uid=0 [ 999.867077][T24216] Memory cgroup out of memory: Killed process 24217 (syz-executor.1) total-vm:56804kB, anon-rss:2452kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:17:50 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000100), 0xa) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000002480)={0x2c, 0x6, 0x0, 0x14, r2}, 0x10) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f0723b200000040000000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x80000000, 0x0, 0x0, 'queue1\x00', 0x1ffff}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:50 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) ioctl$int_in(0xffffffffffffffff, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) 18:17:50 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4a00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:50 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:50 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3052f, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:50 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x5d340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1000.016478][T24247] device macvtap2 entered promiscuous mode [ 1000.053148][T24247] device virt_wifi0 entered promiscuous mode 18:17:50 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30530, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1000.079956][T24247] team0: Device macvtap2 failed to register rx_handler [ 1000.117002][T24249] cgroup2: Unknown parameter '@[-}+' [ 1000.137082][T24247] device virt_wifi0 left promiscuous mode [ 1000.499130][T24254] cgroup2: Unknown parameter '@[-}+' 18:17:51 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30531, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:51 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:51 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4c00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:51 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x5e340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) ioctl$int_in(0xffffffffffffffff, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) 18:17:51 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x30532, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:51 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000100), 0xa) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) bind$xdp(0xffffffffffffffff, &(0x7f0000002480)={0x2c, 0x6, 0x0, 0x14, r2}, 0x10) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f0723b200000040000000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x80000000, 0x0, 0x0, 'queue1\x00', 0x1ffff}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:51 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1001.205492][T24265] device macvtap2 entered promiscuous mode [ 1001.245720][T24265] device virt_wifi0 entered promiscuous mode 18:17:51 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5865, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1001.304351][T24265] team0: Device macvtap2 failed to register rx_handler [ 1001.387060][T24265] device virt_wifi0 left promiscuous mode [ 1001.430050][T24276] cgroup2: Unknown parameter '@[-}+' 18:17:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:51 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3ffff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1001.696896][T24283] cgroup2: Unknown parameter '@[-}+' 18:17:51 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x10000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:52 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x5f340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:52 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1002.080614][T24293] device macvtap2 entered promiscuous mode 18:17:52 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x40000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:52 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1002.157099][T24293] device virt_wifi0 entered promiscuous mode 18:17:52 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x10010000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1002.210932][T24293] team0: Device macvtap2 failed to register rx_handler [ 1002.269979][T24293] device virt_wifi0 left promiscuous mode 18:17:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000100), 0xa) (async, rerun: 32) r4 = socket$xdp(0x2c, 0x3, 0x0) (rerun: 32) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) bind$xdp(0xffffffffffffffff, &(0x7f0000002480)={0x2c, 0x6, 0x0, 0x14, r2}, 0x10) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f0723b200000040000000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x80000000, 0x0, 0x0, 'queue1\x00', 0x1ffff}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:52 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6301, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:52 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x60000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:52 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x50300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:52 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x12000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1002.808733][T24326] device macvtap2 entered promiscuous mode [ 1002.824709][T24326] device virt_wifi0 entered promiscuous mode 18:17:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6558, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1002.849279][T24340] cgroup2: Unknown parameter '@[-}+' [ 1002.869898][T24326] team0: Device macvtap2 failed to register rx_handler [ 1002.929057][T24326] device virt_wifi0 left promiscuous mode 18:17:53 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:53 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf0ffff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) open(&(0x7f0000000100)='./file0\x00', 0x141880, 0x1) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:53 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1c030000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:53 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x60340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:53 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6800, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1003.419140][T24428] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1003.464396][T24434] device macvtap2 entered promiscuous mode [ 1003.471534][T24428] CPU: 0 PID: 24428 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1003.480343][T24428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1003.486680][T24434] device virt_wifi0 entered promiscuous mode [ 1003.490409][T24428] Call Trace: [ 1003.490421][T24428] [ 1003.490430][T24428] dump_stack_lvl+0xcd/0x134 [ 1003.490466][T24428] dump_header+0x106/0x624 18:17:53 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:53 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1f000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1003.490496][T24428] oom_kill_process.cold+0x10/0x15 [ 1003.490522][T24428] out_of_memory+0x358/0x1460 [ 1003.490555][T24428] ? find_held_lock+0x2d/0x110 [ 1003.490582][T24428] ? oom_killer_disable+0x270/0x270 [ 1003.490614][T24428] ? find_held_lock+0x2d/0x110 [ 1003.490642][T24428] mem_cgroup_out_of_memory+0x206/0x270 [ 1003.512095][T24434] team0: Device macvtap2 failed to register rx_handler [ 1003.516881][T24428] ? mem_cgroup_margin+0x130/0x130 [ 1003.516913][T24428] ? lock_downgrade+0x6e0/0x6e0 [ 1003.516958][T24428] try_charge_memcg+0xed2/0x1270 [ 1003.563564][T24428] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1003.569138][T24428] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1003.574891][T24428] ? lock_downgrade+0x6e0/0x6e0 [ 1003.579776][T24428] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1003.585536][T24428] obj_cgroup_charge_pages+0x1e/0x90 [ 1003.590847][T24428] __memcg_kmem_charge_page+0x392/0x5f0 [ 1003.596426][T24428] copy_process+0x80a/0x75a0 [ 1003.601041][T24428] ? lock_chain_count+0x20/0x20 [ 1003.605915][T24428] ? lock_chain_count+0x20/0x20 [ 1003.610800][T24428] ? __cleanup_sighand+0xb0/0xb0 [ 1003.615760][T24428] ? __lock_acquire+0x1655/0x5470 [ 1003.620805][T24428] ? kernel_clone+0x314/0xab0 [ 1003.625500][T24428] kernel_clone+0xe7/0xab0 [ 1003.629941][T24428] ? create_io_thread+0xf0/0xf0 [ 1003.634806][T24428] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1003.640818][T24428] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1003.646834][T24428] ? find_held_lock+0x2d/0x110 [ 1003.646889][T24437] cgroup2: Unknown parameter '@[-}+' [ 1003.651627][T24428] __do_sys_clone+0xc8/0x110 [ 1003.651659][T24428] ? kernel_clone+0xab0/0xab0 [ 1003.651683][T24428] ? lock_downgrade+0x6e0/0x6e0 [ 1003.651724][T24428] ? syscall_enter_from_user_mode+0x21/0x70 [ 1003.651764][T24428] do_syscall_64+0x35/0xb0 [ 1003.651787][T24428] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1003.651816][T24428] RIP: 0033:0x7f67b64282c1 [ 1003.651838][T24428] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1003.711974][T24428] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1003.720412][T24428] RAX: ffffffffffffffda RBX: 00007f67b4d9c700 RCX: 00007f67b64282c1 [ 1003.728405][T24428] RDX: 00007f67b4d9c9d0 RSI: 00007f67b4d9c2f0 RDI: 00000000003d0f00 [ 1003.738444][T24428] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d9c700 R09: 00007f67b4d9c700 [ 1003.746439][T24428] R10: 00007f67b4d9c9d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 1003.754438][T24428] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 1003.762537][T24428] [ 1003.767071][T24434] device virt_wifi0 left promiscuous mode 18:17:54 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1003.897558][T24428] memory: usage 307200kB, limit 307200kB, failcnt 18153 [ 1003.920290][T24428] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1003.972997][T24428] Memory cgroup stats for /syz1: [ 1003.973222][T24428] anon 290979840 [ 1003.973222][T24428] file 155648 [ 1003.973222][T24428] kernel_stack 98304 [ 1003.973222][T24428] pagetables 9748480 [ 1003.973222][T24428] percpu 0 [ 1003.973222][T24428] sock 0 [ 1003.973222][T24428] shmem 155648 [ 1003.973222][T24428] file_mapped 155648 [ 1003.973222][T24428] file_dirty 0 [ 1003.973222][T24428] file_writeback 0 [ 1003.973222][T24428] swapcached 0 [ 1003.973222][T24428] anon_thp 232783872 [ 1003.973222][T24428] file_thp 0 18:17:54 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x20000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:54 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:17:54 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x69a2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1003.973222][T24428] shmem_thp 0 [ 1003.973222][T24428] inactive_anon 290988032 [ 1003.973222][T24428] active_anon 147456 [ 1003.973222][T24428] inactive_file 0 [ 1003.973222][T24428] active_file 0 [ 1003.973222][T24428] unevictable 0 [ 1003.973222][T24428] slab_reclaimable 622792 [ 1003.973222][T24428] slab_unreclaimable 10545112 [ 1003.973222][T24428] slab 11167904 [ 1003.973222][T24428] workingset_refault_anon 0 [ 1003.973222][T24428] workingset_refault_file 0 [ 1003.973222][T24428] workingset_activate_anon 0 18:17:54 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x61340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:54 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1004.192764][T24560] device macvtap2 entered promiscuous mode [ 1004.215284][T24560] device virt_wifi0 entered promiscuous mode [ 1004.242212][T24560] team0: Device macvtap2 failed to register rx_handler [ 1004.242509][T24428] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24285,uid=0 [ 1004.266734][T24560] device virt_wifi0 left promiscuous mode [ 1004.291585][T24428] Memory cgroup out of memory: Killed process 24285 (syz-executor.1) total-vm:57464kB, anon-rss:2472kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 1004.331477][T24555] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1004.342588][T24555] CPU: 0 PID: 24555 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 1004.351395][T24555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1004.361654][T24555] Call Trace: [ 1004.364942][T24555] [ 1004.367889][T24555] dump_stack_lvl+0xcd/0x134 [ 1004.372502][T24555] dump_header+0x106/0x624 [ 1004.377034][T24555] oom_kill_process.cold+0x10/0x15 [ 1004.382171][T24555] out_of_memory+0x358/0x1460 [ 1004.386884][T24555] ? find_held_lock+0x2d/0x110 [ 1004.391669][T24555] ? oom_killer_disable+0x270/0x270 [ 1004.396900][T24555] ? find_held_lock+0x2d/0x110 [ 1004.401687][T24555] mem_cgroup_out_of_memory+0x206/0x270 [ 1004.407424][T24555] ? mem_cgroup_margin+0x130/0x130 [ 1004.412548][T24555] ? lock_downgrade+0x6e0/0x6e0 [ 1004.417431][T24555] try_charge_memcg+0xed2/0x1270 [ 1004.422397][T24555] ? find_held_lock+0x2d/0x110 [ 1004.427186][T24555] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1004.432759][T24555] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 1004.438327][T24555] ? lock_downgrade+0x6e0/0x6e0 [ 1004.443221][T24555] charge_memcg+0xae/0x360 [ 1004.447657][T24555] __mem_cgroup_charge+0x27/0x90 [ 1004.452623][T24555] wp_page_copy+0x294/0x2280 [ 1004.457242][T24555] ? do_page_mkwrite+0x550/0x550 [ 1004.462200][T24555] ? lock_downgrade+0x6e0/0x6e0 [ 1004.467075][T24555] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 1004.472811][T24555] ? vm_normal_page+0x146/0x2a0 [ 1004.477697][T24555] do_wp_page+0x2cb/0x1ae0 [ 1004.482137][T24555] __handle_mm_fault+0x1f41/0x5120 [ 1004.487279][T24555] ? vm_iomap_memory+0x190/0x190 [ 1004.492264][T24555] handle_mm_fault+0x1c8/0x790 [ 1004.497057][T24555] do_user_addr_fault+0x489/0x11c0 [ 1004.502198][T24555] exc_page_fault+0x9e/0x180 [ 1004.506804][T24555] ? asm_exc_page_fault+0x8/0x30 [ 1004.511763][T24555] asm_exc_page_fault+0x1e/0x30 [ 1004.516637][T24555] RIP: 0033:0x7f462baf00d0 [ 1004.521062][T24555] Code: fe ff 49 39 dc 75 eb 48 8b 44 24 18 89 28 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 44 00 00 41 89 c5 e9 75 fe ff ff <43> 89 2c 84 e9 a3 fe ff ff 0f 1f 80 00 00 00 00 49 39 d4 74 70 48 [ 1004.540773][T24555] RSP: 002b:00007f462c188ab0 EFLAGS: 00010246 [ 1004.546864][T24555] RAX: 00000000698cf73f RBX: 00007f462bc54ff8 RCX: 0000001b2e620000 [ 1004.554847][T24555] RDX: 0000000000000000 RSI: 0000001b2e620014 RDI: 0000000008e75d53 [ 1004.562832][T24555] RBP: 00000000698cf73f R08: 000000000000173f R09: 00000000698cf743 [ 1004.570812][T24555] R10: 00007f462c188c80 R11: 0000000000000246 R12: 00007f462bc49000 [ 1004.578883][T24555] R13: 0000000000000001 R14: 0000000000000004 R15: ffffffff819bd244 [ 1004.586888][T24555] ? trace_user_exit.constprop.0+0x144/0x220 [ 1004.592919][T24555] [ 1004.664922][T24555] memory: usage 307200kB, limit 307200kB, failcnt 1818 [ 1004.672204][T24555] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1004.679581][T24555] Memory cgroup stats for /syz5: [ 1004.679808][T24555] anon 286281728 [ 1004.679808][T24555] file 90112 [ 1004.679808][T24555] kernel_stack 983040 [ 1004.679808][T24555] pagetables 9756672 [ 1004.679808][T24555] percpu 0 [ 1004.679808][T24555] sock 0 [ 1004.679808][T24555] shmem 90112 [ 1004.679808][T24555] file_mapped 90112 [ 1004.679808][T24555] file_dirty 0 [ 1004.679808][T24555] file_writeback 0 [ 1004.679808][T24555] swapcached 0 [ 1004.679808][T24555] anon_thp 220200960 [ 1004.679808][T24555] file_thp 0 [ 1004.679808][T24555] shmem_thp 0 [ 1004.679808][T24555] inactive_anon 286285824 [ 1004.679808][T24555] active_anon 86016 [ 1004.679808][T24555] inactive_file 0 [ 1004.679808][T24555] active_file 0 [ 1004.679808][T24555] unevictable 0 [ 1004.679808][T24555] slab_reclaimable 526248 [ 1004.679808][T24555] slab_unreclaimable 14544096 [ 1004.679808][T24555] slab 15070344 [ 1004.679808][T24555] workingset_refault_anon 0 [ 1004.679808][T24555] workingset_refault_file 0 [ 1004.679808][T24555] workingset_activate_anon 0 [ 1004.725386][T24564] cgroup2: Unknown parameter '@[-}+' [ 1004.778949][T24555] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7069,uid=0 [ 1004.779132][T24555] Memory cgroup out of memory: Killed process 7069 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 18:17:55 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async, rerun: 32) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (rerun: 32) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async, rerun: 64) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (rerun: 64) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) open(&(0x7f0000000100)='./file0\x00', 0x141880, 0x1) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:55 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x21000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:55 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6c00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:55 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:55 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x62340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:55 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x22020000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:55 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6c0c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1005.057617][T24574] device macvtap2 entered promiscuous mode 18:17:55 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1005.145009][T24574] device virt_wifi0 entered promiscuous mode [ 1005.184872][T24583] cgroup2: Unknown parameter '@[-}+' [ 1005.200968][T24574] team0: Device macvtap2 failed to register rx_handler [ 1005.203906][T24580] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1005.219773][T24580] CPU: 0 PID: 24580 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1005.228571][T24580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1005.238639][T24580] Call Trace: [ 1005.242049][T24580] [ 1005.244995][T24580] dump_stack_lvl+0xcd/0x134 [ 1005.249625][T24580] dump_header+0x106/0x624 [ 1005.254185][T24580] oom_kill_process.cold+0x10/0x15 [ 1005.259328][T24580] out_of_memory+0x358/0x1460 [ 1005.264039][T24580] ? find_held_lock+0x2d/0x110 [ 1005.268845][T24580] ? oom_killer_disable+0x270/0x270 [ 1005.274071][T24580] ? find_held_lock+0x2d/0x110 [ 1005.278863][T24580] mem_cgroup_out_of_memory+0x206/0x270 [ 1005.284602][T24580] ? mem_cgroup_margin+0x130/0x130 [ 1005.289731][T24580] ? lock_downgrade+0x6e0/0x6e0 [ 1005.294617][T24580] try_charge_memcg+0xed2/0x1270 [ 1005.299569][T24580] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1005.305160][T24580] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1005.310898][T24580] ? lock_downgrade+0x6e0/0x6e0 [ 1005.315777][T24580] obj_cgroup_charge_pages+0x1e/0x90 [ 1005.321072][T24580] obj_cgroup_charge+0xf3/0x280 [ 1005.325930][T24580] ? sock_alloc_inode+0x18/0x1c0 [ 1005.330877][T24580] kmem_cache_alloc+0x92/0x3a0 [ 1005.335645][T24580] ? sock_free_inode+0x20/0x20 [ 1005.340413][T24580] sock_alloc_inode+0x18/0x1c0 [ 1005.345175][T24580] ? sock_free_inode+0x20/0x20 [ 1005.349954][T24580] alloc_inode+0x61/0x230 [ 1005.354296][T24580] new_inode_pseudo+0x14/0xe0 [ 1005.358974][T24580] sock_alloc+0x3c/0x260 [ 1005.363225][T24580] __sock_create+0xb9/0x790 [ 1005.367720][T24580] ? __context_tracking_exit+0xb8/0xe0 [ 1005.373180][T24580] ? lock_downgrade+0x6e0/0x6e0 [ 1005.378033][T24580] __sys_socket+0xef/0x200 [ 1005.382476][T24580] ? compat_sock_ioctl+0x6d0/0x6d0 [ 1005.387593][T24580] __x64_sys_socket+0x6f/0xb0 [ 1005.392264][T24580] ? syscall_enter_from_user_mode+0x21/0x70 [ 1005.398161][T24580] do_syscall_64+0x35/0xb0 [ 1005.402576][T24580] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1005.408473][T24580] RIP: 0033:0x7f67b6426e99 [ 1005.412883][T24580] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1005.432539][T24580] RSP: 002b:00007f67b4d18168 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1005.440965][T24580] RAX: ffffffffffffffda RBX: 00007f67b653a2a0 RCX: 00007f67b6426e99 [ 1005.448944][T24580] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 000000000000002c [ 1005.456918][T24580] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 1005.464891][T24580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1005.472882][T24580] R13: 00007f67b6a6db1f R14: 00007f67b4d18300 R15: 0000000000022000 [ 1005.480868][T24580] [ 1005.488299][T24574] device virt_wifi0 left promiscuous mode 18:17:55 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1005.526138][T24580] memory: usage 307200kB, limit 307200kB, failcnt 18271 [ 1005.536155][T24580] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1005.557985][T24580] Memory cgroup stats for /syz1: [ 1005.558226][T24580] anon 291028992 [ 1005.558226][T24580] file 155648 [ 1005.558226][T24580] kernel_stack 262144 [ 1005.558226][T24580] pagetables 9678848 [ 1005.558226][T24580] percpu 0 [ 1005.558226][T24580] sock 0 [ 1005.558226][T24580] shmem 155648 [ 1005.558226][T24580] file_mapped 155648 [ 1005.558226][T24580] file_dirty 0 [ 1005.558226][T24580] file_writeback 0 [ 1005.558226][T24580] swapcached 0 [ 1005.558226][T24580] anon_thp 232783872 [ 1005.558226][T24580] file_thp 0 [ 1005.558226][T24580] shmem_thp 0 [ 1005.558226][T24580] inactive_anon 291037184 [ 1005.558226][T24580] active_anon 147456 [ 1005.558226][T24580] inactive_file 0 [ 1005.558226][T24580] active_file 0 [ 1005.558226][T24580] unevictable 0 [ 1005.558226][T24580] slab_reclaimable 617392 [ 1005.558226][T24580] slab_unreclaimable 10578024 [ 1005.558226][T24580] slab 11195416 [ 1005.558226][T24580] workingset_refault_anon 0 [ 1005.558226][T24580] workingset_refault_file 0 [ 1005.558226][T24580] workingset_activate_anon 0 [ 1005.658096][T24580] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=24575,uid=0 18:17:55 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3f000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1005.674100][T24580] Memory cgroup out of memory: Killed process 24575 (syz-executor.1) total-vm:57332kB, anon-rss:2432kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:104kB oom_score_adj:1000 [ 1005.813495][ T28] oom_reaper: reaped process 24575 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:4kB 18:17:56 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x63340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:17:56 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:56 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32) r0 = syz_io_uring_complete(0x0) (async, rerun: 32) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async, rerun: 32) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (rerun: 32) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) open(&(0x7f0000000100)='./file0\x00', 0x141880, 0x1) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:17:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6d0c, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:56 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x40000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1006.025806][T24591] cgroup2: Unknown parameter '@[-}+' 18:17:56 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1006.167637][T24600] device macvtap2 entered promiscuous mode 18:17:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7400, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1006.238242][T24600] device virt_wifi0 entered promiscuous mode [ 1006.308595][T24600] team0: Device macvtap2 failed to register rx_handler 18:17:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1006.352964][T24600] device virt_wifi0 left promiscuous mode [ 1006.494057][T24606] cgroup2: Unknown parameter '@[-}+' 18:17:56 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x40020000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:56 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:56 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7902, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:17:56 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x64340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1006.812606][T24614] cgroup2: Unknown parameter '@[-}+' 18:17:57 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1007.634155][T24719] device macvtap2 entered promiscuous mode [ 1007.989970][T24719] device virt_wifi0 entered promiscuous mode 18:17:58 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x48000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1008.291412][T24719] team0: Device macvtap2 failed to register rx_handler [ 1008.577724][T24719] device virt_wifi0 left promiscuous mode [ 1010.027588][T24926] syz-executor.1: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 1010.936241][T24926] CPU: 1 PID: 24926 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1010.945060][T24926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1010.955134][T24926] Call Trace: [ 1010.958426][T24926] [ 1010.961364][T24926] dump_stack_lvl+0xcd/0x134 [ 1010.965981][T24926] warn_alloc.cold+0x87/0x17a [ 1010.970679][T24926] ? zone_watermark_ok_safe+0x290/0x290 [ 1010.976248][T24926] ? __kmalloc_node+0x62/0x390 [ 1010.981052][T24926] ? __vmalloc_node_range+0x571/0xab0 [ 1010.986450][T24926] __vmalloc_node_range+0x880/0xab0 [ 1010.991680][T24926] ? vfree_atomic+0xe0/0xe0 [ 1010.996208][T24926] ? rcu_read_lock_sched_held+0x3a/0x70 [ 1011.001780][T24926] ? kernel_clone+0xe7/0xab0 [ 1011.006400][T24926] copy_process+0x926/0x75a0 [ 1011.011006][T24926] ? kernel_clone+0xe7/0xab0 [ 1011.015616][T24926] ? find_held_lock+0x2d/0x110 [ 1011.020413][T24926] ? __cleanup_sighand+0xb0/0xb0 [ 1011.025373][T24926] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 1011.031663][T24926] ? _copy_from_user+0x5d/0x180 [ 1011.036535][T24926] ? kernel_clone+0x314/0xab0 [ 1011.041231][T24926] kernel_clone+0xe7/0xab0 [ 1011.045670][T24926] ? create_io_thread+0xf0/0xf0 [ 1011.050552][T24926] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1011.056573][T24926] __do_sys_clone3+0x1dd/0x2f0 [ 1011.061359][T24926] ? __do_sys_clone+0x110/0x110 [ 1011.066239][T24926] ? lock_downgrade+0x6e0/0x6e0 [ 1011.071117][T24926] ? lock_downgrade+0x6e0/0x6e0 [ 1011.076013][T24926] ? syscall_enter_from_user_mode+0x21/0x70 [ 1011.081933][T24926] do_syscall_64+0x35/0xb0 [ 1011.086363][T24926] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1011.092279][T24926] RIP: 0033:0x7f67b6426e99 [ 1011.096708][T24926] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1011.117800][T24926] RSP: 002b:00007f67b4d39168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 1011.126227][T24926] RAX: ffffffffffffffda RBX: 00007f67b653a1d0 RCX: 00007f67b6426e99 [ 1011.136128][T24926] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 1011.144127][T24926] RBP: 00007f67b6480ff1 R08: 0000000000000000 R09: 0000000000000000 [ 1011.152121][T24926] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1011.160115][T24926] R13: 00007f67b6a6db1f R14: 00007f67b4d39300 R15: 0000000000022000 [ 1011.168119][T24926] 18:18:01 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) sendmsg$inet(r0, &(0x7f00000006c0)={&(0x7f0000000100)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000400)="ca059c98e4ea0e07765c399daaf6fbc1b775b11caa3ae81035f85fed450bc5f3a19cc7788e89163e2e718bec4f18dfe8d6d663717bbe4cf9a3e561da0f2be02a2350d344c48296507443bb14bc77042107cd8f154afa27460a2f5dcd10a1c82830ed47c7e0cee36a98c0751d9556123536c6f1e12109b8345b610b2be020e7adc6d8e4aed93b626ab92ded4335273631743d5cd2c8fc6e672f4e7ae732", 0x9d}, {&(0x7f00000004c0)="47c7ff0d3b781df6ba28fd06cde659aa4309fba542b094ad769755d4e1a1c6bfa4e0b7cdba607a1172405b7d604104c9c6221946a60e8cd0103af6f5c8273527b3d4ccfebf414914d5350e9b142b9136ba60aa12598ef56c1178f2b474a3dcfd39e5fd1d315f989408946ba88ee951448e14715c48a94efec64468dbf027f62f93210ef73f062f07b6f60b579c80ff6c80365d6e4e26", 0x96}], 0x2, &(0x7f0000000600)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x2e}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3ff}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_u8={{0x11}}], 0x90}, 0x84010) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) 18:18:01 executing program 5: openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:01 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7a00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1013.773333][T25470] cgroup2: Unknown parameter '@[-}+' 18:18:04 executing program 5: openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:04 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7c03, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:04 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x65340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:04 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:04 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4a000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1014.528236][T25580] cgroup2: Unknown parameter '@[-}+' 18:18:04 executing program 5: openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1014.641796][T25587] device macvtap2 entered promiscuous mode 18:18:04 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8100, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1014.683180][T25587] device virt_wifi0 entered promiscuous mode [ 1014.746399][T25591] cgroup2: Unknown parameter '@[-}+' [ 1014.753171][T25587] team0: Device macvtap2 failed to register rx_handler [ 1014.789814][T25587] device virt_wifi0 left promiscuous mode [ 1014.884387][T25596] cgroup2: Unknown parameter '@[-}+' 18:18:05 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1015.089191][T25599] cgroup2: Unknown parameter '@[-}+' 18:18:05 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1015.147845][T24926] Mem-Info: [ 1015.156748][T24926] active_anon:650 inactive_anon:402802 isolated_anon:0 [ 1015.156748][T24926] active_file:7191 inactive_file:67248 isolated_file:0 [ 1015.156748][T24926] unevictable:768 dirty:0 writeback:0 [ 1015.156748][T24926] slab_reclaimable:18347 slab_unreclaimable:205633 [ 1015.156748][T24926] mapped:27777 shmem:2260 pagetables:32423 bounce:0 [ 1015.156748][T24926] kernel_misc_reclaimable:0 [ 1015.156748][T24926] free:832588 free_pcp:20094 free_cma:0 [ 1015.264427][T24926] Node 0 active_anon:2292kB inactive_anon:1527368kB active_file:28596kB inactive_file:238892kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:110808kB dirty:0kB writeback:0kB shmem:6112kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 1069056kB writeback_tmp:0kB kernel_stack:41552kB pagetables:79600kB all_unreclaimable? no [ 1015.397683][T24926] Node 1 active_anon:308kB inactive_anon:79604kB active_file:168kB inactive_file:30100kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:300kB dirty:0kB writeback:0kB shmem:2928kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:20420kB pagetables:49992kB all_unreclaimable? no [ 1015.444543][T25602] cgroup2: Unknown parameter '@[-}+' [ 1015.475059][T24926] Node 0 DMA free:10812kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:1308kB active_file:0kB inactive_file:456kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:228kB local_pcp:116kB free_cma:0kB [ 1015.509164][T24926] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 1015.522331][T24926] Node 0 DMA32 free:44328kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:2292kB inactive_anon:1525960kB active_file:28596kB inactive_file:238436kB unevictable:1536kB writepending:0kB present:3129332kB managed:2716748kB mlocked:0kB bounce:0kB free_pcp:40064kB local_pcp:22024kB free_cma:0kB [ 1015.553965][T24926] lowmem_reserve[]: 0 0 0 0 0 [ 1015.560784][T24926] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1015.592205][T24926] lowmem_reserve[]: 0 0 0 0 0 [ 1015.597316][T24926] Node 1 Normal free:3276028kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:312kB inactive_anon:79676kB active_file:168kB inactive_file:30100kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:46236kB local_pcp:12844kB free_cma:0kB [ 1015.629401][T24926] lowmem_reserve[]: 0 0 0 0 0 [ 1015.634532][T24926] Node 0 DMA: 9*4kB (UM) 5*8kB (U) 1*16kB (M) 13*32kB (U) 7*64kB (UM) 7*128kB (UM) 1*256kB (U) 1*512kB (U) 0*1024kB 2*2048kB (M) 1*4096kB (E) = 10812kB [ 1015.652553][T24926] Node 0 DMA32: 234*4kB (UME) 142*8kB (UME) 151*16kB (ME) 95*32kB (UME) 401*64kB (UME) 61*128kB (UME) 5*256kB (UE) 4*512kB (ME) 0*1024kB 0*2048kB 0*4096kB = 44328kB [ 1015.670132][T24926] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1015.682367][T24926] Node 1 Normal: 5365*4kB (UME) 3731*8kB (UME) 2011*16kB (UME) 987*32kB (UME) 142*64kB (UME) 14*128kB (UE) 5*256kB (UE) 2*512kB (ME) 2*1024kB (UE) 2*2048kB (ME) 767*4096kB (M) = 3276028kB [ 1015.706766][T24926] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1015.730203][T24926] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1015.749256][T24926] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1015.759037][T24926] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1015.769248][T24926] 9599 total pagecache pages [ 1015.773949][T24926] 0 pages in swap cache [ 1015.778211][T24926] Swap cache stats: add 0, delete 0, find 0/0 [ 1015.784276][T24926] Free swap = 0kB [ 1015.788175][T24926] Total swap = 0kB [ 1015.792775][T24926] 2097051 pages RAM [ 1015.796590][T24926] 0 pages HighMem/MovableOnly [ 1015.801372][T24926] 384519 pages reserved [ 1015.805531][T24926] 0 pages cma reserved 18:18:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) sendmsg$inet(r0, &(0x7f00000006c0)={&(0x7f0000000100)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000400)="ca059c98e4ea0e07765c399daaf6fbc1b775b11caa3ae81035f85fed450bc5f3a19cc7788e89163e2e718bec4f18dfe8d6d663717bbe4cf9a3e561da0f2be02a2350d344c48296507443bb14bc77042107cd8f154afa27460a2f5dcd10a1c82830ed47c7e0cee36a98c0751d9556123536c6f1e12109b8345b610b2be020e7adc6d8e4aed93b626ab92ded4335273631743d5cd2c8fc6e672f4e7ae732", 0x9d}, {&(0x7f00000004c0)="47c7ff0d3b781df6ba28fd06cde659aa4309fba542b094ad769755d4e1a1c6bfa4e0b7cdba607a1172405b7d604104c9c6221946a60e8cd0103af6f5c8273527b3d4ccfebf414914d5350e9b142b9136ba60aa12598ef56c1178f2b474a3dcfd39e5fd1d315f989408946ba88ee951448e14715c48a94efec64468dbf027f62f93210ef73f062f07b6f60b579c80ff6c80365d6e4e26", 0x96}], 0x2, &(0x7f0000000600)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x2e}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3ff}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_u8={{0x11}}], 0x90}, 0x84010) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) sendmsg$inet(r0, &(0x7f00000006c0)={&(0x7f0000000100)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000400)="ca059c98e4ea0e07765c399daaf6fbc1b775b11caa3ae81035f85fed450bc5f3a19cc7788e89163e2e718bec4f18dfe8d6d663717bbe4cf9a3e561da0f2be02a2350d344c48296507443bb14bc77042107cd8f154afa27460a2f5dcd10a1c82830ed47c7e0cee36a98c0751d9556123536c6f1e12109b8345b610b2be020e7adc6d8e4aed93b626ab92ded4335273631743d5cd2c8fc6e672f4e7ae732", 0x9d}, {&(0x7f00000004c0)="47c7ff0d3b781df6ba28fd06cde659aa4309fba542b094ad769755d4e1a1c6bfa4e0b7cdba607a1172405b7d604104c9c6221946a60e8cd0103af6f5c8273527b3d4ccfebf414914d5350e9b142b9136ba60aa12598ef56c1178f2b474a3dcfd39e5fd1d315f989408946ba88ee951448e14715c48a94efec64468dbf027f62f93210ef73f062f07b6f60b579c80ff6c80365d6e4e26", 0x96}], 0x2, &(0x7f0000000600)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x2e}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3ff}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_u8={{0x11}}], 0x90}, 0x84010) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r1, r2, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) (async) 18:18:06 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:06 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4c000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:06 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:06 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8103, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:06 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x65580000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1016.169036][T25608] device macvtap2 entered promiscuous mode [ 1016.185219][T25611] cgroup2: Unknown parameter '@[-}+' [ 1016.191256][T25608] device virt_wifi0 entered promiscuous mode 18:18:06 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1016.213273][T25608] team0: Device macvtap2 failed to register rx_handler [ 1016.223478][T25608] device virt_wifi0 left promiscuous mode [ 1016.338386][T25618] cgroup2: Unknown parameter '@[-}+' 18:18:06 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:06 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:06 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8402, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:06 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x66340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:06 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x60000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1016.635565][T25616] cgroup2: Unknown parameter '@[-}+' 18:18:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) sendmsg$inet(r0, &(0x7f00000006c0)={&(0x7f0000000100)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000400)="ca059c98e4ea0e07765c399daaf6fbc1b775b11caa3ae81035f85fed450bc5f3a19cc7788e89163e2e718bec4f18dfe8d6d663717bbe4cf9a3e561da0f2be02a2350d344c48296507443bb14bc77042107cd8f154afa27460a2f5dcd10a1c82830ed47c7e0cee36a98c0751d9556123536c6f1e12109b8345b610b2be020e7adc6d8e4aed93b626ab92ded4335273631743d5cd2c8fc6e672f4e7ae732", 0x9d}, {&(0x7f00000004c0)="47c7ff0d3b781df6ba28fd06cde659aa4309fba542b094ad769755d4e1a1c6bfa4e0b7cdba607a1172405b7d604104c9c6221946a60e8cd0103af6f5c8273527b3d4ccfebf414914d5350e9b142b9136ba60aa12598ef56c1178f2b474a3dcfd39e5fd1d315f989408946ba88ee951448e14715c48a94efec64468dbf027f62f93210ef73f062f07b6f60b579c80ff6c80365d6e4e26", 0x96}], 0x2, &(0x7f0000000600)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x2e}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3ff}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_u8={{0x11}}], 0x90}, 0x84010) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r1, r2, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) (async) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) [ 1016.703743][T25628] device macvtap2 entered promiscuous mode [ 1016.733481][T25628] device virt_wifi0 entered promiscuous mode 18:18:06 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:06 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9002, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1016.750699][T25629] cgroup2: Unknown parameter '@[-}+' [ 1016.771446][T25628] team0: Device macvtap2 failed to register rx_handler [ 1016.789499][T25628] device virt_wifi0 left promiscuous mode 18:18:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1016.910073][T25656] cgroup2: Unknown parameter '@[-}+' [ 1016.956719][T25662] cgroup2: Unknown parameter '@[-}+' 18:18:07 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x65580000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1017.013458][T25666] cgroup2: Unknown parameter '@[-}+' 18:18:07 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:07 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x67340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:07 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x990b, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:07 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:07 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x68000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1017.367190][T25672] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1017.377635][T25672] CPU: 1 PID: 25672 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 1017.386417][T25672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1017.396487][T25672] Call Trace: [ 1017.399778][T25672] [ 1017.402717][T25672] dump_stack_lvl+0xcd/0x134 [ 1017.407331][T25672] dump_header+0x106/0x624 [ 1017.411772][T25672] oom_kill_process.cold+0x10/0x15 [ 1017.416911][T25672] out_of_memory+0x358/0x1460 [ 1017.421617][T25672] ? find_held_lock+0x2d/0x110 [ 1017.426406][T25672] ? oom_killer_disable+0x270/0x270 [ 1017.431633][T25672] ? find_held_lock+0x2d/0x110 [ 1017.436514][T25672] mem_cgroup_out_of_memory+0x206/0x270 [ 1017.442081][T25672] ? mem_cgroup_margin+0x130/0x130 [ 1017.447227][T25672] ? lock_downgrade+0x6e0/0x6e0 [ 1017.452111][T25672] try_charge_memcg+0xed2/0x1270 [ 1017.457082][T25672] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1017.462655][T25672] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1017.468394][T25672] ? lock_downgrade+0x6e0/0x6e0 [ 1017.473271][T25672] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1017.479024][T25672] obj_cgroup_charge_pages+0x1e/0x90 [ 1017.484349][T25672] __memcg_kmem_charge_page+0x392/0x5f0 [ 1017.489927][T25672] copy_process+0x80a/0x75a0 [ 1017.494543][T25672] ? lock_chain_count+0x20/0x20 [ 1017.499421][T25672] ? lock_chain_count+0x20/0x20 [ 1017.504317][T25672] ? __cleanup_sighand+0xb0/0xb0 [ 1017.509286][T25672] ? __lock_acquire+0x1655/0x5470 18:18:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=0x0) write$cgroup_pid(r0, &(0x7f00000001c0)=r3, 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:07 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9b02, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:07 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1017.510292][T25676] device macvtap2 entered promiscuous mode [ 1017.514325][T25672] ? kernel_clone+0x314/0xab0 [ 1017.514360][T25672] kernel_clone+0xe7/0xab0 [ 1017.514389][T25672] ? create_io_thread+0xf0/0xf0 [ 1017.521622][T25676] device virt_wifi0 entered promiscuous mode [ 1017.524852][T25672] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1017.524889][T25672] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1017.524934][T25672] ? find_held_lock+0x2d/0x110 [ 1017.524965][T25672] __do_sys_clone+0xc8/0x110 [ 1017.537750][T25676] team0: Device macvtap2 failed to register rx_handler [ 1017.540149][T25672] ? kernel_clone+0xab0/0xab0 [ 1017.540179][T25672] ? lock_downgrade+0x6e0/0x6e0 [ 1017.540225][T25672] ? syscall_enter_from_user_mode+0x21/0x70 [ 1017.583818][T25672] do_syscall_64+0x35/0xb0 [ 1017.588249][T25672] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1017.594141][T25672] RIP: 0033:0x7f462bb432c1 [ 1017.598569][T25672] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1017.618274][T25672] RSP: 002b:00007f462c188a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1017.626708][T25672] RAX: ffffffffffffffda RBX: 00007f462a4b7700 RCX: 00007f462bb432c1 [ 1017.634782][T25672] RDX: 00007f462a4b79d0 RSI: 00007f462a4b72f0 RDI: 00000000003d0f00 [ 1017.642768][T25672] RBP: 00007f462c188cb0 R08: 00007f462a4b7700 R09: 00007f462a4b7700 [ 1017.650737][T25672] R10: 00007f462a4b79d0 R11: 0000000000000206 R12: 00007f462c188b1e [ 1017.658715][T25672] R13: 00007f462c188b1f R14: 00007f462a4b7300 R15: 0000000000022000 [ 1017.666817][T25672] [ 1017.676474][T25672] memory: usage 307200kB, limit 307200kB, failcnt 1887 [ 1017.683647][T25676] device virt_wifi0 left promiscuous mode [ 1017.723604][T25672] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1017.748850][T25672] Memory cgroup stats for /syz5: [ 1017.749837][T25672] anon 289710080 [ 1017.749837][T25672] file 90112 [ 1017.749837][T25672] kernel_stack 917504 [ 1017.749837][T25672] pagetables 9678848 [ 1017.749837][T25672] percpu 0 [ 1017.749837][T25672] sock 0 [ 1017.749837][T25672] shmem 90112 [ 1017.749837][T25672] file_mapped 90112 [ 1017.749837][T25672] file_dirty 0 [ 1017.749837][T25672] file_writeback 0 [ 1017.749837][T25672] swapcached 0 [ 1017.749837][T25672] anon_thp 222298112 [ 1017.749837][T25672] file_thp 0 [ 1017.749837][T25672] shmem_thp 0 [ 1017.749837][T25672] inactive_anon 289705984 [ 1017.749837][T25672] active_anon 86016 [ 1017.749837][T25672] inactive_file 0 [ 1017.749837][T25672] active_file 0 [ 1017.749837][T25672] unevictable 0 [ 1017.749837][T25672] slab_reclaimable 570312 [ 1017.749837][T25672] slab_unreclaimable 11212088 [ 1017.749837][T25672] slab 11782400 [ 1017.749837][T25672] workingset_refault_anon 0 [ 1017.749837][T25672] workingset_refault_file 0 [ 1017.749837][T25672] workingset_activate_anon 0 18:18:08 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa089, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:08 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1017.883526][T25672] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7038,uid=0 18:18:08 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6c000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:08 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x68000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1017.968001][T25672] Memory cgroup out of memory: Killed process 7038 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 [ 1018.151281][T25694] device macvtap2 entered promiscuous mode [ 1018.168981][T25696] cgroup2: Unknown parameter '@[-}+' 18:18:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:08 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa269, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:08 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1018.193866][T25694] device virt_wifi0 entered promiscuous mode [ 1018.243175][T25691] cgroup2: Unknown parameter '@[-}+' [ 1018.259710][T25694] team0: Device macvtap2 failed to register rx_handler [ 1018.278353][T25694] device virt_wifi0 left promiscuous mode [ 1018.331627][T25703] cgroup2: Unknown parameter '@[-}+' 18:18:08 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=0x0) write$cgroup_pid(r0, &(0x7f00000001c0)=r3, 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) (async) write$cgroup_pid(r0, &(0x7f00000001c0)=r3, 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:18:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:08 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6c0c0000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1018.442927][T25710] cgroup2: Unknown parameter '@[-}+' 18:18:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:08 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa302, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:08 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:08 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x68340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1018.630158][T25718] cgroup2: Unknown parameter '@[-}+' 18:18:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:08 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6d0c0000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1018.822683][T25726] cgroup2: Unknown parameter '@[-}+' 18:18:09 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa403, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1018.868497][T25731] cgroup2: Unknown parameter '@[-}+' [ 1018.880708][T25723] device macvtap2 entered promiscuous mode [ 1018.898264][T25723] device virt_wifi0 entered promiscuous mode 18:18:09 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:09 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1018.927729][T25723] team0: Device macvtap2 failed to register rx_handler [ 1018.986091][T25711] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1018.997080][T25711] CPU: 1 PID: 25711 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1019.005872][T25711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1019.015940][T25711] Call Trace: [ 1019.019234][T25711] [ 1019.022173][T25711] dump_stack_lvl+0xcd/0x134 [ 1019.026788][T25711] dump_header+0x106/0x624 [ 1019.031229][T25711] oom_kill_process.cold+0x10/0x15 [ 1019.036363][T25711] out_of_memory+0x358/0x1460 [ 1019.041075][T25711] ? find_held_lock+0x2d/0x110 [ 1019.045860][T25711] ? oom_killer_disable+0x270/0x270 [ 1019.051084][T25711] ? find_held_lock+0x2d/0x110 [ 1019.055872][T25711] mem_cgroup_out_of_memory+0x206/0x270 [ 1019.061438][T25711] ? mem_cgroup_margin+0x130/0x130 [ 1019.066560][T25711] ? lock_downgrade+0x6e0/0x6e0 [ 1019.071437][T25711] try_charge_memcg+0xed2/0x1270 [ 1019.076392][T25711] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1019.081943][T25711] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1019.087661][T25711] ? lock_downgrade+0x6e0/0x6e0 [ 1019.092514][T25711] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1019.098242][T25711] obj_cgroup_charge_pages+0x1e/0x90 [ 1019.103526][T25711] __memcg_kmem_charge_page+0x392/0x5f0 [ 1019.109075][T25711] copy_process+0x80a/0x75a0 [ 1019.113667][T25711] ? lock_chain_count+0x20/0x20 [ 1019.118513][T25711] ? lock_chain_count+0x20/0x20 [ 1019.123370][T25711] ? __cleanup_sighand+0xb0/0xb0 [ 1019.128316][T25711] ? __lock_acquire+0x1655/0x5470 [ 1019.133342][T25711] ? kernel_clone+0x314/0xab0 [ 1019.138018][T25711] kernel_clone+0xe7/0xab0 [ 1019.142435][T25711] ? create_io_thread+0xf0/0xf0 [ 1019.147279][T25711] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1019.153255][T25711] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1019.159244][T25711] ? find_held_lock+0x2d/0x110 [ 1019.164008][T25711] __do_sys_clone+0xc8/0x110 [ 1019.168592][T25711] ? kernel_clone+0xab0/0xab0 [ 1019.173261][T25711] ? lock_downgrade+0x6e0/0x6e0 [ 1019.178119][T25711] ? syscall_enter_from_user_mode+0x21/0x70 [ 1019.184017][T25711] do_syscall_64+0x35/0xb0 [ 1019.188428][T25711] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1019.194323][T25711] RIP: 0033:0x7f67b64282c1 [ 1019.198733][T25711] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1019.218339][T25711] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1019.226754][T25711] RAX: ffffffffffffffda RBX: 00007f67b4d39700 RCX: 00007f67b64282c1 [ 1019.234729][T25711] RDX: 00007f67b4d399d0 RSI: 00007f67b4d392f0 RDI: 00000000003d0f00 [ 1019.242692][T25711] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d39700 R09: 00007f67b4d39700 [ 1019.250657][T25711] R10: 00007f67b4d399d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 1019.258620][T25711] R13: 00007f67b6a6db1f R14: 00007f67b4d39300 R15: 0000000000022000 [ 1019.266602][T25711] [ 1019.271508][T25723] device virt_wifi0 left promiscuous mode [ 1019.294122][T25743] cgroup2: Unknown parameter '@[-}+' [ 1019.302468][T25711] memory: usage 307172kB, limit 307200kB, failcnt 18360 [ 1019.320819][T25711] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1019.329318][T25711] Memory cgroup stats for /syz1: [ 1019.329497][T25711] anon 291577856 [ 1019.329497][T25711] file 155648 [ 1019.329497][T25711] kernel_stack 229376 [ 1019.329497][T25711] pagetables 9834496 [ 1019.329497][T25711] percpu 0 [ 1019.329497][T25711] sock 0 [ 1019.329497][T25711] shmem 155648 [ 1019.329497][T25711] file_mapped 155648 [ 1019.329497][T25711] file_dirty 0 [ 1019.329497][T25711] file_writeback 0 [ 1019.329497][T25711] swapcached 0 [ 1019.329497][T25711] anon_thp 232783872 [ 1019.329497][T25711] file_thp 0 [ 1019.329497][T25711] shmem_thp 0 [ 1019.329497][T25711] inactive_anon 291586048 [ 1019.329497][T25711] active_anon 147456 [ 1019.329497][T25711] inactive_file 0 [ 1019.329497][T25711] active_file 0 [ 1019.329497][T25711] unevictable 0 [ 1019.329497][T25711] slab_reclaimable 572976 [ 1019.329497][T25711] slab_unreclaimable 9881464 [ 1019.329497][T25711] slab 10454440 [ 1019.329497][T25711] workingset_refault_anon 0 [ 1019.329497][T25711] workingset_refault_file 0 [ 1019.329497][T25711] workingset_activate_anon 0 [ 1019.436494][T25711] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25701,uid=0 [ 1019.452908][T25711] Memory cgroup out of memory: Killed process 25701 (syz-executor.1) total-vm:60776kB, anon-rss:2488kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 1019.474723][ T28] oom_reaper: reaped process 25701 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 1019.533252][T25731] cgroup2: Unknown parameter '@[-}+' 18:18:09 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=0x0) write$cgroup_pid(r0, &(0x7f00000001c0)=r3, 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async, rerun: 64) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async, rerun: 64) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:09 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:09 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x73d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:09 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xad00, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:09 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x69340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:09 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1019.710395][T25757] cgroup2: Unknown parameter '@[-}+' 18:18:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xae03, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1019.770874][T25759] device macvtap2 entered promiscuous mode [ 1019.805671][T25759] device virt_wifi0 entered promiscuous mode 18:18:10 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb020000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:10 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x74000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1019.826634][T25759] team0: Device macvtap2 failed to register rx_handler [ 1019.858571][T25761] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1019.871741][T25759] device virt_wifi0 left promiscuous mode [ 1019.893432][T25767] cgroup2: Unknown parameter '@[-}+' 18:18:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1019.923275][T25761] CPU: 0 PID: 25761 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1019.932117][T25761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1019.942189][T25761] Call Trace: [ 1019.945474][T25761] [ 1019.948400][T25761] dump_stack_lvl+0xcd/0x134 [ 1019.953017][T25761] dump_header+0x106/0x624 [ 1019.957458][T25761] oom_kill_process.cold+0x10/0x15 [ 1019.962590][T25761] out_of_memory+0x358/0x1460 [ 1019.967290][T25761] ? find_held_lock+0x2d/0x110 [ 1019.972059][T25761] ? oom_killer_disable+0x270/0x270 [ 1019.977286][T25761] ? find_held_lock+0x2d/0x110 [ 1019.982075][T25761] mem_cgroup_out_of_memory+0x206/0x270 [ 1019.987624][T25761] ? mem_cgroup_margin+0x130/0x130 [ 1019.992819][T25761] ? lock_downgrade+0x6e0/0x6e0 [ 1019.997693][T25761] try_charge_memcg+0xed2/0x1270 [ 1020.002648][T25761] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1020.008193][T25761] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1020.013911][T25761] ? lock_downgrade+0x6e0/0x6e0 [ 1020.018769][T25761] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1020.024499][T25761] obj_cgroup_charge_pages+0x1e/0x90 [ 1020.029785][T25761] __memcg_kmem_charge_page+0x392/0x5f0 [ 1020.035341][T25761] copy_process+0x80a/0x75a0 [ 1020.039931][T25761] ? lock_chain_count+0x20/0x20 [ 1020.044780][T25761] ? lock_chain_count+0x20/0x20 [ 1020.049641][T25761] ? __cleanup_sighand+0xb0/0xb0 [ 1020.054582][T25761] ? __lock_acquire+0x1655/0x5470 [ 1020.059608][T25761] ? kernel_clone+0x314/0xab0 [ 1020.064285][T25761] kernel_clone+0xe7/0xab0 [ 1020.068704][T25761] ? create_io_thread+0xf0/0xf0 [ 1020.073550][T25761] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1020.079617][T25761] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1020.085608][T25761] ? find_held_lock+0x2d/0x110 [ 1020.090374][T25761] __do_sys_clone+0xc8/0x110 [ 1020.094961][T25761] ? kernel_clone+0xab0/0xab0 [ 1020.099633][T25761] ? lock_downgrade+0x6e0/0x6e0 [ 1020.104581][T25761] ? syscall_enter_from_user_mode+0x21/0x70 [ 1020.110485][T25761] do_syscall_64+0x35/0xb0 [ 1020.114900][T25761] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1020.120794][T25761] RIP: 0033:0x7f67b64282c1 [ 1020.125204][T25761] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1020.144809][T25761] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1020.153219][T25761] RAX: ffffffffffffffda RBX: 00007f67b4d39700 RCX: 00007f67b64282c1 [ 1020.161188][T25761] RDX: 00007f67b4d399d0 RSI: 00007f67b4d392f0 RDI: 00000000003d0f00 [ 1020.169162][T25761] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d39700 R09: 00007f67b4d39700 [ 1020.177131][T25761] R10: 00007f67b4d399d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 1020.185107][T25761] R13: 00007f67b6a6db1f R14: 00007f67b4d39300 R15: 0000000000022000 [ 1020.193106][T25761] [ 1020.218601][T25761] memory: usage 307200kB, limit 307200kB, failcnt 18429 [ 1020.225907][T25761] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1020.242103][T25761] Memory cgroup stats for /syz1: [ 1020.242311][T25761] anon 291553280 [ 1020.242311][T25761] file 155648 [ 1020.242311][T25761] kernel_stack 229376 [ 1020.242311][T25761] pagetables 9834496 [ 1020.242311][T25761] percpu 0 [ 1020.242311][T25761] sock 0 [ 1020.242311][T25761] shmem 155648 [ 1020.242311][T25761] file_mapped 155648 [ 1020.242311][T25761] file_dirty 0 [ 1020.242311][T25761] file_writeback 0 [ 1020.242311][T25761] swapcached 0 [ 1020.242311][T25761] anon_thp 232783872 [ 1020.242311][T25761] file_thp 0 [ 1020.242311][T25761] shmem_thp 0 [ 1020.242311][T25761] inactive_anon 291561472 [ 1020.242311][T25761] active_anon 147456 [ 1020.242311][T25761] inactive_file 0 [ 1020.242311][T25761] active_file 0 [ 1020.242311][T25761] unevictable 0 [ 1020.242311][T25761] slab_reclaimable 575672 18:18:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb001, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1020.242311][T25761] slab_unreclaimable 9959248 [ 1020.242311][T25761] slab 10534920 [ 1020.242311][T25761] workingset_refault_anon 0 [ 1020.242311][T25761] workingset_refault_file 0 [ 1020.242311][T25761] workingset_activate_anon 0 [ 1020.386360][T25761] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25748,uid=0 [ 1020.458554][T25761] Memory cgroup out of memory: Killed process 25748 (syz-executor.1) total-vm:57200kB, anon-rss:2468kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 1020.646406][T25776] cgroup2: Unknown parameter '@[-}+' 18:18:10 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x2}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f6465766d7030000000009e35b613242ebfb0b95d97d1b0109dbc5070c474d06d5bab8d0800000078967daf9791e178b56f0750d82bd0dcf88710b2e937dd5d4d4609576d50598ce5c7b8d088096a6ce62990e72b5dd27e81cfc355c42879e6eb62cbff95f720bb12add427589c80a757e7e36053fa021501ca5fa0dd01e38cc3ab741304d0ebc201c2ce09dc793ce3926f7401aa4e34203437a144406ce5b9b60843c733d9e1dd334ef126561792dfd6a52d48cfcd2f8151a4cf85"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00', 0xffff8000}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:10 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:10 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x74d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:10 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6a340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:10 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb802, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:11 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x75d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:11 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc801, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1020.921347][T25792] device macvtap2 entered promiscuous mode [ 1020.928243][T25792] device virt_wifi0 entered promiscuous mode [ 1020.935419][T25792] team0: Device macvtap2 failed to register rx_handler [ 1020.953512][T25792] device virt_wifi0 left promiscuous mode [ 1021.135868][T25791] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1021.156736][T25791] CPU: 1 PID: 25791 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1021.165544][T25791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1021.171879][T25800] cgroup2: Unknown parameter '@[-}+' [ 1021.175616][T25791] Call Trace: 18:18:11 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x76d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:11 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xd103, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1021.175629][T25791] [ 1021.175638][T25791] dump_stack_lvl+0xcd/0x134 [ 1021.191798][T25791] dump_header+0x106/0x624 [ 1021.196234][T25791] oom_kill_process.cold+0x10/0x15 [ 1021.201375][T25791] out_of_memory+0x358/0x1460 [ 1021.206083][T25791] ? find_held_lock+0x2d/0x110 [ 1021.210869][T25791] ? oom_killer_disable+0x270/0x270 [ 1021.216083][T25791] ? find_held_lock+0x2d/0x110 [ 1021.220884][T25791] mem_cgroup_out_of_memory+0x206/0x270 [ 1021.226456][T25791] ? mem_cgroup_margin+0x130/0x130 [ 1021.231591][T25791] ? lock_downgrade+0x6e0/0x6e0 [ 1021.236483][T25791] try_charge_memcg+0xed2/0x1270 [ 1021.241459][T25791] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1021.247026][T25791] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1021.252768][T25791] ? lock_downgrade+0x6e0/0x6e0 [ 1021.257643][T25791] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1021.263490][T25791] obj_cgroup_charge_pages+0x1e/0x90 [ 1021.268797][T25791] __memcg_kmem_charge_page+0x392/0x5f0 [ 1021.274372][T25791] copy_process+0x80a/0x75a0 [ 1021.278981][T25791] ? lock_chain_count+0x20/0x20 18:18:11 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x77d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1021.283848][T25791] ? lock_chain_count+0x20/0x20 [ 1021.288819][T25791] ? __cleanup_sighand+0xb0/0xb0 [ 1021.293790][T25791] ? __lock_acquire+0x1655/0x5470 [ 1021.298841][T25791] ? kernel_clone+0x314/0xab0 [ 1021.303536][T25791] kernel_clone+0xe7/0xab0 [ 1021.307974][T25791] ? create_io_thread+0xf0/0xf0 [ 1021.312840][T25791] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1021.318845][T25791] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1021.324862][T25791] ? find_held_lock+0x2d/0x110 [ 1021.329669][T25791] __do_sys_clone+0xc8/0x110 18:18:11 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xd703, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1021.334278][T25791] ? kernel_clone+0xab0/0xab0 [ 1021.338970][T25791] ? lock_downgrade+0x6e0/0x6e0 [ 1021.343859][T25791] ? syscall_enter_from_user_mode+0x21/0x70 [ 1021.349784][T25791] do_syscall_64+0x35/0xb0 [ 1021.354218][T25791] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1021.360235][T25791] RIP: 0033:0x7f67b64282c1 [ 1021.364841][T25791] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1021.384485][T25791] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1021.393016][T25791] RAX: ffffffffffffffda RBX: 00007f67b4d7b700 RCX: 00007f67b64282c1 [ 1021.401092][T25791] RDX: 00007f67b4d7b9d0 RSI: 00007f67b4d7b2f0 RDI: 00000000003d0f00 [ 1021.409079][T25791] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d7b700 R09: 00007f67b4d7b700 [ 1021.417071][T25791] R10: 00007f67b4d7b9d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 1021.425059][T25791] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 1021.433068][T25791] [ 1021.443601][T25791] memory: usage 307200kB, limit 307200kB, failcnt 18512 [ 1021.455594][T25791] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1021.462910][T25791] Memory cgroup stats for /syz1: [ 1021.463141][T25791] anon 291610624 [ 1021.463141][T25791] file 155648 [ 1021.463141][T25791] kernel_stack 163840 [ 1021.463141][T25791] pagetables 9834496 [ 1021.463141][T25791] percpu 0 [ 1021.463141][T25791] sock 0 [ 1021.463141][T25791] shmem 155648 [ 1021.463141][T25791] file_mapped 155648 [ 1021.463141][T25791] file_dirty 0 [ 1021.463141][T25791] file_writeback 0 [ 1021.463141][T25791] swapcached 0 [ 1021.463141][T25791] anon_thp 232783872 [ 1021.463141][T25791] file_thp 0 [ 1021.463141][T25791] shmem_thp 0 [ 1021.463141][T25791] inactive_anon 291618816 [ 1021.463141][T25791] active_anon 147456 [ 1021.463141][T25791] inactive_file 0 [ 1021.463141][T25791] active_file 0 [ 1021.463141][T25791] unevictable 0 [ 1021.463141][T25791] slab_reclaimable 574904 [ 1021.463141][T25791] slab_unreclaimable 9901576 [ 1021.463141][T25791] slab 10476480 [ 1021.463141][T25791] workingset_refault_anon 0 [ 1021.463141][T25791] workingset_refault_file 0 [ 1021.463141][T25791] workingset_activate_anon 0 [ 1021.575516][T25791] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25782,uid=0 18:18:11 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) 18:18:11 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:11 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x78d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:11 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6b340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:11 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x2}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async, rerun: 64) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (rerun: 64) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) (async) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f6465766d7030000000009e35b613242ebfb0b95d97d1b0109dbc5070c474d06d5bab8d0800000078967daf9791e178b56f0750d82bd0dcf88710b2e937dd5d4d4609576d50598ce5c7b8d088096a6ce62990e72b5dd27e81cfc355c42879e6eb62cbff95f720bb12add427589c80a757e7e36053fa021501ca5fa0dd01e38cc3ab741304d0ebc201c2ce09dc793ce3926f7401aa4e34203437a144406ce5b9b60843c733d9e1dd334ef126561792dfd6a52d48cfcd2f8151a4cf85"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00', 0xffff8000}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:11 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe003, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1021.591600][T25791] Memory cgroup out of memory: Killed process 25782 (syz-executor.1) total-vm:57200kB, anon-rss:2464kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 1021.612246][ T28] oom_reaper: reaped process 25782 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:0kB [ 1021.620994][T25794] cgroup2: Unknown parameter '@[-}+' 18:18:12 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x79020000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1021.836569][T25820] device macvtap2 entered promiscuous mode [ 1021.853848][T25820] device virt_wifi0 entered promiscuous mode [ 1021.871656][T25823] cgroup2: Unknown parameter '@[-}+' [ 1021.903889][T25820] team0: Device macvtap2 failed to register rx_handler 18:18:12 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x2}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f6465766d7030000000009e35b613242ebfb0b95d97d1b0109dbc5070c474d06d5bab8d0800000078967daf9791e178b56f0750d82bd0dcf88710b2e937dd5d4d4609576d50598ce5c7b8d088096a6ce62990e72b5dd27e81cfc355c42879e6eb62cbff95f720bb12add427589c80a757e7e36053fa021501ca5fa0dd01e38cc3ab741304d0ebc201c2ce09dc793ce3926f7401aa4e34203437a144406ce5b9b60843c733d9e1dd334ef126561792dfd6a52d48cfcd2f8151a4cf85"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00', 0xffff8000}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x2}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f6465766d7030000000009e35b613242ebfb0b95d97d1b0109dbc5070c474d06d5bab8d0800000078967daf9791e178b56f0750d82bd0dcf88710b2e937dd5d4d4609576d50598ce5c7b8d088096a6ce62990e72b5dd27e81cfc355c42879e6eb62cbff95f720bb12add427589c80a757e7e36053fa021501ca5fa0dd01e38cc3ab741304d0ebc201c2ce09dc793ce3926f7401aa4e34203437a144406ce5b9b60843c733d9e1dd334ef126561792dfd6a52d48cfcd2f8151a4cf85"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00', 0xffff8000}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) [ 1021.953022][T25820] device virt_wifi0 left promiscuous mode 18:18:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) [ 1022.030037][T25830] cgroup2: Unknown parameter '@[-}+' [ 1022.116579][T25835] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1022.134887][T25835] CPU: 0 PID: 25835 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1022.143689][T25835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1022.153754][T25835] Call Trace: [ 1022.157042][T25835] [ 1022.159985][T25835] dump_stack_lvl+0xcd/0x134 [ 1022.164596][T25835] dump_header+0x106/0x624 [ 1022.169032][T25835] oom_kill_process.cold+0x10/0x15 [ 1022.174169][T25835] out_of_memory+0x358/0x1460 [ 1022.178876][T25835] ? find_held_lock+0x2d/0x110 [ 1022.183665][T25835] ? oom_killer_disable+0x270/0x270 [ 1022.188892][T25835] ? find_held_lock+0x2d/0x110 [ 1022.193679][T25835] mem_cgroup_out_of_memory+0x206/0x270 [ 1022.199243][T25835] ? mem_cgroup_margin+0x130/0x130 [ 1022.204370][T25835] ? lock_downgrade+0x6e0/0x6e0 [ 1022.209258][T25835] try_charge_memcg+0xed2/0x1270 [ 1022.214219][T25835] ? find_held_lock+0x2d/0x110 [ 1022.219004][T25835] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1022.224569][T25835] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 1022.230131][T25835] ? lock_downgrade+0x6e0/0x6e0 [ 1022.235017][T25835] charge_memcg+0xae/0x360 [ 1022.239457][T25835] __mem_cgroup_charge+0x27/0x90 [ 1022.244415][T25835] wp_page_copy+0x294/0x2280 [ 1022.249035][T25835] ? do_page_mkwrite+0x550/0x550 [ 1022.253990][T25835] ? lock_downgrade+0x6e0/0x6e0 [ 1022.258852][T25835] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 1022.264588][T25835] ? vm_normal_page+0x146/0x2a0 [ 1022.269472][T25835] do_wp_page+0x2cb/0x1ae0 [ 1022.273913][T25835] __handle_mm_fault+0x1f41/0x5120 [ 1022.279051][T25835] ? vm_iomap_memory+0x190/0x190 [ 1022.284042][T25835] handle_mm_fault+0x1c8/0x790 [ 1022.288837][T25835] do_user_addr_fault+0x489/0x11c0 [ 1022.294170][T25835] exc_page_fault+0x9e/0x180 [ 1022.298777][T25835] ? asm_exc_page_fault+0x8/0x30 [ 1022.303734][T25835] asm_exc_page_fault+0x1e/0x30 [ 1022.308603][T25835] RIP: 0033:0x7f67b63d2055 [ 1022.313029][T25835] Code: 0c 48 89 df 41 83 c6 01 e8 18 f7 ff ff 48 83 c3 20 49 39 df 75 df 44 89 75 00 8b 05 b5 3f 16 00 48 8b 15 66 13 0a 01 83 c0 01 <89> 05 a5 3f 16 00 89 02 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f [ 1022.332658][T25835] RSP: 002b:00007f67b6a6db10 EFLAGS: 00010202 [ 1022.338740][T25835] RAX: 0000000000000001 RBX: 00007f67b6539f60 RCX: 0000001b2e320000 [ 1022.346724][T25835] RDX: 0000001b2e320000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1022.354705][T25835] RBP: 0000001b2e32001c R08: 0000001b2e360000 R09: 0000000000000000 18:18:12 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xeb03, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1022.362783][T25835] R10: 00007f67b6a6dc80 R11: 0000000000000246 R12: 00007f67b6539f60 [ 1022.370761][T25835] R13: 0000001b2e320014 R14: 0000001b2e320018 R15: 0000000000000032 [ 1022.378765][T25835] 18:18:12 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6c000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:12 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xd050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:12 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x79d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1022.428281][T25835] memory: usage 307200kB, limit 307200kB, failcnt 18570 [ 1022.435305][T25835] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1022.465092][T25841] cgroup2: Unknown parameter '@[-}+' 18:18:12 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1022.500362][T25835] Memory cgroup stats for /syz1: [ 1022.502347][T25835] anon 291692544 [ 1022.502347][T25835] file 155648 [ 1022.502347][T25835] kernel_stack 131072 [ 1022.502347][T25835] pagetables 9752576 [ 1022.502347][T25835] percpu 0 [ 1022.502347][T25835] sock 0 [ 1022.502347][T25835] shmem 155648 [ 1022.502347][T25835] file_mapped 155648 [ 1022.502347][T25835] file_dirty 0 [ 1022.502347][T25835] file_writeback 0 [ 1022.502347][T25835] swapcached 0 [ 1022.502347][T25835] anon_thp 232783872 [ 1022.502347][T25835] file_thp 0 [ 1022.502347][T25835] shmem_thp 0 [ 1022.502347][T25835] inactive_anon 291700736 [ 1022.502347][T25835] active_anon 147456 [ 1022.502347][T25835] inactive_file 0 [ 1022.502347][T25835] active_file 0 [ 1022.502347][T25835] unevictable 0 [ 1022.502347][T25835] slab_reclaimable 586896 [ 1022.502347][T25835] slab_unreclaimable 10013248 [ 1022.502347][T25835] slab 10600144 [ 1022.502347][T25835] workingset_refault_anon 0 [ 1022.502347][T25835] workingset_refault_file 0 [ 1022.502347][T25835] workingset_activate_anon 0 18:18:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, 0x0) [ 1022.595505][T25847] device macvtap2 entered promiscuous mode [ 1022.615969][T25847] device virt_wifi0 entered promiscuous mode [ 1022.634647][T25847] team0: Device macvtap2 failed to register rx_handler [ 1022.650452][T25847] device virt_wifi0 left promiscuous mode [ 1022.655793][T25835] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25733,uid=0 [ 1022.682777][T25835] Memory cgroup out of memory: Killed process 25733 (syz-executor.1) total-vm:56804kB, anon-rss:2452kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 18:18:13 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1022.812702][T25857] cgroup2: Unknown parameter '@[-}+' [ 1022.830354][T25836] cgroup2: Unknown parameter '@[-}+' 18:18:13 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7a000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:13 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r0}, 0x8) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x2000000, 0x0, 0x0, 0x0, {0x14}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdc7}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) 18:18:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xfc03, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:13 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6c0c0000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:13 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1023.132755][T25884] device macvtap2 entered promiscuous mode 18:18:13 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7ad90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1023.184442][T25884] device virt_wifi0 entered promiscuous mode [ 1023.206160][T25878] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1023.231666][T25884] team0: Device macvtap2 failed to register rx_handler [ 1023.255820][T25878] CPU: 1 PID: 25878 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1023.264632][T25878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1023.274705][T25878] Call Trace: [ 1023.277991][T25878] [ 1023.280931][T25878] dump_stack_lvl+0xcd/0x134 [ 1023.285540][T25878] dump_header+0x106/0x624 [ 1023.289955][T25878] oom_kill_process.cold+0x10/0x15 [ 1023.295061][T25878] out_of_memory+0x358/0x1460 [ 1023.299750][T25878] ? find_held_lock+0x2d/0x110 [ 1023.304527][T25878] ? oom_killer_disable+0x270/0x270 [ 1023.309721][T25878] ? find_held_lock+0x2d/0x110 [ 1023.314478][T25878] mem_cgroup_out_of_memory+0x206/0x270 [ 1023.320018][T25878] ? mem_cgroup_margin+0x130/0x130 [ 1023.325121][T25878] ? lock_downgrade+0x6e0/0x6e0 [ 1023.329971][T25878] try_charge_memcg+0xed2/0x1270 [ 1023.334911][T25878] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1023.340452][T25878] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1023.346163][T25878] ? lock_downgrade+0x6e0/0x6e0 [ 1023.351002][T25878] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1023.356733][T25878] obj_cgroup_charge_pages+0x1e/0x90 [ 1023.362032][T25878] __memcg_kmem_charge_page+0x392/0x5f0 [ 1023.367571][T25878] copy_process+0x80a/0x75a0 [ 1023.372163][T25878] ? lock_chain_count+0x20/0x20 [ 1023.377027][T25878] ? lock_chain_count+0x20/0x20 [ 1023.381875][T25878] ? __cleanup_sighand+0xb0/0xb0 [ 1023.386809][T25878] ? lock_downgrade+0x6e0/0x6e0 [ 1023.391678][T25878] ? __lock_acquire+0x1655/0x5470 [ 1023.396697][T25878] ? kernel_clone+0x314/0xab0 [ 1023.401383][T25878] kernel_clone+0xe7/0xab0 [ 1023.405815][T25878] ? create_io_thread+0xf0/0xf0 [ 1023.410664][T25878] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1023.416637][T25878] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1023.422627][T25878] ? find_held_lock+0x2d/0x110 [ 1023.427412][T25878] __do_sys_clone+0xc8/0x110 [ 1023.432011][T25878] ? kernel_clone+0xab0/0xab0 [ 1023.436678][T25878] ? lock_downgrade+0x6e0/0x6e0 [ 1023.441545][T25878] ? syscall_enter_from_user_mode+0x21/0x70 [ 1023.447450][T25878] do_syscall_64+0x35/0xb0 [ 1023.451882][T25878] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1023.457778][T25878] RIP: 0033:0x7f67b64282c1 [ 1023.462195][T25878] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1023.481812][T25878] RSP: 002b:00007f67b6a6da68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1023.490218][T25878] RAX: ffffffffffffffda RBX: 00007f67b4d7b700 RCX: 00007f67b64282c1 [ 1023.498187][T25878] RDX: 00007f67b4d7b9d0 RSI: 00007f67b4d7b2f0 RDI: 00000000003d0f00 18:18:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x0, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1023.506171][T25878] RBP: 00007f67b6a6dcb0 R08: 00007f67b4d7b700 R09: 00007f67b4d7b700 [ 1023.514130][T25878] R10: 00007f67b4d7b9d0 R11: 0000000000000206 R12: 00007f67b6a6db1e [ 1023.522101][T25878] R13: 00007f67b6a6db1f R14: 00007f67b4d7b300 R15: 0000000000022000 [ 1023.530072][T25878] [ 1023.534823][T25884] device virt_wifi0 left promiscuous mode [ 1023.561806][T25878] memory: usage 307200kB, limit 307200kB, failcnt 18604 [ 1023.599033][T25878] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1023.640388][T25878] Memory cgroup stats for /syz1: [ 1023.640580][T25878] anon 291741696 [ 1023.640580][T25878] file 155648 [ 1023.640580][T25878] kernel_stack 98304 [ 1023.640580][T25878] pagetables 9670656 [ 1023.640580][T25878] percpu 0 [ 1023.640580][T25878] sock 0 [ 1023.640580][T25878] shmem 155648 [ 1023.640580][T25878] file_mapped 155648 [ 1023.640580][T25878] file_dirty 0 [ 1023.640580][T25878] file_writeback 0 [ 1023.640580][T25878] swapcached 0 [ 1023.640580][T25878] anon_thp 232783872 [ 1023.640580][T25878] file_thp 0 18:18:13 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7bd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:13 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xfeff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:13 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1023.640580][T25878] shmem_thp 0 [ 1023.640580][T25878] inactive_anon 291749888 [ 1023.640580][T25878] active_anon 147456 [ 1023.640580][T25878] inactive_file 0 [ 1023.640580][T25878] active_file 0 [ 1023.640580][T25878] unevictable 0 [ 1023.640580][T25878] slab_reclaimable 601584 [ 1023.640580][T25878] slab_unreclaimable 10065936 [ 1023.640580][T25878] slab 10667520 [ 1023.640580][T25878] workingset_refault_anon 0 [ 1023.640580][T25878] workingset_refault_file 0 [ 1023.640580][T25878] workingset_activate_anon 0 18:18:14 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6c340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:14 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7c030000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1023.790113][T25893] cgroup2: Unknown parameter '@[-}+' 18:18:14 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xff0f, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1023.882655][T25904] device macvtap2 entered promiscuous mode [ 1023.901747][T25904] device virt_wifi0 entered promiscuous mode [ 1023.923937][T25878] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25878,uid=0 [ 1023.941796][T25904] team0: Device macvtap2 failed to register rx_handler 18:18:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r1 = syz_io_uring_complete(0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r0}, 0x8) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x2000000, 0x0, 0x0, 0x0, {0x14}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdc7}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) 18:18:14 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:14 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x0, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1023.969353][T25878] Memory cgroup out of memory: Killed process 25878 (syz-executor.1) total-vm:60776kB, anon-rss:2432kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:104kB oom_score_adj:1000 [ 1023.988077][T25904] device virt_wifi0 left promiscuous mode [ 1024.014455][ T28] oom_reaper: reaped process 25878 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:8kB 18:18:14 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7cd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:14 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xff7f, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1024.205222][T25915] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 18:18:14 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x10000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:14 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6d0c0000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1024.284246][T25915] CPU: 1 PID: 25915 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1024.293065][T25915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1024.303134][T25915] Call Trace: [ 1024.306418][T25915] [ 1024.309362][T25915] dump_stack_lvl+0xcd/0x134 [ 1024.313981][T25915] dump_header+0x106/0x624 [ 1024.318422][T25915] oom_kill_process.cold+0x10/0x15 [ 1024.323558][T25915] out_of_memory+0x358/0x1460 [ 1024.328260][T25915] ? find_held_lock+0x2d/0x110 [ 1024.333040][T25915] ? oom_killer_disable+0x270/0x270 [ 1024.338262][T25915] ? find_held_lock+0x2d/0x110 [ 1024.343054][T25915] mem_cgroup_out_of_memory+0x206/0x270 [ 1024.348629][T25915] ? mem_cgroup_margin+0x130/0x130 [ 1024.353756][T25915] ? lock_downgrade+0x6e0/0x6e0 [ 1024.358645][T25915] try_charge_memcg+0xed2/0x1270 [ 1024.363609][T25915] ? find_held_lock+0x2d/0x110 [ 1024.368390][T25915] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1024.373963][T25915] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 1024.379531][T25915] ? lock_downgrade+0x6e0/0x6e0 [ 1024.384423][T25915] charge_memcg+0xae/0x360 [ 1024.388858][T25915] __mem_cgroup_charge+0x27/0x90 [ 1024.393818][T25915] wp_page_copy+0x294/0x2280 [ 1024.398436][T25915] ? do_page_mkwrite+0x550/0x550 [ 1024.403564][T25915] ? lock_downgrade+0x6e0/0x6e0 [ 1024.408430][T25915] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 1024.414168][T25915] ? vm_normal_page+0x146/0x2a0 [ 1024.419053][T25915] do_wp_page+0x2cb/0x1ae0 [ 1024.423493][T25915] __handle_mm_fault+0x1f41/0x5120 [ 1024.428657][T25915] ? vm_iomap_memory+0x190/0x190 [ 1024.433640][T25915] handle_mm_fault+0x1c8/0x790 [ 1024.438427][T25915] do_user_addr_fault+0x489/0x11c0 [ 1024.442746][T25916] cgroup2: Unknown parameter '@[-}+' [ 1024.443562][T25915] exc_page_fault+0x9e/0x180 [ 1024.443595][T25915] ? asm_exc_page_fault+0x8/0x30 [ 1024.458382][T25915] asm_exc_page_fault+0x1e/0x30 [ 1024.463257][T25915] RIP: 0033:0x7f67b63cdd2c [ 1024.467685][T25915] Code: da 5a ff ff 41 39 5c 24 2c 7f d3 31 c0 48 8d 3d 1f 22 0b 00 e8 c5 5a ff ff 48 8b 44 24 08 c7 44 24 1c ff ff ff ff 44 8b 60 78 80 c8 00 00 00 00 45 85 e4 0f 8e 83 00 00 00 48 8b 44 24 08 8b [ 1024.487316][T25915] RSP: 002b:00007f67b4d9c190 EFLAGS: 00010202 [ 1024.493404][T25915] RAX: 00007f67b6539f60 RBX: 0000000000000005 RCX: 00007f67b648b0e8 [ 1024.501393][T25915] RDX: 00000000000d6588 RSI: 0000000000000000 RDI: 00007f67b647ff35 [ 1024.509389][T25915] RBP: 00007f67b6480ff1 R08: 0000000000000400 R09: 00007ffef6d2f080 [ 1024.517381][T25915] R10: 00007ffef6d2f090 R11: 000000000002f3a0 R12: 0000000000000000 [ 1024.525368][T25915] R13: 00007f67b6a6db1f R14: 00007f67b4d9c300 R15: 0000000000022000 [ 1024.533369][T25915] 18:18:14 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7dd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1024.621095][T25915] memory: usage 307200kB, limit 307200kB, failcnt 18650 18:18:14 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xfffe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1024.678611][T25915] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1024.705287][T25925] device macvtap2 entered promiscuous mode [ 1024.731228][T25925] device virt_wifi0 entered promiscuous mode [ 1024.745383][T25915] Memory cgroup stats for /syz1: [ 1024.745620][T25915] anon 291688448 [ 1024.745620][T25915] file 155648 [ 1024.745620][T25915] kernel_stack 98304 [ 1024.745620][T25915] pagetables 9670656 [ 1024.745620][T25915] percpu 0 [ 1024.745620][T25915] sock 0 [ 1024.745620][T25915] shmem 155648 [ 1024.745620][T25915] file_mapped 155648 [ 1024.745620][T25915] file_dirty 0 [ 1024.745620][T25915] file_writeback 0 [ 1024.745620][T25915] swapcached 0 [ 1024.745620][T25915] anon_thp 232783872 [ 1024.745620][T25915] file_thp 0 [ 1024.745620][T25915] shmem_thp 0 [ 1024.745620][T25915] inactive_anon 291696640 [ 1024.745620][T25915] active_anon 147456 [ 1024.745620][T25915] inactive_file 0 [ 1024.745620][T25915] active_file 0 [ 1024.745620][T25915] unevictable 0 [ 1024.745620][T25915] slab_reclaimable 614736 [ 1024.745620][T25915] slab_unreclaimable 10104688 [ 1024.745620][T25915] slab 10719424 [ 1024.745620][T25915] workingset_refault_anon 0 18:18:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x0, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1024.745620][T25915] workingset_refault_file 0 [ 1024.745620][T25915] workingset_activate_anon 0 [ 1024.814466][T25925] team0: Device macvtap2 failed to register rx_handler [ 1024.864093][T25925] device virt_wifi0 left promiscuous mode 18:18:15 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x10050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1024.870274][T25915] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25914,uid=0 [ 1024.940986][T25915] Memory cgroup out of memory: Killed process 25914 (syz-executor.1) total-vm:56804kB, anon-rss:2432kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:104kB oom_score_adj:1000 [ 1024.980232][ T28] oom_reaper: reaped process 25914 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:4kB 18:18:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r0 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r1 = syz_io_uring_complete(0x0) (async) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r1, r2, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r0}, 0x8) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) (async) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x2000000, 0x0, 0x0, 0x0, {0x14}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdc7}, 0x58) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, 0x0) 18:18:15 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7ed90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:15 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x11050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:15 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6d340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:15 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310eb, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:15 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7fd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1025.255916][T25938] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1025.290251][T25938] CPU: 1 PID: 25938 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1025.292587][T25943] device macvtap2 entered promiscuous mode [ 1025.299061][T25938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1025.299081][T25938] Call Trace: [ 1025.299089][T25938] [ 1025.299100][T25938] dump_stack_lvl+0xcd/0x134 [ 1025.299136][T25938] dump_header+0x106/0x624 [ 1025.299163][T25938] oom_kill_process.cold+0x10/0x15 [ 1025.299191][T25938] out_of_memory+0x358/0x1460 [ 1025.316467][T25943] device virt_wifi0 entered promiscuous mode [ 1025.318325][T25938] ? find_held_lock+0x2d/0x110 [ 1025.318361][T25938] ? oom_killer_disable+0x270/0x270 [ 1025.318396][T25938] ? find_held_lock+0x2d/0x110 [ 1025.318427][T25938] mem_cgroup_out_of_memory+0x206/0x270 [ 1025.327327][T25943] team0: Device macvtap2 failed to register rx_handler [ 1025.330322][T25938] ? mem_cgroup_margin+0x130/0x130 [ 1025.330354][T25938] ? lock_downgrade+0x6e0/0x6e0 [ 1025.330402][T25938] try_charge_memcg+0xed2/0x1270 [ 1025.382000][T25933] cgroup2: Unknown parameter '@[-}+' [ 1025.383121][T25938] ? find_held_lock+0x2d/0x110 [ 1025.383157][T25938] ? mem_cgroup_oom_trylock+0x220/0x220 18:18:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1025.383191][T25938] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 1025.383220][T25938] ? lock_downgrade+0x6e0/0x6e0 [ 1025.383267][T25938] charge_memcg+0xae/0x360 [ 1025.383297][T25938] __mem_cgroup_charge+0x27/0x90 [ 1025.383328][T25938] wp_page_copy+0x294/0x2280 [ 1025.383366][T25938] ? do_page_mkwrite+0x550/0x550 [ 1025.383393][T25938] ? lock_downgrade+0x6e0/0x6e0 [ 1025.383420][T25938] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 1025.383451][T25938] ? vm_normal_page+0x146/0x2a0 [ 1025.383494][T25938] do_wp_page+0x2cb/0x1ae0 [ 1025.383529][T25938] __handle_mm_fault+0x1f41/0x5120 [ 1025.383570][T25938] ? vm_iomap_memory+0x190/0x190 [ 1025.383626][T25938] handle_mm_fault+0x1c8/0x790 [ 1025.383661][T25938] do_user_addr_fault+0x489/0x11c0 [ 1025.383702][T25938] exc_page_fault+0x9e/0x180 [ 1025.383732][T25938] ? asm_exc_page_fault+0x8/0x30 [ 1025.383764][T25938] asm_exc_page_fault+0x1e/0x30 [ 1025.383793][T25938] RIP: 0033:0x7f67b63f5e61 [ 1025.383822][T25938] Code: 11 00 4c 29 e8 4b 8d 0c 2f 48 8b 6c 24 18 48 39 d3 48 89 4b 60 0f 95 c2 48 83 c8 01 0f b6 d2 48 c1 e2 02 4c 09 ea 48 83 ca 01 <49> 89 57 08 48 89 41 08 49 83 c7 10 eb b3 48 8d 3d 5a dc 09 00 e8 [ 1025.511541][T25938] RSP: 002b:00007f67b6a6d9c0 EFLAGS: 00010206 [ 1025.517614][T25938] RAX: 00000000000206e1 RBX: 00007f67b650c5e0 RCX: 0000555556038920 [ 1025.525583][T25938] RDX: 0000000000000121 RSI: 0000000000000000 RDI: 0000000000000004 [ 1025.533550][T25938] RBP: 0000000000000110 R08: 0000000000000003 R09: 00007f67b650c640 [ 1025.541602][T25938] R10: 0000000000020022 R11: 0000000000000120 R12: 0000000000000010 [ 1025.549582][T25938] R13: 0000000000000120 R14: 0000000000000012 R15: 0000555556038800 [ 1025.557559][T25938] [ 1025.561765][T25943] device virt_wifi0 left promiscuous mode [ 1025.564653][T25938] memory: usage 307184kB, limit 307200kB, failcnt 18698 [ 1025.574945][T25938] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1025.582361][T25938] Memory cgroup stats for /syz1: [ 1025.587256][T25938] anon 291680256 [ 1025.587256][T25938] file 155648 [ 1025.587256][T25938] kernel_stack 65536 [ 1025.587256][T25938] pagetables 9666560 [ 1025.587256][T25938] percpu 0 [ 1025.587256][T25938] sock 0 [ 1025.587256][T25938] shmem 155648 [ 1025.587256][T25938] file_mapped 155648 [ 1025.587256][T25938] file_dirty 0 [ 1025.587256][T25938] file_writeback 0 [ 1025.587256][T25938] swapcached 0 [ 1025.587256][T25938] anon_thp 232783872 [ 1025.587256][T25938] file_thp 0 [ 1025.587256][T25938] shmem_thp 0 [ 1025.587256][T25938] inactive_anon 291688448 [ 1025.587256][T25938] active_anon 147456 [ 1025.587256][T25938] inactive_file 0 [ 1025.587256][T25938] active_file 0 [ 1025.587256][T25938] unevictable 0 [ 1025.587256][T25938] slab_reclaimable 624752 [ 1025.587256][T25938] slab_unreclaimable 10140880 [ 1025.587256][T25938] slab 10765632 [ 1025.587256][T25938] workingset_refault_anon 0 [ 1025.587256][T25938] workingset_refault_file 0 [ 1025.587256][T25938] workingset_activate_anon 0 [ 1025.688080][T25938] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25938,uid=0 [ 1025.706861][T25938] Memory cgroup out of memory: Killed process 25938 (syz-executor.1) total-vm:56804kB, anon-rss:2432kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 1025.730895][ T28] oom_reaper: reaped process 25938 (syz-executor.1), now anon-rss:0kB, file-rss:14336kB, shmem-rss:4kB 18:18:16 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465662f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:16 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x12000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1025.915481][T25950] syz-executor.1 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 1025.991317][T25950] CPU: 0 PID: 25950 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1026.000133][T25950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1026.010208][T25950] Call Trace: [ 1026.013502][T25950] [ 1026.016444][T25950] dump_stack_lvl+0xcd/0x134 [ 1026.021060][T25950] dump_header+0x106/0x624 [ 1026.025505][T25950] oom_kill_process.cold+0x10/0x15 [ 1026.030641][T25950] out_of_memory+0x358/0x1460 [ 1026.035348][T25950] ? find_held_lock+0x2d/0x110 [ 1026.040127][T25950] ? oom_killer_disable+0x270/0x270 [ 1026.045433][T25950] ? find_held_lock+0x2d/0x110 [ 1026.050217][T25950] mem_cgroup_out_of_memory+0x206/0x270 [ 1026.055785][T25950] ? mem_cgroup_margin+0x130/0x130 [ 1026.060914][T25950] ? lock_downgrade+0x6e0/0x6e0 [ 1026.065809][T25950] try_charge_memcg+0xed2/0x1270 [ 1026.070865][T25950] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1026.076427][T25950] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1026.082171][T25950] ? lock_downgrade+0x6e0/0x6e0 [ 1026.087143][T25950] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1026.092902][T25950] obj_cgroup_charge_pages+0x1e/0x90 [ 1026.098211][T25950] __memcg_kmem_charge_page+0x392/0x5f0 [ 1026.103790][T25950] __alloc_pages+0x1da/0x500 [ 1026.108405][T25950] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 1026.115195][T25950] ? __lock_acquire+0xbbf/0x5470 [ 1026.120163][T25950] alloc_pages+0x1a7/0x300 [ 1026.124599][T25950] ? mark_lock+0xef/0x17b0 [ 1026.129047][T25950] get_zeroed_page+0x10/0x40 [ 1026.133661][T25950] __pud_alloc+0x37/0x170 18:18:16 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310ec, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1026.138011][T25950] __handle_mm_fault+0x603/0x5120 [ 1026.143057][T25950] ? vm_iomap_memory+0x190/0x190 [ 1026.148043][T25950] handle_mm_fault+0x1c8/0x790 [ 1026.152835][T25950] do_user_addr_fault+0x489/0x11c0 [ 1026.157974][T25950] exc_page_fault+0x9e/0x180 [ 1026.162579][T25950] ? asm_exc_page_fault+0x8/0x30 [ 1026.167526][T25950] asm_exc_page_fault+0x1e/0x30 [ 1026.172386][T25950] RIP: 0033:0x7f67b63c4676 [ 1026.176808][T25950] Code: 1f 44 00 00 48 8b 0d 61 ed 0a 01 4c 63 05 4a ed 0a 01 48 8b 05 4b ed 0a 01 49 01 c8 48 39 c8 72 13 4c 39 c0 73 0e 48 8d 50 04 <89> 38 48 89 15 31 ed 0a 01 c3 52 48 8d 35 b4 b7 0b 00 48 89 c2 48 [ 1026.196411][T25950] RSP: 002b:00007f67b6a6db98 EFLAGS: 00010287 [ 1026.202480][T25950] RAX: 0000001b2e320000 RBX: 0000000000000003 RCX: 0000001b2e320000 [ 1026.210450][T25950] RDX: 0000001b2e320004 RSI: 00000000003c0000 RDI: 0000000000000000 [ 1026.218421][T25950] RBP: 0000000000000000 R08: 0000001b2e720000 R09: 0000000000040000 [ 1026.226891][T25950] R10: 0000000000000011 R11: 0000000000000000 R12: 0000000000000001 18:18:16 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6e340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1026.234871][T25950] R13: 0000000000000000 R14: 0000000000000001 R15: 00007f67b6a6de40 [ 1026.242866][T25950] 18:18:16 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x80010000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:16 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310ed, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:16 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x12050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1026.484769][T25957] device macvtap2 entered promiscuous mode [ 1026.504590][T25957] device virt_wifi0 entered promiscuous mode [ 1026.517829][T25950] memory: usage 307176kB, limit 307200kB, failcnt 18730 [ 1026.524811][T25950] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1026.540080][T25957] team0: Device macvtap2 failed to register rx_handler [ 1026.562770][T25957] device virt_wifi0 left promiscuous mode [ 1026.591345][T25950] Memory cgroup stats for /syz1: [ 1026.591573][T25950] anon 291667968 [ 1026.591573][T25950] file 155648 [ 1026.591573][T25950] kernel_stack 65536 [ 1026.591573][T25950] pagetables 9646080 [ 1026.591573][T25950] percpu 0 [ 1026.591573][T25950] sock 0 [ 1026.591573][T25950] shmem 155648 [ 1026.591573][T25950] file_mapped 155648 [ 1026.591573][T25950] file_dirty 0 [ 1026.591573][T25950] file_writeback 0 [ 1026.591573][T25950] swapcached 0 [ 1026.591573][T25950] anon_thp 232783872 [ 1026.591573][T25950] file_thp 0 [ 1026.591573][T25950] shmem_thp 0 [ 1026.591573][T25950] inactive_anon 291676160 [ 1026.591573][T25950] active_anon 147456 [ 1026.591573][T25950] inactive_file 0 [ 1026.591573][T25950] active_file 0 [ 1026.591573][T25950] unevictable 0 [ 1026.591573][T25950] slab_reclaimable 636752 [ 1026.591573][T25950] slab_unreclaimable 10160128 [ 1026.591573][T25950] slab 10796880 [ 1026.591573][T25950] workingset_refault_anon 0 [ 1026.591573][T25950] workingset_refault_file 0 [ 1026.591573][T25950] workingset_activate_anon 0 [ 1026.608789][T25963] cgroup2: Unknown parameter '@[-}+' [ 1026.692494][T25950] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=25950,uid=0 [ 1026.711012][T25950] Memory cgroup out of memory: Killed process 25950 (syz-executor.1) total-vm:60512kB, anon-rss:2432kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 18:18:16 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465662f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465662f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) [ 1026.742227][ T28] oom_reaper: reaped process 25950 (syz-executor.1), now anon-rss:0kB, file-rss:13636kB, shmem-rss:0kB 18:18:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:17 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310ee, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1026.871326][T25965] syz-executor.1 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 1026.932647][T25965] CPU: 1 PID: 25965 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1026.941458][T25965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1026.951529][T25965] Call Trace: [ 1026.954819][T25965] [ 1026.957762][T25965] dump_stack_lvl+0xcd/0x134 [ 1026.962378][T25965] dump_header+0x106/0x624 [ 1026.966815][T25965] oom_kill_process.cold+0x10/0x15 [ 1026.971946][T25965] out_of_memory+0x358/0x1460 [ 1026.976655][T25965] ? find_held_lock+0x2d/0x110 [ 1026.981443][T25965] ? oom_killer_disable+0x270/0x270 [ 1026.986681][T25965] ? find_held_lock+0x2d/0x110 [ 1026.991475][T25965] mem_cgroup_out_of_memory+0x206/0x270 [ 1026.997045][T25965] ? mem_cgroup_margin+0x130/0x130 [ 1027.002175][T25965] ? lock_downgrade+0x6e0/0x6e0 [ 1027.007068][T25965] try_charge_memcg+0xed2/0x1270 [ 1027.012033][T25965] ? find_held_lock+0x2d/0x110 [ 1027.016820][T25965] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1027.022386][T25965] ? get_mem_cgroup_from_mm+0x12f/0x6c0 [ 1027.027941][T25965] ? lock_downgrade+0x6e0/0x6e0 [ 1027.032834][T25965] charge_memcg+0xae/0x360 [ 1027.037288][T25965] __mem_cgroup_charge+0x27/0x90 [ 1027.042262][T25965] wp_page_copy+0x294/0x2280 [ 1027.046883][T25965] ? do_page_mkwrite+0x550/0x550 [ 1027.051839][T25965] ? lock_downgrade+0x6e0/0x6e0 [ 1027.056709][T25965] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 1027.062456][T25965] ? vm_normal_page+0x146/0x2a0 [ 1027.067345][T25965] do_wp_page+0x2cb/0x1ae0 [ 1027.071803][T25965] __handle_mm_fault+0x1f41/0x5120 [ 1027.076963][T25965] ? vm_iomap_memory+0x190/0x190 [ 1027.081946][T25965] handle_mm_fault+0x1c8/0x790 [ 1027.086737][T25965] do_user_addr_fault+0x489/0x11c0 [ 1027.091882][T25965] exc_page_fault+0x9e/0x180 [ 1027.096499][T25965] asm_exc_page_fault+0x1e/0x30 [ 1027.101371][T25965] RIP: 0010:__put_user_nocheck_4+0x3/0x11 [ 1027.107179][T25965] Code: 00 00 48 39 d9 73 54 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 0f 1f 44 00 00 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 34 0f 01 cb <89> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb f9 ef ff ff ff 7f [ 1027.126809][T25965] RSP: 0000:ffffc9001378ff38 EFLAGS: 00050293 [ 1027.132897][T25965] RAX: 0000000000004eae RBX: 00007fffffffeffd RCX: 00005555560376d0 [ 1027.140886][T25965] RDX: 1ffff1102f621c2a RSI: 0000000000000000 RDI: 0000000000000000 [ 1027.148877][T25965] RBP: 00005555560376d0 R08: 0000000000000000 R09: 0000000000000000 [ 1027.156865][T25965] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 1027.164852][T25965] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1027.172858][T25965] schedule_tail+0xaa/0xd0 [ 1027.177361][T25965] ret_from_fork+0x8/0x30 18:18:17 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:17 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x14050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:17 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x15050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:17 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x6f340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:17 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x16050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:17 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x80d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1027.181760][T25965] 18:18:17 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310ef, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1027.252482][T25967] cgroup2: Unknown parameter '@[-}+' 18:18:17 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x81000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1027.293765][T25965] memory: usage 307192kB, limit 307200kB, failcnt 18785 [ 1027.343328][T25965] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1027.361117][T25982] device macvtap2 entered promiscuous mode [ 1027.375843][T25965] Memory cgroup stats for /syz1: [ 1027.376067][T25965] anon 291651584 [ 1027.376067][T25965] file 155648 [ 1027.376067][T25965] kernel_stack 65536 [ 1027.376067][T25965] pagetables 9646080 [ 1027.376067][T25965] percpu 0 [ 1027.376067][T25965] sock 0 [ 1027.376067][T25965] shmem 155648 [ 1027.376067][T25965] file_mapped 155648 [ 1027.376067][T25965] file_dirty 0 [ 1027.376067][T25965] file_writeback 0 [ 1027.376067][T25965] swapcached 0 [ 1027.376067][T25965] anon_thp 232783872 [ 1027.376067][T25965] file_thp 0 [ 1027.376067][T25965] shmem_thp 0 [ 1027.376067][T25965] inactive_anon 291659776 [ 1027.376067][T25965] active_anon 147456 [ 1027.376067][T25965] inactive_file 0 [ 1027.376067][T25965] active_file 0 18:18:17 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x17050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1027.376067][T25965] unevictable 0 [ 1027.376067][T25965] slab_reclaimable 636368 [ 1027.376067][T25965] slab_unreclaimable 10183816 [ 1027.376067][T25965] slab 10820184 [ 1027.376067][T25965] workingset_refault_anon 0 [ 1027.376067][T25965] workingset_refault_file 0 [ 1027.376067][T25965] workingset_activate_anon 0 [ 1027.479076][T25982] device virt_wifi0 entered promiscuous mode [ 1027.487331][T25982] team0: Device macvtap2 failed to register rx_handler [ 1027.495682][T25982] device virt_wifi0 left promiscuous mode [ 1027.526090][T25965] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor.1,pid=3755,uid=0 [ 1027.556756][T25965] Memory cgroup out of memory: Killed process 3755 (syz-executor.1) total-vm:56672kB, anon-rss:2432kB, file-rss:15232kB, shmem-rss:4kB, UID:0 pgtables:88kB oom_score_adj:0 18:18:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465662f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:21 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x81030000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:21 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x18050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:21 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x70340200, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1031.195587][T25998] device macvtap2 entered promiscuous mode 18:18:21 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x81d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1031.259678][T25998] device virt_wifi0 entered promiscuous mode [ 1031.288531][T25998] team0: Device macvtap2 failed to register rx_handler [ 1031.313458][T25998] device virt_wifi0 left promiscuous mode [ 1031.390819][T26002] cgroup2: Unknown parameter '@[-}+' 18:18:21 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x19050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:21 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x74000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:21 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f2, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:21 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x82d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:22 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) sendto$phonet(0xffffffffffffffff, &(0x7f0000000100)="44865c27", 0x4, 0x40005, &(0x7f00000001c0)={0x23, 0x1, 0x20, 0x2}, 0x10) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f646d70ef300000000000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:22 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:22 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1a050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1031.790350][T26014] device macvtap2 entered promiscuous mode [ 1031.817060][T26014] device virt_wifi0 entered promiscuous mode [ 1031.871646][T26014] team0: Device macvtap2 failed to register rx_handler [ 1031.934722][T26014] device virt_wifi0 left promiscuous mode 18:18:22 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x7a000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:22 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f3, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:22 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x83d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:22 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:22 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1b050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1032.435060][T26025] device macvtap2 entered promiscuous mode [ 1032.464339][T26025] device virt_wifi0 entered promiscuous mode [ 1032.505445][T26025] team0: Device macvtap2 failed to register rx_handler [ 1032.545700][T26025] device virt_wifi0 left promiscuous mode 18:18:23 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x84d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:23 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1c030000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:23 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x81000000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:23 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f4, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1033.053208][T26041] device macvtap2 entered promiscuous mode [ 1033.087126][T26041] device virt_wifi0 entered promiscuous mode [ 1033.123075][T26041] team0: Device macvtap2 failed to register rx_handler [ 1033.168950][T26041] device virt_wifi0 left promiscuous mode [ 1034.337808][ T975] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.408888][ T975] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.466556][ T975] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.550315][ T975] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1035.625976][ T975] device hsr_slave_0 left promiscuous mode [ 1035.637108][ T975] device hsr_slave_1 left promiscuous mode [ 1035.665426][ T975] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1035.674030][ T975] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1035.691852][ T975] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1035.700167][ T975] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1035.710918][ T975] device bridge_slave_1 left promiscuous mode [ 1035.718565][ T975] bridge0: port 2(bridge_slave_1) entered disabled state [ 1035.734087][ T975] device bridge_slave_0 left promiscuous mode [ 1035.743086][ T975] bridge0: port 1(bridge_slave_0) entered disabled state [ 1035.780510][ T975] device veth1_macvtap left promiscuous mode [ 1035.787128][ T975] device veth0_macvtap left promiscuous mode [ 1035.794066][ T975] device veth1_vlan left promiscuous mode [ 1035.801221][ T975] device veth0_vlan left promiscuous mode [ 1036.174008][ T975] team0 (unregistering): Port device team_slave_1 removed [ 1036.188356][ T975] team0 (unregistering): Port device team_slave_0 removed [ 1036.215606][ T975] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1036.244914][ T975] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1036.316396][ T975] bond0 (unregistering): Released all slaves [ 1036.514999][T26095] chnl_net:caif_netlink_parms(): no params data found [ 1036.627959][T26095] bridge0: port 1(bridge_slave_0) entered blocking state [ 1036.635118][T26095] bridge0: port 1(bridge_slave_0) entered disabled state [ 1036.644602][T26095] device bridge_slave_0 entered promiscuous mode [ 1036.654137][T26095] bridge0: port 2(bridge_slave_1) entered blocking state [ 1036.661394][T26095] bridge0: port 2(bridge_slave_1) entered disabled state [ 1036.673602][T26095] device bridge_slave_1 entered promiscuous mode [ 1036.702454][T26095] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1036.715223][T26095] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1036.769366][T26095] team0: Port device team_slave_0 added [ 1036.793792][T26095] team0: Port device team_slave_1 added [ 1036.843520][T26095] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1036.850854][T26095] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1036.888812][T26095] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1036.914935][T26095] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1036.922069][T26095] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1036.948461][T26095] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1037.013599][T26095] device hsr_slave_0 entered promiscuous mode [ 1037.046608][T26095] device hsr_slave_1 entered promiscuous mode [ 1037.085284][T26095] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1037.107707][T26095] Cannot create hsr debugfs directory [ 1037.314384][T26095] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.321525][T26095] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1037.328954][T26095] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.336036][T26095] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1037.477268][ T8868] bridge0: port 1(bridge_slave_0) entered disabled state [ 1037.486233][ T8868] bridge0: port 2(bridge_slave_1) entered disabled state [ 1037.548446][T26095] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1037.574581][T10438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1037.583932][T10438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1037.608318][T26095] 8021q: adding VLAN 0 to HW filter on device team0 [ 1037.625662][T10438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1037.635150][T10438] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1037.644722][T10438] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.651845][T10438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1037.668572][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1037.680989][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1037.694851][ T922] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.701981][ T922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1037.740787][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1037.774027][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1037.793747][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1037.816344][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1037.833519][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1037.847670][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1037.856934][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1037.882416][T26095] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1037.917873][T26095] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1037.946479][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1037.958574][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1037.973421][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1037.982661][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1038.001444][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1038.035720][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1038.044301][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1038.066350][T26095] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1038.094473][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1038.104733][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1038.146575][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1038.156216][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1038.165970][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1038.184170][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1038.198194][T26095] device veth0_vlan entered promiscuous mode [ 1038.214845][T26095] device veth1_vlan entered promiscuous mode [ 1038.265850][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1038.267642][ T4192] Bluetooth: hci4: command 0x0409 tx timeout [ 1038.275316][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1038.289587][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1038.299611][ T3670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1038.312312][T26095] device veth0_macvtap entered promiscuous mode [ 1038.326975][T26095] device veth1_macvtap entered promiscuous mode [ 1038.346998][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1038.360988][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.371816][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1038.388221][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.398666][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1038.409427][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.419669][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1038.430807][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.440986][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1038.451714][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.464114][T26095] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1038.475881][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1038.491872][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1038.500803][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1038.516028][ T922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1038.541399][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1038.576125][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.607545][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1038.645511][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.655454][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1038.674882][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.687134][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1038.705660][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.715555][T26095] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1038.735723][T26095] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1038.761104][T26095] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1038.802025][ T8868] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1038.818561][ T8868] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1038.976380][ T3680] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1039.013933][ T3680] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1039.032177][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1039.049794][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1039.060592][ T8868] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1039.078097][ T8868] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 18:18:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) sendto$phonet(0xffffffffffffffff, &(0x7f0000000100)="44865c27", 0x4, 0x40005, &(0x7f00000001c0)={0x23, 0x1, 0x20, 0x2}, 0x10) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f646d70ef300000000000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) sendto$phonet(0xffffffffffffffff, &(0x7f0000000100)="44865c27", 0x4, 0x40005, &(0x7f00000001c0)={0x23, 0x1, 0x20, 0x2}, 0x10) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f646d70ef300000000000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:18:29 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x85d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:29 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1c050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:29 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f5, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:29 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x81030000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1039.212607][T26158] cgroup2: Unknown parameter '@[-}+' [ 1039.378625][T26172] cgroup2: Unknown parameter '@[-}+' 18:18:29 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f6, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1039.463486][T26170] warn_alloc: 1 callbacks suppressed [ 1039.463504][T26170] syz-executor.1: vmalloc error: size 12288, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) [ 1039.483734][T26168] device macvtap2 entered promiscuous mode [ 1039.516309][T26170] ,cpuset=syz1,mems_allowed=0-1 [ 1039.531706][T26170] CPU: 1 PID: 26170 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1039.540508][T26170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1039.550575][T26170] Call Trace: [ 1039.553858][T26170] [ 1039.556799][T26170] dump_stack_lvl+0xcd/0x134 [ 1039.561406][T26170] warn_alloc.cold+0x87/0x17a [ 1039.566097][T26170] ? zone_watermark_ok_safe+0x290/0x290 [ 1039.571660][T26170] ? __kmalloc_node+0x62/0x390 [ 1039.576511][T26170] ? __vmalloc_node_range+0x571/0xab0 [ 1039.581914][T26170] __vmalloc_node_range+0x880/0xab0 [ 1039.587147][T26170] ? vfree_atomic+0xe0/0xe0 [ 1039.591671][T26170] ? rcu_read_lock_sched_held+0x3a/0x70 [ 1039.597238][T26170] ? kernel_clone+0xe7/0xab0 [ 1039.601841][T26170] copy_process+0x926/0x75a0 [ 1039.606450][T26170] ? kernel_clone+0xe7/0xab0 [ 1039.611053][T26170] ? lock_chain_count+0x20/0x20 [ 1039.615916][T26170] ? lock_chain_count+0x20/0x20 [ 1039.620786][T26170] ? find_held_lock+0x2d/0x110 [ 1039.625579][T26170] ? __cleanup_sighand+0xb0/0xb0 [ 1039.630536][T26170] ? lock_downgrade+0x6e0/0x6e0 [ 1039.635410][T26170] ? __lock_acquire+0x1655/0x5470 [ 1039.640458][T26170] ? kernel_clone+0x314/0xab0 [ 1039.645154][T26170] kernel_clone+0xe7/0xab0 [ 1039.649598][T26170] ? create_io_thread+0xf0/0xf0 [ 1039.654469][T26170] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1039.660466][T26170] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1039.666476][T26170] ? find_held_lock+0x2d/0x110 [ 1039.671258][T26170] __do_sys_clone+0xc8/0x110 [ 1039.675864][T26170] ? kernel_clone+0xab0/0xab0 [ 1039.680553][T26170] ? lock_downgrade+0x6e0/0x6e0 [ 1039.685431][T26170] ? syscall_enter_from_user_mode+0x21/0x70 [ 1039.691349][T26170] do_syscall_64+0x35/0xb0 [ 1039.695777][T26170] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1039.701685][T26170] RIP: 0033:0x7f5683b072c1 [ 1039.706109][T26170] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1039.725728][T26170] RSP: 002b:00007f568414ca68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1039.734158][T26170] RAX: ffffffffffffffda RBX: 00007f568224a700 RCX: 00007f5683b072c1 [ 1039.742139][T26170] RDX: 00007f568224a9d0 RSI: 00007f568224a2f0 RDI: 00000000003d0f00 [ 1039.750227][T26170] RBP: 00007f568414ccb0 R08: 00007f568224a700 R09: 00007f568224a700 [ 1039.758210][T26170] R10: 00007f568224a9d0 R11: 0000000000000206 R12: 00007f568414cb1e 18:18:29 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x86d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:30 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1d050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1039.766194][T26170] R13: 00007f568414cb1f R14: 00007f568224a300 R15: 0000000000022000 [ 1039.774197][T26170] [ 1039.819771][T26168] device virt_wifi0 entered promiscuous mode [ 1039.822009][T26170] Mem-Info: [ 1039.838908][T26170] active_anon:685 inactive_anon:331757 isolated_anon:0 [ 1039.838908][T26170] active_file:7314 inactive_file:67488 isolated_file:0 [ 1039.838908][T26170] unevictable:768 dirty:10 writeback:0 [ 1039.838908][T26170] slab_reclaimable:18331 slab_unreclaimable:197690 18:18:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1039.838908][T26170] mapped:27807 shmem:2301 pagetables:22742 bounce:0 [ 1039.838908][T26170] kernel_misc_reclaimable:0 [ 1039.838908][T26170] free:926971 free_pcp:21972 free_cma:0 [ 1039.854684][T26168] team0: Device macvtap2 failed to register rx_handler [ 1039.890874][T26170] Node 0 active_anon:2348kB inactive_anon:1277596kB active_file:29088kB inactive_file:239852kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:110928kB dirty:36kB writeback:0kB shmem:6192kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 833536kB writeback_tmp:0kB kernel_stack:34852kB pagetables:61656kB all_unreclaimable? no [ 1039.933955][T26168] device virt_wifi0 left promiscuous mode [ 1039.940924][T26170] Node 1 active_anon:392kB inactive_anon:49332kB active_file:168kB inactive_file:30100kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:300kB dirty:4kB writeback:0kB shmem:3012kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:12288kB pagetables:29412kB all_unreclaimable? no [ 1040.034587][T26170] Node 0 DMA free:11468kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:972kB active_file:0kB inactive_file:456kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:208kB local_pcp:104kB free_cma:0kB [ 1040.144330][T26170] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 1040.151899][T26170] Node 0 DMA32 free:293036kB boost:0kB min:35676kB low:44592kB high:53508kB reserved_highatomic:0KB active_anon:2348kB inactive_anon:1278840kB active_file:29088kB inactive_file:239396kB unevictable:1536kB writepending:36kB present:3129332kB managed:2716748kB mlocked:0kB bounce:0kB free_pcp:29880kB local_pcp:10020kB free_cma:0kB 18:18:30 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f7, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1040.344098][T26170] lowmem_reserve[]: 0 0 0 0 0 [ 1040.357515][ T922] Bluetooth: hci4: command 0x041b tx timeout 18:18:30 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x87d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1040.371331][T26170] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1040.523803][T26170] lowmem_reserve[]: 0 0 0 0 0 [ 1040.544651][T26170] Node 1 Normal free:3396344kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:392kB inactive_anon:49332kB active_file:168kB inactive_file:30100kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:60764kB local_pcp:31872kB free_cma:0kB [ 1040.671696][T26170] lowmem_reserve[]: 0 0 0 0 0 [ 1040.690533][T26170] Node 0 DMA: 79*4kB (UM) 24*8kB (UM) 7*16kB (UM) 15*32kB (UM) 8*64kB (UM) 7*128kB (UM) 1*256kB (U) 1*512kB (U) 0*1024kB 2*2048kB (M) 1*4096kB (E) = 11468kB [ 1040.722035][T26170] Node 0 DMA32: 2828*4kB (UME) 1642*8kB (UME) 549*16kB (UME) 132*32kB (UME) 109*64kB (UME) 71*128kB (UME) 9*256kB (UME) 8*512kB (ME) 3*1024kB (M) 67*2048kB (M) 23*4096kB (M) = 294416kB [ 1040.795001][T26170] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1040.826613][T26170] Node 1 Normal: 9962*4kB (UME) 3652*8kB (UME) 1855*16kB (UME) 1780*32kB (UME) 741*64kB (UME) 255*128kB (UE) 42*256kB (UE) 4*512kB (UME) 2*1024kB (UE) 2*2048kB (ME) 767*4096kB (M) = 3396344kB [ 1040.848929][T26170] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1040.859229][T26170] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1040.868617][T26170] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1040.882184][T26170] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1040.891590][T26170] 9760 total pagecache pages [ 1040.896357][T26170] 0 pages in swap cache [ 1040.905565][T26170] Swap cache stats: add 0, delete 0, find 0/0 [ 1040.919342][T26170] Free swap = 0kB [ 1040.923081][T26170] Total swap = 0kB [ 1040.926804][T26170] 2097051 pages RAM [ 1040.936718][T26170] 0 pages HighMem/MovableOnly [ 1040.944796][T26170] 384519 pages reserved [ 1040.955578][T26170] 0 pages cma reserved 18:18:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) sendto$phonet(0xffffffffffffffff, &(0x7f0000000100)="44865c27", 0x4, 0x40005, &(0x7f00000001c0)={0x23, 0x1, 0x20, 0x2}, 0x10) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f646d70ef300000000000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:31 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x88a8ffff, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:31 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1e050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:31 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f8, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:31 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x88a8ffff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:31 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:31 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1f000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000100)=0x40, 0x4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 1041.147223][T26323] device macvtap2 entered promiscuous mode [ 1041.168185][T26323] device virt_wifi0 entered promiscuous mode [ 1041.175092][T26323] team0: Device macvtap2 failed to register rx_handler 18:18:31 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310f9, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1041.295166][T26323] device virt_wifi0 left promiscuous mode [ 1041.437086][T26348] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1041.509764][T26348] CPU: 1 PID: 26348 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 1041.518574][T26348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1041.528641][T26348] Call Trace: [ 1041.531927][T26348] [ 1041.534865][T26348] dump_stack_lvl+0xcd/0x134 [ 1041.539476][T26348] dump_header+0x106/0x624 [ 1041.543910][T26348] oom_kill_process.cold+0x10/0x15 [ 1041.549040][T26348] out_of_memory+0x358/0x1460 [ 1041.553738][T26348] ? find_held_lock+0x2d/0x110 [ 1041.558522][T26348] ? oom_killer_disable+0x270/0x270 [ 1041.563740][T26348] ? find_held_lock+0x2d/0x110 [ 1041.568523][T26348] mem_cgroup_out_of_memory+0x206/0x270 [ 1041.574082][T26348] ? mem_cgroup_margin+0x130/0x130 [ 1041.579207][T26348] ? lock_downgrade+0x6e0/0x6e0 [ 1041.584097][T26348] try_charge_memcg+0xed2/0x1270 [ 1041.589075][T26348] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1041.594640][T26348] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1041.600375][T26348] ? lock_downgrade+0x6e0/0x6e0 [ 1041.605248][T26348] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1041.611006][T26348] obj_cgroup_charge_pages+0x1e/0x90 [ 1041.616318][T26348] __memcg_kmem_charge_page+0x392/0x5f0 [ 1041.621890][T26348] copy_process+0x80a/0x75a0 [ 1041.626498][T26348] ? __free_object+0x64b/0xe00 [ 1041.631281][T26348] ? lock_chain_count+0x20/0x20 [ 1041.636149][T26348] ? lock_chain_count+0x20/0x20 [ 1041.641039][T26348] ? __cleanup_sighand+0xb0/0xb0 [ 1041.645996][T26348] ? debug_object_free+0x1c0/0x350 [ 1041.648317][T26370] cgroup2: Unknown parameter '@[-}+' [ 1041.651124][T26348] ? lock_downgrade+0x6e0/0x6e0 [ 1041.651162][T26348] ? __lock_acquire+0x1655/0x5470 [ 1041.651201][T26348] ? kernel_clone+0x314/0xab0 [ 1041.651229][T26348] kernel_clone+0xe7/0xab0 [ 1041.651259][T26348] ? create_io_thread+0xf0/0xf0 [ 1041.651283][T26348] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1041.651314][T26348] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1041.651356][T26348] ? find_held_lock+0x2d/0x110 [ 1041.651389][T26348] __do_sys_clone+0xc8/0x110 [ 1041.651414][T26348] ? kernel_clone+0xab0/0xab0 [ 1041.651440][T26348] ? lock_downgrade+0x6e0/0x6e0 [ 1041.651482][T26348] ? syscall_enter_from_user_mode+0x21/0x70 [ 1041.651521][T26348] do_syscall_64+0x35/0xb0 [ 1041.721584][T26348] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1041.727498][T26348] RIP: 0033:0x7f462bb432c1 [ 1041.731922][T26348] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1041.751543][T26348] RSP: 002b:00007f462c188a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1041.759973][T26348] RAX: ffffffffffffffda RBX: 00007f462a496700 RCX: 00007f462bb432c1 [ 1041.767953][T26348] RDX: 00007f462a4969d0 RSI: 00007f462a4962f0 RDI: 00000000003d0f00 [ 1041.775934][T26348] RBP: 00007f462c188cb0 R08: 00007f462a496700 R09: 00007f462a496700 [ 1041.784002][T26348] R10: 00007f462a4969d0 R11: 0000000000000206 R12: 00007f462c188b1e [ 1041.791977][T26348] R13: 00007f462c188b1f R14: 00007f462a496300 R15: 000055555673b940 [ 1041.799978][T26348] [ 1041.805696][T26348] memory: usage 307200kB, limit 307200kB, failcnt 1963 [ 1041.820588][T26348] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1041.827592][T26348] Memory cgroup stats for /syz5: [ 1041.827796][T26348] anon 289816576 [ 1041.827796][T26348] file 90112 [ 1041.827796][T26348] kernel_stack 1015808 [ 1041.827796][T26348] pagetables 9834496 [ 1041.827796][T26348] percpu 0 [ 1041.827796][T26348] sock 0 [ 1041.827796][T26348] shmem 90112 [ 1041.827796][T26348] file_mapped 90112 [ 1041.827796][T26348] file_dirty 0 [ 1041.827796][T26348] file_writeback 0 [ 1041.827796][T26348] swapcached 0 [ 1041.827796][T26348] anon_thp 220200960 [ 1041.827796][T26348] file_thp 0 [ 1041.827796][T26348] shmem_thp 0 [ 1041.827796][T26348] inactive_anon 289820672 [ 1041.827796][T26348] active_anon 86016 [ 1041.827796][T26348] inactive_file 0 [ 1041.827796][T26348] active_file 0 [ 1041.827796][T26348] unevictable 0 [ 1041.827796][T26348] slab_reclaimable 415944 [ 1041.827796][T26348] slab_unreclaimable 10964616 [ 1041.827796][T26348] slab 11380560 18:18:32 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1f050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1041.827796][T26348] workingset_refault_anon 0 [ 1041.827796][T26348] workingset_refault_file 0 [ 1041.827796][T26348] workingset_activate_anon 0 [ 1041.930247][T26348] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7018,uid=0 18:18:32 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x88d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1041.973485][T26348] Memory cgroup out of memory: Killed process 7018 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 18:18:32 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x89a00000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000100)=0x40, 0x4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000100)=0x40, 0x4) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:18:32 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x20000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:32 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310fa, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:32 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x89a00000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1042.340955][T26388] device macvtap2 entered promiscuous mode [ 1042.380781][T26388] device virt_wifi0 entered promiscuous mode [ 1042.425908][T26388] team0: Device macvtap2 failed to register rx_handler [ 1042.433302][T10438] Bluetooth: hci4: command 0x040f tx timeout [ 1042.478751][T26388] device virt_wifi0 left promiscuous mode [ 1042.500031][T26385] cgroup2: Unknown parameter '@[-}+' 18:18:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) (async, rerun: 32) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (rerun: 32) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async, rerun: 64) clone3(0x0, 0x0) (async, rerun: 64) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000100)=0x40, 0x4) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:33 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x20050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:33 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x89d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:33 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x990b0000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:33 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310fb, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000400)="94c2e10c472ccc1bb535f9d138d03560d4990ba51afa65e43690a709c1de10b4f1b94a09c7b347cf7ffd8b4914883da6fba6633a291de07d9efdab7c6144ef6b7be705d08ea3ce", 0x47, 0x4010, &(0x7f0000000100)={0xa, 0x4e23, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:33 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310fc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1043.254579][T26441] device macvtap2 entered promiscuous mode [ 1043.285439][T26441] device virt_wifi0 entered promiscuous mode 18:18:33 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x21000000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1043.339329][T26441] team0: Device macvtap2 failed to register rx_handler [ 1043.361506][T26441] device virt_wifi0 left promiscuous mode [ 1043.576788][T26446] cgroup2: Unknown parameter '@[-}+' 18:18:33 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8ad90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:34 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x21050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:34 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x9effffff, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:34 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310fd, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1044.095451][T26466] device macvtap2 entered promiscuous mode [ 1044.153279][T26466] device virt_wifi0 entered promiscuous mode [ 1044.241942][T26466] team0: Device macvtap2 failed to register rx_handler [ 1044.288822][T26466] device virt_wifi0 left promiscuous mode [ 1044.513118][T10438] Bluetooth: hci4: command 0x0419 tx timeout 18:18:34 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:34 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8bd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:34 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x22050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) (async) sendto$inet6(0xffffffffffffffff, &(0x7f0000000400)="94c2e10c472ccc1bb535f9d138d03560d4990ba51afa65e43690a709c1de10b4f1b94a09c7b347cf7ffd8b4914883da6fba6633a291de07d9efdab7c6144ef6b7be705d08ea3ce", 0x47, 0x4010, &(0x7f0000000100)={0xa, 0x4e23, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:34 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310fe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:34 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0xa8010000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) [ 1044.674308][T26485] cgroup2: Unknown parameter '@[-}+' 18:18:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000400)="94c2e10c472ccc1bb535f9d138d03560d4990ba51afa65e43690a709c1de10b4f1b94a09c7b347cf7ffd8b4914883da6fba6633a291de07d9efdab7c6144ef6b7be705d08ea3ce", 0x47, 0x4010, &(0x7f0000000100)={0xa, 0x4e23, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) sendto$inet6(0xffffffffffffffff, &(0x7f0000000400)="94c2e10c472ccc1bb535f9d138d03560d4990ba51afa65e43690a709c1de10b4f1b94a09c7b347cf7ffd8b4914883da6fba6633a291de07d9efdab7c6144ef6b7be705d08ea3ce", 0x47, 0x4010, &(0x7f0000000100)={0xa, 0x4e23, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) 18:18:35 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x310ff, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:35 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8cd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1044.841236][T26486] device macvtap2 entered promiscuous mode [ 1044.868190][T26486] device virt_wifi0 entered promiscuous mode 18:18:35 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x23050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1044.953358][T26486] team0: Device macvtap2 failed to register rx_handler [ 1045.031032][T26486] device virt_wifi0 left promiscuous mode [ 1045.076686][T26488] syz-executor.5 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1045.114154][T26488] CPU: 0 PID: 26488 Comm: syz-executor.5 Not tainted 5.16.0-rc8-syzkaller #0 [ 1045.122965][T26488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1045.133034][T26488] Call Trace: [ 1045.136322][T26488] [ 1045.139260][T26488] dump_stack_lvl+0xcd/0x134 [ 1045.143874][T26488] dump_header+0x106/0x624 [ 1045.148308][T26488] oom_kill_process.cold+0x10/0x15 [ 1045.153443][T26488] out_of_memory+0x358/0x1460 [ 1045.158153][T26488] ? find_held_lock+0x2d/0x110 [ 1045.162938][T26488] ? oom_killer_disable+0x270/0x270 [ 1045.168163][T26488] ? find_held_lock+0x2d/0x110 [ 1045.172947][T26488] mem_cgroup_out_of_memory+0x206/0x270 [ 1045.178512][T26488] ? mem_cgroup_margin+0x130/0x130 [ 1045.183638][T26488] ? lock_downgrade+0x6e0/0x6e0 [ 1045.188526][T26488] try_charge_memcg+0xed2/0x1270 [ 1045.193496][T26488] ? mem_cgroup_oom_trylock+0x220/0x220 [ 1045.199062][T26488] ? get_mem_cgroup_from_objcg+0x9f/0x170 [ 1045.204802][T26488] ? lock_downgrade+0x6e0/0x6e0 [ 1045.209677][T26488] ? __memcg_kmem_charge_page+0x352/0x5f0 [ 1045.215207][T26494] cgroup2: Unknown parameter '@[-}+' [ 1045.215436][T26488] obj_cgroup_charge_pages+0x1e/0x90 [ 1045.215484][T26488] __memcg_kmem_charge_page+0x392/0x5f0 [ 1045.215521][T26488] copy_process+0x80a/0x75a0 [ 1045.215558][T26488] ? __free_object+0x64b/0xe00 [ 1045.215591][T26488] ? lock_chain_count+0x20/0x20 [ 1045.215622][T26488] ? lock_chain_count+0x20/0x20 [ 1045.215665][T26488] ? __cleanup_sighand+0xb0/0xb0 [ 1045.215689][T26488] ? debug_object_free+0x1c0/0x350 [ 1045.215725][T26488] ? lock_downgrade+0x6e0/0x6e0 [ 1045.265682][T26488] ? __lock_acquire+0x1655/0x5470 [ 1045.270747][T26488] ? kernel_clone+0x314/0xab0 18:18:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f646576184fdb6d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') accept4$unix(0xffffffffffffffff, &(0x7f0000000400), &(0x7f00000001c0)=0x6e, 0x80000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 1045.275455][T26488] kernel_clone+0xe7/0xab0 [ 1045.279918][T26488] ? create_io_thread+0xf0/0xf0 [ 1045.284792][T26488] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1045.290803][T26488] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1045.296820][T26488] ? find_held_lock+0x2d/0x110 [ 1045.301614][T26488] __do_sys_clone+0xc8/0x110 [ 1045.306214][T26488] ? kernel_clone+0xab0/0xab0 [ 1045.310887][T26488] ? lock_downgrade+0x6e0/0x6e0 [ 1045.315745][T26488] ? syscall_enter_from_user_mode+0x21/0x70 [ 1045.321646][T26488] do_syscall_64+0x35/0xb0 [ 1045.326096][T26488] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1045.332000][T26488] RIP: 0033:0x7f462bb432c1 [ 1045.336538][T26488] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1045.356165][T26488] RSP: 002b:00007f462c188a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1045.364683][T26488] RAX: ffffffffffffffda RBX: 00007f462a475700 RCX: 00007f462bb432c1 [ 1045.372648][T26488] RDX: 00007f462a4759d0 RSI: 00007f462a4752f0 RDI: 00000000003d0f00 [ 1045.380611][T26488] RBP: 00007f462c188cb0 R08: 00007f462a475700 R09: 00007f462a475700 [ 1045.388582][T26488] R10: 00007f462a4759d0 R11: 0000000000000206 R12: 00007f462c188b1e [ 1045.396565][T26488] R13: 00007f462c188b1f R14: 00007f462a475300 R15: 000055555673ba60 [ 1045.404557][T26488] [ 1045.440678][T26488] memory: usage 307200kB, limit 307200kB, failcnt 1984 [ 1045.507655][T26488] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1045.551188][T26488] Memory cgroup stats for /syz5: [ 1045.552953][T26488] anon 289734656 [ 1045.552953][T26488] file 90112 [ 1045.552953][T26488] kernel_stack 1015808 [ 1045.552953][T26488] pagetables 9756672 [ 1045.552953][T26488] percpu 0 [ 1045.552953][T26488] sock 0 [ 1045.552953][T26488] shmem 90112 [ 1045.552953][T26488] file_mapped 90112 [ 1045.552953][T26488] file_dirty 0 [ 1045.552953][T26488] file_writeback 0 [ 1045.552953][T26488] swapcached 0 [ 1045.552953][T26488] anon_thp 220200960 [ 1045.552953][T26488] file_thp 0 [ 1045.552953][T26488] shmem_thp 0 [ 1045.552953][T26488] inactive_anon 289738752 [ 1045.552953][T26488] active_anon 86016 [ 1045.552953][T26488] inactive_file 0 [ 1045.552953][T26488] active_file 0 [ 1045.552953][T26488] unevictable 0 [ 1045.552953][T26488] slab_reclaimable 403176 [ 1045.552953][T26488] slab_unreclaimable 11152952 [ 1045.552953][T26488] slab 11556128 [ 1045.552953][T26488] workingset_refault_anon 0 [ 1045.552953][T26488] workingset_refault_file 0 [ 1045.552953][T26488] workingset_activate_anon 0 [ 1045.667998][T26488] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz5,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz-executor.5,pid=7003,uid=0 18:18:35 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31100, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1045.878382][T26488] Memory cgroup out of memory: Killed process 7003 (syz-executor.5) total-vm:60776kB, anon-rss:2492kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 [ 1045.926182][T26546] cgroup2: Unknown parameter '@[-}+' 18:18:37 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:37 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8dd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:37 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x24050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:37 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0xc3ffffff, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:37 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31101, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async, rerun: 32) r4 = socket$xdp(0x2c, 0x3, 0x0) (rerun: 32) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async, rerun: 64) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (rerun: 64) clone3(0x0, 0x0) (async) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f646576184fdb6d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) accept4$unix(0xffffffffffffffff, &(0x7f0000000400), &(0x7f00000001c0)=0x6e, 0x80000) (async, rerun: 64) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (rerun: 64) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 1046.967601][T26601] cgroup2: Unknown parameter '@[-}+' [ 1047.055497][T26594] device macvtap2 entered promiscuous mode 18:18:37 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1047.108277][T26594] device virt_wifi0 entered promiscuous mode [ 1047.132494][T26594] team0: Device macvtap2 failed to register rx_handler [ 1047.408578][T26594] device virt_wifi0 left promiscuous mode 18:18:37 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8ed90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:39 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = syz_io_uring_complete(0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f646576184fdb6d703000"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) accept4$unix(0xffffffffffffffff, &(0x7f0000000400), &(0x7f00000001c0)=0x6e, 0x80000) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) 18:18:42 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31102, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:42 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0xe0030000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(0x0, 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:43 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8fd90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:43 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x26050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1054.108797][ T1227] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.115143][ T1227] ieee802154 phy1 wpan1: encryption failed: -22 18:18:48 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0xe4ffffff, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:18:52 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31103, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:52 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x27050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:53 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x90d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) 18:18:53 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(0x0, 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) 18:18:55 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x264880, 0x10) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f40a0a9f4be539f0d20e4e3da3c44b2e66cb96d70993fa3156de88df58c2e1fcd4626716322b0cc7b3e2be6b75f63e1d638238126bdc8da2ba2bdc41f01743b8b95997d8548bfb145802400"/89], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) [ 1068.213733][T30785] warn_alloc: 1 callbacks suppressed [ 1068.213754][T30785] syz-executor.4: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz4,mems_allowed=0-1 18:19:00 executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x80003, 0x6b) r4 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) bind$packet(r4, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) getsockname$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0xe8020000, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) 18:19:00 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x28010000, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1071.767842][T30785] CPU: 1 PID: 30785 Comm: syz-executor.4 Not tainted 5.16.0-rc8-syzkaller #0 [ 1071.776659][T30785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1071.786733][T30785] Call Trace: [ 1071.790030][T30785] [ 1071.792972][T30785] dump_stack_lvl+0xcd/0x134 [ 1071.797589][T30785] warn_alloc.cold+0x87/0x17a [ 1071.802374][T30785] ? zone_watermark_ok_safe+0x290/0x290 [ 1071.807937][T30785] ? __kmalloc_node+0x62/0x390 [ 1071.812734][T30785] ? __vmalloc_node_range+0x571/0xab0 [ 1071.818136][T30785] __vmalloc_node_range+0x880/0xab0 [ 1071.823375][T30785] ? vfree_atomic+0xe0/0xe0 [ 1071.827907][T30785] ? rcu_read_lock_sched_held+0x3a/0x70 [ 1071.833473][T30785] ? kernel_clone+0xe7/0xab0 [ 1071.838083][T30785] copy_process+0x926/0x75a0 [ 1071.842691][T30785] ? kernel_clone+0xe7/0xab0 [ 1071.847296][T30785] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 1071.853560][T30785] ? wp_page_copy+0x55d/0x2280 [ 1071.858339][T30785] ? lock_chain_count+0x20/0x20 [ 1071.863213][T30785] ? lock_chain_count+0x20/0x20 [ 1071.868087][T30785] ? do_page_mkwrite+0x550/0x550 [ 1071.873040][T30785] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 1071.878785][T30785] ? __cleanup_sighand+0xb0/0xb0 [ 1071.883745][T30785] ? __lock_acquire+0x1655/0x5470 [ 1071.888791][T30785] ? kernel_clone+0x314/0xab0 [ 1071.893494][T30785] kernel_clone+0xe7/0xab0 [ 1071.897931][T30785] ? create_io_thread+0xf0/0xf0 [ 1071.902792][T30785] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1071.908790][T30785] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1071.914817][T30785] ? find_held_lock+0x2d/0x110 [ 1071.919606][T30785] __do_sys_clone+0xc8/0x110 [ 1071.924211][T30785] ? kernel_clone+0xab0/0xab0 [ 1071.928896][T30785] ? lock_downgrade+0x6e0/0x6e0 [ 1071.933776][T30785] ? syscall_enter_from_user_mode+0x21/0x70 [ 1071.939698][T30785] do_syscall_64+0x35/0xb0 [ 1071.944118][T30785] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1071.950045][T30785] RIP: 0033:0x7f1dbcc762c1 [ 1071.954455][T30785] Code: 48 85 ff 74 3d 48 85 f6 74 38 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 7c 13 74 01 c3 31 ed 58 5f ff d0 48 89 c7 b8 3c 00 00 00 [ 1071.974058][T30785] RSP: 002b:00007f1dbd2bba68 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1071.982467][T30785] RAX: ffffffffffffffda RBX: 00007f1dbb5ea700 RCX: 00007f1dbcc762c1 [ 1071.990433][T30785] RDX: 00007f1dbb5ea9d0 RSI: 00007f1dbb5ea2f0 RDI: 00000000003d0f00 [ 1071.998399][T30785] RBP: 00007f1dbd2bbcb0 R08: 00007f1dbb5ea700 R09: 00007f1dbb5ea700 [ 1072.006364][T30785] R10: 00007f1dbb5ea9d0 R11: 0000000000000206 R12: 00007f1dbd2bbb1e [ 1072.014332][T30785] R13: 00007f1dbd2bbb1f R14: 00007f1dbb5ea300 R15: 0000000000022000 [ 1072.022320][T30785] [ 1073.328861][T30785] Mem-Info: [ 1073.357599][T30785] active_anon:697 inactive_anon:342452 isolated_anon:0 [ 1073.357599][T30785] active_file:7317 inactive_file:67487 isolated_file:0 [ 1073.357599][T30785] unevictable:768 dirty:0 writeback:0 [ 1073.357599][T30785] slab_reclaimable:18233 slab_unreclaimable:337881 [ 1073.357599][T30785] mapped:27777 shmem:2309 pagetables:213552 bounce:0 [ 1073.357599][T30785] kernel_misc_reclaimable:0 [ 1073.357599][T30785] free:404659 free_pcp:9184 free_cma:0 18:19:14 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31104, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1085.657798][ T921] device macvtap2 entered promiscuous mode [ 1089.753944][ T921] device virt_wifi0 entered promiscuous mode [ 1099.329814][ T921] team0: Device macvtap2 failed to register rx_handler 18:19:32 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31105, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1102.907905][ T921] device virt_wifi0 left promiscuous mode [ 1104.283980][T30785] Node 0 active_anon:2392kB inactive_anon:1292436kB active_file:28652kB inactive_file:211912kB unevictable:1536kB isolated(anon):0kB isolated(file):26640kB mapped:110588kB dirty:0kB writeback:0kB shmem:6212kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 837632kB writeback_tmp:0kB kernel_stack:98008kB pagetables:167256kB all_unreclaimable? no [ 1104.543104][T30785] Node 1 active_anon:408kB inactive_anon:90436kB active_file:60kB inactive_file:80kB unevictable:1536kB isolated(anon):0kB isolated(file):4kB mapped:300kB dirty:0kB writeback:0kB shmem:3032kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:660496kB pagetables:1313716kB all_unreclaimable? no 18:19:35 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000300)) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(0x0, 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mount(&(0x7f0000000140)=ANY=[@ANYBLOB="2f6465762f6cb96d7030ff"], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, 0x0) [ 1104.923005][T30785] Node 0 DMA free:10752kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:996kB active_file:0kB inactive_file:456kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 18:19:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_complete(0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x264880, 0x10) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) close_range(r0, r1, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, 0x0}, 0x58) clone3(0x0, 0x0) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f40a0a9f4be539f0d20e4e3da3c44b2e66cb96d70993fa3156de88df58c2e1fcd4626716322b0cc7b3e2be6b75f63e1d638238126bdc8da2ba2bdc41f01743b8b95997d8548bfb145802400"/89], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) (async) openat$vcsu(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) open(&(0x7f0000000100)='./file0\x00', 0x264880, 0x10) (async) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300)) (async) close_range(r0, r1, 0x2) (async) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) (async) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) openat$cgroup_procs(r2, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r3, &(0x7f00000000c0), 0x12) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) (async) clone3(&(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) clone3(0x0, 0x0) (async) mount(&(0x7f0000000400)=ANY=[@ANYBLOB="2f40a0a9f4be539f0d20e4e3da3c44b2e66cb96d70993fa3156de88df58c2e1fcd4626716322b0cc7b3e2be6b75f63e1d638238126bdc8da2ba2bdc41f01743b8b95997d8548bfb145802400"/89], &(0x7f0000000300)='./file0\x00', &(0x7f0000000380)='reiserfs\x00', 0x2e402f, &(0x7f00000003c0)='@[-}+\x00') (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000240)={0x0, 0x0, 0x0, 'queue1\x00'}) (async) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, 0x0) (async) [ 1106.464459][ T1297] syz-executor.0 (1297) used greatest stack depth: 22544 bytes left [ 1106.479606][T30785] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 1106.485684][T30785] Node 0 DMA32 free:45396kB boost:10240kB min:45916kB low:54832kB high:63748kB reserved_highatomic:8192KB active_anon:2392kB inactive_anon:1289316kB active_file:28652kB inactive_file:211456kB unevictable:1536kB writepending:0kB present:3129332kB managed:2716748kB mlocked:0kB bounce:0kB free_pcp:764kB local_pcp:312kB free_cma:0kB 18:19:38 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x28050300, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1108.189811][T30785] lowmem_reserve[]: 0 0 0 0 0 [ 1108.204518][T30785] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1108.232705][T30785] lowmem_reserve[]: 0 0 0 0 0 [ 1108.239444][T30785] Node 1 Normal free:54792kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:408kB inactive_anon:90360kB active_file:4kB inactive_file:4kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:388kB local_pcp:388kB free_cma:0kB 18:19:38 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x31106, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1109.037504][T30785] lowmem_reserve[]: 0 0 0 0 0 [ 1109.042431][T30785] Node 0 DMA: 34*4kB (UM) 19*8kB (UM) 6*16kB (M) 2*32kB (UM) 7*64kB (UM) 7*128kB (UM) 1*256kB (U) 1*512kB (U) 0*1024kB 2*2048kB (M) 1*4096kB (E) = 10752kB [ 1109.069700][T30785] Node 0 DMA32: 2853*4kB (UME) 875*8kB (UME) 367*16kB (UME) 147*32kB (UME) 48*64kB (UMEH) 28*128kB (UME) 7*256kB (UMEH) 7*512kB (UME) 2*1024kB (MH) 1*2048kB (M) 0*4096kB = 45116kB [ 1109.093222][T30785] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1109.105329][T30785] Node 1 Normal: 538*4kB (ME) 414*8kB (UME) 343*16kB (ME) 252*32kB (UME) 145*64kB (UME) 27*128kB (UME) 2*256kB (ME) 2*512kB (ME) 1*1024kB (E) 2*2048kB (ME) 4*4096kB (UM) = 54792kB [ 1110.887523][T30785] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1110.907488][T30785] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1110.927488][T30785] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1110.947481][T30785] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1110.961929][T30785] 9680 total pagecache pages [ 1110.966684][T30785] 0 pages in swap cache [ 1110.971405][T30785] Swap cache stats: add 0, delete 0, find 0/0 [ 1110.977877][T30785] Free swap = 0kB [ 1110.981730][T30785] Total swap = 0kB [ 1111.285927][T30785] 2097051 pages RAM [ 1111.290206][T30785] 0 pages HighMem/MovableOnly [ 1111.295031][T30785] 384519 pages reserved [ 1111.299692][T30785] 0 pages cma reserved 18:19:41 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'virt_wifi0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x91d90200, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}}, 0x0) [ 1131.868995][ T1227] ieee802154 phy0 wpan0: encryption failed: -22 [ 1131.875343][ T1227] ieee802154 phy1 wpan1: encryption failed: -22 [ 1159.146186][ T922] Bluetooth: hci4: command 0x0406 tx timeout [ 1193.058185][ T1227] ieee802154 phy0 wpan0: encryption failed: -22 [ 1193.064562][ T1227] ieee802154 phy1 wpan1: encryption failed: -22 [ 1203.179335][ T6172] syz-executor.1 invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=1000 [ 1204.342441][ T6172] CPU: 0 PID: 6172 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1204.351175][ T6172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1204.361245][ T6172] Call Trace: [ 1204.364534][ T6172] [ 1204.367475][ T6172] dump_stack_lvl+0xcd/0x134 [ 1204.372087][ T6172] dump_header+0x106/0x624 [ 1204.376519][ T6172] oom_kill_process.cold+0x10/0x15 [ 1204.381652][ T6172] out_of_memory+0x119b/0x1460 [ 1204.386447][ T6172] ? oom_killer_disable+0x270/0x270 [ 1204.391677][ T6172] __alloc_pages_slowpath.constprop.0+0x1b03/0x20d0 [ 1204.398311][ T6172] ? warn_alloc+0x120/0x120 [ 1204.402846][ T6172] ? prepare_alloc_pages+0x415/0x570 [ 1204.408162][ T6172] __alloc_pages+0x412/0x500 [ 1204.412768][ T6172] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 1204.419560][ T6172] ? __slab_alloc.constprop.0+0x4d/0xa0 [ 1204.425138][ T6172] alloc_pages+0x1a7/0x300 [ 1204.429579][ T6172] new_slab+0x349/0x4a0 [ 1204.433749][ T6172] ___slab_alloc+0x918/0xfe0 [ 1204.438360][ T6172] ? find_held_lock+0x2d/0x110 [ 1204.443151][ T6172] ? copy_process+0x5c4/0x75a0 [ 1204.447941][ T6172] ? lock_downgrade+0x6e0/0x6e0 [ 1204.452822][ T6172] ? copy_process+0x5c4/0x75a0 [ 1204.458640][ T6172] ? __slab_alloc.constprop.0+0x4d/0xa0 [ 1204.464205][ T6172] ? copy_process+0x5c4/0x75a0 [ 1204.468977][ T6172] __slab_alloc.constprop.0+0x4d/0xa0 [ 1204.474373][ T6172] kmem_cache_alloc_node+0x122/0x3f0 [ 1204.479673][ T6172] ? copy_process+0x5c4/0x75a0 [ 1204.484458][ T6172] copy_process+0x5c4/0x75a0 [ 1204.489498][ T6172] ? find_held_lock+0x2d/0x110 [ 1204.494298][ T6172] ? __cleanup_sighand+0xb0/0xb0 [ 1204.499257][ T6172] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 1204.505517][ T6172] ? _copy_from_user+0x5d/0x180 [ 1204.510390][ T6172] ? kernel_clone+0x314/0xab0 [ 1204.515190][ T6172] kernel_clone+0xe7/0xab0 [ 1204.519621][ T6172] ? create_io_thread+0xf0/0xf0 [ 1204.524499][ T6172] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1204.530501][ T6172] __do_sys_clone3+0x1dd/0x2f0 [ 1204.535280][ T6172] ? __do_sys_clone+0x110/0x110 [ 1204.540164][ T6172] ? lock_downgrade+0x6e0/0x6e0 [ 1204.545026][ T6172] ? lock_downgrade+0x6e0/0x6e0 [ 1204.549908][ T6172] ? syscall_enter_from_user_mode+0x21/0x70 [ 1204.555835][ T6172] do_syscall_64+0x35/0xb0 [ 1204.560267][ T6172] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1204.566188][ T6172] RIP: 0033:0x7f5683b05e99 [ 1204.570619][ T6172] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1204.590244][ T6172] RSP: 002b:00007f5682439168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 1204.598880][ T6172] RAX: ffffffffffffffda RBX: 00007f5683c19100 RCX: 00007f5683b05e99 [ 1204.606959][ T6172] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 1204.614956][ T6172] RBP: 00007f5683b5fff1 R08: 0000000000000000 R09: 0000000000000000 [ 1204.623032][ T6172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1204.631015][ T6172] R13: 00007f568414cb1f R14: 00007f5682439300 R15: 0000000000022000 [ 1204.639019][ T6172] [ 1214.742003][ T6172] Mem-Info: [ 1214.745164][ T6172] active_anon:5319 inactive_anon:332376 isolated_anon:48 [ 1214.745164][ T6172] active_file:0 inactive_file:1475 isolated_file:376 [ 1214.745164][ T6172] unevictable:768 dirty:0 writeback:0 [ 1214.745164][ T6172] slab_reclaimable:18207 slab_unreclaimable:462504 [ 1214.745164][ T6172] mapped:19827 shmem:2312 pagetables:394751 bounce:0 [ 1214.745164][ T6172] kernel_misc_reclaimable:0 [ 1214.745164][ T6172] free:43053 free_pcp:180 free_cma:0 [ 1216.663536][ T6172] Node 0 active_anon:20864kB inactive_anon:1239040kB active_file:0kB inactive_file:5684kB unevictable:1536kB isolated(anon):192kB isolated(file):1628kB mapped:78992kB dirty:0kB writeback:0kB shmem:6212kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 755712kB writeback_tmp:0kB kernel_stack:140336kB pagetables:260276kB all_unreclaimable? no [ 1216.839125][ T6172] Node 1 active_anon:412kB inactive_anon:90488kB active_file:8kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:300kB dirty:0kB writeback:0kB shmem:3036kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:663052kB pagetables:1319068kB all_unreclaimable? yes [ 1217.533408][ T6172] Node 0 DMA free:10760kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:1000kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1217.839810][ T6172] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 1217.845634][ T6172] Node 0 DMA32 free:105160kB boost:80260kB min:115936kB low:124852kB high:133768kB reserved_highatomic:10240KB active_anon:20864kB inactive_anon:1238040kB active_file:4kB inactive_file:5684kB unevictable:1536kB writepending:0kB present:3129332kB managed:2716748kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1218.859239][ T6172] lowmem_reserve[]: 0 0 0 0 0 [ 1218.909089][ T6172] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1219.176505][ T6172] lowmem_reserve[]: 0 0 0 0 0 [ 1219.266016][ T6172] Node 1 Normal free:54128kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:412kB inactive_anon:90504kB active_file:4kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:792kB local_pcp:248kB free_cma:0kB [ 1220.247345][ T6172] lowmem_reserve[]: 0 0 0 0 0 [ 1220.252120][ T6172] Node 0 DMA: 46*4kB (M) 24*8kB (UM) 15*16kB (UM) 7*32kB (UM) 3*64kB (UM) 6*128kB (UM) 1*256kB (U) 1*512kB (U) 0*1024kB 2*2048kB (M) 1*4096kB (E) = 10760kB [ 1220.531450][ T6172] Node 0 DMA32: 6210*4kB (UME) 4013*8kB (UME) 1617*16kB (UME) 487*32kB (UME) 101*64kB (UM) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 104992kB [ 1221.160122][ T6172] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1221.444982][ T6172] Node 1 Normal: 411*4kB (UME) 423*8kB (UME) 341*16kB (ME) 249*32kB (UME) 144*64kB (UME) 30*128kB (UME) 2*256kB (ME) 3*512kB (UME) 2*1024kB (UE) 3*2048kB (UME) 3*4096kB (M) = 54036kB [ 1222.587306][ T6172] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1222.757310][ T6172] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1222.817312][ T6172] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1222.867308][ T6172] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1222.907202][ T6172] 3808 total pagecache pages [ 1222.927308][ T6172] 0 pages in swap cache [ 1222.947302][ T6172] Swap cache stats: add 0, delete 0, find 0/0 [ 1222.973812][ T6172] Free swap = 0kB [ 1222.997298][ T6172] Total swap = 0kB [ 1223.001056][ T6172] 2097051 pages RAM [ 1223.035406][ T6172] 0 pages HighMem/MovableOnly [ 1223.057069][ T6172] 384519 pages reserved [ 1223.067512][ T6172] 0 pages cma reserved [ 1223.071615][ T6172] Unreclaimable slab info: [ 1223.866938][ T6172] Name Used Total [ 1223.887187][ T6172] pid_3 7KB 7KB [ 1223.952512][ T6172] pid_2 4395KB 4406KB [ 1223.991467][ T6172] bio-312 7KB 7KB [ 1224.027337][ T6172] batadv_tt_change_cache 8KB 8KB [ 1224.058540][ T6172] batadv_tl_cache 8KB 8KB [ 1224.167303][ T6172] SMC 59KB 59KB [ 1224.173417][ T6172] TIPC 151KB 364KB [ 1224.207339][ T6172] SCTPv6 91KB 91KB [ 1224.235613][ T6172] SCTP 61KB 61KB [ 1224.297311][ T6172] sctp_chunk 41KB 60KB [ 1224.309896][ T6172] sctp_bind_bucket 8KB 8KB [ 1224.327314][ T6172] DCCPv6 59KB 59KB [ 1224.837603][ T6172] DCCP 92KB 92KB [ 1224.843764][ T6172] RXRPC 61KB 61KB [ 1224.867302][ T6172] rxrpc_call_jar 210KB 252KB [ 1224.883661][ T6172] can_receiver 3KB 3KB [ 1224.889807][ T6172] bridge_fdb_cache 15KB 15KB [ 1224.906137][ T6172] MPTCPv6 60KB 60KB [ 1224.912278][ T6172] fib6_nodes 187KB 200KB [ 1224.927313][ T6172] ip6_dst_cache 220KB 423KB [ 1224.943650][ T6172] RAWv6 308KB 308KB [ 1224.949783][ T6172] UDPLITEv6 64KB 64KB [ 1224.966116][ T6172] UDPv6 128KB 128KB [ 1225.506419][ T6172] TCPv6 191KB 191KB [ 1225.547026][ T6172] nf_conntrack 39KB 39KB [ 1225.557159][ T6172] ashmem_area_cache 30KB 30KB [ 1225.607369][ T6172] wg_peer 152KB 152KB [ 1225.617308][ T6172] allowedips_node 19KB 19KB [ 1225.623417][ T6172] t10_alua_lu_gp_cache 3KB 3KB [ 1225.667316][ T6172] sd_ext_cdb 3KB 3KB [ 1225.693873][ T6172] scsi_sense_cache 1092KB 1092KB [ 1225.715285][ T6172] virtio_scsi_cmd 16KB 16KB [ 1225.724355][ T6172] bio-136 60KB 60KB [ 1225.744638][ T6172] sgpool-128 29KB 29KB [ 1225.750791][ T6172] sgpool-64 63KB 63KB [ 1226.243433][ T6172] sgpool-32 63KB 63KB [ 1226.249591][ T6172] sgpool-16 22KB 22KB [ 1226.265928][ T6172] sgpool-8 26KB 26KB [ 1226.276073][ T6172] bio-264 7KB 7KB [ 1226.296375][ T6172] mqueue_inode_cache 60KB 60KB [ 1226.302630][ T6172] f2fs_bio_post_read_ctx 16KB 16KB [ 1226.317410][ T6172] jfs_mp 7KB 7KB [ 1226.367319][ T6172] fuse_request 7KB 7KB [ 1226.419865][ T6172] cifs_small_rq 16KB 16KB [ 1226.426412][ T6172] cifs_request 67KB 67KB [ 1226.644324][ T6172] cifs_mpx_ids 4KB 4KB [ 1227.157334][ T6172] nfs_commit_data 15KB 15KB [ 1227.215063][ T6172] nfs_write_data 47KB 47KB [ 1227.301513][ T6172] jbd2_inode 7KB 7KB [ 1227.431807][ T6172] ext4_system_zone 3KB 3KB [ 1227.517599][ T6172] ext4_io_end_vec 7KB 7KB [ 1227.523719][ T6172] ext4_bio_post_read_ctx 15KB 15KB [ 1227.682505][ T6172] kioctx 31KB 31KB [ 1227.776512][ T6172] aio_kiocb 7KB 7KB [ 1227.837033][ T6172] userfaultfd_ctx_cache 8KB 8KB [ 1227.902952][ T6172] fasync_cache 7KB 7KB [ 1228.647318][ T6172] pid_namespace 7KB 7KB [ 1228.653434][ T6172] posix_timers_cache 15KB 15KB [ 1228.707314][ T6172] kvm_vcpu 22KB 22KB [ 1228.713599][ T6172] kvm_mmu_page_header 11KB 11KB [ 1228.767316][ T6172] pte_list_desc 7KB 7KB [ 1228.773426][ T6172] x86_emulator 60KB 60KB [ 1228.967311][ T6172] rpc_buffers 31KB 31KB [ 1228.973425][ T6172] rpc_tasks 3KB 3KB [ 1229.137311][ T6172] UNIX-STREAM 102KB 256KB [ 1229.143425][ T6172] UNIX 240KB 416KB [ 1229.327325][ T6172] UDP-Lite 61KB 61KB [ 1229.333437][ T6172] MPTCP 61KB 61KB [ 1229.497316][ T6172] tcp_bind_bucket 8KB 8KB [ 1229.503447][ T6172] xfrm_state 31KB 31KB [ 1229.599179][ T6172] ip_fib_trie 32KB 32KB [ 1229.605292][ T6172] ip_fib_alias 106KB 106KB [ 1230.717321][ T6172] ip_dst_cache 56KB 56KB [ 1231.027316][ T6172] RAW 130KB 216KB [ 1231.118124][ T6172] UDP 123KB 123KB [ 1231.124241][ T6172] tw_sock_TCP 7KB 7KB [ 1231.857305][ T6172] request_sock_TCP 7KB 7KB [ 1231.907302][ T6172] TCP 60KB 60KB [ 1231.913433][ T6172] hugetlbfs_inode_cache 61KB 61KB [ 1232.357324][ T6172] fscache_cookie_jar 15KB 15KB [ 1232.457341][ T6172] bio-256 11KB 11KB [ 1232.504142][ T6172] ep_head 16KB 16KB [ 1232.537307][ T6172] eventpoll_pwq 35KB 35KB [ 1232.543418][ T6172] eventpoll_epi 66KB 66KB [ 1232.934508][ T6172] inotify_inode_mark 42KB 46KB [ 1232.995339][ T6172] bio_crypt_ctx 7KB 7KB [ 1233.076482][ T6172] request_queue 395KB 593KB [ 1233.117020][ T6172] blkdev_ioc 15KB 15KB [ 1233.151992][ T6172] bio-200 37KB 37KB [ 1233.188425][ T6172] biovec-max 297KB 297KB [ 1233.194641][ T6172] biovec-64 78KB 141KB [ 1233.473190][ T6172] biovec-16 15KB 15KB [ 1233.479440][ T6172] bio_integrity_payload 3KB 3KB [ 1233.485882][ T6172] khugepaged_mm_slot 4275KB 4289KB [ 1233.507305][ T6172] user_namespace 31KB 31KB [ 1233.523680][ T6172] uid_cache 7KB 7KB [ 1233.529829][ T6172] dmaengine-unmap-2 4KB 4KB [ 1233.546152][ T6172] QIPCRTR 63KB 63KB [ 1233.552303][ T6172] audit_buffer 7KB 7KB [ 1233.810988][ T6172] skbuff_ext_cache 44KB 44KB [ 1233.817105][ T6172] skbuff_fclone_cache 105KB 135KB [ 1233.833642][ T6172] skbuff_head_cache 10353KB 10410KB [ 1233.849638][ T6172] configfs_dir_cache 8KB 8KB [ 1233.897582][ T6172] file_lock_cache 39KB 66KB [ 1233.903705][ T6172] file_lock_ctx 11KB 11KB [ 1233.957305][ T6172] fsnotify_mark_connector 40KB 40KB [ 1234.267758][ T6172] net_namespace 124KB 183KB [ 1234.273889][ T6172] taskstats 313KB 494KB [ 1234.320625][ T6172] proc_dir_entry 1738KB 1777KB [ 1234.326825][ T6172] pde_opener 15KB 15KB [ 1234.377315][ T6172] seq_file 225KB 372KB [ 1234.383425][ T6172] sigqueue 43KB 63KB [ 1234.420036][ T6172] shmem_inode_cache 8799KB 10696KB [ 1234.426146][ T6172] kernfs_iattrs_cache 7KB 7KB [ 1234.695628][ T6172] kernfs_node_cache 95143KB 95676KB [ 1234.712087][ T6172] mnt_cache 3345KB 4260KB [ 1234.736216][ T6172] filp 2277KB 4440KB [ 1234.753231][ T6172] names_cache 4220KB 5652KB [ 1234.776343][ T6172] iint_cache 39KB 39KB [ 1234.799053][ T6172] lsm_inode_cache 1784KB 1964KB [ 1235.044823][ T6172] lsm_file_cache 402KB 811KB [ 1235.057304][ T6172] key_jar 23KB 23KB [ 1235.073674][ T6172] uts_namespace 15KB 15KB [ 1235.079944][ T6172] nsproxy 56KB 63KB [ 1235.107361][ T6172] vm_area_struct 180851KB 180852KB [ 1235.113470][ T6172] mm_struct 43578KB 43596KB [ 1235.377310][ T6172] fs_cache 6250KB 6260KB [ 1235.397300][ T6172] files_cache 23455KB 23475KB [ 1235.403411][ T6172] signal_cache 43756KB 43770KB [ 1235.440018][ T6172] sighand_cache 58110KB 58170KB [ 1235.446257][ T6172] task_struct 188732KB 188782KB [ 1235.477304][ T6172] cred_jar 6523KB 6524KB [ 1235.847330][ T6172] anon_vma_chain 231543KB 231548KB [ 1235.853542][ T6172] anon_vma 64849KB 64852KB [ 1235.871896][ T6172] pid 121KB 221KB [ 1235.878623][ T6172] Acpi-Operand 147KB 205KB [ 1235.897299][ T6172] Acpi-ParseExt 23KB 23KB [ 1235.905934][ T6172] Acpi-Parse 35KB 75KB [ 1236.190089][ T6172] Acpi-State 55KB 94KB [ 1236.196206][ T6172] Acpi-Namespace 28KB 28KB [ 1236.407303][ T6172] numa_policy 3KB 3KB [ 1236.413545][ T6172] perf_event 1104KB 1727KB [ 1236.646447][ T6172] trace_event_file 390KB 390KB [ 1236.768629][ T6172] ftrace_event_field 536KB 536KB [ 1236.865763][ T6172] pool_workqueue 200KB 256KB [ 1237.306398][ T6172] task_group 30KB 30KB [ 1237.317512][ T6172] vmap_area 4878KB 4878KB [ 1237.323617][ T6172] debug_objects_cache 11229KB 11230KB [ 1237.445142][ T6172] page->ptl 37177KB 37181KB [ 1237.507342][ T6172] kmalloc-cg-8k 51024KB 51200KB [ 1237.581989][ T6172] kmalloc-cg-4k 4024KB 4960KB [ 1237.653697][ T6172] kmalloc-cg-2k 100040KB 100096KB [ 1237.733846][ T6172] kmalloc-cg-1k 924KB 1440KB [ 1237.874584][ T6172] kmalloc-cg-512 4625KB 5904KB [ 1238.453130][ T6172] kmalloc-cg-256 259KB 344KB [ 1238.592419][ T6172] kmalloc-cg-192 874KB 900KB [ 1238.741333][ T6172] kmalloc-cg-128 112KB 112KB [ 1238.856019][ T6172] kmalloc-cg-96 3127KB 3140KB [ 1239.016218][ T6172] kmalloc-cg-64 3126KB 3136KB [ 1239.116390][ T6172] kmalloc-cg-32 28KB 32KB [ 1239.241303][ T6172] kmalloc-cg-16 858KB 868KB [ 1239.478825][ T6172] kmalloc-cg-8 239KB 306KB [ 1239.676921][ T6172] kmalloc-8k 8112KB 8928KB [ 1239.804378][ T6172] kmalloc-4k 234072KB 234376KB [ 1239.967393][ T6172] kmalloc-2k 97600KB 103040KB [ 1240.147299][ T6172] kmalloc-1k 39684KB 39776KB [ 1240.340032][ T6172] kmalloc-512 111940KB 112588KB [ 1241.023743][ T6172] kmalloc-256 5562KB 6008KB [ 1241.146523][ T6172] kmalloc-192 4810KB 4824KB [ 1241.347318][ T6172] kmalloc-128 21607KB 21620KB [ 1241.512608][ T6172] kmalloc-96 2728KB 2772KB [ 1241.678784][ T6172] kmalloc-64 15938KB 16044KB [ 1241.824562][ T6172] kmalloc-32 1327KB 1364KB [ 1241.986079][ T6172] kmalloc-16 655KB 2660KB [ 1242.112369][ T6172] kmalloc-8 1448KB 1530KB [ 1242.302836][ T6172] kmem_cache_node 200KB 200KB [ 1242.452053][ T6172] kmem_cache 168KB 168KB [ 1242.613589][ T6172] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz1,mems_allowed=0-1,global_oom,task_memcg=/,task=syz-executor.1,pid=6172,uid=0 [ 1243.037313][ T6172] Out of memory (oom_kill_allocating_task): Killed process 6172 (syz-executor.1) total-vm:57068kB, anon-rss:2568kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 [ 1244.161412][ T28] oom_reaper: reaped process 6172 (syz-executor.1), now anon-rss:0kB, file-rss:14080kB, shmem-rss:0kB [ 1244.186429][ T6172] syz-executor.1: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 1244.607304][ T6172] CPU: 1 PID: 6172 Comm: syz-executor.1 Not tainted 5.16.0-rc8-syzkaller #0 [ 1244.616037][ T6172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1244.626109][ T6172] Call Trace: [ 1244.629396][ T6172] [ 1244.632331][ T6172] dump_stack_lvl+0xcd/0x134 [ 1244.636948][ T6172] warn_alloc.cold+0x87/0x17a [ 1244.641644][ T6172] ? zone_watermark_ok_safe+0x290/0x290 [ 1244.647204][ T6172] ? __kmalloc_node+0x62/0x390 [ 1244.652184][ T6172] ? __vmalloc_node_range+0x571/0xab0 [ 1244.657576][ T6172] __vmalloc_node_range+0x880/0xab0 [ 1244.662803][ T6172] ? vfree_atomic+0xe0/0xe0 [ 1244.667325][ T6172] ? rcu_read_lock_sched_held+0x3a/0x70 [ 1244.672892][ T6172] ? kernel_clone+0xe7/0xab0 [ 1244.677491][ T6172] copy_process+0x926/0x75a0 [ 1244.682102][ T6172] ? kernel_clone+0xe7/0xab0 [ 1244.686706][ T6172] ? find_held_lock+0x2d/0x110 [ 1244.691582][ T6172] ? __cleanup_sighand+0xb0/0xb0 [ 1244.696539][ T6172] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 1244.702794][ T6172] ? _copy_from_user+0x5d/0x180 [ 1244.707663][ T6172] ? kernel_clone+0x314/0xab0 [ 1244.712365][ T6172] kernel_clone+0xe7/0xab0 [ 1244.716803][ T6172] ? create_io_thread+0xf0/0xf0 [ 1244.721678][ T6172] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 1244.727692][ T6172] __do_sys_clone3+0x1dd/0x2f0 [ 1244.732470][ T6172] ? __do_sys_clone+0x110/0x110 [ 1244.737347][ T6172] ? lock_downgrade+0x6e0/0x6e0 [ 1244.742216][ T6172] ? lock_downgrade+0x6e0/0x6e0 [ 1244.747093][ T6172] ? syscall_enter_from_user_mode+0x21/0x70 [ 1244.753015][ T6172] do_syscall_64+0x35/0xb0 [ 1244.757448][ T6172] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1244.763366][ T6172] RIP: 0033:0x7f5683b05e99 [ 1244.767800][ T6172] Code: Unable to access opcode bytes at RIP 0x7f5683b05e6f. [ 1244.775167][ T6172] RSP: 002b:00007f5682439168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 1244.783605][ T6172] RAX: ffffffffffffffda RBX: 00007f5683c19100 RCX: 00007f5683b05e99 [ 1244.791587][ T6172] RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020000580 [ 1244.799567][ T6172] RBP: 00007f5683b5fff1 R08: 0000000000000000 R09: 0000000000000000 [ 1244.807550][ T6172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1244.815533][ T6172] R13: 00007f568414cb1f R14: 00007f5682439300 R15: 0000000000022000 [ 1244.823536][ T6172] [ 1247.014279][ T6172] Mem-Info: [ 1247.017470][ T6172] active_anon:5322 inactive_anon:332277 isolated_anon:190 [ 1247.017470][ T6172] active_file:2 inactive_file:626 isolated_file:232 [ 1247.017470][ T6172] unevictable:768 dirty:0 writeback:0 [ 1247.017470][ T6172] slab_reclaimable:18207 slab_unreclaimable:463312 [ 1247.017470][ T6172] mapped:19227 shmem:2312 pagetables:395675 bounce:0 [ 1247.017470][ T6172] kernel_misc_reclaimable:0 [ 1247.017470][ T6172] free:41762 free_pcp:212 free_cma:0 [ 1247.697309][ T6172] Node 0 active_anon:20876kB inactive_anon:1238472kB active_file:12kB inactive_file:2496kB unevictable:1536kB isolated(anon):760kB isolated(file):808kB mapped:76608kB dirty:0kB writeback:0kB shmem:6212kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 755712kB writeback_tmp:0kB kernel_stack:140336kB pagetables:260276kB all_unreclaimable? no [ 1248.025149][ T6172] Node 1 active_anon:412kB inactive_anon:90636kB active_file:0kB inactive_file:8kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:300kB dirty:0kB writeback:0kB shmem:3036kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:663968kB pagetables:1322624kB all_unreclaimable? yes [ 1248.607305][ T6172] Node 0 DMA free:10760kB boost:0kB min:200kB low:248kB high:296kB reserved_highatomic:0KB active_anon:0kB inactive_anon:1000kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1248.797306][ T6172] lowmem_reserve[]: 0 2645 2645 2645 2645 [ 1248.803122][ T6172] Node 0 DMA32 free:101412kB boost:80260kB min:115936kB low:124852kB high:133768kB reserved_highatomic:12288KB active_anon:20876kB inactive_anon:1237476kB active_file:24kB inactive_file:2520kB unevictable:1536kB writepending:0kB present:3129332kB managed:2716748kB mlocked:0kB bounce:0kB free_pcp:128kB local_pcp:0kB free_cma:0kB [ 1249.377297][ T6172] lowmem_reserve[]: 0 0 0 0 0 [ 1249.382063][ T6172] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:400kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1249.557298][ T6172] lowmem_reserve[]: 0 0 0 0 0 [ 1249.562070][ T6172] Node 1 Normal free:53976kB boost:0kB min:54224kB low:67780kB high:81336kB reserved_highatomic:0KB active_anon:412kB inactive_anon:90648kB active_file:0kB inactive_file:8kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:1664kB local_pcp:104kB free_cma:0kB [ 1249.697293][ T6172] lowmem_reserve[]: 0 0 0 0 0 [ 1249.702059][ T6172] Node 0 DMA: 46*4kB (M) 24*8kB (UM) 15*16kB (UM) 7*32kB (UM) 3*64kB (UM) 6*128kB (UM) 1*256kB (U) 1*512kB (U) 0*1024kB 2*2048kB (M) 1*4096kB (E) = 10760kB [ 1250.197299][ T6172] Node 0 DMA32: 6747*4kB (UME) 4053*8kB (UME) 1643*16kB (UME) 345*32kB (UME) 51*64kB (UM) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 100004kB [ 1250.287304][ T6172] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1250.339591][ T6172] Node 1 Normal: 374*4kB (UME) 423*8kB (UME) 341*16kB (ME) 248*32kB (ME) 142*64kB (UME) 35*128kB (UME) 3*256kB (UME) 3*512kB (UME) 2*1024kB (UE) 3*2048kB (UME) 3*4096kB (M) = 54624kB [ 1250.364930][ T6172] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1250.807298][ T6172] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1250.816632][ T6172] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1250.927299][ T6172] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1250.936633][ T6172] 3040 total pagecache pages [ 1250.997316][ T6172] 0 pages in swap cache [ 1251.001522][ T6172] Swap cache stats: add 0, delete 0, find 0/0 [ 1251.057300][ T6172] Free swap = 0kB [ 1251.061059][ T6172] Total swap = 0kB [ 1251.064781][ T6172] 2097051 pages RAM [ 1251.117297][ T6172] 0 pages HighMem/MovableOnly [ 1251.122019][ T6172] 384519 pages reserved [ 1251.126176][ T6172] 0 pages cma reserved [ 1254.255102][ T1227] ieee802154 phy0 wpan0: encryption failed: -22 [ 1254.261495][ T1227] ieee802154 phy1 wpan1: encryption failed: -22 [ 1278.764692][ T27] INFO: task syz-executor.4:3641 blocked for more than 151 seconds. [ 1279.627874][ T27] Not tainted 5.16.0-rc8-syzkaller #0 [ 1279.654260][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1279.715099][ T27] task:syz-executor.4 state:D stack:23400 pid: 3641 ppid: 3625 flags:0x00000000 [ 1279.775979][ T27] Call Trace: [ 1279.796277][ T27] [ 1279.806423][ T27] __schedule+0xa9a/0x4900 [ 1279.836870][ T27] ? io_schedule_timeout+0x180/0x180 [ 1279.863520][ T27] schedule+0xd2/0x260 [ 1279.884650][ T27] schedule_preempt_disabled+0xf/0x20 [ 1279.907272][ T27] __mutex_lock+0xa32/0x12f0 [ 1279.917282][ T27] ? xt_find_table_lock+0x140/0x680 [ 1279.932758][ T27] ? mutex_lock_io_nested+0x1150/0x1150 [ 1279.949090][ T27] ? xt_find_table_lock+0xfa/0x680 [ 1279.974729][ T27] xt_find_table_lock+0x140/0x680 [ 1279.979858][ T27] xt_request_find_table_lock+0x27/0xf0 [ 1280.392168][ T27] get_info+0x178/0x750 [ 1280.396480][ T27] ? arpt_do_table+0x1900/0x1900 [ 1280.431291][ T27] ? find_held_lock+0x2d/0x110 [ 1280.436115][ T27] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 1280.516529][ T27] ? apparmor_capable+0x1d8/0x460 [ 1280.669620][ T27] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 1280.801731][ T27] ? security_capable+0x8f/0xc0 [ 1280.806661][ T27] do_arpt_get_ctl+0x474/0x8f0 [ 1280.973231][ T27] ? get_info+0x750/0x750 [ 1281.033062][ T27] ? lock_downgrade+0x6e0/0x6e0 [ 1281.137286][ T27] ? nf_sockopt_find.constprop.0+0x22d/0x2a0 [ 1281.221450][ T27] nf_getsockopt+0x72/0xd0 [ 1281.225935][ T27] ip_getsockopt+0x164/0x1c0 [ 1281.403707][ T27] ? do_ip_getsockopt+0x18f0/0x18f0 [ 1281.473120][ T27] tcp_getsockopt+0x86/0xd0 [ 1281.509220][ T27] ? sock_def_destruct+0x10/0x10 [ 1281.514218][ T27] __sys_getsockopt+0x21f/0x5f0 [ 1282.917285][ T27] ? lock_downgrade+0x6e0/0x6e0 [ 1282.922199][ T27] ? __ia32_sys_setsockopt+0x150/0x150 [ 1283.517293][ T27] __x64_sys_getsockopt+0xba/0x150 [ 1283.522465][ T27] ? syscall_enter_from_user_mode+0x21/0x70 [ 1283.557280][ T27] do_syscall_64+0x35/0xb0 [ 1283.561752][ T27] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1283.887290][ T27] RIP: 0033:0x7f1dbcc764ba [ 1283.891755][ T27] RSP: 002b:00007f1dbd2bb6c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1284.437271][ T27] RAX: ffffffffffffffda RBX: 00007f1dbd2bb6dc RCX: 00007f1dbcc764ba [ 1284.445291][ T27] RDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000003 [ 1284.767286][ T27] RBP: 0000000000000003 R08: 00007f1dbd2bb6dc R09: ffffffffff000000 [ 1284.775316][ T27] R10: 00007f1dbd2bb6e0 R11: 0000000000000246 R12: 00007f1dbd2bb6e0 [ 1286.019135][ T27] R13: 0000000000103f9b R14: 0000000000000000 R15: 00007f1dbd2bbe40 [ 1286.027183][ T27] [ 1286.167380][ T27] INFO: task syz-executor.2:3644 blocked for more than 158 seconds. [ 1286.175399][ T27] Not tainted 5.16.0-rc8-syzkaller #0 [ 1286.217274][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1286.225984][ T27] task:syz-executor.2 state:D stack:23816 pid: 3644 ppid: 3623 flags:0x00000000 [ 1286.277279][ T27] Call Trace: [ 1286.280600][ T27] [ 1286.283549][ T27] __schedule+0xa9a/0x4900 [ 1286.307291][ T27] ? io_schedule_timeout+0x180/0x180 [ 1286.312637][ T27] schedule+0xd2/0x260 [ 1286.316729][ T27] schedule_preempt_disabled+0xf/0x20 [ 1286.345980][ T27] __mutex_lock+0xa32/0x12f0 [ 1286.367277][ T27] ? xt_find_table_lock+0x140/0x680 [ 1286.372528][ T27] ? mutex_lock_io_nested+0x1150/0x1150 [ 1287.577294][ T27] ? xt_find_table_lock+0xfa/0x680 [ 1287.582488][ T27] xt_find_table_lock+0x140/0x680 [ 1287.637287][ T27] xt_request_find_table_lock+0x27/0xf0 [ 1287.642894][ T27] get_info+0x178/0x750 [ 1287.647077][ T27] ? arpt_do_table+0x1900/0x1900 [ 1287.914071][ T27] ? find_held_lock+0x2d/0x110 [ 1288.066164][ T27] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 1288.213161][ T27] ? apparmor_capable+0x1d8/0x460 [ 1288.321513][ T27] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70