last executing test programs: 8m8.987516414s ago: executing program 2 (id=3215): perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0x3) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000000)=@bpf_lsm={0x1e, 0x3, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="88"}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001c80), 0x8}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = perf_event_open(&(0x7f0000000440)={0x2, 0x80, 0xf2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_bp={0x0, 0x7}, 0x8, 0x0, 0x0, 0x5, 0x9, 0x6, 0x20, 0x0, 0x0, 0x0, 0x400200000000003b}, 0x0, 0x7fffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) perf_event_open(&(0x7f00000005c0)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_config_ext={0x1, 0x1000}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x5, r1, 0x3) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)="d8000000140081044e81f782db44b9040218080207000000040000a118000200e000000100000e1208000f0100810401a80016ea1f000840032e5f54c92011148ed08734843c8802033d0803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x8010) perf_event_open(&(0x7f00000007c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000840), 0x4}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x11b9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) mkdir(0x0, 0x102) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000880)='devices.allow\x00', 0x2, 0x0) perf_event_open(&(0x7f00000008c0)={0x2, 0x80, 0x0, 0x0, 0x0, 0x86, 0x0, 0x4d31, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext={0x3, 0x8309}, 0x0, 0x2, 0xffffffff, 0x5, 0x2, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001dc0)=@newqdisc={0x148, 0x24, 0x605, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x20, 0xe, 0x80, 0x8, 0xe, 0x8, 0xc}}, @TCA_RED_STAB={0x104, 0x2, "0000000000000000000000000000fff100"}]}}]}, 0x148}}, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x32, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000001d00)={0x0, 0x0, &(0x7f0000001d40)={&(0x7f0000001d80)=ANY=[@ANYBLOB="280000001e0021800000000000000000070000000500ff0f000000000a0005"], 0x28}}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) 8m8.71567131s ago: executing program 2 (id=3216): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xc, 0xe, &(0x7f0000000840)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000100850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9bf0bdf81524f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6cd87cef9000000a39c15a7ef365cc27dfeac7b9b0e9048517354b0ca4f9cf8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19ea2eb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc089a9813c1efa26001b3f486ebfaae85c4d0b96778478ae5355e6f923b11056969f486f80a35f7f2339704fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d0000000000000000000000004e1fa60acabcf0553910ca2e5ea499fd5889dde9261f0848a5b8af657bfc96049308e8953431b269053627a1523551c160c813969925a892d266792352ec0204596a37ce8d6d260b32239bddbce2e79f93cb5a0ad897adb53b397d07c50f84b74f2605a565ee149016aa75ea31c0087dcd821b47c8b36efc6da4fb2ea7f1f36c85856b73ac9872babc62149699b6b8c796a79d833eb4b5ca668d430db5653a2b3c5b87e17ca1"], &(0x7f0000000a80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000ac0), 0x0, 0x10, &(0x7f0000000b00), 0x2ca}, 0x48) perf_event_open(&(0x7f0000000b40)={0x2, 0x80, 0xf2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e381, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0xb, 0xffffffffffffffff}, 0x8, 0x0, 0x0, 0x5, 0x9, 0x6, 0x0, 0x0, 0x0, 0x0, 0x400200000000003b}, 0x0, 0x7fffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000bc0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0x1}, 0x404c, 0x1ff, 0x4, 0x4, 0x4, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c40)={r0, 0x18000000000002a0, 0x2f9, 0xffffca88, &(0x7f0000000cc0)="b90103600040f000009e0ff008001fffffe160004000632f77fb7f0200017f020001be3e7d2a182fff", 0x0, 0x104, 0x6000000000000000, 0x0, 0xfeb9, &(0x7f0000000d00)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281c26691949d054b784a5866f081e53eb9cfd7", &(0x7f0000000e40)}, 0x28) 8m8.135643859s ago: executing program 2 (id=3219): r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x4f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x114244, 0x0, 0xafe8, 0x4, 0x7fff, 0x7fffffff}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x5, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xf00, &(0x7f0000000040)=[{&(0x7f0000000080)="2e00000011008188040f80ec59acbc0413a1f8480b0000005e140602000000000e0027001000000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x140) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r4, &(0x7f0000000500)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x48000}, 0xc050) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}}, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x10, 0x4, &(0x7f0000000cc0)=ANY=[@ANYBLOB], &(0x7f0000000d00)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = getpid() bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x106a655, 0x0, 0x0, 0x0, 0x7ff}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0xfca804a0, 0x10, 0x38, &(0x7f0000000680)="b800000500000000", &(0x7f00000006c0)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) perf_event_open(&(0x7f0000000840)={0x2, 0x80, 0x4f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x114244, 0x0, 0x6, 0x4, 0x7fff, 0x7fffffff}, r6, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x3, 0x3, &(0x7f0000000ac0)=ANY=[@ANYBLOB="85000000080000005d0000000000000095000000000000000a621cf434b9eaafdc0a00e9bfde908990817b364e51afe9c81a97f0570759f1cae63487ff68fffffffffffe8e3932e2b7185a25a4cf8a9456aa8a701c318c67edb6e9330b53c0eeba8644311ba75411892f5466eb01820a43d8e5b1dc91c5499bea0977"], &(0x7f0000000b40)='GPL\x00', 0x5, 0x487, &(0x7f0000000d40)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) 8m7.65051932s ago: executing program 2 (id=3222): socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000000)='./file0\x00', 0x1cb) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="d80000001b0001000000000000000000ac1414aa0000000000000000000000007f00000100000000000000000000000000000000000000000000002000000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="0000000000000000000000000000000004000000000000000000000000000000000000000000000072000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010003000000000000000000000000000c0008"], 0xd8}}, 0x0) mount$bpf(0x200000000000, &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f00000000c0)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000180)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x6000, 0x0) mount$bpf(0x0, &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x44000, 0x0) perf_event_open(&(0x7f0000001940)={0x2, 0x80, 0xef, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e381, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext={0xb, 0xffffffffffffffff}, 0x8, 0x0, 0x0, 0x1, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x400200000000003b}, 0x0, 0x7fffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000019c0)={0x5, 0x3, &(0x7f0000001a80)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000001ac0)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000001b00)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, 0x0, 0x20002800) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f0000001f40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x20008040) ioctl$TUNATTACHFILTER(r2, 0x401054d5, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) 8m7.290607049s ago: executing program 2 (id=3223): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x1ff, 0x4, 0x0, 0x4, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000009c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040033, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 8m4.511763364s ago: executing program 2 (id=3231): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="b80000002900010026bd70001000000000000000000000000000000000000000ff020000000000000000000000000001", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000a7c9043d00000000000000000000000000000000000000000800000000000000000000000000f700bb0000fbffffffffffffff000000000000000202140000000000000000000000000000030000000000000000000000b66b6e000003030100e0c84637ed290eae"], 0xb8}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x3, 0x0) socket$kcm(0x11, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000880)={0x0, 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x0) perf_event_open(&(0x7f0000000b00)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x20104, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000b80), 0x1}, 0x8, 0x2000000000000000, 0x0, 0x2, 0x6, 0x6, 0x0, 0x0, 0x0, 0x0, 0x6e}, 0x0, 0x100f, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000bc0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x4000, 0x2, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8983, &(0x7f0000000c40)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) 8m3.585699515s ago: executing program 32 (id=3231): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="b80000002900010026bd70001000000000000000000000000000000000000000ff020000000000000000000000000001", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000a7c9043d00000000000000000000000000000000000000000800000000000000000000000000f700bb0000fbffffffffffffff000000000000000202140000000000000000000000000000030000000000000000000000b66b6e000003030100e0c84637ed290eae"], 0xb8}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x3, 0x0) socket$kcm(0x11, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000880)={0x0, 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x0) perf_event_open(&(0x7f0000000b00)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x20104, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000b80), 0x1}, 0x8, 0x2000000000000000, 0x0, 0x2, 0x6, 0x6, 0x0, 0x0, 0x0, 0x0, 0x6e}, 0x0, 0x100f, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000bc0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x4000, 0x2, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8983, &(0x7f0000000c40)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) 2.772407366s ago: executing program 5 (id=6697): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000880), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f00000000c0)='FROZEN\x00', 0x7) 2.555766662s ago: executing program 5 (id=6702): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f00000007c0)={0x0, 0x6000, &(0x7f0000000880)=[{&(0x7f00000008c0)='U', 0xa00120}], 0x1}, 0x3) close(r3) 2.250398938s ago: executing program 1 (id=6709): perf_event_open(&(0x7f0000000900)={0x2, 0x80, 0xaf, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x800, 0x2000000, 0x0, 0x0, 0x6, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200000000000400000000000000008500000030000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007200000095"], &(0x7f0000000340)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r0, 0x0, 0xe, 0x0, &(0x7f0000000400)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.195379379s ago: executing program 5 (id=6710): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8923, &(0x7f0000000640)={'vlan1\x00', @broadcast}) 2.169614685s ago: executing program 0 (id=6712): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001380), 0x0, 0x0) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000001400)={0x0, 0x0}) ioctl$TUNSETSNDBUF(r0, 0x400454d4, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001240)={&(0x7f0000001280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x5}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x1d}, 0x28) bpf$MAP_CREATE(0x300000000000000, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6_vti0\x00', 0x200}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000017c0)='blkio.bfq.idle_time\x00', 0x275a, 0x0) perf_event_open(&(0x7f0000001800)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001880)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001900)=ANY=[@ANYBLOB="0e000000040000000400000003"], 0x48) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001940)={0x2, 0x4, 0x8, 0x1, 0x80, r2, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000019c0)={0x18, 0x1c, &(0x7f0000001a80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0x6, 0x9, 0x0, 0x0, 0x3}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0x6, 0x0}, {0x18, 0x9, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x6, 0x1, 0x5, 0x2}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000001b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0xd, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.987787792s ago: executing program 5 (id=6714): perf_event_open(0x0, 0x0, 0xf, 0xffffffffffffffff, 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000f30000bfa300000000000007030000f0ffffff7a0af0ff0020000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26ffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c1f860d050d694cc7806d294d3665016a7b29da0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d40887c58559b7dcb98a6273b8c651e57f727041c62cea5b7bd24d9f679e4fbe948dfb4cc4a389469608241630459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b83720eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb89872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d0000002000000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebed161980f2fde4f9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc3600040543a34b195c6a8fc054282cd41b264906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e4bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af41000000000000007f5ab0d534b8d63e4ca3be71f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af0be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733097f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99e85b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5359dbdfbf31a562395020becaf3fd1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4b28288e78980c1184d8223edbc4bf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b5524642c248aa813edaa626f0000000000000000000000000000000003ba5bac34b611569a451564d3a5400f9097ffe7a37e765bc652be71ee24250d6d9cf19878dd62c53062d6000c409de6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89ad07963acbd4dd4dc5b4552591edde7a22ad06f7567e6fec2f65011b579bf609d61a3ff4d6f490824bb035995449fc34106ae6889f036d67b6aaee784f855ebc746ac871b5d2031ac0a252ac1f86e93e245f3793cea80b6de773899d49d11d3b1ed79163b111c976cf840a2ef6214a43338fba8c9edb6be26e68fcc5d47ed74a66ce8aba726ab955b9b32ab1890e84a5e2d7476252af25e5c95c5a8b2b1b5c8a2645b017d23c0f169d6ab529cc889bb07889d9e155114cf3e26a50c527ec6d4021cd2cacfea6d7e41e39e26b3967cad65c648b170f12ea9cc69dcee64be0c27b1f4f7f5ce3e62c35602c9d2921326891901661c85b9ee4a0a0b9636bef4c23788494f094abb91ed813b42828aa93105896e0aee851a8087e169a1d69e841257d9053d0cdc3a6ac4f12084cc6470abebe8b344b1f56690a2687b428686c854c21831da277e8b8a21b7b91a46d22ba083eca7b1f8268048cde7d6f237dca42035881b29ca9c8c2937971821b613894297ff6f7796053a4de1fd77e180cc22b205d43bb4a1b59962c1f605ea1b74587100e8d579f157cb45561c357f9976cec6a43388b3049a0d9c171ff6145266ba119d00000000001ef3794a930eb12f3a6215c510bf0bca70c127e9c70cc7bef921249a7f18a0034ce3264a9e96656b47233e2ed7c76520e649c3fd550bdafd77c5cd72b4446d3e157ddd97e7622a6891fb739acd3b2cdaf65ac78490f0641be6e8c6f55bf3d228786895ff5fd5970faacd8a5025aca0aa1931f477ba06aa60051298c8bf7f3b399194f98dc3f4e8513ad06da09dc393c1284515986b8c70ac69512f6c0c04f42edb3a097a11f2ab480e3e391abffae097752300576337c6dd24c4a98280684aa1fe8c7b43ee8bce05fe979b34da18cdb44dbb030b8009cd3b3b44fd8e7b534acd3f1839cb54817668ab446d3d47848429ea831a57f26c8b05dedddceb24483f8f998b05c3ddf85c3799c9000000000000000000000000001e57cf839eb3150d6a076fb7b86fae98dbb46014f483aecb4ec4f0877371bcae8912c78aff857c669760f0e55041563c5c3e8ee4a0eef885fd43fe34a1febc82370d1d07fdfe705ada4764320889000000000000000000000000000000a790af4fc17872b55b10db99e212d18193235659df45627da300959eafc8bfb44f70d250f8f2e86532700254c9a8b14999f59c8b9034c4bb2448eaeff5db21d4a7f3d974790d4c3cba7c402f50585b9289d86400679e5c2bcacb2841ca074d51fdb4a29e84d72b6c996cfbee06aa52cd632e82ba068e8e1572ef2eb414ba5fccfc3c03e64df6a9cc3936c604aa2c0e2ec7b777475023f29b146af003472ce146a5ff997ba53c51026c0096154f9280a34bbf21d66f57a250b5397766122fc86950ce5252e96868cd04df54764cf2082153d6cedd8aaf9700c734aa4a1cb33a2e0a13c5687be4de327511bff9816d13c3219dac1c1535f10243db6f96960ea6a621f5e1b7babbedf0a6bf0cf74123d2e78d01be2b048883a2459eec630fb0293d28d9799fd3a792caff693fd9f002f14c43fb5a1051cc686b7f114d7927eed559bdf2e8ddea3e61d5d942b63fe90230b2e1948fc563ef94d437281671d2fe5032d2a091fa842b0af2e116ba"], &(0x7f00000018c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000001900), 0xfffffedf, 0x10, &(0x7f0000001940)}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001980)={r0, 0x2f00020b, 0xe, 0x0, &(0x7f0000001a00)="ad8b33c216b1161d18f6ab22bb19", 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.986998621s ago: executing program 1 (id=6715): bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0xe, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffdffd, 0x0, 0x0, 0x0, 0x800}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x4a, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r2 = perf_event_open(&(0x7f0000000e40)={0x4, 0x80, 0xc0, 0x2, 0x6, 0x1, 0x0, 0x0, 0x80004, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4000000, 0x2, @perf_bp={&(0x7f0000000080), 0x8}, 0x100a, 0x9, 0x6, 0x0, 0x3d0, 0x3, 0x3, 0x0, 0x30, 0x0, 0xffffffff}, 0x0, 0xb, 0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r2) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) 1.879894431s ago: executing program 4 (id=6716): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0xf7, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x9, 0x81, 0x4, 0x8000, 0x16, 0xffffffffffffffff, 0xffffffff}, 0x50) 1.87189943s ago: executing program 1 (id=6717): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x12, 0x4, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x209, 0x0, 0x0, 0x0, 0x1ffc}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x40}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) 1.767683412s ago: executing program 0 (id=6718): recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x3, 0x7}, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffbfffffffffff, 0xffffffffffffffff, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000ce3b6a996e0287"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a000000800000000642"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 1.767005005s ago: executing program 5 (id=6719): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x140, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x880, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000300)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000440)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0200000004000000080000000100"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10003, 0x1, 0x1, 0xffffffffffffffff, 0x80000001}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000700)) perf_event_open(&(0x7f0000000740)={0x2, 0x80, 0xcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfff, 0xecc}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000008c0)) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) perf_event_open(&(0x7f0000000a40)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000ac0)={0x2, 0x80, 0xaf, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x800, 0x2000000, 0x0, 0x3, 0x0, 0x1000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000b40)={0x2, 0x80, 0x87, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0xfffffffe, 0x2, 0xffff, 0xd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c40)={0x1f, 0x10, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003000000850000008600000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000d80)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000dc0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.697405438s ago: executing program 1 (id=6720): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000001300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0xc}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x13}, 0x94) 1.566385899s ago: executing program 1 (id=6721): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x2f, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x3, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x6a2c, 0x7}, 0x12000, 0x400000, 0x10000000, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.net/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000006c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000a80)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000ac0), 0x12) openat$cgroup_freezer_state(r2, 0x0, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000e80)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0xfffffe95, 0x0, 0x0, 0x0, 0x4d}, 0x2) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, 0x0, 0x0) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) r5 = perf_event_open(&(0x7f0000001540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fd, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xdf}, 0x266, 0x400000, 0x8200, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000015c0), 0x301081, 0x0) close(r6) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8943, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x40082406, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000016c0), 0x0, 0x0) 1.12287307s ago: executing program 1 (id=6724): bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0xa, 0x4, &(0x7f0000000d00)=ANY=[@ANYBLOB="180000000000000000000000000000006118b80000000000"], &(0x7f0000000d40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r0 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500000003000000fa0900008500000041000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r2, 0x0, 0x200040c4) sendmsg$tipc(r2, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) sendmsg$inet(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)="86", 0x1}], 0x1}, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x21, &(0x7f0000000740), 0x4) recvmsg(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000840)=""/210, 0xd2}], 0x1}, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r3 = perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x99, 0x1, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffff91, 0xfffffffffffffff8}, 0x126a0, 0x1000, 0x0, 0x0, 0x0, 0x2, 0x7ff, 0x0, 0x0, 0x0, 0x2}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f0000000f00)='\t!~&\x00\xaeH\xfc\xf7\xf7\xd4\x1c\x94\xcb\r^\xd6<\xda9\xdc\xac(\x8cj\x13hk\xfc\xa8\v#)\xddk\x93\x12\xbfh\x95\xb9\xb7-:\xebr\xf2%\xaf\x8fH\x89MO\xf7\xbe\x1b\xd7\xd7S\b\x00\x00\x00\x00\x00\x00') r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x14, &(0x7f0000000d80)=ANY=[@ANYBLOB="18000000a936b862000000000000ff002ee00000d9c2b7fb28488672662ecf083663139cf140e02553c1d12d1f385f69a6853c74827a5d46a4070157fa92cae915bda4642e765dd95476497f589e33acd8441885b8b56ed4332b633ff9ee29db5e4cddc7d6735465af289882ae33c1c085be7139e9ac45ad53dbf0cae00b188734540446f9", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000010000008500000006000000950000000000"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x60, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x6, 0xd, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000ac0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b00)={{r5}, &(0x7f0000000b40), &(0x7f0000000b80)=r6}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000bc0)={r6, 0x5, 0x3100, 0x3100, &(0x7f0000000c40), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r7, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000000)={0x3, 0x80, 0x92, 0x8, 0x8, 0x5, 0x0, 0x2, 0x400, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x6, 0x0, @perf_config_ext={0x5d, 0x8}, 0x2000, 0x3, 0x5, 0x3, 0x7ff, 0x2, 0x6, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x4, r0, 0xa) syz_clone(0x40100000, 0x0, 0x0, 0x0, 0x0, 0x0) 1.06665937s ago: executing program 0 (id=6725): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'gre0\x00', 0x10}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00000084000000000100000100000000", @ANYRESHEX=0x0], 0x50) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)) 1.066401313s ago: executing program 4 (id=6726): bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) 1.065937745s ago: executing program 3 (id=6727): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'gre0\x00', 0x10}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@o_path={&(0x7f0000000040)='./file0\x00', 0x0, 0x4000}, 0x18) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f2, &(0x7f0000000080)) 903.215376ms ago: executing program 4 (id=6728): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd28, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x13, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000000085000000700000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000800000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0x10, 0xfffffef3, &(0x7f0000000400)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000580)=""/8, 0x5562, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) 902.541083ms ago: executing program 5 (id=6729): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e000000040000000800000008", @ANYRES8=r1], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000780)={0xffffffffffffffff, 0x0, 0x0}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x8b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x9, 0x100000000}, 0x9, 0x0, 0x0, 0x6, 0x0, 0xfffffff9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) 835.654956ms ago: executing program 3 (id=6730): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x41, 0x2, 0x0, 0x0, 0x0, 0x0, 0x91c, 0x4156, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xfffffffffffffff8, 0x1}, 0x12640, 0x0, 0xfffffffe, 0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000300)={0x5, 0x80, 0xec, 0x5, 0x42, 0x7, 0x0, 0x0, 0x9d6d1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x4}, 0x10137f, 0x7ff, 0x7, 0x0, 0x81, 0xfffffffe, 0x5, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/17], 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000280)=""/73}, 0x20) 828.75016ms ago: executing program 0 (id=6731): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000004c0)=""/240, 0xf0}], 0x1}, 0x11e01) sendmsg$tipc(r3, &(0x7f0000000680)={0x0, 0xfffffff5, &(0x7f00000006c0)=[{&(0x7f0000000700)="a2", 0xfffffdef}], 0x1}, 0x0) close(r2) 599.165584ms ago: executing program 4 (id=6732): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=@base={0x12, 0x7, 0x4, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000180)=r3) write$cgroup_devices(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 598.395959ms ago: executing program 3 (id=6733): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000bc0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x6, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x1f, 0x2, &(0x7f0000000900)=ANY=[@ANYBLOB="85000000a800"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x13}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x5, 0x3, &(0x7f00000007c0)=@framed, &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r4) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000000800000850000005000000095"], 0x0}, 0x94) r5 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xfe10a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe2, 0x0, @perf_bp={0x0, 0x8}, 0x44, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xfeefffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 523.31011ms ago: executing program 0 (id=6734): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x6a2c, 0x7}, 0x12000, 0x400000, 0x10000000, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980), 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x13, 0x10, &(0x7f0000001000)=@framed={{0x18, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x407}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000001340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001380)={r3, 0xfffff000, 0xe, 0x0, &(0x7f0000001400)="882f1242a03c3f98722780b605a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 429.307987ms ago: executing program 3 (id=6735): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x4, 0xe, &(0x7f0000000280)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b70500000100001b6a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3efd9af115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b0600000016cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d394d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d2889ac04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc30000000000000000c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20ba82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818709e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec527c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f128ddfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac45f0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38509582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c6d6e7c9d49db1b2a6082bb0e8b013bd1ee3612cd43cd2a3cb83754bb34081599ce2a33600d4120353e477237c1dcf66b6a353aa1832d60179da56951d2b77e91c3e73fc7285d1ed2722a30c10f9cfd4a20ae6dc32f5d90a9290b393daff597ad7d5d3e5a73b25002ad928c92bd3d1be2444ff00f6b7719f06ddca6b48db95a746032d5ca0d4c460bb30a43ed735504192cb6ce50eed19a552101cb7bbf82c4924e2a862bd51ebaeb8e15e5428a87b56b81eff64a75baf33ae2b67b55a724cbbe788a8d8ece234a81e90186aca593260d559c0cb2f2be882288db291b231b8d"], &(0x7f0000001040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001080), 0xfffffedf, 0x10, &(0x7f00000010c0), 0xffffff95, 0x0, 0xffffffffffffffff, 0xd}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001100)={r0, 0x0, 0xe, 0x0, &(0x7f0000001180)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x9ffc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 262.914552ms ago: executing program 4 (id=6736): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x5, 0x5, 0x2, 0x4}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r2}, &(0x7f0000000000), &(0x7f0000000080)=r4}, 0x20) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r1, &(0x7f00000006c0)={0x0, 0xfffffffffffffe96, 0x0, 0x0, 0x0, 0x0, 0x20000001}, 0x40000) 262.418873ms ago: executing program 0 (id=6737): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000011c0)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000001200)={0x2, &(0x7f0000001240)=[{0x20, 0x0, 0xfd, 0xfffff020}, {0x6, 0x81, 0x3f, 0x1000000d}]}) 240.279247ms ago: executing program 3 (id=6738): bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xa, 0x4, 0x2, 0x1, 0x0, 0xffffffffffffffff, 0xe92}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfff, 0xecc}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8804}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x3, &(0x7f0000000800)=@framed, &(0x7f0000000840)='syzkaller\x00'}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001040)) perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x0, 0x2000000, 0x0, 0x6, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x2000035e, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000630120000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 139.75231ms ago: executing program 4 (id=6739): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdffffde18000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) 0s ago: executing program 3 (id=6740): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={r0, 0x18000000000002a0, 0x12, 0x0, &(0x7f0000000200)="00fd03f6990d69301291ff9e14ff9aaee6a8", 0x0, 0x9, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) kernel console output (not intermixed with test programs): 50] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.999099][T24950] RIP: 0033:0x7f634d99f559 [ 890.999119][T24950] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 890.999157][T24950] RSP: 002b:00007f634e807028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 890.999181][T24950] RAX: ffffffffffffffda RBX: 00007f634dc25fa0 RCX: 00007f634d99f559 [ 890.999199][T24950] RDX: 000000000000fe33 RSI: 0000200000001dc0 RDI: 0000000000000005 [ 890.999214][T24950] RBP: 00007f634e807090 R08: 0000000000000000 R09: 0000000000000000 [ 890.999246][T24950] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 890.999267][T24950] R13: 00007f634dc26038 R14: 00007f634dc25fa0 R15: 00007ffe8d66c3c8 [ 890.999305][T24950] [ 891.502805][T24962] netlink: 'syz.4.5810': attribute type 2 has an invalid length. [ 891.502830][T24962] __nla_validate_parse: 6 callbacks suppressed [ 891.502846][T24962] netlink: 100 bytes leftover after parsing attributes in process `syz.4.5810'. [ 892.094848][T24973] netlink: 316 bytes leftover after parsing attributes in process `syz.1.5813'. [ 892.127867][T24972] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 892.196239][T24978] netlink: 288 bytes leftover after parsing attributes in process `syz.0.5816'. [ 892.255737][T24978] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5816'. [ 892.458830][T24987] netlink: 'syz.3.5817': attribute type 10 has an invalid length. [ 892.612520][T24992] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 892.632407][T24992] netlink: 168 bytes leftover after parsing attributes in process `syz.5.5820'. [ 892.986883][T25007] netlink: 'syz.1.5826': attribute type 10 has an invalid length. [ 893.236358][T25014] netlink: 316 bytes leftover after parsing attributes in process `syz.5.5828'. [ 893.305623][T25012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 893.537944][T25025] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 893.579726][T25025] netlink: 168 bytes leftover after parsing attributes in process `syz.5.5834'. [ 893.745570][T25026] netlink: 10 bytes leftover after parsing attributes in process `syz.1.5832'. [ 893.775147][T25033] netlink: 14601 bytes leftover after parsing attributes in process `syz.0.5836'. [ 893.776721][T25033] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5836'. [ 894.173397][T25041] netlink: 'syz.1.5839': attribute type 10 has an invalid length. [ 894.223461][T25043] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 894.241542][T25043] netlink: 'syz.3.5840': attribute type 32 has an invalid length. [ 894.332680][T25051] netlink: 'syz.4.5843': attribute type 2 has an invalid length. [ 894.332700][T25051] netlink: 'syz.4.5843': attribute type 8 has an invalid length. [ 894.493403][T25050] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 894.589345][T25062] netlink: 'syz.3.5847': attribute type 10 has an invalid length. [ 895.893690][T25087] netlink: 'syz.1.5855': attribute type 10 has an invalid length. [ 895.918154][T25089] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 895.931599][T25089] netlink: 'syz.4.5857': attribute type 32 has an invalid length. [ 896.128073][T25093] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 896.536476][T25115] __nla_validate_parse: 10 callbacks suppressed [ 896.536511][T25115] netlink: 288 bytes leftover after parsing attributes in process `syz.1.5866'. [ 896.568407][T25115] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5866'. [ 896.587633][T25112] validate_nla: 2 callbacks suppressed [ 896.587667][T25112] netlink: 'syz.4.5861': attribute type 10 has an invalid length. [ 896.994599][T25127] netlink: 'syz.3.5872': attribute type 10 has an invalid length. [ 897.129395][T25133] netlink: 316 bytes leftover after parsing attributes in process `syz.3.5874'. [ 897.147764][T25132] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 897.205018][T25131] netlink: 'syz.4.5873': attribute type 28 has an invalid length. [ 897.205089][T25131] netlink: 'syz.4.5873': attribute type 29 has an invalid length. [ 897.205139][T25131] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5873'. [ 897.302879][T25138] netlink: 'syz.5.5876': attribute type 28 has an invalid length. [ 897.302948][T25138] netlink: 'syz.5.5876': attribute type 29 has an invalid length. [ 897.302997][T25138] netlink: 132 bytes leftover after parsing attributes in process `syz.5.5876'. [ 897.350121][T25143] netlink: 288 bytes leftover after parsing attributes in process `syz.4.5878'. [ 897.374389][T25143] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5878'. [ 897.393422][T25140] netlink: 'syz.3.5877': attribute type 5 has an invalid length. [ 897.620464][T25149] netlink: 288 bytes leftover after parsing attributes in process `syz.5.5881'. [ 897.702973][T25151] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 897.718135][T25151] netlink: 168 bytes leftover after parsing attributes in process `syz.0.5880'. [ 897.728944][T25149] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5881'. [ 898.091104][T25159] netlink: 'syz.1.5885': attribute type 10 has an invalid length. [ 898.184179][T25163] netlink: 'syz.4.5886': attribute type 1 has an invalid length. [ 898.249446][T25167] netlink: 'syz.0.5887': attribute type 39 has an invalid length. [ 900.307214][T25233] FAULT_INJECTION: forcing a failure. [ 900.307214][T25233] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 900.307249][T25233] CPU: 1 UID: 0 PID: 25233 Comm: syz.0.5913 Not tainted syzkaller #0 PREEMPT(full) [ 900.307276][T25233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 900.307290][T25233] Call Trace: [ 900.307300][T25233] [ 900.307311][T25233] dump_stack_lvl+0xe8/0x150 [ 900.307355][T25233] should_fail_ex+0x3eb/0x540 [ 900.307392][T25233] _copy_to_user+0x31/0xb0 [ 900.307424][T25233] simple_read_from_buffer+0xe1/0x170 [ 900.307462][T25233] proc_fail_nth_read+0x1bb/0x230 [ 900.307505][T25233] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 900.307557][T25233] ? rw_verify_area+0x24a/0x4c0 [ 900.307591][T25233] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 900.307628][T25233] vfs_read+0x213/0xa80 [ 900.307667][T25233] ? __pfx___mutex_lock+0x10/0x10 [ 900.307696][T25233] ? __pfx_vfs_read+0x10/0x10 [ 900.307741][T25233] ? __fget_files+0x2a/0x420 [ 900.307767][T25233] ? __fget_files+0x3a2/0x420 [ 900.307793][T25233] ? __fget_files+0x2a/0x420 [ 900.307830][T25233] ? fdget+0x1ac/0x250 [ 900.307868][T25233] ksys_read+0x150/0x270 [ 900.307903][T25233] ? __pfx_ksys_read+0x10/0x10 [ 900.307951][T25233] do_syscall_64+0x166/0x520 [ 900.307975][T25233] ? trace_irq_disable+0x3b/0x140 [ 900.308017][T25233] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.308041][T25233] ? clear_bhb_loop+0x70/0xc0 [ 900.308069][T25233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.308091][T25233] RIP: 0033:0x7f9e12b5fd8e [ 900.308111][T25233] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 900.308130][T25233] RSP: 002b:00007f9e13ad4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 900.308152][T25233] RAX: ffffffffffffffda RBX: 00007f9e13ad56c0 RCX: 00007f9e12b5fd8e [ 900.308168][T25233] RDX: 000000000000000f RSI: 00007f9e13ad50a0 RDI: 0000000000000005 [ 900.308182][T25233] RBP: 00007f9e13ad5090 R08: 0000000000000000 R09: 0000000000000000 [ 900.308195][T25233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.308208][T25233] R13: 00007f9e12e26038 R14: 00007f9e12e25fa0 R15: 00007ffd9fc65328 [ 900.308248][T25233] [ 901.143021][T25242] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 901.635230][T25267] validate_nla: 12 callbacks suppressed [ 901.635271][T25267] netlink: 'syz.5.5926': attribute type 35 has an invalid length. [ 901.964523][T25280] netlink: 'syz.5.5929': attribute type 10 has an invalid length. [ 902.088243][T25287] FAULT_INJECTION: forcing a failure. [ 902.088243][T25287] name failslab, interval 1, probability 0, space 0, times 0 [ 902.088367][T25287] CPU: 0 UID: 0 PID: 25287 Comm: syz.4.5932 Not tainted syzkaller #0 PREEMPT(full) [ 902.088391][T25287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 902.088402][T25287] Call Trace: [ 902.088410][T25287] [ 902.088419][T25287] dump_stack_lvl+0xe8/0x150 [ 902.088454][T25287] should_fail_ex+0x3eb/0x540 [ 902.088481][T25287] should_failslab+0xa8/0x100 [ 902.088511][T25287] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 902.088538][T25287] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 902.088564][T25287] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 902.088594][T25287] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 902.088622][T25287] krealloc_node_align_noprof+0x19a/0x390 [ 902.088648][T25287] ? bpf_lsm_capable+0x9/0x20 [ 902.088667][T25287] ? security_capable+0x7e/0x2c0 [ 902.088696][T25287] kvrealloc_node_align_noprof+0x7b/0xf0 [ 902.088726][T25287] bpf_iarray_realloc+0x34/0xa0 [ 902.088754][T25287] bpf_check+0x17a6/0x34e0 [ 902.088775][T25287] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 902.088818][T25287] ? ktime_get_with_offset+0x93/0x2d0 [ 902.088847][T25287] ? __pfx_bpf_check+0x10/0x10 [ 902.088870][T25287] ? bpf_obj_name_cpy+0x194/0x1e0 [ 902.088900][T25287] bpf_prog_load+0x14da/0x1c60 [ 902.088932][T25287] ? __pfx_bpf_prog_load+0x10/0x10 [ 902.088968][T25287] ? __might_fault+0xaf/0x130 [ 902.088995][T25287] __sys_bpf+0xd86/0xe00 [ 902.089022][T25287] ? __pfx___sys_bpf+0x10/0x10 [ 902.089052][T25287] ? __fget_files+0x2a/0x420 [ 902.089093][T25287] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 902.089122][T25287] ? ksys_write+0x242/0x270 [ 902.089150][T25287] ? __pfx_ksys_write+0x10/0x10 [ 902.089181][T25287] __x64_sys_bpf+0xba/0xd0 [ 902.089213][T25287] do_syscall_64+0x166/0x520 [ 902.089233][T25287] ? trace_irq_disable+0x3b/0x140 [ 902.089260][T25287] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.089280][T25287] ? clear_bhb_loop+0x70/0xc0 [ 902.089313][T25287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.089334][T25287] RIP: 0033:0x7f634d99f559 [ 902.089352][T25287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 902.089370][T25287] RSP: 002b:00007f634e807028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 902.089395][T25287] RAX: ffffffffffffffda RBX: 00007f634dc25fa0 RCX: 00007f634d99f559 [ 902.089409][T25287] RDX: 0000000000000094 RSI: 0000200000000580 RDI: 0000000000000005 [ 902.089422][T25287] RBP: 00007f634e807090 R08: 0000000000000000 R09: 0000000000000000 [ 902.089435][T25287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 902.089447][T25287] R13: 00007f634dc26038 R14: 00007f634dc25fa0 R15: 00007ffe8d66c3c8 [ 902.089478][T25287] [ 902.633499][T25290] __nla_validate_parse: 15 callbacks suppressed [ 902.633571][T25290] netlink: 316 bytes leftover after parsing attributes in process `syz.4.5933'. [ 902.685029][T25289] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 903.029385][T25303] netlink: 'syz.1.5939': attribute type 35 has an invalid length. [ 903.126626][T25308] netlink: 'syz.0.5941': attribute type 39 has an invalid length. [ 903.455550][T25320] netlink: 10 bytes leftover after parsing attributes in process `syz.3.5940'. [ 903.908485][T25331] FAULT_INJECTION: forcing a failure. [ 903.908485][T25331] name failslab, interval 1, probability 0, space 0, times 0 [ 903.908550][T25331] CPU: 0 UID: 0 PID: 25331 Comm: syz.3.5945 Not tainted syzkaller #0 PREEMPT(full) [ 903.908574][T25331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 903.908586][T25331] Call Trace: [ 903.908594][T25331] [ 903.908603][T25331] dump_stack_lvl+0xe8/0x150 [ 903.908648][T25331] should_fail_ex+0x3eb/0x540 [ 903.908676][T25331] should_failslab+0xa8/0x100 [ 903.908709][T25331] __kmalloc_noprof+0xf9/0x710 [ 903.908733][T25331] ? tcf_idr_create+0x5d/0x6b0 [ 903.908761][T25331] ? tcf_idr_create+0x5d/0x6b0 [ 903.908796][T25331] tcf_idr_create+0x5d/0x6b0 [ 903.908825][T25331] ? __nla_parse+0x40/0x60 [ 903.908854][T25331] tcf_bpf_init+0x2e5/0x960 [ 903.908956][T25331] ? __pfx_tcf_bpf_init+0x10/0x10 [ 903.908985][T25331] ? rcu_is_watching+0x16/0xb0 [ 903.909018][T25331] ? __kasan_kmalloc+0x93/0xb0 [ 903.909054][T25331] ? nla_memcpy+0x5b/0xc0 [ 903.909087][T25331] tcf_action_init_1+0x4ba/0x740 [ 903.909125][T25331] ? __pfx_tcf_action_init_1+0x10/0x10 [ 903.909155][T25331] ? _raw_read_unlock+0x28/0x50 [ 903.909184][T25331] ? tc_action_load_ops+0x247/0x540 [ 903.909234][T25331] ? __nla_parse+0x40/0x60 [ 903.909262][T25331] tcf_action_init+0x31f/0xac0 [ 903.909306][T25331] ? __pfx_tcf_action_init+0x10/0x10 [ 903.909333][T25331] ? ktime_get+0x45/0x220 [ 903.909384][T25331] ? __raw_callee_save_pv_queued_spin_unlock_traced+0x15/0x40 [ 903.909448][T25331] tc_ctl_action+0x44a/0xc80 [ 903.909469][T25331] ? lockdep_hardirqs_on+0x7b/0x110 [ 903.909519][T25331] ? __pfx_tc_ctl_action+0x10/0x10 [ 903.909565][T25331] ? irqentry_exit+0x2a0/0x9b0 [ 903.909588][T25331] ? __pfx_hook_capable+0x10/0x10 [ 903.909627][T25331] ? irqentry_exit+0x2a0/0x9b0 [ 903.909674][T25331] ? __pfx___mutex_lock+0x10/0x10 [ 903.909718][T25331] ? __pfx_tc_ctl_action+0x10/0x10 [ 903.909746][T25331] rtnetlink_rcv_msg+0x7b9/0xc00 [ 903.909805][T25331] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 903.909839][T25331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 903.909873][T25331] ? perf_trace_preemptirq_template+0x270/0x350 [ 903.909910][T25331] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 903.909946][T25331] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 903.909989][T25331] netlink_rcv_skb+0x226/0x4a0 [ 903.910021][T25331] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 903.910059][T25331] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 903.910119][T25331] netlink_unicast+0x8ef/0xa80 [ 903.910167][T25331] netlink_sendmsg+0x7f0/0xb20 [ 903.910206][T25331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 903.910242][T25331] ? aa_sock_msg_perm+0x144/0x210 [ 903.910281][T25331] ? apparmor_socket_sendmsg+0x98/0x360 [ 903.910314][T25331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 903.910344][T25331] sock_sendmsg_nosec+0x14e/0x190 [ 903.910376][T25331] ____sys_sendmsg+0x54e/0x850 [ 903.910419][T25331] ? __pfx_____sys_sendmsg+0x10/0x10 [ 903.910467][T25331] ? import_iovec+0x73/0xa0 [ 903.910498][T25331] ___sys_sendmsg+0x2a5/0x360 [ 903.910541][T25331] ? __pfx____sys_sendmsg+0x10/0x10 [ 903.910583][T25331] ? pv_queued_spin_unlock_traced+0x5a/0x1b0 [ 903.910633][T25331] ? lockdep_hardirqs_on+0x7b/0x110 [ 903.910678][T25331] ? __x64_sys_sendmsg+0x196/0x290 [ 903.910721][T25331] __x64_sys_sendmsg+0x1b1/0x290 [ 903.910767][T25331] ? perf_trace_preemptirq_template+0x270/0x350 [ 903.910801][T25331] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 903.910860][T25331] do_syscall_64+0x166/0x520 [ 903.910883][T25331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.910916][T25331] ? clear_bhb_loop+0x70/0xc0 [ 903.910942][T25331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.910963][T25331] RIP: 0033:0x7f973259f559 [ 903.910982][T25331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 903.911013][T25331] RSP: 002b:00007f973340b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 903.911034][T25331] RAX: ffffffffffffffda RBX: 00007f9732825fa0 RCX: 00007f973259f559 [ 903.911049][T25331] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000007 [ 903.911062][T25331] RBP: 00007f973340b090 R08: 0000000000000000 R09: 0000000000000000 [ 903.911074][T25331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 903.911086][T25331] R13: 00007f9732826038 R14: 00007f9732825fa0 R15: 00007ffe93028188 [ 903.911119][T25331] [ 904.044805][T25331] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5945'. [ 904.044865][T25331] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5945'. [ 904.636982][T25339] netlink: 316 bytes leftover after parsing attributes in process `syz.0.5948'. [ 904.657029][T25337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 905.047566][T15919] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 905.064191][T15919] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 905.065099][T15919] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 905.066411][T15919] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 905.067215][T15919] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 905.733745][T25359] netlink: 'syz.1.5954': attribute type 35 has an invalid length. [ 906.105272][T25372] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5956'. [ 906.105301][T25372] netlink: 'syz.0.5956': attribute type 1 has an invalid length. [ 906.247371][ T3006] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.275164][T25375] tmpfs: Bad value for 'uid' [ 906.275183][T25375] tmpfs: Bad value for 'uid' [ 906.329325][T25345] rxe_eth0 speed is unknown, defaulting to 1000 [ 906.406841][ T3006] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.483870][T25381] veth1_macvtap: left promiscuous mode [ 906.483900][T25381] macsec0: entered promiscuous mode [ 906.618160][ T3006] netdevsim netdevsim3 netdevsim1 (unregistering): left promiscuous mode [ 906.635742][ T3006] team0: Port device netdevsim1 removed [ 906.637014][ T3006] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.875960][ T3006] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.932741][T25389] netlink: 316 bytes leftover after parsing attributes in process `syz.0.5962'. [ 906.958981][T25388] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 907.170850][T15919] Bluetooth: hci1: command tx timeout [ 907.407075][T25345] lo speed is unknown, defaulting to 1000 [ 907.774826][ T3006] bridge_slave_1: left allmulticast mode [ 907.775058][ T3006] bridge0: port 2(bridge_slave_1) entered disabled state [ 907.819832][ T3006] bridge_slave_0: left allmulticast mode [ 907.820027][ T3006] bridge0: port 1(bridge_slave_0) entered disabled state [ 908.135913][T25418] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5966'. [ 908.280093][T25432] netlink: 'syz.1.5967': attribute type 35 has an invalid length. [ 908.597076][T25442] netlink: 'syz.5.5968': attribute type 10 has an invalid length. [ 908.626356][ T3006] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 908.643160][ T3006] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 908.649334][ T3006] bond0 (unregistering): Released all slaves [ 908.687400][T25418] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5966'. [ 908.701126][T25418] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 908.704346][T25345] wg0 speed is unknown, defaulting to 1000 [ 908.714942][T25345] lo speed is unknown, defaulting to 1000 [ 908.788953][ T5297] 8021q: adding VLAN 0 to HW filter on device eth5 [ 909.250755][T15919] Bluetooth: hci1: command tx timeout [ 909.648352][T25458] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5973'. [ 909.679138][T25458] netlink: 'syz.5.5973': attribute type 1 has an invalid length. [ 909.679159][T25458] netlink: 96 bytes leftover after parsing attributes in process `syz.5.5973'. [ 909.842019][T25466] netlink: 316 bytes leftover after parsing attributes in process `syz.4.5974'. [ 909.869696][T25462] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 910.102502][T25478] netlink: 288 bytes leftover after parsing attributes in process `syz.5.5977'. [ 910.187153][T25478] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5977'. [ 910.854660][T25494] netlink: 'syz.0.5979': attribute type 10 has an invalid length. [ 910.889294][T25499] netlink: 'syz.1.5980': attribute type 10 has an invalid length. [ 911.005384][T25505] netlink: 'syz.5.5982': attribute type 28 has an invalid length. [ 911.005429][T25505] netlink: 'syz.5.5982': attribute type 29 has an invalid length. [ 911.005496][T25505] netlink: 132 bytes leftover after parsing attributes in process `syz.5.5982'. [ 911.330673][T15919] Bluetooth: hci1: command tx timeout [ 911.412282][T25517] netlink: 'syz.4.5983': attribute type 35 has an invalid length. [ 911.430002][ T5297] 8021q: adding VLAN 0 to HW filter on device eth6 [ 911.539438][T25345] bridge0: port 1(bridge_slave_0) entered blocking state [ 911.539662][T25345] bridge0: port 1(bridge_slave_0) entered disabled state [ 911.539816][T25345] bridge_slave_0: entered allmulticast mode [ 911.567546][T25345] bridge_slave_0: entered promiscuous mode [ 911.578890][T25345] bridge0: port 2(bridge_slave_1) entered blocking state [ 911.579001][T25345] bridge0: port 2(bridge_slave_1) entered disabled state [ 911.583557][T25345] bridge_slave_1: entered allmulticast mode [ 911.602728][T25522] netlink: 316 bytes leftover after parsing attributes in process `syz.0.5987'. [ 911.603067][T25345] bridge_slave_1: entered promiscuous mode [ 911.609187][T25521] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 911.786374][T25345] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 911.804941][T25345] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 911.859931][T25523] netlink: 10 bytes leftover after parsing attributes in process `syz.1.5986'. [ 911.934138][T25345] team0: Port device team_slave_0 added [ 911.955281][T25345] team0: Port device team_slave_1 added [ 912.219779][T25548] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 912.226095][T25548] netlink: 'syz.5.5991': attribute type 32 has an invalid length. [ 912.582763][T25345] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 912.582782][T25345] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 912.582810][T25345] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 912.719474][T25345] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 912.719495][T25345] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 912.719525][T25345] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 912.729472][ T5297] 8021q: adding VLAN 0 to HW filter on device eth7 [ 912.900766][T25345] hsr_slave_0: entered promiscuous mode [ 912.902067][T25345] hsr_slave_1: entered promiscuous mode [ 913.071540][T25576] netlink: 'syz.4.5994': attribute type 10 has an invalid length. [ 913.412002][T15919] Bluetooth: hci1: command tx timeout [ 913.735200][T25598] __nla_validate_parse: 2 callbacks suppressed [ 913.735233][T25598] netlink: 288 bytes leftover after parsing attributes in process `syz.5.6000'. [ 913.807214][T25598] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6000'. [ 913.939710][T25596] validate_nla: 2 callbacks suppressed [ 913.939755][T25596] netlink: 'syz.4.5999': attribute type 35 has an invalid length. [ 914.057264][T25607] netlink: 'syz.1.6003': attribute type 39 has an invalid length. [ 914.178948][T25609] netlink: 'syz.0.6002': attribute type 10 has an invalid length. [ 915.268316][T25649] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6008'. [ 915.331765][T25652] netlink: 'syz.5.6009': attribute type 10 has an invalid length. [ 915.588397][T25345] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 915.604583][T25659] netlink: 'syz.4.6013': attribute type 35 has an invalid length. [ 915.625983][T25345] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 915.650171][T25345] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 915.677532][T25345] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 915.678471][T25661] netlink: 10 bytes leftover after parsing attributes in process `syz.0.6014'. [ 915.765964][T25345] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 915.787559][T25345] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 915.788456][T25345] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 915.807647][T25345] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 915.883210][T25665] netlink: 'syz.1.6015': attribute type 10 has an invalid length. [ 916.075385][T25686] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6018'. [ 916.107464][T25683] netlink: 288 bytes leftover after parsing attributes in process `syz.4.6018'. [ 916.389149][T25700] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6020'. [ 916.441579][T25698] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6020'. [ 916.449671][T25698] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 916.997616][T25691] netlink: 10 bytes leftover after parsing attributes in process `syz.0.6019'. [ 917.273455][T25345] 8021q: adding VLAN 0 to HW filter on device bond0 [ 917.276076][T25717] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6022'. [ 917.293075][T25728] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 917.404171][T25345] 8021q: adding VLAN 0 to HW filter on device team0 [ 917.463678][ T1434] bridge0: port 1(bridge_slave_0) entered blocking state [ 917.463781][ T1434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 917.517414][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 917.517522][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 917.743624][T25738] xt_nfacct: accounting object `syz0' does not exist [ 917.820282][T25738] netlink: 'syz.4.6027': attribute type 28 has an invalid length. [ 917.820324][T25738] netlink: 'syz.4.6027': attribute type 29 has an invalid length. [ 918.229279][T25752] netlink: 'syz.0.6029': attribute type 10 has an invalid length. [ 919.075078][ T3006] team0 (unregistering): Port device team_slave_1 removed [ 919.113933][ T3006] team0 (unregistering): Port device team_slave_0 removed [ 919.458836][ T150] smc: removing ib device syz2 [ 919.487542][ T1434] smbdirect: ib_dev[syz_device_name_32_chars_1234567] removed [ 919.518896][ T150] smbdirect: ib_dev[syz2] removed [ 919.649686][ T52] infiniband syz_device_name_32_chars_1234567: ib_query_port failed (-19) [ 919.650208][T25762] __nla_validate_parse: 5 callbacks suppressed [ 919.650237][T25762] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6032'. [ 919.692806][T25762] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 920.189976][T25793] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6034'. [ 920.190137][T25793] netlink: 30 bytes leftover after parsing attributes in process `syz.5.6034'. [ 920.256174][T25796] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 920.430409][T25345] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 920.508849][T25804] netlink: 'syz.0.6037': attribute type 28 has an invalid length. [ 920.508889][T25804] netlink: 'syz.0.6037': attribute type 29 has an invalid length. [ 920.508935][T25804] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6037'. [ 920.666354][T25345] veth0_vlan: entered promiscuous mode [ 920.738652][T25813] netlink: 288 bytes leftover after parsing attributes in process `syz.5.6040'. [ 920.743340][T25345] veth1_vlan: entered promiscuous mode [ 920.862222][T25813] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6040'. [ 920.936399][T25345] veth0_macvtap: entered promiscuous mode [ 920.966506][T25345] veth1_macvtap: entered promiscuous mode [ 921.335881][T25825] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6044'. [ 921.441183][T25828] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 921.447840][T25828] netlink: 'syz.1.6043': attribute type 32 has an invalid length. [ 921.519108][T25345] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 921.584838][T25829] netlink: 'syz.0.6042': attribute type 10 has an invalid length. [ 921.645335][T25821] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6044'. [ 921.662293][T25821] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 921.685125][T25345] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 921.820669][ T1434] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.820713][ T1434] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.820747][ T1434] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 921.820780][ T1434] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 922.191988][T25832] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6045'. [ 922.192116][ T86] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.192133][ T86] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 922.192148][T25832] netlink: 30 bytes leftover after parsing attributes in process `syz.5.6045'. [ 922.397503][T25840] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 922.417232][T25840] netlink: 'syz.4.6046': attribute type 32 has an invalid length. [ 922.702738][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 922.702761][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 923.059964][T25852] netlink: 'syz.5.6049': attribute type 1 has an invalid length. [ 923.059994][T25852] netlink: 'syz.5.6049': attribute type 4 has an invalid length. [ 923.637658][T25863] netlink: 'syz.0.6052': attribute type 1 has an invalid length. [ 924.373457][T25872] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 924.799435][T25892] __nla_validate_parse: 6 callbacks suppressed [ 924.799456][T25892] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6058'. [ 924.858733][T25894] netlink: 'syz.3.6059': attribute type 10 has an invalid length. [ 924.900928][T25896] netlink: 'syz.5.6057': attribute type 10 has an invalid length. [ 926.099375][T25910] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6064'. [ 926.374457][ C1] ip6_tunnel:  xmit: Local address not yet configured! [ 927.383555][T25888] netlink: 288 bytes leftover after parsing attributes in process `syz.0.6058'. [ 927.388327][T25894] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 927.389979][T25894] team0: Port device netdevsim1 added [ 927.458548][T25909] netlink: 288 bytes leftover after parsing attributes in process `syz.4.6064'. [ 927.509865][T25913] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6066'. [ 927.509890][T25913] netlink: 'syz.5.6066': attribute type 1 has an invalid length. [ 928.033222][T25925] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6070'. [ 928.056200][T25925] netlink: 128 bytes leftover after parsing attributes in process `syz.5.6070'. [ 928.083459][T25925] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 928.308498][T25930] netlink: 'syz.4.6068': attribute type 10 has an invalid length. [ 928.384843][T25932] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6071'. [ 928.385449][T25932] netlink: 30 bytes leftover after parsing attributes in process `syz.1.6071'. [ 928.692399][ T5646] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 928.693669][ T5646] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 928.694512][ T5646] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 928.696554][ T5646] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 928.698433][ T5646] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 928.960023][T25948] netlink: 'syz.1.6075': attribute type 10 has an invalid length. [ 929.412899][ T31] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 929.467951][T25960] netlink: 288 bytes leftover after parsing attributes in process `syz.4.6077'. [ 929.497867][T25941] rxe_eth0 speed is unknown, defaulting to 1000 [ 929.617180][ T31] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 929.843471][T25969] __nla_validate_parse: 1 callbacks suppressed [ 929.843491][T25969] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6080'. [ 929.843511][T25969] netlink: 'syz.5.6080': attribute type 1 has an invalid length. [ 929.939758][T25941] wg0 speed is unknown, defaulting to 1000 [ 929.999708][ T31] team0: Port device netdevsim1 removed [ 930.004026][ T31] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.188366][ T31] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.220228][T25979] netlink: 288 bytes leftover after parsing attributes in process `syz.1.6084'. [ 930.262686][T25979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6084'. [ 930.772946][ T5646] Bluetooth: hci5: command tx timeout [ 930.791755][ T31] bridge_slave_1: left allmulticast mode [ 930.791779][ T31] bridge_slave_1: left promiscuous mode [ 930.792020][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 930.795659][ T31] bridge_slave_0: left allmulticast mode [ 930.795681][ T31] bridge_slave_0: left promiscuous mode [ 930.798438][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 930.947219][T25995] FAULT_INJECTION: forcing a failure. [ 930.947219][T25995] name failslab, interval 1, probability 0, space 0, times 0 [ 930.947252][T25995] CPU: 1 UID: 0 PID: 25995 Comm: syz.1.6088 Not tainted syzkaller #0 PREEMPT(full) [ 930.947281][T25995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 930.947295][T25995] Call Trace: [ 930.947304][T25995] [ 930.947314][T25995] dump_stack_lvl+0xe8/0x150 [ 930.947358][T25995] should_fail_ex+0x3eb/0x540 [ 930.947392][T25995] should_failslab+0xa8/0x100 [ 930.947429][T25995] __kmalloc_noprof+0xf9/0x710 [ 930.947454][T25995] ? __kasan_kmalloc+0x93/0xb0 [ 930.947484][T25995] ? nla_strdup+0x9d/0x140 [ 930.947511][T25995] ? nla_strdup+0x9d/0x140 [ 930.947540][T25995] ? __kmalloc_cache_noprof+0x148/0x600 [ 930.947584][T25995] nla_strdup+0x9d/0x140 [ 930.947614][T25995] nf_tables_newchain+0x1aba/0x28b0 [ 930.947666][T25995] ? __pfx_nf_tables_newchain+0x10/0x10 [ 930.947735][T25995] ? lock_acquire+0x115/0x350 [ 930.947770][T25995] ? nfnl_pernet+0x23/0x240 [ 930.947811][T25995] ? __nla_parse+0x40/0x60 [ 930.947845][T25995] nfnetlink_rcv+0x1288/0x28c0 [ 930.947921][T25995] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 930.948008][T25995] ? skb_clone+0x246/0x3a0 [ 930.948052][T25995] ? netlink_deliver_tap+0x2e/0x1b0 [ 930.948080][T25995] ? netlink_deliver_tap+0x2e/0x1b0 [ 930.948116][T25995] netlink_unicast+0x8ef/0xa80 [ 930.948166][T25995] netlink_sendmsg+0x7f0/0xb20 [ 930.948204][T25995] ? __pfx_netlink_sendmsg+0x10/0x10 [ 930.948248][T25995] ? aa_sock_msg_perm+0x144/0x210 [ 930.948286][T25995] ? apparmor_socket_sendmsg+0x98/0x360 [ 930.948315][T25995] ? __pfx_netlink_sendmsg+0x10/0x10 [ 930.948340][T25995] sock_sendmsg_nosec+0x14e/0x190 [ 930.948369][T25995] ____sys_sendmsg+0x54e/0x850 [ 930.948408][T25995] ? __pfx_____sys_sendmsg+0x10/0x10 [ 930.948472][T25995] ? import_iovec+0x73/0xa0 [ 930.948502][T25995] ___sys_sendmsg+0x2a5/0x360 [ 930.948533][T25995] ? __lock_acquire+0x747/0x2de0 [ 930.948567][T25995] ? __pfx____sys_sendmsg+0x10/0x10 [ 930.948652][T25995] ? __fget_files+0x3a2/0x420 [ 930.948678][T25995] ? __fget_files+0x2a/0x420 [ 930.948718][T25995] __x64_sys_sendmsg+0x1b1/0x290 [ 930.948762][T25995] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 930.948826][T25995] do_syscall_64+0x166/0x520 [ 930.948848][T25995] ? trace_irq_disable+0x3b/0x140 [ 930.948877][T25995] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.948900][T25995] ? clear_bhb_loop+0x70/0xc0 [ 930.948927][T25995] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.948949][T25995] RIP: 0033:0x7f935dd9f559 [ 930.948969][T25995] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 930.948987][T25995] RSP: 002b:00007f935ec70028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 930.949009][T25995] RAX: ffffffffffffffda RBX: 00007f935e025fa0 RCX: 00007f935dd9f559 [ 930.949024][T25995] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 930.949037][T25995] RBP: 00007f935ec70090 R08: 0000000000000000 R09: 0000000000000000 [ 930.949051][T25995] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 930.949064][T25995] R13: 00007f935e026038 R14: 00007f935e025fa0 R15: 00007ffd40e87d38 [ 930.949105][T25995] [ 931.377879][T25997] netlink: 'syz.1.6089': attribute type 39 has an invalid length. [ 931.398299][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 931.411820][ T31] bond0 (unregistering): Released all slaves [ 931.437125][ T150] smbdirect: ib_dev[syz1] removed [ 931.494971][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.495019][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.542954][ T52] infiniband syz1: ib_query_port failed (-19) [ 931.815914][T25833] wg0 speed is unknown, defaulting to 1000 [ 931.815949][T25833] syz0: Port: 1 Link DOWN [ 931.846881][T26010] netlink: 'syz.1.6093': attribute type 1 has an invalid length. [ 931.846903][T26010] netlink: 'syz.1.6093': attribute type 4 has an invalid length. [ 931.846919][T26010] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.6093'. [ 931.882866][T26013] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6091'. [ 931.882891][T26013] netlink: 'syz.5.6091': attribute type 1 has an invalid length. [ 932.052292][T26014] »»»»»»: renamed from veth0_vlan (while UP) [ 932.379927][T26032] netlink: 'syz.1.6098': attribute type 28 has an invalid length. [ 932.379976][T26032] netlink: 'syz.1.6098': attribute type 29 has an invalid length. [ 932.380024][T26032] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6098'. [ 932.429488][T25941] bridge0: port 1(bridge_slave_0) entered blocking state [ 932.429659][T25941] bridge0: port 1(bridge_slave_0) entered disabled state [ 932.429796][T25941] bridge_slave_0: entered allmulticast mode [ 932.454436][T25941] bridge_slave_0: entered promiscuous mode [ 932.463014][T25941] bridge0: port 2(bridge_slave_1) entered blocking state [ 932.463109][T25941] bridge0: port 2(bridge_slave_1) entered disabled state [ 932.463260][T25941] bridge_slave_1: entered allmulticast mode [ 932.465260][T25941] bridge_slave_1: entered promiscuous mode [ 932.511333][T26039] netlink: 'syz.3.6100': attribute type 39 has an invalid length. [ 932.852220][ T5646] Bluetooth: hci5: command tx timeout [ 932.906724][T25941] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 933.002432][T26050] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6101'. [ 933.027702][T25941] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 933.102141][ T5297] 8021q: adding VLAN 0 to HW filter on device eth5 [ 933.179809][T25941] team0: Port device team_slave_0 added [ 933.190316][T25941] team0: Port device team_slave_1 added [ 933.210104][T26055] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 933.210144][T26055] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 933.210190][T26055] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 933.361767][T26063] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6106'. [ 933.361795][T26063] netlink: 'syz.3.6106': attribute type 1 has an invalid length. [ 933.419664][T25941] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 933.419681][T25941] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 933.419704][T25941] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 933.497576][T25941] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 933.497594][T25941] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 933.497622][T25941] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 933.821013][T26072] siw: device registration error -23 [ 933.829772][T25941] hsr_slave_0: entered promiscuous mode [ 933.831897][T25941] hsr_slave_1: entered promiscuous mode [ 933.833380][T25941] debugfs: 'hsr0' already exists in 'hsr' [ 933.833431][T25941] Cannot create hsr debugfs directory [ 933.924010][ T63] smbdirect: ib_dev[syz2] removed [ 934.477159][T26102] netlink: 288 bytes leftover after parsing attributes in process `syz.3.6116'. [ 934.502746][ T5297] 8021q: adding VLAN 0 to HW filter on device eth6 [ 934.628203][T26106] netlink: 'syz.1.6118': attribute type 10 has an invalid length. [ 934.930759][ T5646] Bluetooth: hci5: command tx timeout [ 935.658576][T26114] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 936.079310][T26145] netlink: 168 bytes leftover after parsing attributes in process `syz.3.6124'. [ 936.445874][T26162] netlink: 288 bytes leftover after parsing attributes in process `syz.1.6129'. [ 936.678432][T26169] netlink: 'syz.3.6130': attribute type 1 has an invalid length. [ 936.678458][T26169] netlink: 'syz.3.6130': attribute type 4 has an invalid length. [ 936.678476][T26169] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.6130'. [ 936.938161][T26172] netlink: 'syz.5.6131': attribute type 10 has an invalid length. [ 937.012194][ T5646] Bluetooth: hci5: command tx timeout [ 937.495102][T26194] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 937.520967][T25941] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 937.542103][T25941] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 937.544892][T25941] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 937.569850][T25941] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 937.622179][T25941] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 937.653634][T25941] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 937.666699][T25941] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 937.690522][T26195] netlink: 168 bytes leftover after parsing attributes in process `syz.1.6136'. [ 937.728458][T25941] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 938.562686][T26234] netlink: 'syz.3.6141': attribute type 10 has an invalid length. [ 938.686841][T25941] 8021q: adding VLAN 0 to HW filter on device bond0 [ 938.827781][T25941] 8021q: adding VLAN 0 to HW filter on device team0 [ 938.849772][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 938.849851][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 938.897370][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 938.897472][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 939.045551][T26252] netlink: 'syz.1.6146': attribute type 28 has an invalid length. [ 939.045604][T26252] netlink: 'syz.1.6146': attribute type 29 has an invalid length. [ 939.045649][T26252] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6146'. [ 939.117440][T26255] netlink: 'syz.5.6144': attribute type 10 has an invalid length. [ 939.225844][T26263] netlink: 'syz.4.6145': attribute type 10 has an invalid length. [ 939.963646][ T31] hsr_slave_0: left promiscuous mode [ 939.969058][ T31] hsr_slave_1: left promiscuous mode [ 939.994749][ T31] veth0_macvtap: left promiscuous mode [ 940.000527][ T31] veth1_vlan: left promiscuous mode [ 940.428933][T26301] netlink: 'syz.4.6152': attribute type 10 has an invalid length. [ 940.848479][ T31] team0 (unregistering): Port device team_slave_1 removed [ 940.897029][ T31] team0 (unregistering): Port device team_slave_0 removed [ 941.074751][ T86] smbdirect: ib_dev[syz0] removed [ 941.149269][T26284] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 941.270381][T26313] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6154'. [ 944.322360][T26330] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6155'. [ 944.343569][T25941] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 944.400863][T25941] veth0_vlan: entered promiscuous mode [ 944.419710][T25941] veth1_vlan: entered promiscuous mode [ 944.487867][T25941] veth0_macvtap: entered promiscuous mode [ 944.501950][T25941] veth1_macvtap: entered promiscuous mode [ 944.528270][T25941] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 944.560496][T25941] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 944.587564][ T1434] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 944.593477][ T3006] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 944.596167][ T150] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 944.596603][ T150] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 944.759122][T26336] netlink: 'syz.3.6159': attribute type 10 has an invalid length. [ 944.896430][T26341] netlink: 'syz.5.6160': attribute type 10 has an invalid length. [ 944.914703][ T3006] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 944.914723][ T3006] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 945.132891][T26349] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 945.150999][T26349] netlink: 'syz.3.6163': attribute type 32 has an invalid length. [ 945.303592][ T1434] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 945.303614][ T1434] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 945.315095][T26353] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 945.469815][T26359] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 945.784161][T26373] netlink: 288 bytes leftover after parsing attributes in process `syz.5.6168'. [ 946.212576][T26372] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6167'. [ 946.250431][T26381] netlink: 'syz.0.6074': attribute type 29 has an invalid length. [ 946.389319][T26385] netlink: 'syz.0.6074': attribute type 29 has an invalid length. [ 946.390526][T26386] netlink: 'syz.0.6074': attribute type 29 has an invalid length. [ 946.576198][T26389] netlink: 288 bytes leftover after parsing attributes in process `syz.4.6171'. [ 946.850401][T26394] netlink: 'syz.3.6172': attribute type 10 has an invalid length. [ 947.129569][T26398] netlink: 'syz.5.6173': attribute type 10 has an invalid length. [ 947.305410][T15919] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 947.308419][T15919] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 947.309113][T15919] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 947.310505][T15919] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 947.363133][T15919] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 948.194731][T26406] rxe_eth0 speed is unknown, defaulting to 1000 [ 948.332277][T26438] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6180'. [ 948.375725][T26433] netlink: 128 bytes leftover after parsing attributes in process `syz.0.6180'. [ 948.377395][T26433] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 949.375335][ T31] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 949.396213][T26406] bridge0: port 1(bridge_slave_0) entered blocking state [ 949.396376][T26406] bridge0: port 1(bridge_slave_0) entered disabled state [ 949.396505][T26406] bridge_slave_0: entered allmulticast mode [ 949.399857][T26406] bridge_slave_0: entered promiscuous mode [ 949.418399][ T5646] Bluetooth: hci4: command tx timeout [ 949.444314][T26406] bridge0: port 2(bridge_slave_1) entered blocking state [ 949.447558][T26406] bridge0: port 2(bridge_slave_1) entered disabled state [ 949.447699][T26406] bridge_slave_1: entered allmulticast mode [ 949.459735][T26406] bridge_slave_1: entered promiscuous mode [ 949.640164][ T31] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 949.691529][T26468] netlink: 'syz.0.6188': attribute type 10 has an invalid length. [ 949.789279][T26406] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 949.920854][T26468] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 949.926524][T26468] team0: Port device netdevsim1 added [ 949.941539][T26406] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 950.042038][ T31] netdevsim netdevsim1 netdevsim1 (unregistering): left promiscuous mode [ 950.042061][ T31] netdevsim netdevsim1 netdevsim1 (unregistering): left allmulticast mode [ 950.048669][ T31] team0: Port device netdevsim1 removed [ 950.049315][ T31] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.305552][T26406] team0: Port device team_slave_0 added [ 950.375642][ T31] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.411311][T26406] team0: Port device team_slave_1 added [ 950.469003][T26406] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 950.469021][T26406] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 950.469047][T26406] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 950.504294][T26406] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 950.504342][T26406] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 950.504409][T26406] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 950.605357][T26481] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6194'. [ 950.625235][T26483] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6193'. [ 950.625389][T26483] netlink: 30 bytes leftover after parsing attributes in process `syz.5.6193'. [ 950.660913][T26406] hsr_slave_0: entered promiscuous mode [ 950.663593][T26406] hsr_slave_1: entered promiscuous mode [ 950.666050][T26406] debugfs: 'hsr0' already exists in 'hsr' [ 950.666071][T26406] Cannot create hsr debugfs directory [ 950.736826][T26483] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 950.882881][T26497] netlink: 'syz.3.6197': attribute type 1 has an invalid length. [ 950.882906][T26497] netlink: 'syz.3.6197': attribute type 4 has an invalid length. [ 950.882922][T26497] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.6197'. [ 950.971198][T26500] netlink: 'syz.4.6199': attribute type 16 has an invalid length. [ 950.971235][T26500] netlink: 'syz.4.6199': attribute type 17 has an invalid length. [ 951.023783][T26500] gretap0: entered promiscuous mode [ 951.129703][T26500] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 951.154317][T26500] : entered promiscuous mode [ 951.158215][T26500] mac80211_hwsim hwsim162 wlan8: entered promiscuous mode [ 951.173438][T26500] mac80211_hwsim hwsim167 wlan9: entered promiscuous mode [ 951.176884][T26500] mac80211_hwsim hwsim168 wlan10: entered promiscuous mode [ 951.198443][T26500] mac80211_hwsim hwsim173 ..ãc¤±: entered promiscuous mode [ 951.210683][T26500] mac80211_hwsim hwsim181 wlan11: entered promiscuous mode [ 951.214398][T26500] mac80211_hwsim hwsim183 wlan12: entered promiscuous mode [ 951.217332][T26500] mac80211_hwsim hwsim209 wlan1: entered promiscuous mode [ 951.220304][T26500] mac80211_hwsim hwsim223 wlan13: entered promiscuous mode [ 951.255351][T26500] mac80211_hwsim hwsim225 wlan14: entered promiscuous mode [ 951.259213][T26500] mac80211_hwsim hwsim228 wlan15: entered promiscuous mode [ 951.277564][T26500] mac80211_hwsim hwsim241 wlan16: entered promiscuous mode [ 951.293696][T26500] mac80211_hwsim hwsim244 wlan17: entered promiscuous mode [ 951.297169][T26500] mac80211_hwsim hwsim248 wlan18: entered promiscuous mode [ 951.328092][T26500] mac80211_hwsim hwsim254 wlan19: entered promiscuous mode [ 951.346295][T26500] mac80211_hwsim hwsim255 wlan20: entered promiscuous mode [ 951.369478][T26500] mac80211_hwsim hwsim262 wlan21: entered promiscuous mode [ 951.453616][ T31] bridge0: port 3(team0) entered disabled state [ 951.468115][ T31] bridge_slave_1: left allmulticast mode [ 951.468339][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 951.491702][ T5646] Bluetooth: hci4: command tx timeout [ 951.492971][ T31] bridge_slave_0: left allmulticast mode [ 951.493147][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 951.584439][T26506] netlink: 'syz.3.6201': attribute type 39 has an invalid length. [ 951.668210][T26514] netlink: 'syz.4.6202': attribute type 10 has an invalid length. [ 951.682523][T26515] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 951.685424][T26515] netlink: 'syz.5.6203': attribute type 32 has an invalid length. [ 951.878730][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 951.893581][ T31] bond0 (unregistering): Released all slaves [ 952.211327][T26529] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6207'. [ 952.281974][T26531] FAULT_INJECTION: forcing a failure. [ 952.281974][T26531] name failslab, interval 1, probability 0, space 0, times 0 [ 952.282004][T26531] CPU: 0 UID: 0 PID: 26531 Comm: syz.5.6208 Not tainted syzkaller #0 PREEMPT(full) [ 952.282027][T26531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 952.282041][T26531] Call Trace: [ 952.282049][T26531] [ 952.282058][T26531] dump_stack_lvl+0xe8/0x150 [ 952.282097][T26531] should_fail_ex+0x3eb/0x540 [ 952.282124][T26531] ? __alloc_skb+0x1db/0x7a0 [ 952.282153][T26531] should_failslab+0xa8/0x100 [ 952.282186][T26531] ? __alloc_skb+0x1db/0x7a0 [ 952.282214][T26531] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 952.282239][T26531] ? __alloc_skb+0x18d/0x7a0 [ 952.282268][T26531] ? __alloc_skb+0x1db/0x7a0 [ 952.282303][T26531] __alloc_skb+0x1db/0x7a0 [ 952.282336][T26531] netlink_sendmsg+0x5cd/0xb20 [ 952.282372][T26531] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.282404][T26531] ? aa_sock_msg_perm+0x144/0x210 [ 952.282449][T26531] ? apparmor_socket_sendmsg+0x98/0x360 [ 952.282479][T26531] ? __pfx_netlink_sendmsg+0x10/0x10 [ 952.282505][T26531] sock_sendmsg_nosec+0x14e/0x190 [ 952.282534][T26531] ____sys_sendmsg+0x54e/0x850 [ 952.282572][T26531] ? __pfx_____sys_sendmsg+0x10/0x10 [ 952.282614][T26531] ? import_iovec+0x73/0xa0 [ 952.282642][T26531] ___sys_sendmsg+0x2a5/0x360 [ 952.282671][T26531] ? __lock_acquire+0x747/0x2de0 [ 952.282702][T26531] ? __pfx____sys_sendmsg+0x10/0x10 [ 952.282770][T26531] ? __fget_files+0x3a2/0x420 [ 952.282795][T26531] ? __fget_files+0x2a/0x420 [ 952.282830][T26531] __x64_sys_sendmsg+0x1b1/0x290 [ 952.282865][T26531] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 952.282918][T26531] do_syscall_64+0x166/0x520 [ 952.282940][T26531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.282962][T26531] ? clear_bhb_loop+0x70/0xc0 [ 952.282987][T26531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 952.283008][T26531] RIP: 0033:0x7f2d0a19f559 [ 952.283027][T26531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 952.283046][T26531] RSP: 002b:00007f2d0afe2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 952.283068][T26531] RAX: ffffffffffffffda RBX: 00007f2d0a425fa0 RCX: 00007f2d0a19f559 [ 952.283084][T26531] RDX: 0000000000028000 RSI: 00002000000005c0 RDI: 0000000000000009 [ 952.283098][T26531] RBP: 00007f2d0afe2090 R08: 0000000000000000 R09: 0000000000000000 [ 952.283111][T26531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 952.283124][T26531] R13: 00007f2d0a426038 R14: 00007f2d0a425fa0 R15: 00007ffe849592c8 [ 952.283158][T26531] [ 952.855203][T26545] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 952.894382][T26546] netlink: 'syz.5.6211': attribute type 35 has an invalid length. [ 953.320177][ T5297] 8021q: adding VLAN 0 to HW filter on device eth5 [ 953.571016][ T5646] Bluetooth: hci4: command tx timeout [ 953.621671][T26562] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 953.625497][T26562] netlink: 'syz.3.6217': attribute type 32 has an invalid length. [ 953.788450][T26573] netlink: 'syz.0.6219': attribute type 10 has an invalid length. [ 953.956994][T26571] netlink: 16402 bytes leftover after parsing attributes in process `syz.5.6221'. [ 954.092275][T26406] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 954.115903][T26406] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 954.118508][T26406] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 954.142136][T26406] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 954.165257][T26406] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 954.199347][T26406] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 954.261079][T26587] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6224'. [ 954.464854][T26406] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 954.469403][T26406] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 954.470380][T26594] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6224'. [ 955.086162][T26406] 8021q: adding VLAN 0 to HW filter on device bond0 [ 955.180953][T26617] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6230'. [ 955.511106][T26614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 955.561337][ T5767] ip6_tunnel:  xmit: Local address not yet configured! [ 955.651318][ T5646] Bluetooth: hci4: command tx timeout [ 955.780516][T26406] 8021q: adding VLAN 0 to HW filter on device team0 [ 955.839770][ T1434] bridge0: port 1(bridge_slave_0) entered blocking state [ 955.839877][ T1434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 955.889231][ T1434] bridge0: port 2(bridge_slave_1) entered blocking state [ 955.889297][ T1434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 956.060458][T26637] netlink: 124 bytes leftover after parsing attributes in process `syz.3.6236'. [ 956.092728][T26637] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6236'. [ 956.292918][ T5742] ip6_tunnel:  xmit: Local address not yet configured! [ 956.379652][T26645] netlink: 340 bytes leftover after parsing attributes in process `syz.5.6238'. [ 956.956862][T26664] netlink: 168 bytes leftover after parsing attributes in process `syz.5.6244'. [ 957.098091][T26670] netlink: 5 bytes leftover after parsing attributes in process `syz.3.6245'. [ 957.248158][T26672] validate_nla: 5 callbacks suppressed [ 957.248181][T26672] netlink: 'syz.4.6246': attribute type 29 has an invalid length. [ 957.383562][T26676] netlink: 'syz.5.6247': attribute type 10 has an invalid length. [ 957.738220][T26686] netlink: 'syz.3.6249': attribute type 28 has an invalid length. [ 957.738290][T26686] netlink: 'syz.3.6249': attribute type 29 has an invalid length. [ 957.738341][T26686] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6249'. [ 957.908730][T26690] netlink: 'syz.5.6250': attribute type 10 has an invalid length. [ 957.908770][T26690] netlink: 2 bytes leftover after parsing attributes in process `syz.5.6250'. [ 958.099859][T26690] team0: Device wg2 is of different type [ 958.168192][T26406] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 958.364175][T26406] veth0_vlan: entered promiscuous mode [ 958.389162][T26406] veth1_vlan: entered promiscuous mode [ 958.530113][T26406] veth0_macvtap: entered promiscuous mode [ 958.576016][T26406] veth1_macvtap: entered promiscuous mode [ 958.690353][T26406] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 958.794028][T26406] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 959.107238][T26706] netlink: 10 bytes leftover after parsing attributes in process `syz.3.6256'. [ 959.130772][ T8194] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 959.130824][ T8194] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 959.130867][ T8194] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 959.130908][ T8194] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 959.137503][T26712] netlink: 168 bytes leftover after parsing attributes in process `syz.5.6257'. [ 959.877400][T26722] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.6261'. [ 959.907462][T26723] netlink: 'syz.0.6260': attribute type 28 has an invalid length. [ 959.907510][T26723] netlink: 'syz.0.6260': attribute type 29 has an invalid length. [ 959.907560][T26723] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6260'. [ 960.214832][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 960.214856][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 961.088256][ T31] team_slave_1 (unregistering): left allmulticast mode [ 961.090406][ T31] team0 (unregistering): Port device team_slave_1 removed [ 961.134761][ T31] team_slave_0 (unregistering): left allmulticast mode [ 961.137148][ T31] team0 (unregistering): Port device team_slave_0 removed [ 961.213835][ T31] bond_slave_0 (unregistering): left allmulticast mode [ 961.216201][ T31] team0 (unregistering): Port device bond_slave_0 removed [ 961.448892][T26733] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6265'. [ 961.449098][T26733] netlink: 30 bytes leftover after parsing attributes in process `syz.3.6265'. [ 961.450478][ T3006] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 961.450498][ T3006] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 961.486497][T26737] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 961.519183][T26751] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6269'. [ 961.601058][T26746] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6268'. [ 962.074464][T26754] netlink: 'syz.3.6270': attribute type 10 has an invalid length. [ 962.917461][T26780] netlink: 'syz.1.6278': attribute type 10 has an invalid length. [ 962.965153][T26780] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 962.967770][T26780] team0: Port device netdevsim1 added [ 963.138032][T26792] »»»»»»: renamed from veth0_vlan (while UP) [ 963.222129][T26798] netlink: 'syz.1.6284': attribute type 1 has an invalid length. [ 963.222154][T26798] __nla_validate_parse: 2 callbacks suppressed [ 963.222169][T26798] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.6284'. [ 963.305098][T26801] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6286'. [ 963.305127][T26801] netlink: 'syz.4.6286': attribute type 1 has an invalid length. [ 963.401679][T26793] netlink: 'syz.3.6283': attribute type 10 has an invalid length. [ 963.419058][T26804] netlink: 288 bytes leftover after parsing attributes in process `syz.1.6287'. [ 963.708298][T26808] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6285'. [ 963.708456][T26808] netlink: 30 bytes leftover after parsing attributes in process `syz.0.6285'. [ 963.755864][T26813] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 963.850575][T26820] netlink: 168 bytes leftover after parsing attributes in process `syz.3.6290'. [ 964.460776][T26837] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6294'. [ 964.460944][T26837] netlink: 30 bytes leftover after parsing attributes in process `syz.0.6294'. [ 964.511714][T26837] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 964.666210][T26841] netlink: 'syz.1.6295': attribute type 10 has an invalid length. [ 964.896464][T26841] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 964.896516][T26841] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 964.901327][T26841] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 964.901356][T26841] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 965.326960][T26853] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6299'. [ 965.326991][T26853] netlink: 'syz.4.6299': attribute type 1 has an invalid length. [ 965.374432][T26851] netlink: 'syz.5.6298': attribute type 1 has an invalid length. [ 965.374458][T26851] netlink: 16150 bytes leftover after parsing attributes in process `syz.5.6298'. [ 966.651596][T26897] netlink: 'syz.1.6314': attribute type 1 has an invalid length. [ 966.941493][T15919] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 966.948268][T15919] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 966.949508][T15919] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 966.950468][T15919] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 966.979378][T15919] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 967.039296][T26911] netlink: 'syz.3.6317': attribute type 1 has an invalid length. [ 967.217408][T26912] netlink: 'syz.1.6319': attribute type 10 has an invalid length. [ 967.316543][T24718] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 967.389767][T24718] netdevsim netdevsim5 netdevsim1 (unregistering): left promiscuous mode [ 967.394351][T24718] team0: Port device netdevsim1 removed [ 967.395188][T24718] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 967.543595][T24718] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 967.884552][T24718] bridge_slave_1: left allmulticast mode [ 967.884773][T24718] bridge0: port 2(bridge_slave_1) entered disabled state [ 967.917298][T24718] bridge_slave_0: left allmulticast mode [ 967.917524][T24718] bridge0: port 1(bridge_slave_0) entered disabled state [ 968.078522][T26952] validate_nla: 3 callbacks suppressed [ 968.078587][T26952] netlink: 'syz.3.6326': attribute type 39 has an invalid length. [ 968.196804][T26948] netlink: 'syz.1.6325': attribute type 10 has an invalid length. [ 968.247589][T26963] netlink: 'syz.0.6324': attribute type 10 has an invalid length. [ 968.356194][T24718] bond0 (unregistering): (slave geneve0): Releasing backup interface [ 968.356619][T24718] geneve0 (unregistering): left promiscuous mode [ 968.402010][T24718] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 968.408231][T24718] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 968.432111][T24718] bond0 (unregistering): Released all slaves [ 968.484859][T26906] rxe_eth0 speed is unknown, defaulting to 1000 [ 968.900467][T26976] __nla_validate_parse: 12 callbacks suppressed [ 968.900491][T26976] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6328'. [ 969.090734][ T5646] Bluetooth: hci0: command tx timeout [ 969.357593][T26992] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6333'. [ 969.426633][T26992] netlink: 'syz.1.6333': attribute type 28 has an invalid length. [ 969.426672][T26992] netlink: 'syz.1.6333': attribute type 29 has an invalid length. [ 969.426703][T26992] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6333'. [ 969.531375][T26995] netlink: 'syz.0.6334': attribute type 10 has an invalid length. [ 969.607345][T27001] netlink: 288 bytes leftover after parsing attributes in process `syz.4.6336'. [ 969.652186][T26999] netlink: 'syz.3.6335': attribute type 10 has an invalid length. [ 969.684437][T27001] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6336'. [ 969.937978][ T5297] 8021q: adding VLAN 0 to HW filter on device eth5 [ 969.986840][T27007] netlink: 'syz.1.6337': attribute type 10 has an invalid length. [ 970.001687][T27007] netlink: 'syz.1.6337': attribute type 10 has an invalid length. [ 970.045811][T27007] team0: Port device netdevsim1 removed [ 970.095980][T27007] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 970.128160][T27007] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 970.308640][T27023] netlink: 'syz.3.6340': attribute type 10 has an invalid length. [ 970.682368][T27032] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6346'. [ 970.746368][T27032] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6346'. [ 971.178230][ T5646] Bluetooth: hci0: command tx timeout [ 971.420120][T27042] netlink: 10 bytes leftover after parsing attributes in process `syz.1.6344'. [ 971.599153][T27060] netlink: 288 bytes leftover after parsing attributes in process `syz.3.6349'. [ 971.620971][T27060] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6349'. [ 972.109817][T26906] bridge0: port 1(bridge_slave_0) entered blocking state [ 972.109921][T26906] bridge0: port 1(bridge_slave_0) entered disabled state [ 972.110082][T26906] bridge_slave_0: entered allmulticast mode [ 972.111813][T26906] bridge_slave_0: entered promiscuous mode [ 972.141996][ T5297] 8021q: adding VLAN 0 to HW filter on device eth6 [ 972.143663][T26906] bridge0: port 2(bridge_slave_1) entered blocking state [ 972.143761][T26906] bridge0: port 2(bridge_slave_1) entered disabled state [ 972.143883][T26906] bridge_slave_1: entered allmulticast mode [ 972.173032][T26906] bridge_slave_1: entered promiscuous mode [ 972.452371][T26906] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 972.492833][T26906] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 972.705773][T26906] team0: Port device team_slave_0 added [ 972.756653][T26906] team0: Port device team_slave_1 added [ 972.924699][T26906] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 972.924718][T26906] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.924745][T26906] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 972.939874][T26906] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 972.939915][T26906] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.940003][T26906] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 973.252207][ T5646] Bluetooth: hci0: command tx timeout [ 973.278106][T26906] hsr_slave_0: entered promiscuous mode [ 973.279230][T26906] hsr_slave_1: entered promiscuous mode [ 973.279944][T26906] debugfs: 'hsr0' already exists in 'hsr' [ 973.279962][T26906] Cannot create hsr debugfs directory [ 973.409053][T27122] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 973.703762][ T5297] 8021q: adding VLAN 0 to HW filter on device eth7 [ 973.929410][T27135] __nla_validate_parse: 8 callbacks suppressed [ 973.929453][T27135] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6367'. [ 974.032211][T27144] FAULT_INJECTION: forcing a failure. [ 974.032211][T27144] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 974.032242][T27144] CPU: 0 UID: 0 PID: 27144 Comm: syz.3.6369 Not tainted syzkaller #0 PREEMPT(full) [ 974.032265][T27144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 974.032279][T27144] Call Trace: [ 974.032287][T27144] [ 974.032297][T27144] dump_stack_lvl+0xe8/0x150 [ 974.032338][T27144] should_fail_ex+0x3eb/0x540 [ 974.032371][T27144] _copy_from_iter+0x1d3/0x1680 [ 974.032411][T27144] ? __pfx__copy_from_iter+0x10/0x10 [ 974.032431][T27144] ? __kmalloc_node_track_caller_noprof+0x2e6/0x720 [ 974.032460][T27144] ? netlink_sendmsg+0x5cd/0xb20 [ 974.032496][T27144] ? netlink_sendmsg+0x5cd/0xb20 [ 974.032533][T27144] ? netlink_sendmsg+0x64f/0xb20 [ 974.032560][T27144] ? skb_put+0x112/0x210 [ 974.032598][T27144] netlink_sendmsg+0x6bb/0xb20 [ 974.032634][T27144] ? __pfx_netlink_sendmsg+0x10/0x10 [ 974.032668][T27144] ? aa_sock_msg_perm+0x144/0x210 [ 974.032709][T27144] ? apparmor_socket_sendmsg+0x98/0x360 [ 974.032740][T27144] ? __pfx_netlink_sendmsg+0x10/0x10 [ 974.032768][T27144] sock_sendmsg_nosec+0x14e/0x190 [ 974.032798][T27144] ____sys_sendmsg+0x54e/0x850 [ 974.032840][T27144] ? __pfx_____sys_sendmsg+0x10/0x10 [ 974.032905][T27144] ? import_iovec+0x73/0xa0 [ 974.032936][T27144] ___sys_sendmsg+0x2a5/0x360 [ 974.032969][T27144] ? __lock_acquire+0x747/0x2de0 [ 974.033008][T27144] ? __pfx____sys_sendmsg+0x10/0x10 [ 974.033076][T27144] ? __fget_files+0x2a/0x420 [ 974.033124][T27144] ? __fget_files+0x3a2/0x420 [ 974.033153][T27144] ? __fget_files+0x2a/0x420 [ 974.033196][T27144] __x64_sys_sendmsg+0x1b1/0x290 [ 974.033236][T27144] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 974.033303][T27144] do_syscall_64+0x166/0x520 [ 974.033329][T27144] ? trace_irq_disable+0x3b/0x140 [ 974.033361][T27144] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 974.033386][T27144] ? clear_bhb_loop+0x70/0xc0 [ 974.033415][T27144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 974.033438][T27144] RIP: 0033:0x7fcf1ff9f559 [ 974.033460][T27144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 974.033486][T27144] RSP: 002b:00007fcf20ee9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 974.033509][T27144] RAX: ffffffffffffffda RBX: 00007fcf20226090 RCX: 00007fcf1ff9f559 [ 974.033525][T27144] RDX: 0000000000000000 RSI: 0000200000001900 RDI: 0000000000000009 [ 974.033540][T27144] RBP: 00007fcf20ee9090 R08: 0000000000000000 R09: 0000000000000000 [ 974.033555][T27144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 974.033568][T27144] R13: 00007fcf20226128 R14: 00007fcf20226090 R15: 00007ffdc141d3b8 [ 974.033611][T27144] [ 974.357881][T27149] FAULT_INJECTION: forcing a failure. [ 974.357881][T27149] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 974.357912][T27149] CPU: 0 UID: 0 PID: 27149 Comm: syz.1.6371 Not tainted syzkaller #0 PREEMPT(full) [ 974.357936][T27149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 974.357949][T27149] Call Trace: [ 974.357958][T27149] [ 974.357967][T27149] dump_stack_lvl+0xe8/0x150 [ 974.358006][T27149] should_fail_ex+0x3eb/0x540 [ 974.358034][T27149] _copy_from_iter+0x1d3/0x1680 [ 974.358054][T27149] ? __alloc_skb+0x27a/0x7a0 [ 974.358081][T27149] ? __alloc_skb+0x27a/0x7a0 [ 974.358105][T27149] ? __alloc_skb+0x27a/0x7a0 [ 974.358130][T27149] ? __pfx__copy_from_iter+0x10/0x10 [ 974.358153][T27149] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 974.358175][T27149] ? __alloc_skb+0x27a/0x7a0 [ 974.358195][T27149] ? __alloc_skb+0x27a/0x7a0 [ 974.358227][T27149] ? netlink_sendmsg+0x64f/0xb20 [ 974.358250][T27149] ? skb_put+0x112/0x210 [ 974.358284][T27149] netlink_sendmsg+0x6bb/0xb20 [ 974.358314][T27149] ? __pfx_netlink_sendmsg+0x10/0x10 [ 974.358343][T27149] ? aa_sock_msg_perm+0x144/0x210 [ 974.358385][T27149] ? apparmor_socket_sendmsg+0x98/0x360 [ 974.358416][T27149] ? __pfx_netlink_sendmsg+0x10/0x10 [ 974.358443][T27149] sock_sendmsg_nosec+0x14e/0x190 [ 974.358474][T27149] ____sys_sendmsg+0x54e/0x850 [ 974.358514][T27149] ? __pfx_____sys_sendmsg+0x10/0x10 [ 974.358577][T27149] ? import_iovec+0x73/0xa0 [ 974.358609][T27149] ___sys_sendmsg+0x2a5/0x360 [ 974.358641][T27149] ? __lock_acquire+0x747/0x2de0 [ 974.358677][T27149] ? __pfx____sys_sendmsg+0x10/0x10 [ 974.358742][T27149] ? __fget_files+0x2a/0x420 [ 974.358788][T27149] ? __fget_files+0x3a2/0x420 [ 974.358814][T27149] ? __fget_files+0x2a/0x420 [ 974.358854][T27149] __x64_sys_sendmsg+0x1b1/0x290 [ 974.358891][T27149] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 974.358954][T27149] do_syscall_64+0x166/0x520 [ 974.358978][T27149] ? trace_irq_disable+0x3b/0x140 [ 974.359008][T27149] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 974.359027][T27149] ? clear_bhb_loop+0x70/0xc0 [ 974.359050][T27149] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 974.359068][T27149] RIP: 0033:0x7f527599f559 [ 974.359087][T27149] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 974.359103][T27149] RSP: 002b:00007f527692a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 974.359123][T27149] RAX: ffffffffffffffda RBX: 00007f5275c25fa0 RCX: 00007f527599f559 [ 974.359136][T27149] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 974.359147][T27149] RBP: 00007f527692a090 R08: 0000000000000000 R09: 0000000000000000 [ 974.359158][T27149] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 974.359170][T27149] R13: 00007f5275c26038 R14: 00007f5275c25fa0 R15: 00007ffebca63a18 [ 974.359206][T27149] [ 974.985745][T27163] validate_nla: 6 callbacks suppressed [ 974.985765][T27163] netlink: 'syz.1.6372': attribute type 10 has an invalid length. [ 975.135942][T27163] bond0: (slave netdevsim1): Releasing backup interface [ 975.140306][T27163] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 975.152573][T27163] team0: Port device netdevsim1 added [ 975.180936][T27171] netlink: 288 bytes leftover after parsing attributes in process `syz.4.6375'. [ 975.275969][T27171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6375'. [ 975.335668][ T5646] Bluetooth: hci0: command tx timeout [ 975.559753][T27186] netlink: 'syz.0.6373': attribute type 10 has an invalid length. [ 975.659298][T27191] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6378'. [ 975.679378][T27191] FAULT_INJECTION: forcing a failure. [ 975.679378][T27191] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 975.679445][T27191] CPU: 0 UID: 0 PID: 27191 Comm: syz.3.6378 Not tainted syzkaller #0 PREEMPT(full) [ 975.679469][T27191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 975.679482][T27191] Call Trace: [ 975.679490][T27191] [ 975.679500][T27191] dump_stack_lvl+0xe8/0x150 [ 975.679538][T27191] should_fail_ex+0x3eb/0x540 [ 975.679567][T27191] _copy_from_user+0x2d/0xb0 [ 975.679593][T27191] ___sys_sendmsg+0x1c6/0x360 [ 975.679623][T27191] ? __lock_acquire+0x747/0x2de0 [ 975.679656][T27191] ? __pfx____sys_sendmsg+0x10/0x10 [ 975.679695][T27191] ? __pfx_trace_call_bpf+0x10/0x10 [ 975.679749][T27191] ? __fget_files+0x3a2/0x420 [ 975.679774][T27191] ? __fget_files+0x2a/0x420 [ 975.679817][T27191] __x64_sys_sendmsg+0x1b1/0x290 [ 975.679852][T27191] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 975.679908][T27191] do_syscall_64+0x166/0x520 [ 975.679931][T27191] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.679952][T27191] ? clear_bhb_loop+0x70/0xc0 [ 975.679978][T27191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.679999][T27191] RIP: 0033:0x7fcf1ff9f559 [ 975.680019][T27191] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 975.680037][T27191] RSP: 002b:00007fcf20f0a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 975.680059][T27191] RAX: ffffffffffffffda RBX: 00007fcf20225fa0 RCX: 00007fcf1ff9f559 [ 975.680075][T27191] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 000000000000000d [ 975.680088][T27191] RBP: 00007fcf20f0a090 R08: 0000000000000000 R09: 0000000000000000 [ 975.680101][T27191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 975.680114][T27191] R13: 00007fcf20226038 R14: 00007fcf20225fa0 R15: 00007ffdc141d3b8 [ 975.680148][T27191] [ 975.855134][T27192] netlink: 'syz.3.6378': attribute type 10 has an invalid length. [ 975.940935][T27192] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 975.940961][T27192] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 975.942140][T27192] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 975.942163][T27192] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 976.309044][T27207] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6382'. [ 976.309083][T27207] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6382'. [ 976.309102][T27207] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6382'. [ 976.543143][T27208] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6381'. [ 976.548856][T27212] netlink: 124 bytes leftover after parsing attributes in process `syz.3.6383'. [ 976.613955][T27215] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6383'. [ 976.957552][T27218] netlink: 'syz.1.6385': attribute type 10 has an invalid length. [ 977.106563][T27235] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 977.777578][T26906] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 977.788629][T27265] FAULT_INJECTION: forcing a failure. [ 977.788629][T27265] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 977.788704][T27265] CPU: 0 UID: 0 PID: 27265 Comm: syz.4.6395 Not tainted syzkaller #0 PREEMPT(full) [ 977.788761][T27265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 977.788791][T27265] Call Trace: [ 977.788812][T27265] [ 977.788839][T27265] dump_stack_lvl+0xe8/0x150 [ 977.788937][T27265] should_fail_ex+0x3eb/0x540 [ 977.789021][T27265] _copy_from_iter+0x1d3/0x1680 [ 977.789086][T27265] ? __alloc_skb+0x27a/0x7a0 [ 977.789163][T27265] ? __alloc_skb+0x27a/0x7a0 [ 977.789247][T27265] ? __alloc_skb+0x27a/0x7a0 [ 977.789332][T27265] ? __pfx__copy_from_iter+0x10/0x10 [ 977.789388][T27265] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 977.789449][T27265] ? __alloc_skb+0x27a/0x7a0 [ 977.789513][T27265] ? __alloc_skb+0x27a/0x7a0 [ 977.789591][T27265] ? netlink_sendmsg+0x64f/0xb20 [ 977.789662][T27265] ? skb_put+0x112/0x210 [ 977.789737][T27265] netlink_sendmsg+0x6bb/0xb20 [ 977.789824][T27265] ? __pfx_netlink_sendmsg+0x10/0x10 [ 977.789892][T27265] ? aa_sock_msg_perm+0x144/0x210 [ 977.789982][T27265] ? apparmor_socket_sendmsg+0x98/0x360 [ 977.790057][T27265] ? __pfx_netlink_sendmsg+0x10/0x10 [ 977.790122][T27265] sock_sendmsg_nosec+0x14e/0x190 [ 977.790199][T27265] ____sys_sendmsg+0x54e/0x850 [ 977.790294][T27265] ? __pfx_____sys_sendmsg+0x10/0x10 [ 977.790398][T27265] ? import_iovec+0x73/0xa0 [ 977.790469][T27265] ___sys_sendmsg+0x2a5/0x360 [ 977.790536][T27265] ? __lock_acquire+0x747/0x2de0 [ 977.790623][T27265] ? __pfx____sys_sendmsg+0x10/0x10 [ 977.790789][T27265] ? __fget_files+0x2a/0x420 [ 977.790888][T27265] ? __fget_files+0x3a2/0x420 [ 977.790946][T27265] ? __fget_files+0x2a/0x420 [ 977.791037][T27265] __x64_sys_sendmsg+0x1b1/0x290 [ 977.791125][T27265] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 977.791273][T27265] do_syscall_64+0x166/0x520 [ 977.791329][T27265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.791370][T27265] ? clear_bhb_loop+0x70/0xc0 [ 977.791435][T27265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.791489][T27265] RIP: 0033:0x7f634d99f559 [ 977.791522][T27265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 977.791567][T27265] RSP: 002b:00007f634e807028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 977.791598][T27265] RAX: ffffffffffffffda RBX: 00007f634dc25fa0 RCX: 00007f634d99f559 [ 977.791636][T27265] RDX: 0000000000004844 RSI: 0000200000000a40 RDI: 0000000000000007 [ 977.791666][T27265] RBP: 00007f634e807090 R08: 0000000000000000 R09: 0000000000000000 [ 977.791701][T27265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 977.791727][T27265] R13: 00007f634dc26038 R14: 00007f634dc25fa0 R15: 00007ffe8d66c3c8 [ 977.791815][T27265] [ 977.805036][T26906] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 977.811567][T26906] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 977.902605][T26906] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 978.119675][T26906] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 978.129646][T27263] netlink: 'syz.0.6393': attribute type 28 has an invalid length. [ 978.129668][T27263] netlink: 'syz.0.6393': attribute type 29 has an invalid length. [ 978.155440][T26906] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 978.193741][T26906] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 978.228029][T26906] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 978.656381][T26906] 8021q: adding VLAN 0 to HW filter on device bond0 [ 978.728726][T27287] netlink: 'syz.3.6398': attribute type 10 has an invalid length. [ 978.756664][T26906] 8021q: adding VLAN 0 to HW filter on device team0 [ 978.806095][ T86] bridge0: port 1(bridge_slave_0) entered blocking state [ 978.806189][ T86] bridge0: port 1(bridge_slave_0) entered forwarding state [ 978.881086][ T150] bridge0: port 2(bridge_slave_1) entered blocking state [ 978.881204][ T150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 979.461496][T27313] netlink: 'syz.3.6402': attribute type 10 has an invalid length. [ 979.560503][T27324] netlink: 'syz.1.6405': attribute type 39 has an invalid length. [ 980.115344][T24718] team0 (unregistering): Port device team_slave_1 removed [ 980.143848][T24718] team0 (unregistering): Port device team_slave_0 removed [ 980.545680][T27351] __nla_validate_parse: 11 callbacks suppressed [ 980.545742][T27351] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6406'. [ 980.572813][T27334] netlink: 830 bytes leftover after parsing attributes in process `syz.0.6404'. [ 980.605325][T27353] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6407'. [ 980.643491][T27351] netlink: 'syz.4.6406': attribute type 28 has an invalid length. [ 980.643536][T27351] netlink: 'syz.4.6406': attribute type 29 has an invalid length. [ 980.643584][T27351] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6406'. [ 981.024736][T27364] netlink: 288 bytes leftover after parsing attributes in process `syz.0.6409'. [ 981.077657][T27364] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6409'. [ 981.242956][T27369] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6410'. [ 981.242991][T27369] sit0: left promiscuous mode [ 981.243960][T27369] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6410'. [ 981.499710][T27366] netlink: 'syz.3.6411': attribute type 10 has an invalid length. [ 982.129693][T26906] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 982.388136][T27392] netlink: 'syz.4.6416': attribute type 39 has an invalid length. [ 982.479291][T27389] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6414'. [ 982.819896][T27403] netlink: 'syz.1.6418': attribute type 6 has an invalid length. [ 982.819934][T27403] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6418'. [ 982.937115][T26906] veth0_vlan: entered promiscuous mode [ 982.955435][T26906] veth1_vlan: entered promiscuous mode [ 983.023733][T26906] veth0_macvtap: entered promiscuous mode [ 983.041539][T26906] veth1_macvtap: entered promiscuous mode [ 983.057902][T26906] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 983.063775][T26906] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 983.216244][ T31] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.232058][ T31] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.691090][ T150] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.691139][ T150] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.077727][T24718] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 986.077751][T24718] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 986.232094][T24716] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 986.232115][T24716] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 986.478624][T27448] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 986.491478][T27448] netlink: 'syz.1.6425': attribute type 32 has an invalid length. [ 986.691192][T27454] netlink: 'syz.5.6313': attribute type 1 has an invalid length. [ 986.691218][T27454] __nla_validate_parse: 1 callbacks suppressed [ 986.691236][T27454] netlink: 16150 bytes leftover after parsing attributes in process `syz.5.6313'. [ 986.779006][T27446] netlink: 'syz.0.6424': attribute type 10 has an invalid length. [ 987.600997][T27464] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6430'. [ 987.726330][T27467] FAULT_INJECTION: forcing a failure. [ 987.726330][T27467] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 987.726360][T27467] CPU: 0 UID: 0 PID: 27467 Comm: syz.3.6431 Not tainted syzkaller #0 PREEMPT(full) [ 987.726380][T27467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 987.726391][T27467] Call Trace: [ 987.726399][T27467] [ 987.726408][T27467] dump_stack_lvl+0xe8/0x150 [ 987.726452][T27467] should_fail_ex+0x3eb/0x540 [ 987.726481][T27467] _copy_from_user+0x2d/0xb0 [ 987.726503][T27467] ___sys_sendmsg+0x1c6/0x360 [ 987.726530][T27467] ? __lock_acquire+0x747/0x2de0 [ 987.726561][T27467] ? __pfx____sys_sendmsg+0x10/0x10 [ 987.726620][T27467] ? __fget_files+0x2a/0x420 [ 987.726663][T27467] ? __fget_files+0x3a2/0x420 [ 987.726684][T27467] ? __fget_files+0x2a/0x420 [ 987.726723][T27467] __x64_sys_sendmsg+0x1b1/0x290 [ 987.726758][T27467] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 987.726815][T27467] do_syscall_64+0x166/0x520 [ 987.726834][T27467] ? trace_irq_disable+0x3b/0x140 [ 987.726861][T27467] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 987.726881][T27467] ? clear_bhb_loop+0x70/0xc0 [ 987.726907][T27467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 987.726925][T27467] RIP: 0033:0x7fcf1ff9f559 [ 987.726944][T27467] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 987.726961][T27467] RSP: 002b:00007fcf20f0a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 987.726980][T27467] RAX: ffffffffffffffda RBX: 00007fcf20225fa0 RCX: 00007fcf1ff9f559 [ 987.726993][T27467] RDX: 0000000000000000 RSI: 0000200000014700 RDI: 0000000000000005 [ 987.727004][T27467] RBP: 00007fcf20f0a090 R08: 0000000000000000 R09: 0000000000000000 [ 987.727015][T27467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 987.727044][T27467] R13: 00007fcf20226038 R14: 00007fcf20225fa0 R15: 00007ffdc141d3b8 [ 987.727083][T27467] [ 987.814888][T15919] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 987.822825][T15919] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 987.824836][T15919] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 987.829809][T15919] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 987.851026][T15919] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 988.150376][T27475] netlink: 288 bytes leftover after parsing attributes in process `syz.5.6433'. [ 988.370491][T27475] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6433'. [ 989.138983][T27489] netlink: 288 bytes leftover after parsing attributes in process `syz.0.6435'. [ 989.330243][T27468] rxe_eth0 speed is unknown, defaulting to 1000 [ 989.758972][T27493] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6435'. [ 989.842153][T27497] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6436'. [ 989.941130][ T86] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 989.985394][ T5646] Bluetooth: hci2: command tx timeout [ 990.067604][ T86] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.113948][T27508] netlink: 'syz.0.6439': attribute type 6 has an invalid length. [ 990.238351][ T86] netdevsim netdevsim4 netdevsim1 (unregistering): left promiscuous mode [ 990.275573][ T86] team0: Port device netdevsim1 removed [ 990.277564][ T86] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.318403][T27513] netlink: 'syz.1.6438': attribute type 10 has an invalid length. [ 990.436955][ T86] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.370511][T27532] netlink: 288 bytes leftover after parsing attributes in process `syz.1.6446'. [ 991.486878][T27532] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6446'. [ 991.616641][T27535] netlink: 124 bytes leftover after parsing attributes in process `syz.3.6445'. [ 991.640118][T27544] netlink: 'syz.0.6448': attribute type 39 has an invalid length. [ 992.050797][ T5646] Bluetooth: hci2: command tx timeout [ 992.542171][T27468] bridge0: port 1(bridge_slave_0) entered blocking state [ 992.542277][T27468] bridge0: port 1(bridge_slave_0) entered disabled state [ 992.542420][T27468] bridge_slave_0: entered allmulticast mode [ 992.549279][T27468] bridge_slave_0: entered promiscuous mode [ 992.585017][T27468] bridge0: port 2(bridge_slave_1) entered blocking state [ 992.585148][T27468] bridge0: port 2(bridge_slave_1) entered disabled state [ 992.585307][T27468] bridge_slave_1: entered allmulticast mode [ 992.618470][T27468] bridge_slave_1: entered promiscuous mode [ 992.770029][T27468] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 992.878942][T27468] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 992.932931][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.932990][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.990054][T27468] team0: Port device team_slave_0 added [ 992.999231][ T5297] 8021q: adding VLAN 0 to HW filter on device eth5 [ 993.038715][T27468] team0: Port device team_slave_1 added [ 993.102083][T27589] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 993.104023][T27589] netlink: 'syz.5.6454': attribute type 32 has an invalid length. [ 993.168110][T27468] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 993.168125][T27468] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 993.168152][T27468] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 993.170117][T27468] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 993.170131][T27468] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 993.170157][T27468] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 993.342076][T27594] netlink: 'syz.0.6453': attribute type 10 has an invalid length. [ 993.445888][T27468] hsr_slave_0: entered promiscuous mode [ 993.448544][T27468] hsr_slave_1: entered promiscuous mode [ 993.464017][T27468] debugfs: 'hsr0' already exists in 'hsr' [ 993.464037][T27468] Cannot create hsr debugfs directory [ 993.613132][T27602] __nla_validate_parse: 1 callbacks suppressed [ 993.613172][T27602] netlink: 92 bytes leftover after parsing attributes in process `syz.3.6458'. [ 993.823129][T27610] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6460'. [ 993.878421][T27605] netlink: 124 bytes leftover after parsing attributes in process `syz.5.6459'. [ 993.921000][T27613] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6459'. [ 993.958602][T27615] openvswitch: netlink: Flow key attribute not present in set flow. [ 994.020498][T27616] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6461'. [ 994.030934][T27612] netlink: 288 bytes leftover after parsing attributes in process `syz.3.6461'. [ 994.109051][T27618] netlink: 4168 bytes leftover after parsing attributes in process `syz.0.6462'. [ 994.136236][ T5646] Bluetooth: hci2: command tx timeout [ 994.511525][T27637] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 994.516525][T27637] netlink: 'syz.0.6465': attribute type 32 has an invalid length. [ 994.542823][T27636] netlink: 'syz.5.6466': attribute type 10 has an invalid length. [ 994.793138][T27636] team0: Device wg2 is of different type [ 994.861581][ T5297] 8021q: adding VLAN 0 to HW filter on device eth6 [ 995.190306][T27655] netlink: 64 bytes leftover after parsing attributes in process `syz.5.6471'. [ 995.217435][T27656] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6473'. [ 995.279349][T27650] netlink: 'syz.3.6472': attribute type 29 has an invalid length. [ 995.345092][T27659] FAULT_INJECTION: forcing a failure. [ 995.345092][T27659] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 995.345119][T27659] CPU: 1 UID: 0 PID: 27659 Comm: syz.0.6474 Not tainted syzkaller #0 PREEMPT(full) [ 995.345140][T27659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 995.345151][T27659] Call Trace: [ 995.345158][T27659] [ 995.345170][T27659] dump_stack_lvl+0xe8/0x150 [ 995.345205][T27659] should_fail_ex+0x3eb/0x540 [ 995.345230][T27659] _copy_to_user+0x31/0xb0 [ 995.345254][T27659] simple_read_from_buffer+0xe1/0x170 [ 995.345281][T27659] proc_fail_nth_read+0x1bb/0x230 [ 995.345313][T27659] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 995.345345][T27659] ? rw_verify_area+0x24a/0x4c0 [ 995.345370][T27659] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 995.345397][T27659] vfs_read+0x213/0xa80 [ 995.345425][T27659] ? __pfx___mutex_lock+0x10/0x10 [ 995.345446][T27659] ? __pfx_vfs_read+0x10/0x10 [ 995.345470][T27659] ? __fget_files+0x2a/0x420 [ 995.345491][T27659] ? __fget_files+0x3a2/0x420 [ 995.345511][T27659] ? __fget_files+0x2a/0x420 [ 995.345536][T27659] ? fdget+0x1ac/0x250 [ 995.345572][T27659] ksys_read+0x150/0x270 [ 995.345598][T27659] ? __pfx_ksys_read+0x10/0x10 [ 995.345631][T27659] do_syscall_64+0x166/0x520 [ 995.345649][T27659] ? trace_irq_disable+0x3b/0x140 [ 995.345675][T27659] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.345693][T27659] ? clear_bhb_loop+0x70/0xc0 [ 995.345716][T27659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 995.345733][T27659] RIP: 0033:0x7f7ad7f5fd8e [ 995.345751][T27659] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 995.345767][T27659] RSP: 002b:00007f7ad8e5efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 995.345787][T27659] RAX: ffffffffffffffda RBX: 00007f7ad8e5f6c0 RCX: 00007f7ad7f5fd8e [ 995.345801][T27659] RDX: 000000000000000f RSI: 00007f7ad8e5f0a0 RDI: 0000000000000004 [ 995.345813][T27659] RBP: 00007f7ad8e5f090 R08: 0000000000000000 R09: 0000000000000000 [ 995.345824][T27659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 995.345835][T27659] R13: 00007f7ad8226038 R14: 00007f7ad8225fa0 R15: 00007ffcec425578 [ 995.345865][T27659] [ 995.646180][T27662] bpf: Bad value for 'gid' [ 995.762643][T27662] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6475'. [ 995.954329][T27679] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 995.955155][T27679] netlink: 'syz.0.6476': attribute type 32 has an invalid length. [ 995.955611][T27662] bond0: (slave bond_slave_0): Releasing backup interface [ 996.039788][T27662] : renamed from bond_slave_0 [ 996.060828][T27662] : entered promiscuous mode [ 996.060852][T27662] : entered allmulticast mode [ 996.211534][ T5646] Bluetooth: hci2: command tx timeout [ 996.506636][T27468] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 996.536273][T27468] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 996.539601][T27468] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 996.582725][T27468] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 996.850679][T27703] FAULT_INJECTION: forcing a failure. [ 996.850679][T27703] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 996.850714][T27703] CPU: 1 UID: 0 PID: 27703 Comm: syz.5.6483 Not tainted syzkaller #0 PREEMPT(full) [ 996.850738][T27703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 996.850751][T27703] Call Trace: [ 996.850760][T27703] [ 996.850770][T27703] dump_stack_lvl+0xe8/0x150 [ 996.850808][T27703] should_fail_ex+0x3eb/0x540 [ 996.850837][T27703] prepare_alloc_pages+0x21e/0x5f0 [ 996.850872][T27703] __alloc_frozen_pages_noprof+0x17c/0x410 [ 996.850912][T27703] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 996.850952][T27703] ? policy_nodemask+0x31b/0x980 [ 996.850990][T27703] alloc_pages_mpol+0x21e/0x390 [ 996.851027][T27703] alloc_pages_noprof+0xb1/0x2b0 [ 996.851061][T27703] pgd_alloc+0x44/0x750 [ 996.851096][T27703] mm_init+0x61d/0xcb0 [ 996.851127][T27703] copy_mm+0xfc/0x470 [ 996.851158][T27703] copy_process+0x1ecc/0x44b0 [ 996.851209][T27703] ? copy_process+0xd17/0x44b0 [ 996.851252][T27703] ? __pfx_copy_process+0x10/0x10 [ 996.851291][T27703] kernel_clone+0x2d7/0x940 [ 996.851325][T27703] ? __pfx_kernel_clone+0x10/0x10 [ 996.851376][T27703] __x64_sys_clone+0x1b6/0x230 [ 996.851408][T27703] ? __pfx___x64_sys_clone+0x10/0x10 [ 996.851453][T27703] ? __pfx_ksys_write+0x10/0x10 [ 996.851491][T27703] do_syscall_64+0x166/0x520 [ 996.851512][T27703] ? trace_irq_disable+0x3b/0x140 [ 996.851539][T27703] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 996.851559][T27703] ? clear_bhb_loop+0x70/0xc0 [ 996.851582][T27703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 996.851602][T27703] RIP: 0033:0x7faba119f559 [ 996.851620][T27703] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 996.851637][T27703] RSP: 002b:00007faba1f82fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 996.851658][T27703] RAX: ffffffffffffffda RBX: 00007faba1425fa0 RCX: 00007faba119f559 [ 996.851672][T27703] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000126400 [ 996.851685][T27703] RBP: 00007faba1f83090 R08: 0000000000000000 R09: 0000000000000000 [ 996.851698][T27703] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000002 [ 996.851710][T27703] R13: 00007faba1426038 R14: 00007faba1425fa0 R15: 00007ffd02ebc058 [ 996.851760][T27703] [ 997.125361][T27468] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 997.153842][T27468] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 997.286964][T27468] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 997.311751][T27468] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 997.389753][T27709] xt_nfacct: accounting object `sy' does not exist [ 997.469940][T27709] netlink: 'syz.0.6485': attribute type 28 has an invalid length. [ 997.469983][T27709] netlink: 'syz.0.6485': attribute type 29 has an invalid length. [ 997.527889][T27710] netlink: 'syz.3.6484': attribute type 29 has an invalid length. [ 997.954961][T27735] FAULT_INJECTION: forcing a failure. [ 997.954961][T27735] name failslab, interval 1, probability 0, space 0, times 0 [ 997.954994][T27735] CPU: 1 UID: 0 PID: 27735 Comm: syz.3.6489 Not tainted syzkaller #0 PREEMPT(full) [ 997.955018][T27735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 997.955031][T27735] Call Trace: [ 997.955039][T27735] [ 997.955049][T27735] dump_stack_lvl+0xe8/0x150 [ 997.955088][T27735] should_fail_ex+0x3eb/0x540 [ 997.955117][T27735] should_failslab+0xa8/0x100 [ 997.955152][T27735] __kmalloc_cache_noprof+0x9e/0x600 [ 997.955178][T27735] ? __pfx___mutex_lock+0x10/0x10 [ 997.955202][T27735] ? genl_start+0x1c9/0x6d0 [ 997.955221][T27735] ? genl_start+0x1c9/0x6d0 [ 997.955249][T27735] genl_start+0x1c9/0x6d0 [ 997.955278][T27735] __netlink_dump_start+0x442/0x7b0 [ 997.955314][T27735] genl_family_rcv_msg_dumpit+0x213/0x310 [ 997.955341][T27735] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 997.955379][T27735] ? __pfx_genl_start+0x10/0x10 [ 997.955397][T27735] ? __pfx_genl_dumpit+0x10/0x10 [ 997.955415][T27735] ? __pfx_genl_done+0x10/0x10 [ 997.955440][T27735] ? bpf_lsm_capable+0x9/0x20 [ 997.955460][T27735] ? security_capable+0x7e/0x2c0 [ 997.955497][T27735] genl_rcv_msg+0x5e1/0x7a0 [ 997.955526][T27735] ? __pfx_genl_rcv_msg+0x10/0x10 [ 997.955545][T27735] ? __pfx_ioam6_genl_dumpns_start+0x10/0x10 [ 997.955567][T27735] ? __pfx_ioam6_genl_dumpns+0x10/0x10 [ 997.955586][T27735] ? __pfx_ioam6_genl_dumpns_done+0x10/0x10 [ 997.955623][T27735] netlink_rcv_skb+0x226/0x4a0 [ 997.955651][T27735] ? __pfx_genl_rcv_msg+0x10/0x10 [ 997.955673][T27735] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 997.955717][T27735] ? down_read+0x2b9/0x320 [ 997.955745][T27735] genl_rcv+0x28/0x40 [ 997.955776][T27735] netlink_unicast+0x8ef/0xa80 [ 997.955820][T27735] netlink_sendmsg+0x7f0/0xb20 [ 997.955853][T27735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 997.955885][T27735] ? aa_sock_msg_perm+0x144/0x210 [ 997.955922][T27735] ? apparmor_socket_sendmsg+0x98/0x360 [ 997.955953][T27735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 997.955979][T27735] sock_sendmsg_nosec+0x14e/0x190 [ 997.956008][T27735] ____sys_sendmsg+0x54e/0x850 [ 997.956065][T27735] ? __pfx_____sys_sendmsg+0x10/0x10 [ 997.956110][T27735] ? import_iovec+0x73/0xa0 [ 997.956141][T27735] ___sys_sendmsg+0x2a5/0x360 [ 997.956183][T27735] ? __lock_acquire+0x747/0x2de0 [ 997.956217][T27735] ? __pfx____sys_sendmsg+0x10/0x10 [ 997.956311][T27735] ? __fget_files+0x3a2/0x420 [ 997.956339][T27735] ? __fget_files+0x2a/0x420 [ 997.956386][T27735] __x64_sys_sendmsg+0x1b1/0x290 [ 997.956420][T27735] ? perf_trace_preemptirq_template+0x270/0x350 [ 997.956455][T27735] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 997.956514][T27735] do_syscall_64+0x166/0x520 [ 997.956537][T27735] ? trace_irq_disable+0x3b/0x140 [ 997.956565][T27735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 997.956588][T27735] ? clear_bhb_loop+0x70/0xc0 [ 997.956616][T27735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 997.956638][T27735] RIP: 0033:0x7fcf1ff9f559 [ 997.956658][T27735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 997.956678][T27735] RSP: 002b:00007fcf20ee9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 997.956701][T27735] RAX: ffffffffffffffda RBX: 00007fcf20226090 RCX: 00007fcf1ff9f559 [ 997.956724][T27735] RDX: 0000000000000840 RSI: 0000200000000900 RDI: 0000000000000007 [ 997.956738][T27735] RBP: 00007fcf20ee9090 R08: 0000000000000000 R09: 0000000000000000 [ 997.956752][T27735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 997.956765][T27735] R13: 00007fcf20226128 R14: 00007fcf20226090 R15: 00007ffdc141d3b8 [ 997.956804][T27735] [ 998.742046][T27745] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 998.768404][T27745] netlink: 'syz.0.6491': attribute type 32 has an invalid length. [ 998.822653][T27468] 8021q: adding VLAN 0 to HW filter on device bond0 [ 999.043628][T27468] 8021q: adding VLAN 0 to HW filter on device team0 [ 999.461295][T27770] __nla_validate_parse: 2 callbacks suppressed [ 999.461328][T27770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6495'. [ 999.461516][T27770] netlink: 30 bytes leftover after parsing attributes in process `syz.0.6495'. [ 999.499240][T27772] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 999.765581][T24718] bridge0: port 1(bridge_slave_0) entered blocking state [ 999.765705][T24718] bridge0: port 1(bridge_slave_0) entered forwarding state [ 999.826367][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 999.826490][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1001.189936][T27807] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6501'. [ 1003.194895][T27825] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6503'. [ 1003.559749][T27846] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6506'. [ 1003.936717][T27855] netlink: 'syz.1.6508': attribute type 1 has an invalid length. [ 1003.936743][T27855] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.6508'. [ 1004.447421][T27864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6509'. [ 1005.392852][ T86] team0 (unregistering): Port device team_slave_1 removed [ 1005.432588][ T86] team0 (unregistering): Port device team_slave_0 removed [ 1005.861229][T27845] netlink: 288 bytes leftover after parsing attributes in process `syz.3.6506'. [ 1005.890695][T27862] netlink: 288 bytes leftover after parsing attributes in process `syz.1.6509'. [ 1006.275343][T27468] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1006.680046][T27897] netlink: 288 bytes leftover after parsing attributes in process `syz.5.6515'. [ 1006.822944][T27896] netlink: 168 bytes leftover after parsing attributes in process `syz.3.6513'. [ 1007.522840][T27902] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6515'. [ 1007.749155][T27468] veth0_vlan: entered promiscuous mode [ 1007.815236][T27468] veth1_vlan: entered promiscuous mode [ 1007.901296][T27916] netlink: 'syz.3.6517': attribute type 39 has an invalid length. [ 1008.095727][T27919] netlink: 'syz.1.6518': attribute type 1 has an invalid length. [ 1008.095755][T27919] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.6518'. [ 1008.145974][T27468] veth0_macvtap: entered promiscuous mode [ 1008.205834][T27468] veth1_macvtap: entered promiscuous mode [ 1008.356520][T27468] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1008.452114][T27468] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1008.615978][T27929] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6520'. [ 1008.616173][T27929] netlink: 30 bytes leftover after parsing attributes in process `syz.0.6520'. [ 1008.744352][ T3006] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1008.745381][T27929] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 1008.863321][ T50] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1008.863384][ T50] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1008.974598][T24718] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.472394][ T3006] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1009.472416][ T3006] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1009.691226][T27947] netlink: 288 bytes leftover after parsing attributes in process `syz.3.6522'. [ 1009.697635][T24718] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1009.697658][T24718] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1009.895451][T27947] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6522'. [ 1010.889408][T27973] netlink: 10 bytes leftover after parsing attributes in process `syz.0.6527'. [ 1011.327799][T27979] FAULT_INJECTION: forcing a failure. [ 1011.327799][T27979] name failslab, interval 1, probability 0, space 0, times 0 [ 1011.327833][T27979] CPU: 1 UID: 0 PID: 27979 Comm: syz.1.6528 Not tainted syzkaller #0 PREEMPT(full) [ 1011.327858][T27979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1011.327873][T27979] Call Trace: [ 1011.327882][T27979] [ 1011.327892][T27979] dump_stack_lvl+0xe8/0x150 [ 1011.327934][T27979] should_fail_ex+0x3eb/0x540 [ 1011.327965][T27979] should_failslab+0xa8/0x100 [ 1011.328002][T27979] __kmalloc_noprof+0xf9/0x710 [ 1011.328027][T27979] ? rcu_is_watching+0x16/0xb0 [ 1011.328061][T27979] ? tomoyo_realpath_from_path+0xef/0x640 [ 1011.328115][T27979] ? tomoyo_realpath_from_path+0xef/0x640 [ 1011.328175][T27979] tomoyo_realpath_from_path+0xef/0x640 [ 1011.328220][T27979] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1011.328251][T27979] tomoyo_path_number_perm+0x246/0x5f0 [ 1011.328284][T27979] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1011.328311][T27979] ? __lock_acquire+0x747/0x2de0 [ 1011.328383][T27979] ? __fget_files+0x2a/0x420 [ 1011.328414][T27979] ? __fget_files+0x2a/0x420 [ 1011.328441][T27979] ? __fget_files+0x2a/0x420 [ 1011.328474][T27979] security_file_ioctl+0xc3/0x2a0 [ 1011.328505][T27979] __se_sys_ioctl+0x47/0x170 [ 1011.328542][T27979] do_syscall_64+0x166/0x520 [ 1011.328565][T27979] ? trace_irq_disable+0x3b/0x140 [ 1011.328595][T27979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.328618][T27979] ? clear_bhb_loop+0x70/0xc0 [ 1011.328645][T27979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.328666][T27979] RIP: 0033:0x7f527599f559 [ 1011.328687][T27979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1011.328708][T27979] RSP: 002b:00007f527692a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1011.328732][T27979] RAX: ffffffffffffffda RBX: 00007f5275c25fa0 RCX: 00007f527599f559 [ 1011.328749][T27979] RDX: 0000200000000a00 RSI: 000000000000541b RDI: 0000000000000006 [ 1011.328775][T27979] RBP: 00007f527692a090 R08: 0000000000000000 R09: 0000000000000000 [ 1011.328788][T27979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1011.328801][T27979] R13: 00007f5275c26038 R14: 00007f5275c25fa0 R15: 00007ffebca63a18 [ 1011.328836][T27979] [ 1011.328857][T27979] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1011.614602][T27984] netlink: 'syz.3.6530': attribute type 1 has an invalid length. [ 1011.614628][T27984] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.6530'. [ 1011.720030][T27990] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6529'. [ 1012.259727][T28002] netlink: 288 bytes leftover after parsing attributes in process `syz.0.6535'. [ 1012.381535][T28002] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6535'. [ 1012.801657][T28015] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1012.829296][T28015] netlink: 'syz.1.6537': attribute type 32 has an invalid length. [ 1013.383157][T28025] syzkaller0: entered promiscuous mode [ 1013.383182][T28025] syzkaller0: entered allmulticast mode [ 1014.225014][T28032] netlink: 288 bytes leftover after parsing attributes in process `syz.5.6542'. [ 1014.248540][T28044] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6542'. [ 1014.263072][T28039] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6539'. [ 1014.452987][T28058] netlink: 'syz.3.6544': attribute type 1 has an invalid length. [ 1014.453011][T28058] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.6544'. [ 1014.691194][T28066] FAULT_INJECTION: forcing a failure. [ 1014.691194][T28066] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1014.691226][T28066] CPU: 1 UID: 0 PID: 28066 Comm: syz.4.6547 Not tainted syzkaller #0 PREEMPT(full) [ 1014.691251][T28066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1014.691265][T28066] Call Trace: [ 1014.691273][T28066] [ 1014.691283][T28066] dump_stack_lvl+0xe8/0x150 [ 1014.691333][T28066] should_fail_ex+0x3eb/0x540 [ 1014.691362][T28066] _copy_from_user+0x2d/0xb0 [ 1014.691388][T28066] ___sys_recvmsg+0x173/0x5a0 [ 1014.691426][T28066] ? __pfx____sys_recvmsg+0x10/0x10 [ 1014.691452][T28066] ? lock_acquire+0x115/0x350 [ 1014.691494][T28066] ? __fget_files+0x2a/0x420 [ 1014.691519][T28066] ? __fget_files+0x3a2/0x420 [ 1014.691543][T28066] ? __fget_files+0x2a/0x420 [ 1014.691578][T28066] __x64_sys_recvmsg+0x1ae/0x290 [ 1014.691602][T28066] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1014.691656][T28066] do_syscall_64+0x166/0x520 [ 1014.691679][T28066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1014.691701][T28066] ? clear_bhb_loop+0x70/0xc0 [ 1014.691726][T28066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1014.691747][T28066] RIP: 0033:0x7f206cd9f559 [ 1014.691767][T28066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1014.691785][T28066] RSP: 002b:00007f206dc99028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1014.691806][T28066] RAX: ffffffffffffffda RBX: 00007f206d025fa0 RCX: 00007f206cd9f559 [ 1014.691821][T28066] RDX: 0000000040000100 RSI: 0000200000000680 RDI: 0000000000000004 [ 1014.691834][T28066] RBP: 00007f206dc99090 R08: 0000000000000000 R09: 0000000000000000 [ 1014.691847][T28066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1014.691859][T28066] R13: 00007f206d026038 R14: 00007f206d025fa0 R15: 00007ffcde164258 [ 1014.691892][T28066] [ 1014.916947][T28069] netlink: 'syz.5.6546': attribute type 21 has an invalid length. [ 1014.917067][T28069] netlink: 'syz.5.6546': attribute type 1 has an invalid length. [ 1014.917084][T28069] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6546'. [ 1015.202576][T28075] openvswitch: netlink: IP tunnel dst address not specified [ 1015.997721][T28112] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6555'. [ 1016.305914][T28124] netlink: 'syz.4.6558': attribute type 32 has an invalid length. [ 1016.319774][T28117] netlink: 'syz.3.6557': attribute type 10 has an invalid length. [ 1016.837270][T28142] netlink: 168 bytes leftover after parsing attributes in process `syz.5.6561'. [ 1016.884271][T28147] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6563'. [ 1016.884304][T28147] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6563'. [ 1016.884331][T28147] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6563'. [ 1017.065251][T28151] veth1_macvtap: left promiscuous mode [ 1017.459131][T28156] : port 1(dummy0) entered blocking state [ 1017.459480][T28156] : port 1(dummy0) entered disabled state [ 1017.459828][T28156] dummy0: entered allmulticast mode [ 1017.489983][T28156] dummy0: entered promiscuous mode [ 1017.562511][T28165] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6568'. [ 1017.713287][T28166] netlink: 'syz.1.6569': attribute type 10 has an invalid length. [ 1017.767087][T28180] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6572'. [ 1018.684720][T28211] netlink: 'syz.3.6574': attribute type 32 has an invalid length. [ 1019.022744][T28217] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6576'. [ 1019.023181][T28217] netlink: 30 bytes leftover after parsing attributes in process `syz.5.6576'. [ 1019.068516][T28217] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 1019.650163][T28247] netlink: 'syz.4.6585': attribute type 10 has an invalid length. [ 1019.686888][T28258] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6587'. [ 1019.694364][T28247] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1019.699103][T28247] team0: Port device netdevsim1 added [ 1020.247990][T28269] »»»»»»: renamed from veth0_vlan [ 1020.360401][T28274] netlink: 'syz.1.6594': attribute type 10 has an invalid length. [ 1020.550939][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.551857][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.552663][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.593706][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.594578][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.595388][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.597448][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.598365][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.599196][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.652285][T28279] Dead loop on virtual device lo (net 598), fix it urgently! [ 1020.708260][T28283] netlink: 'syz.3.6597': attribute type 10 has an invalid length. [ 1021.038480][T28284] syzkaller0: entered promiscuous mode [ 1021.038510][T28284] syzkaller0: entered allmulticast mode [ 1021.515381][T28300] netlink: 'syz.1.6601': attribute type 10 has an invalid length. [ 1021.639705][T28308] __nla_validate_parse: 1 callbacks suppressed [ 1021.639755][T28308] netlink: 124 bytes leftover after parsing attributes in process `syz.0.6604'. [ 1021.692208][T28309] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6604'. [ 1022.390396][T28321] netlink: 'syz.3.6609': attribute type 32 has an invalid length. [ 1023.300051][T28294] netlink: 10 bytes leftover after parsing attributes in process `syz.5.6600'. [ 1023.521859][T28331] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6614'. [ 1023.521901][T28331] netlink: 'syz.4.6614': attribute type 1 has an invalid length. [ 1023.588748][T28328] netlink: 'syz.3.6613': attribute type 10 has an invalid length. [ 1023.837953][T28340] »»»»»»: renamed from veth0_vlan [ 1024.485092][T28351] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6621'. [ 1024.704481][T28359] netlink: 'syz.4.6624': attribute type 10 has an invalid length. [ 1024.747058][T28360] netlink: 'syz.5.6623': attribute type 32 has an invalid length. [ 1024.840293][T28369] netlink: 'syz.3.6626': attribute type 32 has an invalid length. [ 1025.109615][T28376] netlink: 'syz.4.6630': attribute type 10 has an invalid length. [ 1025.124313][T28388] netlink: 'syz.0.6628': attribute type 10 has an invalid length. [ 1025.253564][T28387] netlink: 10 bytes leftover after parsing attributes in process `syz.1.6634'. [ 1026.150447][T28413] netlink: 'syz.5.6640': attribute type 10 has an invalid length. [ 1026.206902][T28413] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1026.233647][T28413] team0: Port device netdevsim1 added [ 1026.548871][T28424] netlink: 'syz.4.6645': attribute type 10 has an invalid length. [ 1026.684919][T28438] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6647'. [ 1026.685165][T28438] netlink: 30 bytes leftover after parsing attributes in process `syz.0.6647'. [ 1026.714680][T28438] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 1026.750433][T28433] netlink: 'syz.1.6649': attribute type 35 has an invalid length. [ 1026.976925][T28447] netlink: 288 bytes leftover after parsing attributes in process `syz.3.6652'. [ 1027.096999][T28447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6652'. [ 1028.274577][T28478] net_ratelimit: 44 callbacks suppressed [ 1028.274630][T28478] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1028.369535][T28481] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6664'. [ 1028.578997][T28487] validate_nla: 2 callbacks suppressed [ 1028.579017][T28487] netlink: 'syz.0.6661': attribute type 10 has an invalid length. [ 1028.595226][T28485] netlink: 'syz.1.6665': attribute type 10 has an invalid length. [ 1029.238484][T28502] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6671'. [ 1029.238959][T28502] netlink: 30 bytes leftover after parsing attributes in process `syz.1.6671'. [ 1029.263888][T28502] sch_tbf: burst 0 is lower than device batadv_slave_1 mtu (1514) ! [ 1029.755528][T28525] netlink: 'syz.1.6676': attribute type 10 has an invalid length. [ 1030.392108][T28532] syzkaller0: entered promiscuous mode [ 1030.392135][T28532] syzkaller0: entered allmulticast mode [ 1030.860869][T25348] Bluetooth: hci1: command 0x0406 tx timeout [ 1032.493401][T28549] IPv6: pim6reg1: Disabled Multicast RS [ 1032.739851][T28583] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 1033.265159][T28610] ÿÿÿÿÿÿ: renamed from vlan1 [ 1034.559122][T28666] rxe_eth0 speed is unknown, defaulting to 1000 [ 1035.006840][T28677] rxe_eth0 speed is unknown, defaulting to 1000 [ 1035.337212][T28706] [ 1035.339646][T28706] ============================= [ 1035.344626][T28706] WARNING: suspicious RCU usage [ 1035.349571][T28706] syzkaller #0 Not tainted [ 1035.354058][T28706] ----------------------------- [ 1035.358926][T28706] kernel/events/callchain.c:163 suspicious rcu_dereference_check() usage! [ 1035.367488][T28706] [ 1035.367488][T28706] other info that might help us debug this: [ 1035.367488][T28706] [ 1035.377881][T28706] [ 1035.377881][T28706] rcu_scheduler_active = 2, debug_locks = 1 [ 1035.387150][T28706] locks held by syz.4.6739/28706: 1, last CPU#1: [ 1035.393594][T28706] #0: ffffffff9015a518 (rcu_tasks_trace_srcu_struct){....}-{0:0}, at: rcu_read_lock_trace+0x25/0x110 [ 1035.405517][T28706] [ 1035.405517][T28706] stack backtrace: [ 1035.411621][T28706] CPU: 1 UID: 0 PID: 28706 Comm: syz.4.6739 Not tainted syzkaller #0 PREEMPT(full) [ 1035.421017][T28706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1035.431102][T28706] Call Trace: [ 1035.434414][T28706] [ 1035.437364][T28706] dump_stack_lvl+0xe8/0x150 [ 1035.442000][T28706] lockdep_rcu_suspicious+0x140/0x1d0 [ 1035.447414][T28706] get_callchain_entry+0x2b7/0x3c0 [ 1035.452567][T28706] get_perf_callchain+0xd5/0x880 [ 1035.457544][T28706] ? __pfx_get_perf_callchain+0x10/0x10 [ 1035.463118][T28706] ? __lock_acquire+0x747/0x2de0 [ 1035.468089][T28706] __bpf_get_stack+0x38e/0xac0 [ 1035.472895][T28706] ? __pfx___bpf_get_stack+0x10/0x10 [ 1035.478203][T28706] ? __lock_acquire+0x747/0x2de0 [ 1035.483171][T28706] ? lock_acquire+0x115/0x350 [ 1035.487877][T28706] ? bpf_prog_38e0858330d1fa91+0x40/0x48 [ 1035.493541][T28706] bpf_get_stack_raw_tp+0x1a4/0x210 [ 1035.498783][T28706] bpf_prog_38e0858330d1fa91+0x40/0x48 [ 1035.504288][T28706] bpf_prog_run_pin_on_cpu+0x14f/0x4c0 [ 1035.509794][T28706] bpf_prog_test_run_syscall+0x324/0x4c0 [ 1035.515470][T28706] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 1035.521658][T28706] ? __fget_files+0x2a/0x420 [ 1035.526286][T28706] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 1035.532505][T28706] bpf_prog_test_run+0x2c5/0x340 [ 1035.537479][T28706] __sys_bpf+0xb1e/0xe00 [ 1035.541806][T28706] ? __pfx___sys_bpf+0x10/0x10 [ 1035.546616][T28706] ? do_futex+0x3e7/0x4e0 [ 1035.551013][T28706] ? rcu_is_watching+0x16/0xb0 [ 1035.555827][T28706] __x64_sys_bpf+0xba/0xd0 [ 1035.560305][T28706] do_syscall_64+0x166/0x520 [ 1035.564930][T28706] ? trace_irq_disable+0x3b/0x140 [ 1035.569981][T28706] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1035.576072][T28706] ? clear_bhb_loop+0x70/0xc0 [ 1035.580771][T28706] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1035.586676][T28706] RIP: 0033:0x7f206cd9f559 [ 1035.591106][T28706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1035.610746][T28706] RSP: 002b:00007f206dc99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1035.619191][T28706] RAX: ffffffffffffffda RBX: 00007f206d025fa0 RCX: 00007f206cd9f559 [ 1035.627194][T28706] RDX: 0000000000000010 RSI: 0000200000000740 RDI: 000000000000000a [ 1035.635199][T28706] RBP: 00007f206ce36b50 R08: 0000000000000000 R09: 0000000000000000 [ 1035.643194][T28706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1035.651188][T28706] R13: 00007f206d026038 R14: 00007f206d025fa0 R15: 00007ffcde164258 [ 1035.659213][T28706]