last executing test programs: 4.67581749s ago: executing program 0 (id=5260): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f00000000c0)={0x2, 0x4e22, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000000000000000020000004404a60007036f001c"], 0x38}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x78}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x3c) 4.4754628s ago: executing program 0 (id=5263): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x10, 0x1a, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9a540}, {}, {}, [@ldst={0x1, 0x2, 0x2, 0x5, 0xe, 0xfffffffffffffffc, 0xfffffffffffffff7}, @ringbuf_query, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='GPL\x00', 0x7c6, 0x59, &(0x7f0000000280)=""/89, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000800)={0x3, 0xd, 0xffffffe8, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000540)=[0x1], &(0x7f0000000580)=[{0x5, 0x5, 0x2, 0x8}], 0x10, 0x5}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000007c0)=@o_path={&(0x7f00000001c0)='./file0\x00', r0}, 0x18) (async) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000007c0)=@o_path={&(0x7f00000001c0)='./file0\x00', r0}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r1) (async) close(r1) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x20008000) bpf$MAP_CREATE(0x0, 0x0, 0x69137b32e883365e) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001640)=ANY=[@ANYBLOB="120000000a0000000800000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r5}, &(0x7f0000000180), &(0x7f0000000100)=r4}, 0x20) r6 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0xe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r3) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4840) r7 = socket$kcm(0x10, 0x3, 0x10) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) (async) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b06d25a806c8c6f94f90424fc600400037a0a000900050282c137153e370e0c1180fc0b10000300", 0x33fe0}], 0x1}, 0x0) (async) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b06d25a806c8c6f94f90424fc600400037a0a000900050282c137153e370e0c1180fc0b10000300", 0x33fe0}], 0x1}, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r8) (async) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r8) recvmsg$unix(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x0) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) (async) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) 4.006466273s ago: executing program 1 (id=5267): syz_clone(0x45004400, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d0048007ea60864160af36504001a0038001d00", 0x28}, {&(0x7f0000000080)="83d2ff5f00000080d2898a0cc6d6703b87eb28f77b09bc7e64f918fa3bc7664d327d90424d5503002800"/52, 0x34}, {&(0x7f0000000040)="3b9ef613ba09c76c22776d58e5ea151c65a301282f14f1b2c2610701b7527efb8ed6cd7e3746e20cc87a", 0x2a}, {&(0x7f0000000340)="f6a267e81e293931a8e222035fd03b4fd193b03eab6b3776a04169c5dee3dea695a863ddedd7612cede4c1745e275ea676f8c59414f56733708089d7dd23b797573890751aa7811c4020bd6eece204fefaf59fa5ad4fd9f085cc3b99b702a17eee2dc4fd60fcb89dde2bc5e71e5137661e3cb1d806f8a9420e4b1f6242154c046c121033f60dce62d8012e8c18466ccd9abb08622a753965", 0x98}, {&(0x7f0000000200)="d7ab425c6c94d93e2c9d3534e8c6cee3fe6b2af9948b20b777a988c032ce436fb7929174c05cd8bc99ae16f9fe864d632423bdda85", 0x35}, {&(0x7f0000000400)="9f99289974aa2e876c70a197d9bc0b31c024", 0x12}], 0x6, 0x0, 0x0, 0x1f00c00e}, 0x20048004) 3.754404396s ago: executing program 0 (id=5268): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000940)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="18000000010000000000000000000000370001000000000095002b43990800125e0000000000"], &(0x7f0000001a40)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000035ec35bc0300000000000000be1ef4d0374d75009ec74c4e8e3c4495955312efaaee2fb91c808796d5b1df73c2b991c02544c4a67e328a8b80ff4cead4373414e0b25f2e3f732a1deaf23e8c", @ANYRES32, @ANYBLOB="0400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x40, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x81ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0x7fff, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000380)={0x7, 0x80, 0xfa, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x0, 0x80000000}, 0x4, 0xc8, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0xe) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) socket$kcm(0x2, 0x5, 0x84) (async) r6 = socket$kcm(0x10, 0x2, 0x4) close(r6) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006b7d373be35c6e17aa31046b876c1d0000007ea60864160af36508001dc0c30002000c0031009ee517d34460bc24eab556a705251e618294ff0051f60a84c9f472736f67c5e73bb9e5c446fa30be62cbd4938037e786", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x5452, &(0x7f00000006c0)='\x02;\xe5\b\x00\x1c\x9c\x00\x00\x00\x00\x00\x00\x91\xecB\xdcZ\xe5\xbd$\x05\x90\xa9\xf3\xc7\xcb\xb7\xf0\xa1;#\x989\xe9\x12\xdf^6T\xdf\xcd\x02\xc5\xb0\xba\x12\'QXp\t\xfc\xf3\x01\x02\xbc\xbf\xc0\xf0\x10\xee\xd3\\yy\xa4\xf9\xe8\x00\xdd\xe97 0_\xe4]W\xf7~\xacVK\xc9t\x9e+:\x85\xef\x94\x0e\x19\x9cV[N.\xeb\x9fJ>\xd9\x99\x88\xd8\xdd\xb8Y\xc3$\xc6\x93\v\x04REY\xf4\xea\xf2\xcd\xcd.\x16\x861\xa1\v\x8d\x8e\x84R\xa6\x83\x84\xc0\x01e\xc3\xc8\xcc?\xc8?\x19\xb2\xa2\xe1\xac<\xe9f\x11\xff3\xc7\x19\x9e\x19\xf5-\xfe\xbd\xae\xbbR\x82\x16\xf9\x15S\x03U\xe0\xd8t\xe3%96') perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_bp={0x0, 0x1}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socket$kcm(0x11, 0x3, 0x0) r8 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r8, 0x0, 0x4, 0x0, 0x11) (async) r9 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r9, &(0x7f0000000100)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x4000, @mcast1={0xff, 0x2}}, 0x80, 0x0}, 0x0) (async) socket$kcm(0x2a, 0x2, 0x0) 3.336209726s ago: executing program 0 (id=5270): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000780)={r1}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000000006c"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x4030582a, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={r2, 0x58, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x8, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r4}, 0x94) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x10, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000022bf000000000000ff7f000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000753cbc3640000000000007617040007000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000d4304040020527d7f848b450dd98729911bb8613199fe00333b7333987d2a3896794e2b8d2ad8795c5f22f17566d0e1f2386760c3a7a37f06726860f195766"], &(0x7f0000000200)='syzkaller\x00', 0x8, 0xd4, &(0x7f0000000040)=""/212, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffff8d}, 0x25) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x2c}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r6, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8, &(0x7f0000001380)}}, 0x10) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r1, @ANYBLOB="0000000000000500000000000000000031a54699", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000030000000100"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1b, 0x30, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6307, 0x0, 0x0, 0x0, 0xffffff01}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @map_idx={0x18, 0x3, 0x5, 0x0, 0xe}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @call={0x85, 0x0, 0x0, 0xc7}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0xb7}, @exit], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x101, 0x12, &(0x7f0000000080)=""/18, 0x40f00, 0x2, '\x00', r3, @fallback=0x17, r0, 0x8, &(0x7f0000000140)={0x3, 0x1}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0x6, 0xc, 0x8001}, 0x10, r4, r0, 0x4, &(0x7f0000000580)=[r5, r7], &(0x7f00000005c0)=[{0x4, 0x2, 0xe, 0x6}, {0x2, 0x1, 0x1, 0xa}, {0x0, 0x3, 0x5, 0x3}, {0x0, 0x5, 0xb}], 0x10, 0x3}, 0x94) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r8 = socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(r8, &(0x7f0000000840)={&(0x7f0000000000)={0x2, 0x4e20, @remote}, 0x10, 0x0, 0x0, &(0x7f0000001c80)=ANY=[], 0x2f8}, 0x20000080) setsockopt$sock_attach_bpf(r8, 0x6, 0x19, &(0x7f0000000200)=r8, 0x78) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r9 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="d80000001c0081", 0x7}], 0x1, 0x0, 0x0, 0x7400}, 0x0) write$cgroup_subtree(r9, &(0x7f0000000040)=ANY=[@ANYBLOB="18"], 0xfe33) write$cgroup_devices(r0, &(0x7f00000005c0)=ANY=[], 0xfffffeff) 3.161915204s ago: executing program 1 (id=5273): socket$kcm(0x10, 0x400000002, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000d00)={r0, 0xe0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000009c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0), 0x0, 0xd5, &(0x7f0000000b00)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000b40), &(0x7f0000000b80), 0x8, 0x47, 0x8, 0x8, &(0x7f0000000bc0)}}, 0x10) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00'}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000380)={0x3, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4fb5b6f85a83c771}, 0x0, 0xc8, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x80}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce810203290800000000000000000000ffffac14140a000000000000000000000000ac1414aa"], 0xfdef) r5 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000000), 0x4) r6 = bpf$ITER_CREATE(0x21, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb01001800000100000000000000000c00000006000000050000000000000b04000000002e005f5f002451fb5cc7e13a044f4239b7aaf9f29979"], &(0x7f0000000240)=""/184, 0x2a, 0xb8, 0x1, 0x3, 0x10000, @value=r6}, 0x28) perf_event_open(&(0x7f0000000780)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x2, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r7) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r8) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x9, 0x3, 0x9, 0x1090, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x4, 0xc}, 0x50) setsockopt$sock_attach_bpf(r9, 0x10f, 0x87, &(0x7f0000000500), 0x4) r10 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r10, 0x10f, 0x87, &(0x7f00000008c0), 0x43) sendmsg$kcm(r10, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xe, 0x6, &(0x7f0000000080)=ANY=[@ANYRESHEX=r6], &(0x7f0000000340)='GPL\x00', 0x5, 0xc3, &(0x7f0000000680)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, r4, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, r1, r4}, 0x94) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000000c0)=@bpf_lsm={0xe, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0x56}]}, &(0x7f0000000180)='syzkaller\x00'}, 0x94) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000280)={'pimreg\x00', 0x5dcf70ef8daa5d0e}) 2.771011994s ago: executing program 3 (id=5275): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'veth1_virt_wifi\x00', 0x10}) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000400000000000000008500000030000000180100002020702500000000f82020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000230000009500000000000000"], &(0x7f0000000080)='GPL\x00'}, 0x65) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.694680827s ago: executing program 1 (id=5277): socket$kcm(0x2, 0x200000000000001, 0x106) (async) r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x9}, 0x4828, 0x9, 0x0, 0x1, 0x10000, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xea, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2101, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffefff, 0x1, @perf_bp={&(0x7f0000000400), 0x1}, 0x828, 0x0, 0x200, 0x9, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x10, 0x2, 0x4) (async) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="5c00000014006b08000000d86e6c1d000a117ea6e070d6060000000000000000250002000f00000017d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9767b4fa51f62a64c9f4d49346d88037e786a6d0bdd700000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f003401}, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000002380)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x40}, 0x94) close(r2) (async) close(r2) close(0xffffffffffffffff) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00\v'], 0x48) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) (async) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001500)}, 0x8880) socketpair(0xf, 0x4, 0x4008, &(0x7f00000000c0)={0x0, 0x0}) r7 = perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x15f90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}, 0x412, 0x0, 0x0, 0x6, 0x4, 0x8001}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xea, 0x0, 0x0, 0x0, 0x0, 0x5, 0x83501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x8a0}, 0x940, 0x4, 0x0, 0x0, 0x6d1a, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x20}, 0x0, 0xffffffffffffffff, r7, 0x0) (async) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xea, 0x0, 0x0, 0x0, 0x0, 0x5, 0x83501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x8a0}, 0x940, 0x4, 0x0, 0x0, 0x6d1a, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x20}, 0x0, 0xffffffffffffffff, r7, 0x0) r8 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000000), 0x4) (async) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r8, &(0x7f0000000040)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0xd0, &(0x7f0000000080), 0x1}, 0x0) (async) sendmsg$kcm(r8, &(0x7f0000000040)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0xd0, &(0x7f0000000080), 0x1}, 0x0) setsockopt$sock_attach_bpf(r6, 0x10f, 0x87, &(0x7f0000000180), 0x127) socket$kcm(0x1e, 0x4, 0x0) sendmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={0x0, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv4\x00\x00s/sync_\x00le\xf44.\xab%\xf8\xff\xff\xff\xff\xff\xff\xff=\x11\xc8\xdd\x15\xcc\xd2\xf1d\'%\x11c\x91l,'}, 0x30) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={0x0, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv4\x00\x00s/sync_\x00le\xf44.\xab%\xf8\xff\xff\xff\xff\xff\xff\xff=\x11\xc8\xdd\x15\xcc\xd2\xf1d\'%\x11c\x91l,'}, 0x30) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) (async) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r9) r10 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r10, 0x2, 0x4, 0x1, 0x3, {0xa, 0x4e27, 0x7, @mcast2, 0x100}}}, 0x80, 0x0}, 0x40004) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r10, 0x2, 0x4, 0x1, 0x3, {0xa, 0x4e27, 0x7, @mcast2, 0x100}}}, 0x80, 0x0}, 0x40004) 2.63959791s ago: executing program 3 (id=5278): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0xc000000, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x2e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x12, 0x0, &(0x7f0000000040)="ded6e0966ec1cf6ba4b897a54e4e062b3114", 0x0, 0x0, 0x3}, 0x50) r0 = socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20029, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0xd}, 0x806, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0xc, 0xc, 0x0, 0x0, 0x0, 0x9, 0x642b9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x3, 0x4, 0x8, 0x5, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x4, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0}, 0x0, 0x10000, 0x0, 0x5, 0x3, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext={0x0, 0x23c}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r4, &(0x7f00000024c0)={0x0, 0x0, 0x0}, 0x20000004) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0xfffffffd, @loopback}, 0x80, 0x0}, 0x20000001) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000780)="1c0000", 0x3}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r6 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xffffffff, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40086602, &(0x7f0000000040)=0x7fff) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x5a92b0bc5ea3e738}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x5, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100003a00702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="85000006c8"], 0x0, 0xffffffff, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, r8}, 0x94) write$cgroup_subtree(r8, &(0x7f0000000200)=ANY=[@ANYRES8=r2, @ANYRES8=r7], 0x12) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="93430000520033d087277b9b108b4ab51c"], 0xfe33) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="1c00000018"], 0xfe33) 2.419315001s ago: executing program 1 (id=5280): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0xf, 0xfffffff7, 0x1, 0x3, 0x800, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x6}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={&(0x7f00000001c0)="c5bad19e45ec06a04401a550fcb37fc9ab5022664fd92b6588b08b4f42dbc422b19c884e34ae8aeab6d36b", &(0x7f0000000240)=""/207, &(0x7f0000000340)="77608c9118071bc4c47b22c57b6bcbbe0a02cb6bf8aa59578a3117808fafd367e6db622cb7ea3eccd71c69e5671813c9a894f3278bbfc32be92597f47863960e7885ad3ffb9a4def6e6bc42aebf8b302cb23bbc039cab4aa46cddf3ed7fcad907d3ba5d65cd8e1bcfbac1fcf953506fd5e2c2e38ddf7e1a990a5fff3dbc5939186a649622c7087d802338b8f762d4af170bbe44b3a6034f3dc159312f0ae5033e25c344341432ad4c747866112fbb3ad0f593078137b8198bed2f0", &(0x7f0000000400)="4fd9795c57d174dffbabd829375e1f8d95db121e94c187dd0da5d7f79063036368a05b598f47940dce566b12c17c75670b964b0018387b51850a87c8a5c598d36873bebe0629dcd4ba", 0x0, r0}, 0x38) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async, rerun: 64) r1 = socket$kcm(0xa, 0x1, 0x106) (rerun: 64) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x80108906, 0x0) (async) r2 = openat$cgroup(r0, &(0x7f0000000540)='syz0\x00', 0x200002, 0x0) openat$cgroup(r2, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async, rerun: 64) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (rerun: 64) r4 = openat$cgroup_int(r3, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000180)=ANY=[@ANYBLOB='1-2:5/', @ANYRESOCT, @ANYBLOB='E'], 0x31) close(0x3) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r6 = openat$cgroup_devices(r5, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r6, &(0x7f0000000080)=ANY=[@ANYBLOB='c 75:', @ANYRESDEC=r1, @ANYBLOB="f594fceb2668ae66a47247704e8caf8bdc89df793362160e7bd368c9d8c655cb5913190d081f602a2a03000000000000001cca98b5d7898e316728c81aaeab4349f417"], 0x9) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000100), &(0x7f0000000140)=r5}, 0x20) 2.280322448s ago: executing program 0 (id=5282): syz_clone(0x45004400, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d0048007ea60864160af36504001a0038001d00", 0x28}, {&(0x7f0000000080)="83d2ff5f00000080d2898a0cc6d6703b87eb28f77b09bc7e64f918fa3bc7664d327d90424d5503002800"/52, 0x34}, {&(0x7f0000000040)="3b9ef613ba09c76c22776d58e5ea151c65a301282f14f1b2c2610701b7527efb8ed6cd7e3746e20cc87a", 0x2a}, {&(0x7f0000000340)="f6a267e81e293931a8e222035fd03b4fd193b03eab6b3776a04169c5dee3dea695a863ddedd7612cede4c1745e275ea676f8c59414f56733708089d7dd23b797573890751aa7811c4020bd6eece204fefaf59fa5ad4fd9f085cc3b99b702a17eee2dc4fd60fcb89dde2bc5e71e5137661e3cb1d806f8a9420e4b1f6242154c046c121033f60dce62d8012e8c18466ccd9abb08622a753965", 0x98}, {&(0x7f0000000200)="d7ab425c6c94d93e2c9d3534e8c6cee3fe6b2af9948b20b777a988c032ce436fb7929174c05cd8bc99ae16f9fe864d632423bdda85", 0x35}, {&(0x7f0000000400)="9f99289974aa2e876c70a197d9bc0b31c024", 0x12}], 0x6, 0x0, 0x0, 0x1f00c00e}, 0x20048004) 2.279794808s ago: executing program 2 (id=5283): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="030000000100000004e4fffffff4e7d28a69bd33300cb98e00000000"], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000080)={r0, &(0x7f0000000380)="2d44ff42fc77d10dc228e0cef415e31f4a7b4a0f3f2b3113520ac53b0321432952c7400be67f05e339f80c8f7697841f55492af65488529fd036d49799308ce15f84d583c4dd2601a6142685ebdaa3c32d2c8abd98041f0aa94bb95b298040d6c2d80f4b41c92b2fe3f4300f830526dca780064f33ee", &(0x7f0000000400)=""/115, 0x4}, 0x20) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_service_bytes\x00', 0x26e1, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001700)={r1, 0x58, &(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001800)={{r1, 0xffffffffffffffff}, &(0x7f0000001780), &(0x7f00000017c0)='%pB \x00'}, 0x20) r5 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_ext={0x1c, 0x3, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x200}}, &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x31, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x7, 0x100, 0x9}, 0x10, 0x2a041, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000", @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYBLOB], 0x48) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000640)={r6, r7}, 0xc) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r8) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x86bf2056334f3ae6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) r9 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000003c0)=[{0x10000002, 0x0, 0x0, 0x9}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r11) recvmsg$unix(r10, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r9, 0x84, 0x6e, 0x0, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r12 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r13 = openat$cgroup_devices(r12, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r13, &(0x7f0000000200)=ANY=[@ANYBLOB='b ', @ANYRESDEC], 0xb) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x11, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000002000000000000000900000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d042c313ede3b6000083000000bf090000000000005509010000000000950000000000000014b310000100000071430c0000000000bf91000000000000b70200000000000085000000840000002decd7b325224ecd9500000000000000"], &(0x7f0000000640)='syzkaller\x00', 0x1, 0x1005, &(0x7f0000001b00)=""/4101, 0x40f00, 0x0, '\x00', r3, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001740)={0x0, 0xf, 0x9, 0x1}, 0x10, 0x0, 0x0, 0xa, &(0x7f0000001840)=[r0, r4, 0x1, r2, 0xffffffffffffffff], &(0x7f0000001880)=[{0x1, 0x5, 0x4, 0x8}, {0x0, 0x3, 0x2, 0x7}, {0x2, 0x3, 0x8, 0x6}, {0x0, 0x5, 0xd}, {0x5, 0x4, 0x10, 0x5}, {0x1, 0x2, 0x2, 0x2}, {0x1, 0x3, 0x1, 0x2}, {0x5, 0x5, 0xd, 0xa}, {0x3, 0x2, 0x10, 0xa}, {0x1, 0x2, 0x1, 0x8}], 0x10, 0x7}, 0x94) 2.221056651s ago: executing program 1 (id=5284): perf_event_open(&(0x7f0000000080)={0x3, 0x80, 0x2, 0x0, 0x1, 0x92, 0x0, 0x91c, 0x4156, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xfffffffffffffff8, 0x1}, 0x12640, 0x2000000000000000, 0xfffffffe, 0x6, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x1002}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000080)={0x1, 0x41, 0x2, 0x0, 0x0, 0x0, 0x0, 0x91c, 0x4156, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xfffffffffffffff8, 0x1}, 0x12640, 0x0, 0xfffffffe, 0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r0, &(0x7f0000000000), 0x2a979d) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x408) syz_clone(0xc4201100, 0x0, 0x0, &(0x7f0000000740), 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x69, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000d00)=""/242, 0xf2}, {&(0x7f0000000240)=""/205, 0xcd}, {&(0x7f0000000380)=""/210, 0xd2}, {&(0x7f00000006c0)=""/188, 0xbc}, {&(0x7f0000000f40)=""/213, 0xd5}, {&(0x7f0000002100)=""/4077, 0xfed}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000000480)=""/176, 0xb0}], 0x8}, 0x40012100) recvmsg$kcm(r2, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0) r3 = socket$kcm(0x1e, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r5, &(0x7f00000008c0)={0x0, 0x0, 0x0}, 0x40040) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r3, 0x10f, 0x8a, &(0x7f0000000040)=r6, 0x4) r7 = socket$kcm(0x10, 0x2, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r1, 0x0, 0x35, 0x6a, &(0x7f0000000180)="ab3a608b4fa2447b88d0d5697bdd820e6e53a75c5ab00e04d56cffcab7255f37a01295da8d25812d24ae4edcc9264000b12136b7d1", &(0x7f0000000540)=""/106, 0x5, 0x0, 0x1000, 0xeb, &(0x7f0000001040)="a35691900d492b46a0c7966433cdf9d30eea93689cc9434e28548ce54fcc0dd4e4e93a99d5bf9e852db9a38e1a59d2d26fa7f5717872145d96243480b1afb4a698db6769afc68e4bdfa847dc372c01f8a8224f620980d851a961740859e9988f938e31c0532de379bdf98b4f13d90695b802ca41183f606bc83969b7c9a966e1fb465b10515dd454bd2c2712d80ae5a32ecb8acac6f483db124574d89ce2883b220caeec6be9e5129cc069f744adecbc6678364985be83aca23cdba80c3dc865c25ac61177edbaf2ea53c52cc82adc64923746c2eed895dd3e10671390075863b54d5ab59460979087d97842a2de404d180bf622674111cf2809e8f447421758509b98cffd461cf593f816747281e1bf8a8008e70a4b1b6a73ad2d93b1a82918d441af93eadbabb93510b184ffd41f0cae7d7706f52350208d3699781d1a140c70f3c2c64aaf2d21c656ad02d74f5180c92817aef106c0a70a296079cd3f7eccf893d1db907b9608d8bd157f7ad76d74104d10a4e2996d81de903cd668cb5d946a55c7782a22978e261a1dbb2df172c82b66a2c931e3380ca0c5322e477a8bb961c5724e6f47d14d8a97200299bb8ceb71fa885621bf664fdb9245cfb995643b7df324b20da52a24387454462c8746e8970131f2e2764b4e9462245af10702a4bde6f14425d2f7dbcf80f28aab4a5aea42191a93bd61c7ed609b8d8f1db69c2338ed9779caec4c0753f338c96dbf615be620063cd1e5319a9b58713618e1f8166ac4e09436ac9096f34382970e8e2b378627e80bee9beab08fa10f7b3c253457adc11352931aa57e443c847542435a14be91297a974c2f974821d5bfda4eebf5d65bb825f81c4d616fa18e9446c6128db68cfb6da4d4cabf5d64a2654c87ac525e4be6e563801f9a3a821f562f3a9ecd3c5fc63feb3e802db25b9bce6be2980ba392d05190bf2e17b4e7a16a5a487234dcb1287cce47997baefe9f79ec324a1f7aa2bbdb840539234966e259a9bf2a1c3e47343df16d10f25ea12b1eef9369412ef312824fb7cb087bbb75fd64d7aa307047b1b738a8ae0a2143598f6d34867cf6f106867ca27463adc992d13c0973039c6f361d374d99ef442e9c4406352524b5ad317e2a8bd71bed61853a61f4468b4eb087cf6ccb89cea65b57129e66f2e085e0dc7d6c862b718907e4b2597c724c62a4e37b93a4eacd872c31ccb8599cabb0566127c0b441c28f5f954841bb0d7675df42c3701387c00f9d343f3d70dee6ce651fe5484f8effcf0ee8a2396b945ad0d651dc09b3a0add1d3fa3d7144470ec0fe2611ee19604784605d721dbc626133bb41c2585167394115616eaad8146bc7ad8cb8f8654f7138c37e1a5059a65b6d8a469e75f28617b4853d4a250654947105c05f5f89fc370d7b5d5910615c94a8d0bd446688c36bceade9bc77f0900cf6e39520ff0af539a14145f34af920f7777f482746e3f24ff6f3984c66a044f0f7c02144c26271d1639974c8cb4c1ebc26e79f14f476da6c7e12bc7741639803723ff4aca164a7594f99e5035df95134f99f749ade34738c0c16970168f6a0ab3afa1dae67e0ac3dc0bff69e8c1ab483ccb693320cf24fdc1b0196ad2a3ad2773a5573797001a97b04913443ce68a7640db6710e8033ff1da0df8925c76dc2421be328e4f6ae31e4e955493d80cc59059fea79be5d1eb0a8695a1f37c008b239bdece039dea5b2d7dbcfaaa735bc66caf7c21a308dc224add6db28caa2fcac05a75470a91e958dc199d3dc6d85c4d390f43845ac9ee0b7af92a849c83ba86c002779224d0495a078526f184405ea256cbd1e5f64679985a43841ba322594199a99335bcc2c7f073cb6d84d420b90bd83372bfe13b1d254d0728fb7635c348e4db03869efcbbf7f5528f310204eeb94094b23f72d55506ec89ca8285237e37648260026f03d529720569fe8d40bdbfa3c1a711755fb00cff06b5c03fdd4b13e6a30fe34bebde40e3c3ea03bf7a270c52028c224e045facf50d65ca4d3a9c0482c45ea34de94aca488258491e3a23aba25e7ff5ebc89e17bb9111a2201961d77095b00113a739fe14008fea260f3cd7e2718ffaf514c6666c1740f0ee71813a3343017a863801cc1f3bbbe7e623537577cdbf830795dbf435e9494104db1ccd3948f1b4933c5fe273c0fef1b67859d0aa0bb683b7a9f6bcee18eb4dec21d1955ec1949d757c9b70abe68b65b0b8bccf08625e0d1d1bfb396bbc1f323724860252e88f88b5d9cae09624bd0e8c7c5b8c9371e6d7cd0778f2b4d0311b08811dff88aece043f7374b891009e29b724b57dbedc76e276cd32fa18d13efeb4f754fcbf1fd3cb5d9b76dd13389e025cf4af36e6451d012293498508c4ffa177d5a3a7437601c6fc645ec531fe9bc5f02ccfbf542ccb98512120738b09fbd86fada42e6f41f04adc69c351e3c7808b9ae1b4aa043bfef331e2cc27bfc429eaccc9bc645b97d8c791f52f6e16b53a852dd50c078b1eba22528967f3961d345e445d0f87a725f04dd27288fa32db4ddd191190ad2727e08d9a65176a790962f27db7037d7c78c9ba21a205242aab1395b147f83e44daf347a6519ed64e0999080fd0737d197db958aef664c742f8f9e61a8361cf01a67cda4293e545e9b0a9599246f32b8f0b140bb806517087ebd1b56b572364cb5a84b44ab90bdefc151c314c10765f17520223b54ebdb6c58666031f7e032d3031dfb4f66ac0c3d44c240448204d8401e9dbbbfdee9b3ed787f5f1b6669ef44c05a584ac417b4b4efc7110e96e542431b43f3a9c265aa278e50879191d6d47f00653759a8c66c268a997c058e605ab5d141f4adf1023afeb99d7e954e3d60e66e7ba16cbe192246b8c7f87cfc9d99edbd9b1f81b9d43b085fe6642886808b1d6172bec06608a348b548d6df67af90142e738f424c4532b7af8f38901aa9ef5ff0c73becef808714b7b9bf21732722b715645798fa81dbe1209f17f3b6355fb3ad900c0fe7aeaaaa09c3a0eb137509b08036b0016a2765906d8b26fc1ec279d27359ecbb5aec34f897329cde73cfc82365ff80a30e629a7b5778adcea08df7ec1655f2f3fa0882962d4c89d3795705615bfca859ec15b66e8914ab07093ace105e8b198b376e1400f18a2fe72c45617930a19e4f810fa1c4bdd263845aeec0300a896b5f7df207373b7d3bd607e1a2c67d3d1a101116979fb06abf4c4f81cebe06a2541de18953c64eb4b5fbf089b298478aeb68b1aa6c41307427fa48f792dcb976203193c00deca71d6c5e03c8677f3d661f845d9c27e0c1bd0185fbb24fd4d31da7ad6f0ec12ff94e3c052be0efa8dc7c405a3ee561f268600c9c7133a0d3a2b889802e7abb3db465835dc4afafd213b16e33377752d75ee79532041e487c2e88105753e0cff6269cb2026c5699415f0ffb06dbad2fdea9d08eb05df6b315d39a79e5bdfbc77b15e8f9abd6d75e8fc7acdfe15a477db126ccad320a954820c829a1d297407352791eadcf773cf3bfc19e469af14e7692bd0ce1e45a639116227ce649df3fff631581e6248bbfe036512dc5bf4b595e5f9e9caf33b639b4a5e4788c81bd1d53dc62f1ae415028c1ec5bc16133079577cc46adcf1b65dfcd72f39fd5af7f665f5c094283bde08b3bae1fad20e2973de89c3c2eaefd34d84867e574bfc84ac9c3b1793ec28fe555672116c7cb98b0a90d7bcc78e38b438cc75d247ee9fe74612c1aba60dc093a0a215d6fc13942556a821a23198e09de4fcc1044d172d53cdbbf081f35c6fce1953276f0becb5c9d86977f855f2cccac5bb689089bfcea8663c1e69869f101d880adc9792b32746698dde71a2cdcb0e0368b0c20d3bbc79004f28675c7b7c0a81446c856792a0bf9fdd1e1dd9f1bcc91f10f6718ae5aa18725470dc55aeb54b42287f716a21ff4ac79ba57dbc35087b183acf68b4321bfc8cdef8cab286f298abc9b0fa28cd27997738bdcf10ef8b87c1f381f78754d99a11b9668577695fb61c659fe1392ee56bf202a1d2e6cc6deaca1bc46388a0d9ed59e75231a7705b6dfd79ec5a40085d1dee269731c388a1210b3146ec36be5ac2104705c2f8274d415f5250ee80fe79ba8e0a25d8ee15b2401cde7dad48ff3cc0262562937907891d245cf0a766456cf7163bb81c521bac2af316a0594976c3b6b5fb591cdc26558ad9b04930648f63bd0e8562946a40663357853508103ab61ee21d5924d9e8aa05f8f089ebe8f07f33ee3dc516d0af9bcdef091745067d07eecc9f3f87d8fa188232b326e7613b4364fb604f1de530a484a67385a919088ddf074f4cf3fd46e275e101373a36b257b07457f1658585a7abed2dd6339435e6aba0ac504fb9fdd70f46fdefabebf103ee817ae5475385bef5ff2dd7b7af9dbce95be84409e1591529e8cd70d73fd4a58f733fd13bfc9abbbef937c833e318242ee32bfcc64cb79db3ad2a07030259eec4299d1b70aff9dd9b4e36818aebdbf6701073dab9f119f3cb03c7b0788f5728a0aebff9258e68ead6a1badb57e362ca199341435bf88b0a017175281cd5f301de479db8209b04da8e474f92911ef466a9cfd02118a22ad416e56d6c312ba4500cb703cf9abdba869ef2ca04c70306443cffeebfb863407da52106681331cc46e0484487957aa5c4de4dab43a0973fe3b99109d9c5bcf55e2c9f830b285c404ee75cd5c0ffc1b854e5dea1d34475f32b680f9cbf4dd0f19028e059b34dd634e58678beba2a4166b6f6103d7f6a818609764302573ae608c0f12e6eaf31e9aee884750155f03ef9c43d64a83635195bd1226e7c0a83b2ff235788ba31e0f10aa19b6790fb0da5d83f5fa72f118e57dbe3f08d801282d9ffbff9f0de17bab9d147e872b246c1866f04bdd6c83b391959448287f0e190a5d9c6d8408e052b504070b8303a8316d499ac1532b8515ecb30c522155d60b047e85629d0983e239f88bef4b3e5a91f2e647af0e5531aa5305874863219a748a246d7aaebf3616b0c600d6a68b7fb11c41f6b60bbc16fa199f572fcdb915153bbd0209e9e86dbb82ffaece24ef3ae44062328b5a1c48b2b53125f2104b60a9ad87bce4de6689dbc34e5371995c4a39ffd6ccf8f31f7aec9baee13a225b836932459f8f9a93724e0a5d4eb04e682103c6b8a9d7774a417c83a677defc3c1f55347117fb54e9bd26ce7710c457a6fe180196a9b10855eedc616e7b64247c7e0a4fb8cd7865d86db0d7f6bca657b62c7661888f5af17c895c75866baa3d0b6cc382aab98ed8b57af6b0dcee8b7b2693cee2b5198c00018c1e833847f63d42cf0cfce724d593f49bb63a8a9f4eebf20ce00aa2573945052232a0f95f8cf788eafaa39222f7eb8a5cba9fc690913362b3f35a19d1d7955c74b44ddd67990abbc03e3acde10ece5e3de45a4abc3ca9a93c1fc68965e77ee3127eabc86a4acc2700c506eea3a1e130e05a6cfb32f1634c450c8556f0ac107eb3f90c2791226f8457d16e07b11e0859a1ad085f1ce6be6ad4db148e9383694ece7bc10898e7c0eb047dd31b9a72cfa7fdc6408895edac584c1c71b9c075e6711d0586012d90bd239adb281a9938b6a389cc40b0c7e2f0101f2221bb272f7c3ccf15c8388d20d67c2adad7ee98a140dc70a7f6630fb3fb536b70b31eee8fd85b18cb8c6dee14733ccecffdd5eb9117a4209c2f2e51fd704cf3a96980dd1e48850c8134f8caa726ec1b3a7f05a1f7462781cdcfb578e7b81cf4036193de00636e3dee4f330eb911427cbe50f78656e076ae2ab9", &(0x7f0000000780)="9cb3ed2e88d58f353954732997669cde927fb4419d4bec03f101c64c7736b8b58826b8f3ac4e9eb2f613db3360f3439513fec0d030f3d19f6b469563c00cfd38aeee36741264bdbdda1f54bb4c608feaa0d47f109816977d6cd60a507b6fd7bdd7fbcf45e006a6f58f1759b2f8667ba5390c02faa32d9d9edb6f4de153d972c6ed085c9ab2f4128c57308f247a22eae93e74795168c04ac1c3ee8bd97217e8dc89f880f09380c50fec8258f44e6d420cef1aa89fe1ca1a42799681e7429c3246ba7154d065a786f4e60680820aaa93767aee57426237f842f7b535e478f09f215e53637dc30f5f9374cf83", 0x7, 0x0, 0x400}, 0x50) close(r7) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000640)="1800000068006b0041000000000000000200000000000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x48010) 2.117509826s ago: executing program 2 (id=5285): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) sendmsg$sock(r0, &(0x7f0000001500)={&(0x7f0000000000)=@ethernet={0x1, @remote}, 0x80, 0x0}, 0x1) r1 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f00000000c0), 0x4) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2409}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000001c0)=@bpf_lsm={0x18, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="8510000004000000950080000000000018000000000000000000000000000002950000000000000085100000fcffffff95"], &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r2, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x200000000000014f, 0xfffffffffffffc9e, &(0x7f0000001680)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x0, 0x19, 0x10, 0x8, 0x2, 0x0}}, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000040)="f4001100022b2c25a6d5b02f3af865fe8007000000007afefff500000900000000000000", 0x24}], 0x1}, 0x0) socket$kcm(0xa, 0x1, 0x106) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="33fe00004a00530c8e5e"], 0xfe33) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r4, &(0x7f00000001c0)='blkio.bfq.time_recursive\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000010000000000000000000000850000008700000085000000a000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc8}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'bridge_slave_0\x00'}) r6 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x6, 0x0, 0x0, 0x9, 0x640b9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r7 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000181100"/20, @ANYRES32=0xffffffffffffffff, @ANYRESOCT=r7], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x49, '\x00', 0x0, @fallback=0x29, r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df"], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0x58, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000006c0)={0x0, r6}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000700)=ANY=[@ANYRESHEX=r10, @ANYRES8=r11], 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, '\x00', r12, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x1, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.607278451s ago: executing program 2 (id=5286): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={0xffffffffffffffff, 0xfd, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, &(0x7f0000000300), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6, 0x8, 0x0, 0x0}}, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071116400000000008510000002000000b8b24e810500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x8}, 0x0, 0xc8, 0xffff, 0x8, 0xf9, 0x0, 0x2, 0x0, 0xea}, 0x0, 0x10, 0xffffffffffffffff, 0x0) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230000) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) (async) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="8fedcb791f6f9875f37538e486dd6317ce81ea032c00fe08000e40000200875a65969ff57b00ff020000000000000000000000000001"], 0xfdef) r6 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x80, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, r7) (async) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000181d0000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400001c000000850000001500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.499072416s ago: executing program 3 (id=5287): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) openat$cgroup_devices(r0, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, &(0x7f0000000080)) openat$cgroup_procs(r0, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0x58, &(0x7f0000000180)}, 0x10) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r2 = openat$cgroup_ro(r0, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x0, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x2, &(0x7f0000000100)=@raw=[@btf_id={0x18, 0x6, 0x3, 0x0, 0x2}], &(0x7f0000000140)='GPL\x00', 0xfffffffb, 0x0, 0x0, 0x41000, 0xe, '\x00', r1, 0x0, r2, 0x8, &(0x7f0000000280)={0x7, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f00000002c0)=[{0x1, 0x1, 0x9, 0x1}, {0x3, 0x5, 0x9, 0x4}, {0x0, 0x3, 0xa, 0x4}, {0x3, 0x1, 0x9}, {0x4, 0x4, 0xd, 0xc}, {0x4, 0x1, 0xb, 0x2}, {0x2, 0x2, 0x7, 0x7}, {0x2, 0x1, 0xd, 0xc}], 0x10, 0x9e}, 0x94) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000540)={r2, &(0x7f0000000400)="b5741438b1f09feb225b7297cc6577742a7b48e95924f7cbba3316a6d0eeba00225212742f1e87a68b4fd89db66826c1665b2688e2a8d4ef5653878cb58b1e1dd95b8e4425f4912f10346dc6b3bce93d6475c9e265ad2b60b6b183a529ca5b5e594975eb577c0938d08fe7fb4b105419bcc9bd55da1520881afc1645de8bc45460196b58924d6b4a9e849df82068c56ed28546488ea4e8a22723ff394a403cacb8177ad68029741f9d0e6031c6eb678fa21610c6946e3690321ae979e5e0a3cdcaafbe0d0229e414467b8b0d33dfa6384348e3337dce1ba013c8617202", &(0x7f0000000500)=""/12}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1c, 0xffff, 0x1, 0x10, 0x20004, r2, 0x7, '\x00', r1, r2, 0x3, 0x2, 0x4}, 0x50) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1c, 0xffff, 0x1, 0x10, 0x20004, r2, 0x7, '\x00', r1, r2, 0x3, 0x2, 0x4}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000008c0)={&(0x7f0000000600)="da3170b5ba007a987023fb95fdacb115e450b935cce5ba9f3713fb37ec68be553d629129f0f6df0c973ccbb2960e346e67828880660682ced771e39bc67e10abb4f5a0f6669515ac4e47a8b3c17d5df49bdda804a9bfa2ff941b0bc53a63b0448a12f140a48432a10b862685e672707df5f144084a6f084eb30cfa8de5d0be6d3b6df3c77f737569f24a84ed3cb6e150a695b71564f0e3d3b472f4132f175f23582ceae9ab9a8a1549", &(0x7f00000006c0)=""/137, &(0x7f0000000780)="0a7bba4495d79a9a44cb49f4946c4c26ad3bf6f7a4980c9d95b8ab83d5655aa9ec4c0510b3be1921c1cfa7f7385ff201cd325f11f444242e60ee7676512ff1", &(0x7f00000007c0)="0777ea19eb008de35ab2b1f407c1bf91ce88cec570abe61cc45c454beb8d8dcaf0b4a5926f748ed021149b811f0724adb1b530aaf76002889037f203a69cd4fc0e514b291349f180c75b5359215e0c0c1debaf41cc62a857ba19b78a1dd198376a81be143ff0a3f0733c39e2d1b1cbba4f9a91410e356be1fac83726f01433e9b4dc4c9efecea78d630230bdb6015879410199210638c6a48d211b15ffcdd4b31af9b71ce08de0c28598ef38da3a7e49c6fe7c8437762a1b4316dcb5573a5f5da26c269563b104eb", 0x101, r4}, 0x38) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000008c0)={&(0x7f0000000600)="da3170b5ba007a987023fb95fdacb115e450b935cce5ba9f3713fb37ec68be553d629129f0f6df0c973ccbb2960e346e67828880660682ced771e39bc67e10abb4f5a0f6669515ac4e47a8b3c17d5df49bdda804a9bfa2ff941b0bc53a63b0448a12f140a48432a10b862685e672707df5f144084a6f084eb30cfa8de5d0be6d3b6df3c77f737569f24a84ed3cb6e150a695b71564f0e3d3b472f4132f175f23582ceae9ab9a8a1549", &(0x7f00000006c0)=""/137, &(0x7f0000000780)="0a7bba4495d79a9a44cb49f4946c4c26ad3bf6f7a4980c9d95b8ab83d5655aa9ec4c0510b3be1921c1cfa7f7385ff201cd325f11f444242e60ee7676512ff1", &(0x7f00000007c0)="0777ea19eb008de35ab2b1f407c1bf91ce88cec570abe61cc45c454beb8d8dcaf0b4a5926f748ed021149b811f0724adb1b530aaf76002889037f203a69cd4fc0e514b291349f180c75b5359215e0c0c1debaf41cc62a857ba19b78a1dd198376a81be143ff0a3f0733c39e2d1b1cbba4f9a91410e356be1fac83726f01433e9b4dc4c9efecea78d630230bdb6015879410199210638c6a48d211b15ffcdd4b31af9b71ce08de0c28598ef38da3a7e49c6fe7c8437762a1b4316dcb5573a5f5da26c269563b104eb", 0x101, r4}, 0x38) openat$cgroup_int(r0, &(0x7f0000000900)='io.weight\x00', 0x2, 0x0) (async) r5 = openat$cgroup_int(r0, &(0x7f0000000900)='io.weight\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f0000000940)=0x7, 0x12) (async) write$cgroup_int(r5, &(0x7f0000000940)=0x7, 0x12) gettid() (async) r6 = gettid() perf_event_open(&(0x7f00000009c0)={0x2, 0x80, 0x1, 0x6, 0x9, 0xd9, 0x0, 0x3, 0x110, 0x4, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb, 0x2, @perf_bp={&(0x7f0000000980), 0x2}, 0x104, 0x1, 0x0, 0x8, 0x5, 0x1, 0x7, 0x0, 0x5, 0x0, 0x8}, r6, 0xe, 0xffffffffffffffff, 0x2) (async) r7 = perf_event_open(&(0x7f00000009c0)={0x2, 0x80, 0x1, 0x6, 0x9, 0xd9, 0x0, 0x3, 0x110, 0x4, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb, 0x2, @perf_bp={&(0x7f0000000980), 0x2}, 0x104, 0x1, 0x0, 0x8, 0x5, 0x1, 0x7, 0x0, 0x5, 0x0, 0x8}, r6, 0xe, 0xffffffffffffffff, 0x2) recvmsg$kcm(r2, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000000a40)=""/71, 0x47}, {&(0x7f0000000ac0)=""/4096, 0x1000}, {&(0x7f0000001ac0)=""/110, 0x6e}], 0x3}, 0x2000) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r7, 0x40042409, 0x1) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000001bc0)=r3, 0x4) (async) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000001bc0)=r3, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001c00)) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002d40)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x101, '\x00', r1, 0xffffffffffffffff, 0x0, 0x4, 0x5}, 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000002e80)={0x1e, 0x5, &(0x7f0000001c40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xd8}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x66}]}, &(0x7f0000001c80)='GPL\x00', 0xffff, 0x1000, &(0x7f0000001cc0)=""/4096, 0x41100, 0x40, '\x00', r1, @fallback=0x21, 0xffffffffffffffff, 0x8, &(0x7f0000002cc0)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000002d00)={0x1, 0x8, 0x9, 0x9}, 0x10, 0xffffffffffffffff, r3, 0x6, &(0x7f0000002dc0)=[r4, r2, r4, r4, r8, r4, r4, r2, r3, r4], &(0x7f0000002e00)=[{0x2, 0x5, 0x4, 0x1}, {0x0, 0x1, 0xa, 0x6}, {0x3, 0x4, 0x9, 0xb}, {0x3, 0x3, 0xa, 0x3}, {0x3, 0x1, 0x0, 0x6}, {0x2, 0x2, 0xf, 0x8}], 0x10, 0x4000000}, 0x94) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000003040)={r4, &(0x7f0000002f40)="1a97d0de9c09c5e5c0d54a77f42a8d8693a04f2141dc9d03b9", &(0x7f0000002f80)=""/166}, 0x20) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000003080)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_devices(r0, &(0x7f00000030c0)='devices.allow\x00', 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000003100)={0x2, 0x4, 0x8, 0x1, 0x80, r8, 0x6, '\x00', 0x0, r2, 0x0, 0x3, 0x5}, 0x50) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000003100)={0x2, 0x4, 0x8, 0x1, 0x80, r8, 0x6, '\x00', 0x0, r2, 0x0, 0x3, 0x5}, 0x50) write$cgroup_subtree(r2, &(0x7f0000003180)={[{0x2d, 'io'}]}, 0x4) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000032c0)={@map=r4, 0x11, 0x0, 0x4, &(0x7f00000031c0)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000003200)=[0x0, 0x0, 0x0], &(0x7f0000003240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000003280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000003340)={0x7, 0x0}, 0x8) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000003300)={@map=r4, r3, 0x2d, 0xb6878ef9de552ee9, r3, @void, @void, @value=r12, @void, r11}, 0x20) (async) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000003300)={@map=r4, r3, 0x2d, 0xb6878ef9de552ee9, r3, @void, @void, @value=r12, @void, r11}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000035c0)={{r2, 0xffffffffffffffff}, &(0x7f0000003540), &(0x7f0000003580)=r9}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000003680)={0x18, 0x2, &(0x7f0000003380)=@raw=[@map_val={0x18, 0xb, 0x2, 0x0, r10, 0x0, 0x0, 0x0, 0x800}], &(0x7f00000033c0)='GPL\x00', 0x5f7c, 0xa0, &(0x7f0000003400)=""/160, 0x41100, 0x10, '\x00', r1, 0x0, r2, 0x8, &(0x7f00000034c0)={0x1, 0x2}, 0x8, 0x10, &(0x7f0000003500)={0x4, 0xd, 0x8000000, 0x8}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000003600)=[r13], &(0x7f0000003640)=[{0x1, 0x3, 0x6, 0x3}, {0x0, 0x3, 0x7, 0x2}, {0x1, 0x2, 0xa, 0x3}], 0x10, 0x401}, 0x94) 1.334525964s ago: executing program 3 (id=5288): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002f000b12d25a80648c2594f90324fc601000084002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r2 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x7, 0x0, 0x4) (async) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0e00000029"], 0x20) (async) close(r1) ioctl$SIOCSIFHWADDR(r1, 0x8b34, 0x0) (async) mkdirat$cgroup(r1, &(0x7f00000000c0)='syz0\x00', 0x1ff) 1.172015702s ago: executing program 3 (id=5289): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000000000000000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xfffffffe, 0x2, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) r0 = perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x200, 0x2020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x12000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000480)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000000604"], 0x0, 0x26}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x15, 0x8, 0x4, 0x0, 0x0, 0x1, 0x5, '\x00', 0x0, r1, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000540)='(pu&00\t||') r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000040400000900000000000000", @ANYRES32, @ANYBLOB="0000000000005826ad790c91a2f8212ca9c73fa7", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x3, 0x4, 0x801, 0x1, r2, 0x15b4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r3, &(0x7f0000000900)}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005080000000000008200000018010000", @ANYRES32, @ANYBLOB="0000000000000000b7080000048000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000085000000ca00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) socket$kcm(0x2, 0x5, 0x84) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000001000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000f4940000850000000600000085000000a00000009500000000000000e51d3d1d2e6ea4d3c3f631bdce08012cc05a21155f2ecf3d64b50d075842e3afbfd30bd984b42fa1c494a8083f54fda93724b4c13aa8a1a375c7ec56cccc19f9446756c5f36f161043fee740df6c3068b385ca91359371a3e06c04508a23d450b0574b118045516fa29518845666e02765378ec3e0e1f5025d6b9cfd9a23442d1319fdf00e11b89f"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r4, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b7040000fc4d0000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x10, 0x400000002, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x9, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0xa) socket$kcm(0x11, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) 1.124814885s ago: executing program 0 (id=5290): r0 = socket$kcm(0x2, 0x3, 0x84) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001340)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4870000000000000200000000000e0ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f55ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf3ed410f6accd3641110bec4e90a634199e07f8f6eb9604000e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e468eea13c9a77e1c89c5082a703fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea7042ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850bf895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fabc0c4dd418c005479ecab19bdfb15a32a4fd67ce446adb431d7e74853b7978639be2463308af07db79240acaf0910300000077d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061622718551c20ec23812770d72c700a44e113d17088fdd00600000f7889b8d7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f740586903500090000000000000000be34b10f9d640dd782ac0cbc0abcf72846903243d0d0f4bc7fb0a0d7c5000032daaf281c450e64c33aac8ff7e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4bfaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e0c81efb5e392a13cdd2ce219e6733b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e863fef0ad9d1ac32276cffe5f1fc21390797d0244cf1ce269d10525745caaa3f77d1b80116cb385a0242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2424ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f55136628090702f70000d0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c685492a1689ad4218cea744b332ab232a09cf1ec375627074ce2d3d7619936768a84a1465fff4610cf8838b28319e0f79533d87eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507818231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f278ea00cee8a2088359946e726aef83d9ff9281ab79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df0000000010c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481c55e86dcd7816ad8940bd19953603000000adeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016be64dc097982e23462392a0cd05afb2e060fd6424a942ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1af45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5d81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b1495213060000000000000049584655c4fce8c5bb7c54664aef6d780100358aa54bcb49926c4be9ee4659153d9fa95d07cc4efdab2c355efe8e8d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6122f572047ccf3c8edd82660e5d74c52be71d780c30000000000fd00000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f99f1b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f2def52394db3e9d8318bbb9baff3db95bfd69e08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d05b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0a832f5194ddfce51e5aff28f621bb2fd2a5ab719df823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c3348329b0ee77d93596e3f1287552e0c8cdb326c5118d2e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e26aa90c571fa3c07238697b13c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170e42f28cea4105541e11c8605628b9ca935bc252fee8b596a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babb8fa16f3182c5b98493a5aa943aa3a777a751f56e0c7a74f7f63d83ff119561acd5fe560563b051dc29ac586b21148ad5a5498369ac347d19660c132b1df58d65418bc824d8b88b699462c2ce6524eaf0905445413033f041a26b189f2553ef218eba22152a4dc979a0e37396ae1a2883b1e4d44c8af7973d5c1f286c26459209db5a9a51dc69d0ba3fb6c884e50be3598ac53295137c97dabe52d98fed0b352c0b68b7e75ed59931ef57bb5fc28d5b1f914fc8abbb444637a5dfbac5035eb0713efb823360a8da80e4265e599f76952a8082b8c5f7890275a922cd2ccaaf75dcca6849e89e1bab32fe9b598c61d7565dc6ab0a6d43b60f8d08ddf27a286807692d18973edaa6d5401c79b3cafaab4a8d6c946cbe5de350000000022e16a5f72c6d41dc9de8517fdcfa0c0efca880257443cfc3057c353569ffb1588b4bb261a6e99c5936e1b4339d87ec84db99e797f44451fc6b5da1950d24b3d4118f2288804740e605500c1f493c7dc42164cc6c1b01a329ce95272a07a355d4ba705b5e71ce5e1042a0c638e565881e5eedbc62f79407b73ae787c9cdb752eda44aeef962c93ab245f61e8ca5c0d41cc56124840f1b2b30be599fea0afaf905f90dd3e55fef0b94afbfd7144b7"], &(0x7f0000000140)='GPL\x00'}, 0x48) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000000300)=r1) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) (async) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f0000000240)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_retopts={{0x11, 0x0, 0x7, {[@end]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x27}, @local}}}], 0x38}, 0x0) 1.082937646s ago: executing program 1 (id=5291): bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000002000000040000000000000e03000000000000000000000000000002040000000d0000000000000c0400000000004005a415471ccaffe9e5cdf66737b54318bc4c99566236b3d8dc97e2122239b1c0f8ec03637bb1ad3a7d457f201192c28f3f5e0d5b9908d7227c57949db85f"], 0x0, 0x42, 0x0, 0x1}, 0x28) r0 = perf_event_open(&(0x7f00000002c0)={0x2, 0x80, 0x7a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x4, 0x4}, 0x48dd, 0x0, 0x4, 0x8, 0xa, 0x100, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000000)='cpu<=0||!') syz_clone(0x126400, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x8901, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110c23003f) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110c230049) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1980, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110c230007) close(0x3) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNGETFILTER(r5, 0xc0189436, &(0x7f0000003100)=""/4080) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a8001600200001", 0x37}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d006a10000000e8fe55a118001500060014b9c3600e1209000a", 0x2b}], 0x1}, 0x4) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0xfe33) 923.422734ms ago: executing program 2 (id=5292): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$inet(r3, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, &(0x7f0000000140)=[{}], 0x1, &(0x7f0000007880)=ANY=[@ANYBLOB="1100000000000000004003000100000000000000000000001c00000000000000000f00fd08000000", @ANYRES32=0x0, @ANYBLOB="ac1414bbe0000001000000001c0000000000000000078f0208000000", @ANYRES32=0x0, @ANYBLOB="a00500000000000000000000240000000000000000000000070000009404000044108800000000000000000000000000000000001100000000000000000000c2d63c67000000000000000000"], 0x98}, 0x0) 768.970442ms ago: executing program 2 (id=5293): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="030000000100000004e4fffffff4e7d28a69bd33300cb98e00000000"], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000080)={r0, &(0x7f0000000380)="2d44ff42fc77d10dc228e0cef415e31f4a7b4a0f3f2b3113520ac53b0321432952c7400be67f05e339f80c8f7697841f55492af65488529fd036d49799308ce15f84d583c4dd2601a6142685ebdaa3c32d2c8abd98041f0aa94bb95b298040d6c2d80f4b41c92b2fe3f4300f830526dca780064f33ee", &(0x7f0000000400)=""/115, 0x4}, 0x20) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_service_bytes\x00', 0x26e1, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001700)={r1, 0x58, &(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001800)={{r1, 0xffffffffffffffff}, &(0x7f0000001780), &(0x7f00000017c0)='%pB \x00'}, 0x20) r5 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_ext={0x1c, 0x3, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x200}}, &(0x7f0000000180)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x31, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x7, 0x100, 0x9}, 0x10, 0x2a041, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000", @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYBLOB], 0x48) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000640)={r6, r7}, 0xc) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r8) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x10, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x86bf2056334f3ae6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) r9 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x6c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000003c0)=[{0x10000002, 0x0, 0x0, 0x9}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r11) recvmsg$unix(r10, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r9, 0x84, 0x6e, 0x0, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r12 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r13 = openat$cgroup_devices(r12, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r13, &(0x7f0000000200)=ANY=[@ANYBLOB='b ', @ANYRESDEC], 0xb) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x11, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000002000000000000000900000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d042c313ede3b6000083000000bf090000000000005509010000000000950000000000000014b310000100000071430c0000000000bf91000000000000b70200000000000085000000840000002decd7b325224ecd9500000000000000"], &(0x7f0000000640)='syzkaller\x00', 0x1, 0x1005, &(0x7f0000001b00)=""/4101, 0x40f00, 0x0, '\x00', r3, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001740)={0x0, 0xf, 0x9, 0x1}, 0x10, 0x0, 0x0, 0xa, &(0x7f0000001840)=[r0, r4, 0x1, r2, 0xffffffffffffffff], &(0x7f0000001880)=[{0x1, 0x5, 0x4, 0x8}, {0x0, 0x3, 0x2, 0x7}, {0x2, 0x3, 0x8, 0x6}, {0x0, 0x5, 0xd}, {0x5, 0x4, 0x10, 0x5}, {0x1, 0x2, 0x2, 0x2}, {0x1, 0x3, 0x1, 0x2}, {0x5, 0x5, 0xd, 0xa}, {0x3, 0x2, 0x10, 0xa}, {0x1, 0x2, 0x1, 0x8}], 0x10, 0x7}, 0x94) 587.559071ms ago: executing program 2 (id=5294): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x1, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0xc}, 0x0, 0x10000, 0x0, 0x3, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa, 0x0, @perf_config_ext={0x6, 0x401}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x4) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, 0x0, 0x3000c085) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000001000000000000000000000095", @ANYRESDEC=r0], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000000001000000a87d00000000000000", @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0xffff0000, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000004000000040000000a00000040000000", @ANYRES32, @ANYBLOB="0000040000000000000000400000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r3, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x2a, 0x1, 0x0, 0xfc, 0x0, 0x9, 0x44039, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x6, @perf_config_ext={0x0, 0x3fff7ff7}, 0x106848, 0x35, 0x43a1bd76, 0x7, 0x3, 0x8, 0x2, 0x0, 0x8000000, 0x0, 0x2009}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0xd) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0xa0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x343b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x4, @perf_config_ext={0x0, 0x3ff78000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000640), &(0x7f00000006c0)=r3}, 0x20) perf_event_open(&(0x7f0000000500)={0x0, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x240b9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b81, 0x2, @perf_bp={0x0}, 0x1008, 0x4, 0x43a1bd76, 0x7, 0x9, 0x2, 0x2, 0x0, 0x800000, 0x0, 0x2005}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x10040, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x2, 0x20000}, 0x102065, 0x0, 0x0, 0x3, 0x7, 0x1, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x404a) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000007c0)={{0x1}, &(0x7f0000000740), &(0x7f0000000780)=r3}, 0x20) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="02000b000000e6ffffffffffffff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="187fc07e28000000000000000008000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @cgroup_skb=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1d}, 0x94) 0s ago: executing program 3 (id=5295): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3, 0x0, &(0x7f0000000c40)=[{}, {}, {0x280000, 0x4, 0x10009, 0x6}], 0x10, 0xfffffff6}, 0x94) r0 = socket$kcm(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="1400000037000b63446a80648c2594f90b24fc60", 0x14}], 0x1}, 0x5006) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r1, 0x27, 0x16, 0x0, &(0x7f0000000dc0)="f8ad1dcc02cb29dcc8003200810066a288a8c6617f50", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700020000000000ef000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r4}, 0xc) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002e000b12d25a80648c2594f90324fc60100c02400a000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) kernel console output (not intermixed with test programs): type 1 has an invalid length. [ 826.714281][T20782] netlink: 'syz.2.3943': attribute type 4 has an invalid length. [ 826.785828][T20782] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.3943'. [ 827.094127][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 827.170745][ T5770] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 827.506273][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 827.726584][T20812] netlink: 'syz.3.3951': attribute type 21 has an invalid length. [ 827.792846][T20812] IPv6: NLM_F_CREATE should be specified when creating new route [ 827.932811][T20815] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3952'. [ 827.982958][T20815] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 828.222027][T20823] netlink: 9087 bytes leftover after parsing attributes in process `syz.3.3954'. [ 828.432263][T20827] netlink: 'syz.0.3956': attribute type 27 has an invalid length. [ 828.470579][T20822] syzkaller0: entered promiscuous mode [ 828.483954][T20822] syzkaller0: entered allmulticast mode [ 828.787172][T20833] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3958'. [ 828.808226][T20833] tc_dump_action: action bad kind [ 828.861605][T20835] netlink: 'syz.3.3959': attribute type 1 has an invalid length. [ 828.881118][T20835] netlink: 'syz.3.3959': attribute type 4 has an invalid length. [ 828.891532][T20835] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.3959'. [ 829.155479][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 829.265088][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 829.992075][T20869] netlink: 'syz.3.3967': attribute type 10 has an invalid length. [ 830.050965][T20882] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3970'. [ 830.056091][T20884] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3968'. [ 830.069926][T20884] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 830.084755][T20869] team0 (unregistering): Port device C removed [ 830.110565][T20869] team0 (unregistering): Port device team_slave_1 removed [ 830.125288][T20869] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 830.155958][T20869] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 830.165630][T20869] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 830.174802][T20869] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 830.201897][T20869] team0 (unregistering): Port device geneve1 removed [ 830.241563][T20878] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.3968'. [ 830.255100][T20882] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3970'. [ 830.334419][T20890] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 830.642567][ T5770] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 831.184251][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 831.370573][T20947] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.3991'. [ 831.380517][T20947] bridge_slave_1: default FDB implementation only supports local addresses [ 832.092319][ T5770] Bluetooth: hci2: unexpected subevent 0x05 length: 150 > 12 [ 832.694624][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 833.247448][T20998] netlink: 'syz.3.4004': attribute type 21 has an invalid length. [ 833.294472][T20998] netlink: 128 bytes leftover after parsing attributes in process `syz.3.4004'. [ 833.343128][T20998] netlink: 'syz.3.4004': attribute type 4 has an invalid length. [ 833.381609][T20998] netlink: 'syz.3.4004': attribute type 5 has an invalid length. [ 833.409970][T20998] netlink: 3 bytes leftover after parsing attributes in process `syz.3.4004'. [ 833.489429][T21007] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 833.787938][T21014] netlink: 'syz.1.4009': attribute type 39 has an invalid length. [ 834.026294][ T5770] Bluetooth: hci4: unexpected subevent 0x05 length: 150 > 12 [ 834.134714][ T5770] Bluetooth: hci2: command 0x0406 tx timeout [ 836.064984][ T5770] Bluetooth: hci4: command 0x0406 tx timeout [ 838.787613][ T5770] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 839.278398][T21105] netlink: 'syz.2.4032': attribute type 29 has an invalid length. [ 839.290321][T21105] netlink: 'syz.2.4032': attribute type 29 has an invalid length. [ 839.506347][T21110] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4034'. [ 839.713748][T21120] syzkaller0: entered promiscuous mode [ 839.729721][T21120] syzkaller0: entered allmulticast mode [ 839.988737][T21126] netlink: 'syz.1.4039': attribute type 21 has an invalid length. [ 839.999755][T21126] netlink: 156 bytes leftover after parsing attributes in process `syz.1.4039'. [ 840.017625][T21130] netlink: 16098 bytes leftover after parsing attributes in process `syz.0.4041'. [ 840.047479][T21128] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.4040'. [ 840.072303][T21134] netlink: 'syz.2.4042': attribute type 6 has an invalid length. [ 840.089610][T21130] netlink: 'syz.0.4041': attribute type 10 has an invalid length. [ 840.387260][T21151] netlink: 10 bytes leftover after parsing attributes in process `syz.2.4047'. [ 840.468019][T21151] pim6reg1: entered allmulticast mode [ 840.480355][ T5770] Bluetooth: hci2: unexpected subevent 0x05 length: 150 > 12 [ 840.518263][T21154] netlink: 'syz.1.4044': attribute type 2 has an invalid length. [ 840.634106][T21154] netlink: 'syz.1.4044': attribute type 3 has an invalid length. [ 840.720777][T21154] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4044'. [ 840.854143][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 841.171442][T21162] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.4048'. [ 841.184198][T21162] netlink: 6324 bytes leftover after parsing attributes in process `syz.1.4048'. [ 841.362107][ T49] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 841.585926][T21169] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.4050'. [ 841.814401][T21189] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4057'. [ 841.916813][T21191] mac80211_hwsim hwsim153 wlan0: entered promiscuous mode [ 841.954482][T21191] mac80211_hwsim hwsim153 wlan0: entered allmulticast mode [ 841.983507][T21198] netlink: 'syz.3.4058': attribute type 29 has an invalid length. [ 841.986558][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 842.535104][ T5770] Bluetooth: hci2: command 0x0406 tx timeout [ 842.541517][T21225] netlink: zone id is out of range [ 842.547723][T21225] netlink: zone id is out of range [ 842.558897][T21225] netlink: zone id is out of range [ 842.566046][T21225] netlink: zone id is out of range [ 842.583192][T21225] netlink: zone id is out of range [ 842.619461][T21225] netlink: zone id is out of range [ 842.622482][T21228] netlink: 'syz.0.4066': attribute type 21 has an invalid length. [ 842.658523][T21225] netlink: zone id is out of range [ 842.703954][T21225] netlink: zone id is out of range [ 842.728953][T21225] netlink: zone id is out of range [ 842.776179][T21225] netlink: zone id is out of range [ 843.151730][T21239] netlink: 'syz.2.4072': attribute type 2 has an invalid length. [ 843.494130][ T5770] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 844.074183][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 845.592442][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 846.846828][T21271] __nla_validate_parse: 3 callbacks suppressed [ 846.846844][T21271] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.4080'. [ 846.877092][T21278] netlink: 'syz.1.4081': attribute type 10 has an invalid length. [ 846.885692][T21278] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4081'. [ 846.914181][T21278] netlink: 'syz.1.4081': attribute type 10 has an invalid length. [ 846.922068][T21278] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4081'. [ 846.999213][T21286] netlink: 'syz.0.4085': attribute type 11 has an invalid length. [ 847.027399][T21286] netlink: 184116 bytes leftover after parsing attributes in process `syz.0.4085'. [ 847.046461][T21286] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 847.076342][T21286] CPU: 0 PID: 21286 Comm: syz.0.4085 Not tainted syzkaller #0 [ 847.083863][T21286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 847.093943][T21286] Call Trace: [ 847.097243][T21286] [ 847.100192][T21286] dump_stack_lvl+0x18c/0x250 [ 847.104903][T21286] ? show_regs_print_info+0x20/0x20 [ 847.110126][T21286] ? load_image+0x400/0x400 [ 847.114666][T21286] sysfs_warn_dup+0x8e/0xa0 [ 847.119193][T21286] sysfs_do_create_link_sd+0xc0/0x110 [ 847.124588][T21286] device_add_class_symlinks+0x1cf/0x240 [ 847.130251][T21286] device_add+0x507/0xc20 [ 847.134608][T21286] wiphy_register+0x1dad/0x2ae0 [ 847.139496][T21286] ? cfg80211_event_work+0x40/0x40 [ 847.144624][T21286] ? minstrel_ht_alloc+0x88a/0x990 [ 847.149770][T21286] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 847.155860][T21286] ieee80211_register_hw+0x3464/0x4250 [ 847.161382][T21286] ? ieee80211_tasklet_handler+0x20/0x20 [ 847.167039][T21286] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 847.172951][T21286] ? __debug_object_init+0xec/0x450 [ 847.178159][T21286] ? __asan_memset+0x22/0x40 [ 847.182756][T21286] ? __hrtimer_init+0x186/0x270 [ 847.187614][T21286] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 847.193470][T21286] ? mac80211_hwsim_free+0x220/0x220 [ 847.198756][T21286] ? rcu_is_watching+0x15/0xb0 [ 847.203517][T21286] ? kstrndup+0xbd/0x140 [ 847.207764][T21286] hwsim_new_radio_nl+0xdc9/0x1a90 [ 847.212880][T21286] ? __nla_validate+0x50/0x50 [ 847.217657][T21286] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 847.224006][T21286] ? __nla_parse+0x40/0x50 [ 847.228419][T21286] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 847.234744][T21286] genl_family_rcv_msg_doit+0x211/0x310 [ 847.240280][T21286] ? end_current_label_crit_section+0x170/0x170 [ 847.246517][T21286] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 847.252411][T21286] ? bpf_lsm_capable+0x9/0x10 [ 847.257082][T21286] ? security_capable+0x89/0xb0 [ 847.261932][T21286] genl_rcv_msg+0x619/0x7a0 [ 847.266439][T21286] ? genl_bind+0x360/0x360 [ 847.270843][T21286] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 847.277170][T21286] ? ref_tracker_free+0x690/0x840 [ 847.282193][T21286] netlink_rcv_skb+0x241/0x4d0 [ 847.286953][T21286] ? genl_bind+0x360/0x360 [ 847.291362][T21286] ? netlink_ack+0x1180/0x1180 [ 847.296131][T21286] ? __lock_acquire+0x7d40/0x7d40 [ 847.301160][T21286] ? down_read+0x1ac/0x2e0 [ 847.305573][T21286] genl_rcv+0x28/0x40 [ 847.309552][T21286] netlink_unicast+0x751/0x8d0 [ 847.314330][T21286] netlink_sendmsg+0x8d0/0xbf0 [ 847.319101][T21286] ? netlink_getsockopt+0x590/0x590 [ 847.324302][T21286] ? aa_sock_msg_perm+0x94/0x150 [ 847.329234][T21286] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 847.334525][T21286] ? security_socket_sendmsg+0x80/0xa0 [ 847.339974][T21286] ? netlink_getsockopt+0x590/0x590 [ 847.345344][T21286] ____sys_sendmsg+0x5ba/0x960 [ 847.350107][T21286] ? __asan_memset+0x22/0x40 [ 847.354694][T21286] ? __sys_sendmsg_sock+0x30/0x30 [ 847.359707][T21286] ? __import_iovec+0x5f2/0x850 [ 847.364564][T21286] ? import_iovec+0x73/0xa0 [ 847.369061][T21286] ___sys_sendmsg+0x2a6/0x360 [ 847.373732][T21286] ? __sys_sendmsg+0x2a0/0x2a0 [ 847.378525][T21286] __se_sys_sendmsg+0x1c2/0x2b0 [ 847.383370][T21286] ? __x64_sys_sendmsg+0x80/0x80 [ 847.388311][T21286] ? lockdep_hardirqs_on+0x98/0x150 [ 847.393503][T21286] do_syscall_64+0x55/0xa0 [ 847.397917][T21286] ? clear_bhb_loop+0x40/0x90 [ 847.402596][T21286] ? clear_bhb_loop+0x40/0x90 [ 847.407269][T21286] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 847.413154][T21286] RIP: 0033:0x7f125c19c799 [ 847.417562][T21286] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 847.437165][T21286] RSP: 002b:00007f125d066028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 847.445575][T21286] RAX: ffffffffffffffda RBX: 00007f125c415fa0 RCX: 00007f125c19c799 [ 847.453535][T21286] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 847.461503][T21286] RBP: 00007f125c232c99 R08: 0000000000000000 R09: 0000000000000000 [ 847.469476][T21286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 847.477472][T21286] R13: 00007f125c416038 R14: 00007f125c415fa0 R15: 00007ffd7c2e8a68 [ 847.485513][T21286] [ 847.550718][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 847.591992][T21301] netlink: 'syz.1.4087': attribute type 10 has an invalid length. [ 847.606721][T21301] netlink: 55 bytes leftover after parsing attributes in process `syz.1.4087'. [ 848.037427][T21306] tap0: tun_chr_ioctl cmd 1074025677 [ 848.043310][T21306] tap0: linktype set to 6 [ 848.172374][T21317] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.4092'. [ 849.574258][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 849.638044][T21341] netlink: 'syz.2.4099': attribute type 9 has an invalid length. [ 849.652066][T21341] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.4099'. [ 849.733178][ T5770] Bluetooth: hci4: unexpected subevent 0x05 length: 150 > 12 [ 849.838246][T21348] netlink: 'syz.3.4100': attribute type 10 has an invalid length. [ 849.848367][T21362] net_ratelimit: 331 callbacks suppressed [ 849.848411][T21362] netlink: set zone limit has 8 unknown bytes [ 849.849934][T21363] netlink: set zone limit has 8 unknown bytes [ 850.379870][T21387] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.4108'. [ 850.559043][T21397] dvmrp1: tun_chr_ioctl cmd 1074812118 [ 850.636118][T21402] netlink: 'syz.0.4113': attribute type 10 has an invalid length. [ 850.656168][T21402] netlink: 55 bytes leftover after parsing attributes in process `syz.0.4113'. [ 850.878707][T21407] netlink: 209820 bytes leftover after parsing attributes in process `syz.2.4114'. [ 850.906646][T21415] netlink: 'syz.2.4114': attribute type 10 has an invalid length. [ 850.935279][T21415] bridge0: port 3(ipvlan1) entered blocking state [ 850.952972][ T5770] Bluetooth: hci4: unexpected subevent 0x05 length: 150 > 12 [ 850.972995][T21415] bridge0: port 3(ipvlan1) entered disabled state [ 851.096221][T21415] ipvlan1: entered allmulticast mode [ 851.111850][T21415] veth0_vlan: entered allmulticast mode [ 851.149922][T21415] ipvlan1: left allmulticast mode [ 851.191112][T21415] veth0_vlan: left allmulticast mode [ 851.214758][T21415] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 851.824124][ T5770] Bluetooth: hci4: command 0x0406 tx timeout [ 852.045484][T21444] __nla_validate_parse: 1 callbacks suppressed [ 852.045502][T21444] netlink: 40227 bytes leftover after parsing attributes in process `syz.0.4124'. [ 852.414534][T21461] netlink: 'syz.2.4131': attribute type 3 has an invalid length. [ 852.509739][T21470] netlink: 105120 bytes leftover after parsing attributes in process `syz.1.4132'. [ 852.538344][T21470] netlink: 16126 bytes leftover after parsing attributes in process `syz.1.4132'. [ 852.606831][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 852.822128][T21479] netlink: 'syz.3.4135': attribute type 12 has an invalid length. [ 852.858530][T21479] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4135'. [ 853.824284][T21509] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 853.839002][T21509] syzkaller0: entered promiscuous mode [ 853.851481][T21509] syzkaller0: entered allmulticast mode [ 853.894223][ T5770] Bluetooth: hci4: command 0x0406 tx timeout [ 854.239694][T21529] netlink: 10 bytes leftover after parsing attributes in process `syz.3.4148'. [ 854.560089][T21538] netlink: 830 bytes leftover after parsing attributes in process `syz.0.4150'. [ 854.614510][T21537] netlink: 830 bytes leftover after parsing attributes in process `syz.0.4150'. [ 854.694816][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 854.856802][ T5770] Bluetooth: hci1: unexpected event 0x30 length: 151 > 3 [ 856.748377][ T5770] Bluetooth: hci2: unexpected subevent 0x05 length: 150 > 12 [ 856.768809][T21611] netlink: 'syz.0.4169': attribute type 3 has an invalid length. [ 856.777173][T21611] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.4169'. [ 857.573248][T21633] netlink: 'syz.1.4173': attribute type 2 has an invalid length. [ 857.611854][T21633] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4173'. [ 858.411847][T21644] netlink: 196 bytes leftover after parsing attributes in process `syz.0.4175'. [ 858.441847][T21645] netlink: 196 bytes leftover after parsing attributes in process `syz.0.4175'. [ 858.463348][T21644] netlink: 'syz.0.4175': attribute type 29 has an invalid length. [ 858.483698][T21644] netlink: 'syz.0.4175': attribute type 29 has an invalid length. [ 858.509193][T21645] netlink: 'syz.0.4175': attribute type 29 has an invalid length. [ 858.526443][T21644] netlink: 'syz.0.4175': attribute type 29 has an invalid length. [ 858.552302][T21645] netlink: 'syz.0.4175': attribute type 29 has an invalid length. [ 858.571753][T21644] netlink: 'syz.0.4175': attribute type 29 has an invalid length. [ 858.774552][ T5770] Bluetooth: hci2: command 0x0406 tx timeout [ 859.375482][T21660] netlink: 'syz.0.4181': attribute type 10 has an invalid length. [ 859.407424][T21660] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4181'. [ 859.440747][T21664] netlink: 'syz.0.4181': attribute type 1 has an invalid length. [ 859.452758][T21660] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 859.469508][T21664] netlink: 'syz.0.4181': attribute type 3 has an invalid length. [ 859.477704][T21664] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4181'. [ 859.491383][T21662] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4180'. [ 859.521003][T21662] tc_dump_action: action bad kind [ 859.659040][T21672] netlink: 157880 bytes leftover after parsing attributes in process `syz.2.4184'. [ 859.847886][ T5770] Bluetooth: hci0: ISO packet for unknown connection handle 2366 [ 860.236352][T21701] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 860.254225][T21701] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 860.342244][T21705] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4193'. [ 860.383042][T21701] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 860.394248][T21701] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 860.437783][T21701] batman_adv: batadv0: Removing interface: vlan1 [ 860.483429][T21709] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.4194'. [ 860.574460][T21705] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4193'. [ 861.040767][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 861.471089][T21751] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 862.576118][T21773] syzkaller0: left promiscuous mode [ 862.581376][T21773] syzkaller0: left allmulticast mode [ 862.638154][T21776] validate_nla: 2 callbacks suppressed [ 862.638171][T21776] netlink: 'syz.2.4212': attribute type 8 has an invalid length. [ 862.734955][T21780] netlink: 'syz.1.4210': attribute type 2 has an invalid length. [ 862.763281][T21780] __nla_validate_parse: 8 callbacks suppressed [ 862.763296][T21780] netlink: 119 bytes leftover after parsing attributes in process `syz.1.4210'. [ 863.111731][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 863.216296][ T5770] Bluetooth: hci4: unexpected subevent 0x04 length: 150 > 11 [ 863.506197][T21807] netlink: 'syz.1.4219': attribute type 3 has an invalid length. [ 863.535749][T21807] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4219'. [ 863.644779][T21809] netlink: 50451 bytes leftover after parsing attributes in process `syz.2.4220'. [ 864.533344][T21838] netlink: 'syz.0.4228': attribute type 21 has an invalid length. [ 864.584408][T21838] netlink: 'syz.0.4228': attribute type 10 has an invalid length. [ 864.652191][T21838] wg1: entered promiscuous mode [ 864.665840][T21838] wg1: entered allmulticast mode [ 864.677704][T21838] team0: Device wg1 is of different type [ 865.303207][T21847] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.4232'. [ 865.633769][ T5770] Bluetooth: hci2: unexpected subevent 0x05 length: 150 > 12 [ 866.334847][T21893] netlink: 'syz.2.4242': attribute type 21 has an invalid length. [ 866.480804][T21899] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4244'. [ 866.568639][T21899] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 866.617280][T21899] CPU: 1 PID: 21899 Comm: syz.1.4244 Not tainted syzkaller #0 [ 866.624802][T21899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 866.634880][T21899] Call Trace: [ 866.638174][T21899] [ 866.641117][T21899] dump_stack_lvl+0x18c/0x250 [ 866.645829][T21899] ? show_regs_print_info+0x20/0x20 [ 866.651054][T21899] ? load_image+0x400/0x400 [ 866.655597][T21899] sysfs_warn_dup+0x8e/0xa0 [ 866.660123][T21899] sysfs_do_create_link_sd+0xc0/0x110 [ 866.665520][T21899] device_add_class_symlinks+0x1cf/0x240 [ 866.671182][T21899] device_add+0x507/0xc20 [ 866.675540][T21899] wiphy_register+0x1dad/0x2ae0 [ 866.680440][T21899] ? cfg80211_event_work+0x40/0x40 [ 866.685568][T21899] ? minstrel_ht_alloc+0x88a/0x990 [ 866.690710][T21899] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 866.696804][T21899] ieee80211_register_hw+0x3464/0x4250 [ 866.702318][T21899] ? ieee80211_tasklet_handler+0x20/0x20 [ 866.707975][T21899] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 866.713892][T21899] ? __debug_object_init+0xec/0x450 [ 866.719118][T21899] ? __asan_memset+0x22/0x40 [ 866.723732][T21899] ? __hrtimer_init+0x186/0x270 [ 866.728610][T21899] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 866.734388][T21899] ? mac80211_hwsim_free+0x220/0x220 [ 866.739709][T21899] ? rcu_is_watching+0x15/0xb0 [ 866.744494][T21899] ? kstrndup+0xbd/0x140 [ 866.748773][T21899] hwsim_new_radio_nl+0xdc9/0x1a90 [ 866.753920][T21899] ? __nla_validate+0x50/0x50 [ 866.758638][T21899] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 866.765011][T21899] ? __nla_parse+0x40/0x50 [ 866.769450][T21899] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 866.775807][T21899] genl_family_rcv_msg_doit+0x211/0x310 [ 866.781373][T21899] ? end_current_label_crit_section+0x170/0x170 [ 866.787730][T21899] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 866.794089][T21899] ? bpf_lsm_capable+0x9/0x10 [ 866.798790][T21899] ? security_capable+0x89/0xb0 [ 866.803675][T21899] genl_rcv_msg+0x619/0x7a0 [ 866.808206][T21899] ? genl_bind+0x360/0x360 [ 866.812649][T21899] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 866.819004][T21899] ? perf_trace_lock+0xfc/0x3b0 [ 866.823895][T21899] netlink_rcv_skb+0x241/0x4d0 [ 866.828684][T21899] ? genl_bind+0x360/0x360 [ 866.833122][T21899] ? netlink_ack+0x1180/0x1180 [ 866.837923][T21899] ? __lock_acquire+0x7d40/0x7d40 [ 866.842980][T21899] ? down_read+0x1ac/0x2e0 [ 866.847422][T21899] genl_rcv+0x28/0x40 [ 866.851426][T21899] netlink_unicast+0x751/0x8d0 [ 866.856225][T21899] netlink_sendmsg+0x8d0/0xbf0 [ 866.861024][T21899] ? netlink_getsockopt+0x590/0x590 [ 866.866249][T21899] ? aa_sock_msg_perm+0x94/0x150 [ 866.871215][T21899] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 866.876522][T21899] ? security_socket_sendmsg+0x80/0xa0 [ 866.882001][T21899] ? netlink_getsockopt+0x590/0x590 [ 866.887231][T21899] ____sys_sendmsg+0x5ba/0x960 [ 866.892019][T21899] ? __asan_memset+0x22/0x40 [ 866.896629][T21899] ? __sys_sendmsg_sock+0x30/0x30 [ 866.901664][T21899] ? __import_iovec+0x5f2/0x850 [ 866.906547][T21899] ? import_iovec+0x73/0xa0 [ 866.911071][T21899] ___sys_sendmsg+0x2a6/0x360 [ 866.915771][T21899] ? __sys_sendmsg+0x2a0/0x2a0 [ 866.920613][T21899] __se_sys_sendmsg+0x1c2/0x2b0 [ 866.925485][T21899] ? __x64_sys_sendmsg+0x80/0x80 [ 866.930468][T21899] ? lockdep_hardirqs_on+0x98/0x150 [ 866.935688][T21899] do_syscall_64+0x55/0xa0 [ 866.940125][T21899] ? clear_bhb_loop+0x40/0x90 [ 866.944826][T21899] ? clear_bhb_loop+0x40/0x90 [ 866.949526][T21899] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 866.955443][T21899] RIP: 0033:0x7f6aa899c799 [ 866.959872][T21899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 866.979495][T21899] RSP: 002b:00007f6aa9876028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 866.987926][T21899] RAX: ffffffffffffffda RBX: 00007f6aa8c16180 RCX: 00007f6aa899c799 [ 866.995916][T21899] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000b [ 867.003901][T21899] RBP: 00007f6aa8a32c99 R08: 0000000000000000 R09: 0000000000000000 [ 867.011891][T21899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 867.019882][T21899] R13: 00007f6aa8c16218 R14: 00007f6aa8c16180 R15: 00007fff363f0978 [ 867.027895][T21899] [ 867.250314][T21907] bridge0: port 1(bridge_slave_0) entered forwarding state [ 867.419124][T21912] netlink: 'syz.2.4247': attribute type 10 has an invalid length. [ 867.450182][T21910] netlink: 'syz.2.4247': attribute type 10 has an invalid length. [ 867.514050][T21910] netlink: 209064 bytes leftover after parsing attributes in process `syz.2.4247'. [ 867.523466][T21912] netlink: 209064 bytes leftover after parsing attributes in process `syz.2.4247'. [ 867.544212][T21910] openvswitch: netlink: Flow key attr not present in new flow. [ 867.584591][T21912] openvswitch: netlink: Flow key attr not present in new flow. [ 867.654385][ T5770] Bluetooth: hci2: command 0x0406 tx timeout [ 867.829013][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 867.902860][T21933] mac80211_hwsim hwsim156 wlan0: entered promiscuous mode [ 867.952272][T21933] mac80211_hwsim hwsim156 wlan0: entered allmulticast mode [ 868.137994][T21937] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.4254'. [ 868.169195][T21937] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.4254'. [ 869.698883][T21969] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.4264'. [ 869.768901][T21976] netlink: 'syz.2.4262': attribute type 27 has an invalid length. [ 869.793479][T21976] netlink: 164 bytes leftover after parsing attributes in process `syz.2.4262'. [ 869.894273][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 869.922961][T21983] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.4267'. [ 869.955209][T21983] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.4267'. [ 870.312903][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.322569][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.596044][T21997] netlink: 'syz.0.4270': attribute type 2 has an invalid length. [ 870.604880][T21997] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4270'. [ 870.624779][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 870.847495][T22006] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4273'. [ 871.061982][T22015] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.4275'. [ 871.083203][T22015] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.4275'. [ 872.694602][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 873.029805][ T5770] Bluetooth: hci4: unexpected subevent 0x05 length: 150 > 12 [ 873.049732][T22055] netlink: 'syz.3.4283': attribute type 10 has an invalid length. [ 873.110083][T22049] netlink: 'syz.3.4283': attribute type 10 has an invalid length. [ 873.160143][T22049] __nla_validate_parse: 1 callbacks suppressed [ 873.160159][T22049] netlink: 9279 bytes leftover after parsing attributes in process `syz.3.4283'. [ 873.361727][T22068] netlink: 'syz.2.4289': attribute type 30 has an invalid length. [ 873.569284][T22075] netlink: 'syz.3.4291': attribute type 1 has an invalid length. [ 873.603406][T22075] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.4291'. [ 873.871353][T22087] netlink: 1057 bytes leftover after parsing attributes in process `syz.1.4296'. [ 875.114041][ T5770] Bluetooth: hci4: command 0x0406 tx timeout [ 875.883642][T22155] netlink: 'syz.2.4313': attribute type 10 has an invalid length. [ 875.902249][T22155] netlink: 55 bytes leftover after parsing attributes in process `syz.2.4313'. [ 876.363897][T22164] netlink: 'syz.1.4316': attribute type 29 has an invalid length. [ 876.479296][T22169] netlink: 'syz.1.4316': attribute type 6 has an invalid length. [ 876.487516][T22169] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.4316'. [ 876.576012][T22164] netlink: 'syz.1.4316': attribute type 29 has an invalid length. [ 876.588905][T22167] netlink: 'syz.1.4316': attribute type 29 has an invalid length. [ 876.729151][T22173] netlink: 'syz.2.4319': attribute type 1 has an invalid length. [ 876.737124][T22173] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.4319'. [ 876.778239][T22180] netlink: 'syz.0.4321': attribute type 153 has an invalid length. [ 876.796317][T22180] netlink: 128124 bytes leftover after parsing attributes in process `syz.0.4321'. [ 877.071078][T22183] netlink: 'syz.0.4322': attribute type 10 has an invalid length. [ 877.233368][T22195] syzkaller0: entered promiscuous mode [ 877.243627][T22195] syzkaller0: entered allmulticast mode [ 878.407460][T22217] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.4331'. [ 880.120514][T22217] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.4331'. [ 881.004326][T22248] netlink: 'syz.3.4338': attribute type 1 has an invalid length. [ 881.420851][T22269] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4344'. [ 881.726190][T22271] netlink: 'syz.2.4345': attribute type 10 has an invalid length. [ 881.742782][T22271] veth0_macvtap: left promiscuous mode [ 881.945988][T22277] syz.3.4347[22277] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 881.946243][T22277] syz.3.4347[22277] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 882.748462][ T5770] Bluetooth: hci2: unexpected subevent 0x05 length: 150 > 12 [ 883.012367][T22308] netlink: 197276 bytes leftover after parsing attributes in process `syz.1.4354'. [ 883.513955][T22315] netlink: 'syz.1.4359': attribute type 29 has an invalid length. [ 883.527255][T22317] netlink: 'syz.0.4360': attribute type 2 has an invalid length. [ 883.544116][T22317] netlink: 'syz.0.4360': attribute type 8 has an invalid length. [ 883.568862][T22317] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4360'. [ 883.602015][T22315] netlink: 'syz.1.4359': attribute type 29 has an invalid length. [ 884.117123][T22323] netlink: set zone limit has 8 unknown bytes [ 884.384996][T22351] IPv6: NLM_F_CREATE should be specified when creating new route [ 884.410310][T22351] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4367'. [ 884.616015][ T5770] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 884.774144][ T5770] Bluetooth: hci2: command 0x0406 tx timeout [ 886.696730][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 887.519243][T22370] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4372'. [ 887.700421][T22372] netlink: 168 bytes leftover after parsing attributes in process `syz.0.4373'. [ 888.764821][ T5770] Bluetooth: hci4: unexpected subevent 0x04 length: 150 > 11 [ 888.907721][T22403] netlink: 134736 bytes leftover after parsing attributes in process `syz.3.4382'. [ 888.930237][T22406] netlink: 56537 bytes leftover after parsing attributes in process `syz.3.4382'. [ 888.940237][T22404] netlink: 56537 bytes leftover after parsing attributes in process `syz.3.4382'. [ 889.406326][T22416] netlink: 'syz.3.4384': attribute type 21 has an invalid length. [ 889.522430][T22415] netlink: 'syz.3.4384': attribute type 21 has an invalid length. [ 889.918920][T22436] netlink: 'syz.2.4389': attribute type 3 has an invalid length. [ 889.929000][T22436] netlink: 16066 bytes leftover after parsing attributes in process `syz.2.4389'. [ 890.158946][T22444] mac80211_hwsim hwsim153 wlan0: left promiscuous mode [ 890.169278][T22444] mac80211_hwsim hwsim153 wlan0: left allmulticast mode [ 890.201216][T22444] mac80211_hwsim hwsim153 »»»»»»: renamed from wlan0 [ 890.320518][T22451] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.4392'. [ 890.329993][T22451] netlink: 6324 bytes leftover after parsing attributes in process `syz.2.4392'. [ 890.354533][T22451] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4392'. [ 890.363457][T22451] tc_dump_action: action bad kind [ 890.397292][T22454] netlink: 830 bytes leftover after parsing attributes in process `syz.0.4393'. [ 890.421333][T22456] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.4394'. [ 890.490473][T22456] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.4394'. [ 890.546682][ T5770] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 890.947364][T22478] netlink: 'syz.1.4400': attribute type 3 has an invalid length. [ 891.351188][ T5770] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 891.645435][T22501] syzkaller0: entered promiscuous mode [ 891.661696][T22501] syzkaller0: entered allmulticast mode [ 892.614183][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 892.787872][T22518] netlink: 'syz.1.4411': attribute type 10 has an invalid length. [ 893.424325][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 894.112305][T22508] netlink: 'syz.0.4408': attribute type 21 has an invalid length. [ 894.123759][T22518] netlink: 'syz.1.4411': attribute type 10 has an invalid length. [ 894.131913][T22518] __nla_validate_parse: 3 callbacks suppressed [ 894.131926][T22518] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4411'. [ 894.222834][ T5770] Bluetooth: hci4: unexpected subevent 0x05 length: 150 > 12 [ 894.249422][T22524] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.4414'. [ 894.300877][T22522] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.4414'. [ 895.016842][T22543] netlink: 'syz.2.4416': attribute type 16 has an invalid length. [ 895.031807][T22543] netlink: 'syz.2.4416': attribute type 3 has an invalid length. [ 895.040887][T22543] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4416'. [ 895.091519][T22543] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4416'. [ 895.279955][T22554] netlink: 'syz.0.4418': attribute type 1 has an invalid length. [ 895.286425][T22553] syzkaller0: entered promiscuous mode [ 895.293462][T22553] syzkaller0: entered allmulticast mode [ 895.304532][T22554] netlink: 181400 bytes leftover after parsing attributes in process `syz.0.4418'. [ 895.487040][ T5770] Bluetooth: hci4: unexpected subevent 0x05 length: 150 > 12 [ 895.573934][T22568] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4422'. [ 895.588388][T22568] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4422'. [ 895.602126][T22568] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4422'. [ 895.625123][T22569] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4422'. [ 895.743832][T22573] pim6reg1: entered allmulticast mode [ 895.873422][T22566] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 896.304253][T22566] Bluetooth: hci4: command 0x0406 tx timeout [ 896.525420][T22593] netlink: 'syz.0.4427': attribute type 16 has an invalid length. [ 896.533632][T22593] netlink: 'syz.0.4427': attribute type 3 has an invalid length. [ 897.896682][T22566] Bluetooth: hci1: command 0x0406 tx timeout [ 898.263537][T22603] sctp: [Deprecated]: syz.2.4430 (pid 22603) Use of int in maxseg socket option. [ 898.263537][T22603] Use struct sctp_assoc_value instead [ 898.374146][T22566] Bluetooth: hci4: command 0x0406 tx timeout [ 898.384418][T10219] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 898.630373][T22566] Bluetooth: hci1: unexpected subevent 0x05 length: 150 > 12 [ 898.656469][T22566] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 899.133437][T22636] netlink: 'syz.0.4438': attribute type 153 has an invalid length. [ 899.141972][T22636] __nla_validate_parse: 4 callbacks suppressed [ 899.141984][T22636] netlink: 128124 bytes leftover after parsing attributes in process `syz.0.4438'. [ 899.188698][T22635] mac80211_hwsim hwsim160 wlan0: entered promiscuous mode [ 899.214708][T22635] mac80211_hwsim hwsim160 wlan0: entered allmulticast mode [ 899.361319][T22650] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4443'. [ 899.924472][T22566] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 900.710725][T22566] Bluetooth: hci0: command 0x0406 tx timeout [ 900.710738][T14548] Bluetooth: hci1: command 0x0406 tx timeout [ 900.724266][T22694] dvmrp1: tun_chr_ioctl cmd 1074812118 [ 900.860632][T22696] syzkaller0: entered promiscuous mode [ 900.871701][T22696] syzkaller0: entered allmulticast mode [ 900.943167][T22698] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 900.963919][T22698] syzkaller0: entered promiscuous mode [ 900.969715][T22698] syzkaller0: entered allmulticast mode [ 901.410061][T14548] Bluetooth: hci0: unexpected subevent 0x05 length: 150 > 12 [ 901.631501][T22732] netlink: 'syz.3.4467': attribute type 11 has an invalid length. [ 901.670858][T22732] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.4467'. [ 902.779180][T14548] Bluetooth: hci0: command 0x0406 tx timeout [ 903.362966][T22766] netlink: 10 bytes leftover after parsing attributes in process `syz.3.4476'. [ 903.389217][T22775] netlink: 'syz.0.4478': attribute type 10 has an invalid length. [ 903.466535][T22775] team0: Device wg1 is of different type [ 903.720229][T22778] tap0: tun_chr_ioctl cmd 1074025675 [ 903.734493][T22778] tap0: persist enabled [ 903.798625][T22779] netlink: 'syz.1.4477': attribute type 3 has an invalid length. [ 903.810261][T22769] pim6reg1: entered promiscuous mode [ 903.824345][T22779] netlink: 'syz.1.4477': attribute type 6 has an invalid length. [ 903.834317][T22769] pim6reg1: entered allmulticast mode [ 903.854087][T22779] netlink: 144448 bytes leftover after parsing attributes in process `syz.1.4477'. [ 903.864148][T22774] tap1: tun_chr_ioctl cmd 1074025677 [ 903.881928][T22774] tap1: linktype set to 778 [ 904.055944][T22781] tap0: tun_chr_ioctl cmd 1074025675 [ 904.061309][T22781] tap0: persist enabled [ 904.072371][T22765] netlink: 'syz.1.4477': attribute type 4 has an invalid length. [ 904.080661][T22765] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4477'. [ 904.109942][T22765] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 904.416220][T22801] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4483'. [ 904.854102][T14548] Bluetooth: hci0: command 0x0406 tx timeout [ 907.653671][T22822] netlink: 56843 bytes leftover after parsing attributes in process `syz.1.4487'. [ 907.681022][T22827] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4490'. [ 907.735962][T22827] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 907.752350][T22827] CPU: 0 PID: 22827 Comm: syz.3.4490 Not tainted syzkaller #0 [ 907.759863][T22827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 907.769942][T22827] Call Trace: [ 907.773326][T22827] [ 907.776282][T22827] dump_stack_lvl+0x18c/0x250 [ 907.780989][T22827] ? show_regs_print_info+0x20/0x20 [ 907.786209][T22827] ? load_image+0x400/0x400 [ 907.790751][T22827] sysfs_warn_dup+0x8e/0xa0 [ 907.795273][T22827] sysfs_do_create_link_sd+0xc0/0x110 [ 907.800663][T22827] device_add_class_symlinks+0x1cf/0x240 [ 907.806322][T22827] device_add+0x507/0xc20 [ 907.810682][T22827] wiphy_register+0x1dad/0x2ae0 [ 907.815577][T22827] ? cfg80211_event_work+0x40/0x40 [ 907.820716][T22827] ? minstrel_ht_alloc+0x88a/0x990 [ 907.825862][T22827] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 907.831972][T22827] ieee80211_register_hw+0x3464/0x4250 [ 907.837490][T22827] ? ieee80211_tasklet_handler+0x20/0x20 [ 907.843149][T22827] ? lockdep_hardirqs_on+0x98/0x150 [ 907.848376][T22827] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 907.854576][T22827] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 907.860352][T22827] ? mac80211_hwsim_free+0x220/0x220 [ 907.865751][T22827] ? rcu_is_watching+0x15/0xb0 [ 907.870539][T22827] ? kstrndup+0xbd/0x140 [ 907.874819][T22827] hwsim_new_radio_nl+0xdc9/0x1a90 [ 907.879964][T22827] ? __nla_validate+0x50/0x50 [ 907.884684][T22827] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 907.891053][T22827] ? __nla_parse+0x40/0x50 [ 907.895495][T22827] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 907.901847][T22827] genl_family_rcv_msg_doit+0x211/0x310 [ 907.907412][T22827] ? end_current_label_crit_section+0x170/0x170 [ 907.913676][T22827] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 907.919593][T22827] ? bpf_lsm_capable+0x9/0x10 [ 907.924291][T22827] ? security_capable+0x89/0xb0 [ 907.929606][T22827] genl_rcv_msg+0x619/0x7a0 [ 907.934130][T22827] ? genl_bind+0x360/0x360 [ 907.938551][T22827] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 907.944539][T22827] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 907.950878][T22827] ? ref_tracker_free+0x690/0x840 [ 907.955924][T22827] netlink_rcv_skb+0x241/0x4d0 [ 907.960702][T22827] ? genl_bind+0x360/0x360 [ 907.965130][T22827] ? netlink_ack+0x1180/0x1180 [ 907.969916][T22827] ? __lock_acquire+0x7d40/0x7d40 [ 907.974958][T22827] ? down_read+0x1ac/0x2e0 [ 907.979389][T22827] genl_rcv+0x28/0x40 [ 907.983374][T22827] netlink_unicast+0x751/0x8d0 [ 907.988161][T22827] netlink_sendmsg+0x8d0/0xbf0 [ 907.992947][T22827] ? netlink_getsockopt+0x590/0x590 [ 907.998161][T22827] ? aa_sock_msg_perm+0x94/0x150 [ 908.003107][T22827] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 908.008397][T22827] ? security_socket_sendmsg+0x80/0xa0 [ 908.013868][T22827] ? netlink_getsockopt+0x590/0x590 [ 908.019204][T22827] ____sys_sendmsg+0x5ba/0x960 [ 908.023988][T22827] ? __asan_memset+0x22/0x40 [ 908.028587][T22827] ? __sys_sendmsg_sock+0x30/0x30 [ 908.033621][T22827] ? __import_iovec+0x5f2/0x850 [ 908.038495][T22827] ? import_iovec+0x73/0xa0 [ 908.043018][T22827] ___sys_sendmsg+0x2a6/0x360 [ 908.047709][T22827] ? __sys_sendmsg+0x2a0/0x2a0 [ 908.052532][T22827] __se_sys_sendmsg+0x1c2/0x2b0 [ 908.057389][T22827] ? __x64_sys_sendmsg+0x80/0x80 [ 908.062355][T22827] ? lockdep_hardirqs_on+0x98/0x150 [ 908.067560][T22827] do_syscall_64+0x55/0xa0 [ 908.071982][T22827] ? clear_bhb_loop+0x40/0x90 [ 908.076668][T22827] ? clear_bhb_loop+0x40/0x90 [ 908.081352][T22827] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 908.087252][T22827] RIP: 0033:0x7f68d099c799 [ 908.091671][T22827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 908.111283][T22827] RSP: 002b:00007f68d1860028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 908.119702][T22827] RAX: ffffffffffffffda RBX: 00007f68d0c15fa0 RCX: 00007f68d099c799 [ 908.127681][T22827] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 908.135654][T22827] RBP: 00007f68d0a32c99 R08: 0000000000000000 R09: 0000000000000000 [ 908.143626][T22827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 908.151599][T22827] R13: 00007f68d0c16038 R14: 00007f68d0c15fa0 R15: 00007ffc1908a828 [ 908.159593][T22827] [ 908.588763][T22847] netlink: 'syz.0.4494': attribute type 10 has an invalid length. [ 908.673596][T22849] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4496'. [ 908.682531][T22854] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.4497'. [ 908.703027][T22849] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4496'. [ 908.785182][T22855] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4496'. [ 908.806001][T22849] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4496'. [ 909.181824][T22866] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4501'. [ 909.212831][T22866] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 909.229827][T22866] CPU: 1 PID: 22866 Comm: syz.2.4501 Not tainted syzkaller #0 [ 909.237350][T22866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 909.247428][T22866] Call Trace: [ 909.250722][T22866] [ 909.253669][T22866] dump_stack_lvl+0x18c/0x250 [ 909.258381][T22866] ? show_regs_print_info+0x20/0x20 [ 909.263614][T22866] ? load_image+0x400/0x400 [ 909.268163][T22866] sysfs_warn_dup+0x8e/0xa0 [ 909.272684][T22866] sysfs_do_create_link_sd+0xc0/0x110 [ 909.278080][T22866] device_add_class_symlinks+0x1cf/0x240 [ 909.283738][T22866] device_add+0x507/0xc20 [ 909.288096][T22866] wiphy_register+0x1dad/0x2ae0 [ 909.293000][T22866] ? cfg80211_event_work+0x40/0x40 [ 909.298132][T22866] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 909.304337][T22866] ieee80211_register_hw+0x3464/0x4250 [ 909.309855][T22866] ? ieee80211_tasklet_handler+0x20/0x20 [ 909.315521][T22866] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 909.321434][T22866] ? __debug_object_init+0xec/0x450 [ 909.326642][T22866] ? __asan_memset+0x22/0x40 [ 909.331231][T22866] ? __hrtimer_init+0x186/0x270 [ 909.336079][T22866] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 909.341813][T22866] ? mac80211_hwsim_free+0x220/0x220 [ 909.347093][T22866] ? rcu_is_watching+0x15/0xb0 [ 909.351854][T22866] ? kstrndup+0xbd/0x140 [ 909.356097][T22866] hwsim_new_radio_nl+0xdc9/0x1a90 [ 909.361217][T22866] ? __nla_validate+0x50/0x50 [ 909.365905][T22866] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 909.372241][T22866] ? __nla_parse+0x40/0x50 [ 909.376659][T22866] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 909.382987][T22866] genl_family_rcv_msg_doit+0x211/0x310 [ 909.388525][T22866] ? end_current_label_crit_section+0x170/0x170 [ 909.394767][T22866] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 909.400658][T22866] ? bpf_lsm_capable+0x9/0x10 [ 909.405334][T22866] ? security_capable+0x89/0xb0 [ 909.410185][T22866] genl_rcv_msg+0x619/0x7a0 [ 909.414705][T22866] ? genl_bind+0x360/0x360 [ 909.419112][T22866] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 909.425449][T22866] ? lockdep_hardirqs_on+0x98/0x150 [ 909.430640][T22866] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 909.436795][T22866] netlink_rcv_skb+0x241/0x4d0 [ 909.441559][T22866] ? genl_bind+0x360/0x360 [ 909.445966][T22866] ? netlink_ack+0x1180/0x1180 [ 909.450732][T22866] ? __lock_acquire+0x7d40/0x7d40 [ 909.455756][T22866] ? down_read+0x1ac/0x2e0 [ 909.460166][T22866] genl_rcv+0x28/0x40 [ 909.464141][T22866] netlink_unicast+0x751/0x8d0 [ 909.468909][T22866] netlink_sendmsg+0x8d0/0xbf0 [ 909.473674][T22866] ? netlink_getsockopt+0x590/0x590 [ 909.478874][T22866] ? aa_sock_msg_perm+0x94/0x150 [ 909.483816][T22866] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 909.489105][T22866] ? security_socket_sendmsg+0x80/0xa0 [ 909.494563][T22866] ? netlink_getsockopt+0x590/0x590 [ 909.499757][T22866] ____sys_sendmsg+0x5ba/0x960 [ 909.504521][T22866] ? __asan_memset+0x22/0x40 [ 909.509106][T22866] ? __sys_sendmsg_sock+0x30/0x30 [ 909.514131][T22866] ? __import_iovec+0x5f2/0x850 [ 909.518989][T22866] ? import_iovec+0x73/0xa0 [ 909.523485][T22866] ___sys_sendmsg+0x2a6/0x360 [ 909.528158][T22866] ? __sys_sendmsg+0x2a0/0x2a0 [ 909.532920][T22866] ? perf_trace_preemptirq_template+0xac/0x330 [ 909.539121][T22866] __se_sys_sendmsg+0x1c2/0x2b0 [ 909.543965][T22866] ? __x64_sys_sendmsg+0x80/0x80 [ 909.548913][T22866] ? lockdep_hardirqs_on+0x98/0x150 [ 909.554107][T22866] do_syscall_64+0x55/0xa0 [ 909.558524][T22866] ? clear_bhb_loop+0x40/0x90 [ 909.563191][T22866] ? clear_bhb_loop+0x40/0x90 [ 909.567862][T22866] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 909.573757][T22866] RIP: 0033:0x7f0f67b9c799 [ 909.578166][T22866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 909.597764][T22866] RSP: 002b:00007f0f68a76028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 909.606171][T22866] RAX: ffffffffffffffda RBX: 00007f0f67e15fa0 RCX: 00007f0f67b9c799 [ 909.614138][T22866] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000009 [ 909.622100][T22866] RBP: 00007f0f67c32c99 R08: 0000000000000000 R09: 0000000000000000 [ 909.630065][T22866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 909.638026][T22866] R13: 00007f0f67e16038 R14: 00007f0f67e15fa0 R15: 00007ffd99399128 [ 909.646006][T22866] [ 909.678885][T14548] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 910.316305][T22894] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4508'. [ 910.966264][T22930] netlink: 'syz.0.4517': attribute type 28 has an invalid length. [ 911.000443][T22930] netlink: 'syz.0.4517': attribute type 29 has an invalid length. [ 911.014328][T22930] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4517'. [ 911.534312][T22956] netlink: 'syz.1.4523': attribute type 21 has an invalid length. [ 911.611332][T22963] netlink: 'syz.0.4525': attribute type 10 has an invalid length. [ 911.630193][T22963] netlink: 2 bytes leftover after parsing attributes in process `syz.0.4525'. [ 911.644251][T22963] hsr0: entered promiscuous mode [ 911.672521][T22966] ip6_vti0: mtu greater than device maximum [ 911.734278][T14548] Bluetooth: hci1: command 0x0406 tx timeout [ 911.932948][T22980] netlink: 16222 bytes leftover after parsing attributes in process `syz.0.4525'. [ 912.048489][T22985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4531'. [ 912.063956][T22985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4531'. [ 912.082141][T22985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4531'. [ 912.121855][T22985] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4531'. [ 912.175053][T22987] netlink: 'syz.2.4530': attribute type 21 has an invalid length. [ 913.150260][T14548] Bluetooth: hci4: unexpected subevent 0x05 length: 150 > 12 [ 914.349941][T23054] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4551'. [ 914.370544][T23054] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4551'. [ 914.997612][T23071] netlink: 'syz.0.4559': attribute type 21 has an invalid length. [ 915.174290][T14548] Bluetooth: hci4: command 0x0406 tx timeout [ 915.287812][T23097] netlink: 'syz.0.4569': attribute type 2 has an invalid length. [ 915.296431][T23097] netlink: 'syz.0.4569': attribute type 8 has an invalid length. [ 915.311579][T23097] netlink: 'syz.0.4569': attribute type 10 has an invalid length. [ 915.395138][T23102] __nla_validate_parse: 7 callbacks suppressed [ 915.395155][T23102] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4571'. [ 915.523605][T23109] netlink: 16410 bytes leftover after parsing attributes in process `syz.2.4573'. [ 915.614169][T23112] netlink: 56537 bytes leftover after parsing attributes in process `syz.3.4574'. [ 916.001587][T23137] can: request_module (can-proto-4) failed. [ 916.148807][T23144] cgroup: fork rejected by pids controller in /syz2 [ 916.503694][T23265] netlink: 'syz.3.4586': attribute type 2 has an invalid length. [ 916.525228][T23265] netlink: 'syz.3.4586': attribute type 1 has an invalid length. [ 916.542165][T23265] netlink: 152 bytes leftover after parsing attributes in process `syz.3.4586'. [ 916.715866][T23274] netlink: 'syz.3.4588': attribute type 1 has an invalid length. [ 916.723658][T23274] netlink: 112860 bytes leftover after parsing attributes in process `syz.3.4588'. [ 917.267739][T22566] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 917.276943][T22566] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 917.285126][T22566] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 917.293636][T22566] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 917.306677][T22566] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 917.314983][T22566] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 917.693174][T23300] smc: adding net device  with user defined pnetid CONFIG [ 917.702427][T23281] chnl_net:caif_netlink_parms(): no params data found [ 917.815996][T23307] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.4598'. [ 917.856607][T23281] bridge0: port 1(bridge_slave_0) entered blocking state [ 917.863869][T23281] bridge0: port 1(bridge_slave_0) entered disabled state [ 917.871440][T23281] bridge_slave_0: entered allmulticast mode [ 917.878980][T23281] bridge_slave_0: entered promiscuous mode [ 917.911593][T23281] bridge0: port 2(bridge_slave_1) entered blocking state [ 917.922973][T23281] bridge0: port 2(bridge_slave_1) entered disabled state [ 917.933864][T23281] bridge_slave_1: entered allmulticast mode [ 917.946048][T23281] bridge_slave_1: entered promiscuous mode [ 918.041143][T23281] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 918.058007][T23281] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 918.113160][T23281] team0: Port device team_slave_0 added [ 918.128709][T23281] team0: Port device team_slave_1 added [ 918.307475][T23281] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 918.314659][T23281] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 918.352821][T23281] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 918.371099][T23316] netlink: 'syz.0.4603': attribute type 10 has an invalid length. [ 918.380576][T23322] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.4604'. [ 918.385488][T23316] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4603'. [ 918.445016][T23281] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 918.452177][T23281] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 918.479099][T23281] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 918.935276][T23281] hsr_slave_0: entered promiscuous mode [ 918.946145][T23281] hsr_slave_1: entered promiscuous mode [ 919.012064][T23334] netlink: 'syz.0.4609': attribute type 10 has an invalid length. [ 919.424319][T22566] Bluetooth: hci1: command tx timeout [ 921.494355][T22566] Bluetooth: hci1: command tx timeout [ 923.074235][T23399] netlink: 'syz.0.4619': attribute type 10 has an invalid length. [ 923.189590][T23399] C: left promiscuous mode [ 923.200333][T23399] C: left allmulticast mode [ 923.217844][T23399] team0 (unregistering): Port device C removed [ 923.242519][T23399] team_slave_1: left promiscuous mode [ 923.260935][T23399] team_slave_1: left allmulticast mode [ 923.282071][T23399] team0 (unregistering): Port device team_slave_1 removed [ 923.294417][T23399] mac80211_hwsim hwsim154 .3ãc¤±: left promiscuous mode [ 923.302681][T23399] mac80211_hwsim hwsim154 .3ãc¤±: left allmulticast mode [ 923.323236][T23399] team0 (unregistering): Port device .3ãc¤± removed [ 923.480637][T23401] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 923.574132][T22566] Bluetooth: hci1: command tx timeout [ 923.786327][T23412] netlink: 'syz.0.4624': attribute type 10 has an invalid length. [ 923.799964][T23412] netlink: 65015 bytes leftover after parsing attributes in process `syz.0.4624'. [ 923.929529][T23281] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 923.950060][T23281] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 923.972727][T23281] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 924.019948][T23281] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 924.415222][T23281] 8021q: adding VLAN 0 to HW filter on device bond0 [ 924.538445][T23281] 8021q: adding VLAN 0 to HW filter on device team0 [ 924.613809][T21356] bridge0: port 1(bridge_slave_0) entered blocking state [ 924.621069][T21356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 924.658166][T23448] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4633'. [ 924.700663][T21356] bridge0: port 2(bridge_slave_1) entered blocking state [ 924.707855][T21356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 925.183120][T23447] netdevsim netdevsim1 ªªªªªª: renamed from netdevsim0 (while UP) [ 925.654709][T22566] Bluetooth: hci1: command tx timeout [ 925.893557][T10230] hsr_slave_0: left promiscuous mode [ 925.902393][T10230] hsr_slave_1: left promiscuous mode [ 925.971877][T10230] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 925.981689][T10230] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 926.018489][T10230] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 926.042643][T10230] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 926.051406][T10230] hsr0: left allmulticast mode [ 926.056595][T10230] bridge0: port 1(hsr0) entered disabled state [ 926.068376][T10230] bridge_slave_1: left allmulticast mode [ 926.077594][T10230] bridge_slave_1: left promiscuous mode [ 926.083417][T10230] bridge0: port 2(bridge_slave_1) entered disabled state [ 926.153522][T23487] netlink: 'syz.3.4642': attribute type 29 has an invalid length. [ 927.521178][T23487] netlink: 'syz.3.4642': attribute type 29 has an invalid length. [ 927.549069][T23491] netlink: 164 bytes leftover after parsing attributes in process `syz.1.4643'. [ 927.708347][T23281] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 927.733525][T23496] tap1: tun_chr_ioctl cmd 1074025680 [ 927.887109][T23281] veth0_vlan: entered promiscuous mode [ 927.940243][T23281] veth1_vlan: entered promiscuous mode [ 928.068194][T23281] veth0_macvtap: entered promiscuous mode [ 928.168258][T23281] veth1_macvtap: entered promiscuous mode [ 928.246552][T23281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 928.259223][T23281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 928.269846][T23281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 928.280352][T23281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 928.291851][T23281] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 928.305155][T23281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 928.316490][T23281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 928.328135][T23281] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 928.339229][T23281] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 928.350805][T23281] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 928.367612][T23281] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.376727][T23281] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.385642][T23281] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.394538][T23281] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.553801][T21359] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 928.588639][T21359] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 928.635045][T23521] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.4652'. [ 928.656517][T23521] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4652'. [ 928.666674][T21359] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 928.684086][T21359] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 928.691843][T23521] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4652'. [ 928.706106][T23521] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4652'. [ 928.738379][T23521] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4652'. [ 928.982290][T23535] netlink: 'syz.0.4655': attribute type 4 has an invalid length. [ 929.014288][T23535] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.4655'. [ 929.115193][T23544] netlink: 188 bytes leftover after parsing attributes in process `syz.2.4658'. [ 929.275627][T23551] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4661'. [ 929.290469][T23553] netlink: 'syz.2.4662': attribute type 12 has an invalid length. [ 929.298735][T23553] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4662'. [ 929.299024][T23551] netlink: get zone limit has 4 unknown bytes [ 929.342004][T23555] netlink: 'syz.3.4663': attribute type 1 has an invalid length. [ 929.364400][T23555] netlink: 161700 bytes leftover after parsing attributes in process `syz.3.4663'. [ 929.480439][T23566] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.4666'. [ 929.512076][T23569] netlink: 'syz.1.4664': attribute type 10 has an invalid length. [ 929.679320][T23569] batman_adv: batadv0: Adding interface: ªªªªªª [ 929.719660][T23569] batman_adv: batadv0: The MTU of interface ªªªªªª is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 929.935284][T23569] batman_adv: batadv0: Not using interface ªªªªªª (retrying later): interface not active [ 930.404215][T21356] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 931.200702][T23587] netlink: 209032 bytes leftover after parsing attributes in process `syz.3.4672'. [ 931.506118][T23599] netlink: 'syz.3.4675': attribute type 39 has an invalid length. [ 931.674659][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.684085][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 934.454378][T23584] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 934.470896][T23605] netlink: 2 bytes leftover after parsing attributes in process `syz.0.4677'. [ 934.485493][T23605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 934.505168][T23605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 934.537229][T23605] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 934.557282][T23605] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 934.584258][T23605] batadv_slave_1: entered promiscuous mode [ 934.811280][T23623] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4678'. [ 934.901570][T23628] netlink: 'syz.0.4682': attribute type 1 has an invalid length. [ 934.916470][T23628] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.4682'. [ 934.928451][T23623] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 934.941871][T23623] bond_slave_0: left promiscuous mode [ 934.978608][T23623] .` (unregistering): (slave 0.&nr): Releasing backup interface [ 935.005835][T23623] .&nr: left promiscuous mode [ 935.027325][T23623] .` (unregistering): Released all slaves [ 935.081697][T23628] netlink: 'syz.0.4682': attribute type 1 has an invalid length. [ 935.101346][T23628] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4682'. [ 935.687696][T23657] netlink: 'syz.0.4696': attribute type 3 has an invalid length. [ 935.696228][T23657] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.4696'. [ 935.785743][T23659] netlink: 13822 bytes leftover after parsing attributes in process `syz.1.4688'. [ 936.170470][T23670] Â: renamed from pim6reg1 [ 936.191473][T23668] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4689'. [ 936.201898][T23668] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 936.215095][T23668] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 936.225357][T23668] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 936.236174][T23668] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 936.247362][T23668] batadv_slave_1: entered promiscuous mode [ 936.253448][T23672] netlink: 'syz.0.4691': attribute type 51 has an invalid length. [ 936.643261][T23690] netlink: 'syz.3.4694': attribute type 3 has an invalid length. [ 936.656985][T23690] netlink: 152 bytes leftover after parsing attributes in process `syz.3.4694'. [ 936.669401][T23690] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 936.727103][T23698] IPv6: NLM_F_CREATE should be specified when creating new route [ 936.740426][T23698] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4695'. [ 936.757812][T23696] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 936.765101][T23696] IPv6: NLM_F_CREATE should be set when creating new route [ 936.772476][T23696] IPv6: NLM_F_CREATE should be set when creating new route [ 936.779757][T23696] IPv6: NLM_F_CREATE should be set when creating new route [ 936.819639][T23693] dvmrp1: tun_chr_ioctl cmd 1074812118 [ 936.944309][T23702] netlink: 'syz.0.4697': attribute type 5 has an invalid length. [ 937.073015][T23707] netlink: 14560 bytes leftover after parsing attributes in process `syz.2.4700'. [ 937.218810][T23713] netlink: 'syz.0.4701': attribute type 4 has an invalid length. [ 937.315543][T23713] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 937.765152][T23724] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 937.802997][T23724] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 937.815539][T23724] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 937.828956][T23724] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 937.839831][T23724] batadv_slave_1: entered promiscuous mode [ 937.883789][T23715] netlink: 'syz.3.4702': attribute type 10 has an invalid length. [ 938.528874][T14548] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 938.538539][T14548] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 938.564593][T14548] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 938.579641][T14548] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 938.594569][T14548] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 938.606579][T14548] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 938.959879][T21359] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.382157][T21359] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.430992][T23756] netlink: 'syz.1.4712': attribute type 10 has an invalid length. [ 939.484220][T23756] __nla_validate_parse: 2 callbacks suppressed [ 939.484239][T23756] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4712'. [ 939.506757][T23756] team0: entered promiscuous mode [ 939.511842][T23756] team_slave_0: entered promiscuous mode [ 939.525205][T23756] team_slave_1: entered promiscuous mode [ 939.531103][T23756] hsr_slave_0: entered promiscuous mode [ 939.558401][T23756] team0: entered allmulticast mode [ 939.629900][T23756] team_slave_1: entered allmulticast mode [ 939.644205][T23756] hsr_slave_0: entered allmulticast mode [ 939.688103][T23756] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 939.820831][T21359] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 940.097339][T21359] netdevsim netdevsim0 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 940.690884][T23775] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 940.697826][T23775] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 940.704164][T22566] Bluetooth: hci3: command tx timeout [ 940.810737][T23736] chnl_net:caif_netlink_parms(): no params data found [ 941.057370][T21359] smc: removing net device  with user defined pnetid CONFIG [ 941.235924][T23794] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 941.261431][T23736] bridge0: port 1(bridge_slave_0) entered blocking state [ 941.280656][T23736] bridge0: port 1(bridge_slave_0) entered disabled state [ 941.298138][T23736] bridge_slave_0: entered allmulticast mode [ 941.311660][T23736] bridge_slave_0: entered promiscuous mode [ 941.361002][T23801] netlink: 'syz.2.4719': attribute type 10 has an invalid length. [ 941.487695][T23736] bridge0: port 2(bridge_slave_1) entered blocking state [ 941.502994][T23736] bridge0: port 2(bridge_slave_1) entered disabled state [ 941.517471][T23736] bridge_slave_1: entered allmulticast mode [ 941.525156][T23736] bridge_slave_1: entered promiscuous mode [ 941.629813][T23812] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4722'. [ 941.659337][T23812] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 941.681534][T23736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 941.696424][T23812] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 941.737920][T23736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 941.752229][T23820] netlink: 188 bytes leftover after parsing attributes in process `syz.2.4723'. [ 941.850415][T23736] team0: Port device team_slave_0 added [ 941.887264][T23736] team0: Port device team_slave_1 added [ 941.970774][T23736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 941.979011][T23736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 942.016699][T23736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 942.084413][T23736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 942.091617][T23736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 942.118188][T23736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 942.416566][T23736] hsr_slave_0: entered promiscuous mode [ 942.449963][T23736] hsr_slave_1: entered promiscuous mode [ 942.517755][T23736] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 942.544063][T23736] Cannot create hsr debugfs directory [ 942.690131][T23840] netlink: 668 bytes leftover after parsing attributes in process `syz.3.4726'. [ 942.744114][T23840] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 942.752431][T23840] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 942.774105][T22566] Bluetooth: hci3: command tx timeout [ 942.778566][T23848] netlink: 'syz.1.4728': attribute type 1 has an invalid length. [ 942.807700][T23848] netlink: 112865 bytes leftover after parsing attributes in process `syz.1.4728'. [ 943.283426][T23865] netlink: 7986 bytes leftover after parsing attributes in process `syz.2.4732'. [ 943.362109][T21359] hsr_slave_0: left promiscuous mode [ 943.372825][T21359] hsr_slave_1: left promiscuous mode [ 943.395744][T21359] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 943.410581][T21359] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 943.434956][T21359] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 943.442879][T21359] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 944.861453][T22566] Bluetooth: hci3: command tx timeout [ 946.946447][T22566] Bluetooth: hci3: command tx timeout [ 947.507395][T23878] netlink: 14568 bytes leftover after parsing attributes in process `syz.1.4735'. [ 948.245153][T23905] syzkaller0: entered allmulticast mode [ 948.323738][T23909] netlink: 'syz.3.4743': attribute type 3 has an invalid length. [ 948.332250][T23909] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4743'. [ 948.581570][T23907] syzkaller0: entered promiscuous mode [ 948.588140][T23907] syzkaller0: entered allmulticast mode [ 950.582423][T23736] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 950.610807][T23736] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 950.647093][T23736] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 950.670897][T23736] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 950.920327][T22566] Bluetooth: hci2: unexpected subevent 0x0a length: 150 > 30 [ 951.238645][T23959] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.4755'. [ 951.453049][T23736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 951.598472][T23736] 8021q: adding VLAN 0 to HW filter on device team0 [ 951.767017][T21356] bridge0: port 1(bridge_slave_0) entered blocking state [ 951.774160][T21356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 951.867993][T21360] bridge0: port 2(bridge_slave_1) entered blocking state [ 951.875198][T21360] bridge0: port 2(bridge_slave_1) entered forwarding state [ 952.835988][T24000] netlink: 'syz.1.4762': attribute type 4 has an invalid length. [ 952.890193][T23736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 953.009906][T24000] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.4762'. [ 953.014368][T23736] veth0_vlan: entered promiscuous mode [ 953.055675][T23736] veth1_vlan: entered promiscuous mode [ 953.526681][T23736] veth0_macvtap: entered promiscuous mode [ 953.610280][T23736] veth1_macvtap: entered promiscuous mode [ 953.724380][T24012] netlink: 'syz.2.4764': attribute type 2 has an invalid length. [ 953.754317][T24012] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4764'. [ 953.768332][T23736] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 953.809683][T23736] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 953.844145][T23736] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 953.874122][T23736] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 953.907907][T23736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 953.965059][T23736] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 954.016255][T23736] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 954.042196][T23736] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 954.065144][T23736] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 954.098698][T23736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 954.143872][T23736] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 954.187335][T23736] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 954.212379][T23736] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 954.234095][T23736] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 955.044688][T24052] netlink: 'syz.1.4770': attribute type 8 has an invalid length. [ 955.052914][T24052] netlink: 161700 bytes leftover after parsing attributes in process `syz.1.4770'. [ 955.639093][T24041] delete_channel: no stack [ 955.643765][T24041] delete_channel: no stack [ 955.716757][T21357] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 955.737610][T21357] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 955.792148][T10219] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 955.804764][T10219] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 955.814912][T24057] netlink: 'syz.3.4771': attribute type 29 has an invalid length. [ 955.844091][T24057] netlink: 'syz.3.4771': attribute type 29 has an invalid length. [ 955.858036][T24054] netlink: 'syz.3.4771': attribute type 29 has an invalid length. [ 956.035542][T24070] netlink: 'syz.3.4774': attribute type 16 has an invalid length. [ 956.084260][T24070] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4774'. [ 956.641164][T24083] netlink: 'syz.2.4779': attribute type 10 has an invalid length. [ 956.722005][T24083] netlink: 55 bytes leftover after parsing attributes in process `syz.2.4779'. [ 957.159765][T24086] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4781'. [ 957.181935][T24087] netlink: 'syz.1.4781': attribute type 11 has an invalid length. [ 957.194422][T24087] netlink: 168 bytes leftover after parsing attributes in process `syz.1.4781'. [ 957.233224][T24086] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4781'. [ 957.272704][T24087] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4781'. [ 958.413113][T24145] netlink: 'syz.2.4796': attribute type 64 has an invalid length. [ 958.427077][T24145] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4796'. [ 958.580806][T24159] netlink: 'syz.2.4801': attribute type 21 has an invalid length. [ 958.935524][T24179] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4808'. [ 959.791640][T24215] netlink: 192504 bytes leftover after parsing attributes in process `syz.1.4817'. [ 959.844088][T24215] openvswitch: netlink: Flow key attribute not present in set flow. [ 959.889114][T24216] can: request_module (can-proto-0) failed. [ 960.062075][T24224] tc_dump_action: action bad kind [ 960.919302][T24238] netlink: 'syz.3.4824': attribute type 29 has an invalid length. [ 960.939339][T24238] netlink: 'syz.3.4824': attribute type 29 has an invalid length. [ 960.960979][T24239] netlink: 'syz.3.4824': attribute type 29 has an invalid length. [ 961.013183][T24250] netlink: 'syz.0.4827': attribute type 1 has an invalid length. [ 961.031917][T24250] netlink: 191376 bytes leftover after parsing attributes in process `syz.0.4827'. [ 961.905287][T22566] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 961.932226][T22566] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 961.940226][T22566] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 961.949223][T22566] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 961.958030][T22566] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 961.969999][T22566] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 962.216345][T24278] netlink: 'syz.0.4838': attribute type 1 has an invalid length. [ 962.230415][T24278] netlink: 157116 bytes leftover after parsing attributes in process `syz.0.4838'. [ 962.356127][T21359] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 962.382136][T21360] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 962.549531][T24279] netlink: 'syz.0.4838': attribute type 16 has an invalid length. [ 962.568734][T24279] netlink: 156 bytes leftover after parsing attributes in process `syz.0.4838'. [ 962.857566][T21359] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 962.913192][T24290] netlink: 'syz.0.4840': attribute type 2 has an invalid length. [ 962.939081][T24290] netlink: 184 bytes leftover after parsing attributes in process `syz.0.4840'. [ 962.958506][T24290] netlink: 201392 bytes leftover after parsing attributes in process `syz.0.4840'. [ 963.030499][T21359] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 963.088348][T24290] netlink: 8446 bytes leftover after parsing attributes in process `syz.0.4840'. [ 963.137943][T24290] netlink: 204416 bytes leftover after parsing attributes in process `syz.0.4840'. [ 963.162212][T21359] batman_adv: batadv0: Removing interface: ªªªªªª [ 963.197396][T21359] netdevsim netdevsim1 ªªªªªª (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 963.694353][T24271] chnl_net:caif_netlink_parms(): no params data found [ 964.006242][T24310] netlink: 'syz.3.4844': attribute type 10 has an invalid length. [ 964.014662][T24310] __nla_validate_parse: 1 callbacks suppressed [ 964.014703][T24310] netlink: 3819 bytes leftover after parsing attributes in process `syz.3.4844'. [ 964.054313][T14548] Bluetooth: hci0: command tx timeout [ 964.892661][T24271] bridge0: port 1(bridge_slave_0) entered blocking state [ 965.022881][T24271] bridge0: port 1(bridge_slave_0) entered disabled state [ 965.057689][T24271] bridge_slave_0: entered allmulticast mode [ 965.092933][T24271] bridge_slave_0: entered promiscuous mode [ 965.130827][T24271] bridge0: port 2(bridge_slave_1) entered blocking state [ 965.155681][T24271] bridge0: port 2(bridge_slave_1) entered disabled state [ 965.174074][T24271] bridge_slave_1: entered allmulticast mode [ 965.196052][T24271] bridge_slave_1: entered promiscuous mode [ 966.022411][T24271] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 966.135344][T14548] Bluetooth: hci0: command tx timeout [ 966.332801][T24271] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 966.432523][T24350] bridge_slave_1: left allmulticast mode [ 966.450870][T24350] bridge_slave_1: left promiscuous mode [ 966.491261][T24350] bridge0: port 2(bridge_slave_1) entered disabled state [ 966.580526][T24350] bridge_slave_0: left allmulticast mode [ 966.639835][T24350] bridge_slave_0: left promiscuous mode [ 966.680938][T24350] bridge0: port 1(bridge_slave_0) entered disabled state [ 966.942507][T24356] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4849'. [ 967.011064][T24271] team0: Port device team_slave_0 added [ 967.125542][T24271] team0: Port device team_slave_1 added [ 967.248613][T24271] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 967.260980][T24271] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 967.291364][T24271] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 967.376445][T24271] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 967.399736][T24271] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 967.460629][T24271] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 967.691147][T24271] hsr_slave_0: entered promiscuous mode [ 967.712679][T24271] hsr_slave_1: entered promiscuous mode [ 967.730975][T24271] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 967.749105][T24271] Cannot create hsr debugfs directory [ 968.025643][T24397] netlink: 'syz.2.4861': attribute type 1 has an invalid length. [ 968.036166][T24397] netlink: 191376 bytes leftover after parsing attributes in process `syz.2.4861'. [ 968.046018][T24398] netlink: 151496 bytes leftover after parsing attributes in process `syz.2.4861'. [ 968.163387][T24401] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4862'. [ 968.214179][T14548] Bluetooth: hci0: command tx timeout [ 968.855766][T24427] netlink: 24643 bytes leftover after parsing attributes in process `syz.3.4868'. [ 968.935134][T24427] netlink: 7994 bytes leftover after parsing attributes in process `syz.3.4868'. [ 969.123465][T24429] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4869'. [ 969.283044][T21359] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 969.290604][T21359] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 969.322659][T21359] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 969.339624][T21359] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 969.370954][T21359] veth1_macvtap: left promiscuous mode [ 969.387208][T21359] veth0_macvtap: left promiscuous mode [ 969.595549][T24452] netlink: set zone limit has 8 unknown bytes [ 969.644553][T24452] sctp: [Deprecated]: syz.0.4872 (pid 24452) Use of int in maxseg socket option. [ 969.644553][T24452] Use struct sctp_assoc_value instead [ 970.222040][T21359] hsr_slave_0 (unregistering): left promiscuous mode [ 970.238772][T21359] hsr_slave_0 (unregistering): left allmulticast mode [ 970.267818][T21359] team0 (unregistering): Port device hsr_slave_0 removed [ 970.294902][T14548] Bluetooth: hci0: command tx timeout [ 970.619547][T24455] netlink: 'syz.2.4873': attribute type 11 has an invalid length. [ 970.634341][T24455] netlink: 184116 bytes leftover after parsing attributes in process `syz.2.4873'. [ 970.691062][T21359] team_slave_1 (unregistering): left promiscuous mode [ 970.705340][T21359] team_slave_1 (unregistering): left allmulticast mode [ 970.722820][T21359] team0 (unregistering): Port device team_slave_1 removed [ 970.808159][T21359] team_slave_0 (unregistering): left promiscuous mode [ 970.823121][T21359] team0 (unregistering): Port device team_slave_0 removed [ 971.501305][T24442] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4870'. [ 971.696444][T24456] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4873'. [ 971.726571][T24456] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4873'. [ 971.740741][T24456] netlink: 33 bytes leftover after parsing attributes in process `syz.2.4873'. [ 971.760803][T24456] bridge_slave_0: entered allmulticast mode [ 971.771314][T24456] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4873'. [ 971.781336][T24456] netlink: 33 bytes leftover after parsing attributes in process `syz.2.4873'. [ 972.068799][T24271] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 972.108274][T24271] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 972.170381][T24271] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 972.294267][T24271] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 972.530512][T24271] 8021q: adding VLAN 0 to HW filter on device bond0 [ 972.620792][T24271] 8021q: adding VLAN 0 to HW filter on device team0 [ 972.665546][T10227] bridge0: port 1(bridge_slave_0) entered blocking state [ 972.672748][T10227] bridge0: port 1(bridge_slave_0) entered forwarding state [ 972.703860][T21361] bridge0: port 2(bridge_slave_1) entered blocking state [ 972.711068][T21361] bridge0: port 2(bridge_slave_1) entered forwarding state [ 973.766454][T24271] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 973.921688][T24271] veth0_vlan: entered promiscuous mode [ 973.978389][T24271] veth1_vlan: entered promiscuous mode [ 974.047583][T24271] veth0_macvtap: entered promiscuous mode [ 974.089791][T24271] veth1_macvtap: entered promiscuous mode [ 974.128430][T24271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 974.151934][T24271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 974.189539][T24271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 974.210351][T24271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 974.263235][T24271] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 974.308392][T24271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 974.335577][T24271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 974.352578][T24271] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 974.377772][T24271] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 974.405889][T24271] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 974.414907][T24566] netlink: 'syz.2.4893': attribute type 11 has an invalid length. [ 974.437197][T24566] netlink: 140 bytes leftover after parsing attributes in process `syz.2.4893'. [ 974.489991][T24271] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 974.503642][T24271] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 974.533632][T24271] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 974.554415][T24271] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 974.611942][T24574] netlink: 'syz.0.4895': attribute type 10 has an invalid length. [ 974.714750][T24574] team0: Port device geneve1 added [ 974.988281][T21357] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 975.029617][T21357] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 975.071686][T21361] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 975.086431][T21361] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 975.702142][T24604] netlink: 'syz.2.4901': attribute type 6 has an invalid length. [ 975.727481][T24604] netlink: 168 bytes leftover after parsing attributes in process `syz.2.4901'. [ 975.743711][T24600] netlink: 'syz.3.4900': attribute type 3 has an invalid length. [ 975.776872][T24600] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.4900'. [ 976.220636][T24611] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4903'. [ 976.271907][T14548] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 976.742194][T24633] veth1_macvtap: entered allmulticast mode [ 976.901360][T24633] netlink: 'syz.2.4908': attribute type 10 has an invalid length. [ 977.780244][T24633] team0: Device vxcan1 is of different type [ 977.949781][T24660] netlink: 'syz.1.4911': attribute type 21 has an invalid length. [ 978.038430][T24673] netlink: 'syz.2.4913': attribute type 21 has an invalid length. [ 978.055706][T24673] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4913'. [ 978.278798][T24685] netlink: 'syz.1.4919': attribute type 10 has an invalid length. [ 978.296777][T14548] Bluetooth: hci1: command tx timeout [ 978.479403][T24685] team0: Device wg1 is of different type [ 978.555596][T24687] netlink: 'syz.1.4919': attribute type 9 has an invalid length. [ 978.611811][T24687] netlink: 61951 bytes leftover after parsing attributes in process `syz.1.4919'. [ 978.991970][T24695] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 979.357634][T24697] -: renamed from syzkaller0 [ 979.896861][T24712] netlink: 'syz.0.4925': attribute type 21 has an invalid length. [ 979.984668][T24714] netlink: 'syz.2.4927': attribute type 21 has an invalid length. [ 979.993916][T24714] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4927'. [ 980.570226][T24739] netlink: 'syz.3.4935': attribute type 29 has an invalid length. [ 980.579096][T24739] netlink: 'syz.3.4935': attribute type 29 has an invalid length. [ 980.590990][T24738] netlink: 'syz.3.4935': attribute type 29 has an invalid length. [ 980.595487][T24745] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4936'. [ 980.609320][T24745] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4936'. [ 980.618811][T24744] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4936'. [ 980.632850][T24746] netlink: 209840 bytes leftover after parsing attributes in process `syz.2.4937'. [ 980.647158][T24744] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4936'. [ 980.787873][T24756] netlink: 'syz.0.4940': attribute type 2 has an invalid length. [ 980.806021][T24756] netlink: 17267 bytes leftover after parsing attributes in process `syz.0.4940'. [ 980.923079][T24760] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4941'. [ 981.337968][T24771] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.4945'. [ 981.368108][T24774] netlink: 199816 bytes leftover after parsing attributes in process `syz.3.4946'. [ 981.733030][T24779] can: request_module (can-proto-0) failed. [ 982.761280][T24792] mac80211_hwsim hwsim195 »»»»»»: renamed from wlan0 [ 983.119173][T24804] bridge_slave_1: left allmulticast mode [ 983.125470][T24804] bridge_slave_1: left promiscuous mode [ 983.132722][T24804] bridge0: port 2(bridge_slave_1) entered disabled state [ 983.202462][T24804] bridge_slave_0: left allmulticast mode [ 983.245933][T24804] bridge_slave_0: left promiscuous mode [ 983.270831][T24804] bridge0: port 1(bridge_slave_0) entered disabled state [ 983.425298][T14548] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 984.025779][T24807] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 984.065240][T24807] CPU: 1 PID: 24807 Comm: syz.3.4956 Not tainted syzkaller #0 [ 984.072760][T24807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 984.082845][T24807] Call Trace: [ 984.086154][T24807] [ 984.089115][T24807] dump_stack_lvl+0x18c/0x250 [ 984.093836][T24807] ? show_regs_print_info+0x20/0x20 [ 984.099070][T24807] ? load_image+0x400/0x400 [ 984.103612][T24807] sysfs_warn_dup+0x8e/0xa0 [ 984.108134][T24807] sysfs_do_create_link_sd+0xc0/0x110 [ 984.113535][T24807] device_add_class_symlinks+0x1cf/0x240 [ 984.119201][T24807] device_add+0x507/0xc20 [ 984.123554][T24807] wiphy_register+0x1dad/0x2ae0 [ 984.128442][T24807] ? cfg80211_event_work+0x40/0x40 [ 984.133658][T24807] ? minstrel_ht_alloc+0x88a/0x990 [ 984.138808][T24807] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 984.144906][T24807] ieee80211_register_hw+0x3464/0x4250 [ 984.150412][T24807] ? ieee80211_tasklet_handler+0x20/0x20 [ 984.156071][T24807] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 984.161989][T24807] ? __debug_object_init+0xec/0x450 [ 984.167212][T24807] ? __asan_memset+0x22/0x40 [ 984.171818][T24807] ? __hrtimer_init+0x186/0x270 [ 984.176681][T24807] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 984.182460][T24807] ? mac80211_hwsim_free+0x220/0x220 [ 984.187779][T24807] ? rcu_is_watching+0x15/0xb0 [ 984.192579][T24807] ? kstrndup+0xbd/0x140 [ 984.196860][T24807] hwsim_new_radio_nl+0xdc9/0x1a90 [ 984.201993][T24807] ? __nla_validate+0x50/0x50 [ 984.206669][T24807] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 984.212999][T24807] ? __nla_parse+0x40/0x50 [ 984.217407][T24807] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 984.223721][T24807] genl_family_rcv_msg_doit+0x211/0x310 [ 984.229266][T24807] ? end_current_label_crit_section+0x170/0x170 [ 984.235538][T24807] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 984.241462][T24807] ? bpf_lsm_capable+0x9/0x10 [ 984.246165][T24807] ? security_capable+0x89/0xb0 [ 984.251031][T24807] genl_rcv_msg+0x619/0x7a0 [ 984.255560][T24807] ? genl_bind+0x360/0x360 [ 984.260000][T24807] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 984.266004][T24807] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 984.272365][T24807] ? ref_tracker_free+0x690/0x840 [ 984.277429][T24807] netlink_rcv_skb+0x241/0x4d0 [ 984.282222][T24807] ? genl_bind+0x360/0x360 [ 984.286664][T24807] ? netlink_ack+0x1180/0x1180 [ 984.291462][T24807] ? __lock_acquire+0x7d40/0x7d40 [ 984.296515][T24807] ? down_read+0x1ac/0x2e0 [ 984.300950][T24807] genl_rcv+0x28/0x40 [ 984.304951][T24807] netlink_unicast+0x751/0x8d0 [ 984.309763][T24807] netlink_sendmsg+0x8d0/0xbf0 [ 984.314554][T24807] ? lockdep_hardirqs_on+0x98/0x150 [ 984.319782][T24807] ? netlink_getsockopt+0x590/0x590 [ 984.325013][T24807] ? aa_sock_msg_perm+0x94/0x150 [ 984.329975][T24807] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 984.335285][T24807] ? security_socket_sendmsg+0x80/0xa0 [ 984.340762][T24807] ? netlink_getsockopt+0x590/0x590 [ 984.345982][T24807] ____sys_sendmsg+0x5ba/0x960 [ 984.350767][T24807] ? __asan_memset+0x22/0x40 [ 984.355377][T24807] ? __sys_sendmsg_sock+0x30/0x30 [ 984.360414][T24807] ? __import_iovec+0x5f2/0x850 [ 984.365300][T24807] ? import_iovec+0x73/0xa0 [ 984.369824][T24807] ___sys_sendmsg+0x2a6/0x360 [ 984.374525][T24807] ? __sys_sendmsg+0x2a0/0x2a0 [ 984.379369][T24807] __se_sys_sendmsg+0x1c2/0x2b0 [ 984.384243][T24807] ? __x64_sys_sendmsg+0x80/0x80 [ 984.389214][T24807] ? syscall_enter_from_user_mode+0x2e/0x80 [ 984.395128][T24807] do_syscall_64+0x55/0xa0 [ 984.399573][T24807] ? clear_bhb_loop+0x40/0x90 [ 984.404302][T24807] ? clear_bhb_loop+0x40/0x90 [ 984.409006][T24807] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 984.414921][T24807] RIP: 0033:0x7f68d099c799 [ 984.419353][T24807] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 984.438993][T24807] RSP: 002b:00007f68d1860028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 984.447438][T24807] RAX: ffffffffffffffda RBX: 00007f68d0c15fa0 RCX: 00007f68d099c799 [ 984.455435][T24807] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000e [ 984.463426][T24807] RBP: 00007f68d0a32c99 R08: 0000000000000000 R09: 0000000000000000 [ 984.471419][T24807] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 984.479582][T24807] R13: 00007f68d0c16038 R14: 00007f68d0c15fa0 R15: 00007ffc1908a828 [ 984.487596][T24807] [ 984.564949][T24802] netlink: 'syz.1.4949': attribute type 4 has an invalid length. [ 984.676882][T24802] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 984.956336][T24814] netlink: 'syz.1.4949': attribute type 10 has an invalid length. [ 985.494574][T14548] Bluetooth: hci2: command 0x0406 tx timeout [ 987.159044][T24814] hsr_slave_0: left promiscuous mode [ 987.200074][T24814] hsr_slave_1: left promiscuous mode [ 987.582537][T21360] tipc: Subscription rejected, illegal request [ 989.608019][T24843] __nla_validate_parse: 2 callbacks suppressed [ 989.608038][T24843] netlink: 168 bytes leftover after parsing attributes in process `syz.3.4963'. [ 989.769060][T24848] mac80211_hwsim hwsim163 wlan1: left promiscuous mode [ 989.885819][T24855] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4968'. [ 989.905738][T24855] netlink: 9275 bytes leftover after parsing attributes in process `syz.1.4968'. [ 989.996251][T24857] netlink: 'syz.3.4969': attribute type 22 has an invalid length. [ 990.235247][T24870] netlink: 167096 bytes leftover after parsing attributes in process `syz.3.4975'. [ 990.409231][T24877] netlink: 'syz.2.4977': attribute type 17 has an invalid length. [ 990.417947][T24877] netlink: 'syz.2.4977': attribute type 16 has an invalid length. [ 990.426540][T24877] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4977'. [ 991.237012][T24886] netlink: 'syz.1.4979': attribute type 10 has an invalid length. [ 991.254806][T24886] netlink: 65015 bytes leftover after parsing attributes in process `syz.1.4979'. [ 991.297517][T24888] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 991.475783][T24893] netlink: 'syz.1.4983': attribute type 13 has an invalid length. [ 991.486939][T24893] netlink: 'syz.1.4983': attribute type 58 has an invalid length. [ 991.495177][T24893] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4983'. [ 991.887822][T24920] netlink: 209820 bytes leftover after parsing attributes in process `syz.3.4990'. [ 991.929673][T24910] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4988'. [ 992.140613][T24918] netlink: 'syz.0.4988': attribute type 10 has an invalid length. [ 993.248735][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.264113][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 995.627328][T24945] netlink: 703 bytes leftover after parsing attributes in process `syz.3.4995'. [ 995.650177][T24945] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4995'. [ 995.791896][T24947] netlink: 'syz.0.4997': attribute type 2 has an invalid length. [ 995.800732][T24947] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4997'. [ 996.563313][T24971] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.5005'. [ 997.098904][T24985] syzkaller0: entered allmulticast mode [ 997.347155][T25000] netlink: 'syz.1.5014': attribute type 39 has an invalid length. [ 997.669911][T24999] netlink: 'syz.0.5015': attribute type 39 has an invalid length. [ 998.065580][T25010] netlink: 763 bytes leftover after parsing attributes in process `syz.2.5017'. [ 999.016944][T25046] netlink: 'syz.1.5028': attribute type 27 has an invalid length. [ 999.034143][T25046] netlink: 2418 bytes leftover after parsing attributes in process `syz.1.5028'. [ 999.085038][T25041] netlink: 192436 bytes leftover after parsing attributes in process `syz.2.5027'. [ 999.104388][T25041] openvswitch: netlink: Message has 20476 unknown bytes. [ 1000.206661][T25063] netlink: 209820 bytes leftover after parsing attributes in process `syz.2.5033'. [ 1000.807412][T25081] netlink: 'syz.1.5039': attribute type 10 has an invalid length. [ 1000.822305][T22566] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1000.834366][T25081] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5039'. [ 1000.854807][T22566] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1000.863529][T22566] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1000.867082][T25081] batman_adv: batadv0: Adding interface: virt_wifi0 [ 1000.883056][T22566] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1000.892161][T22566] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1000.899685][T22566] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1000.900067][T25081] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1000.944863][T25081] batman_adv: batadv0: Interface activated: virt_wifi0 [ 1001.797839][T25085] chnl_net:caif_netlink_parms(): no params data found [ 1002.331699][T25123] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.5049'. [ 1002.375049][T25124] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.5049'. [ 1002.563619][T25128] netlink: 'syz.2.5050': attribute type 21 has an invalid length. [ 1002.664246][T25123] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.5049'. [ 1002.929961][T25139] syzkaller0: entered allmulticast mode [ 1003.009872][T25085] bridge0: port 1(bridge_slave_0) entered blocking state [ 1003.014860][T22566] Bluetooth: hci2: command tx timeout [ 1003.032111][T25085] bridge0: port 1(bridge_slave_0) entered disabled state [ 1003.058470][T25085] bridge_slave_0: entered allmulticast mode [ 1003.066459][T25085] bridge_slave_0: entered promiscuous mode [ 1003.174397][T25085] bridge0: port 2(bridge_slave_1) entered blocking state [ 1003.181660][T25085] bridge0: port 2(bridge_slave_1) entered disabled state [ 1003.211240][T25085] bridge_slave_1: entered allmulticast mode [ 1003.228321][T25085] bridge_slave_1: entered promiscuous mode [ 1003.400627][T25085] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1003.433812][T25085] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1003.646340][T25085] team0: Port device team_slave_0 added [ 1003.669726][T25085] team0: Port device team_slave_1 added [ 1003.840453][T25085] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1003.848840][T25085] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1003.877622][T25085] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1003.897160][T25085] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1003.904435][T25085] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1003.934435][T25085] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1004.145779][T25085] hsr_slave_0: entered promiscuous mode [ 1004.183818][T25085] hsr_slave_1: entered promiscuous mode [ 1004.234291][T25085] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1004.241923][T25085] Cannot create hsr debugfs directory [ 1004.327208][T25181] netlink: 'syz.1.5063': attribute type 10 has an invalid length. [ 1005.061817][T25181] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1005.094608][T22566] Bluetooth: hci2: command tx timeout [ 1005.777951][T25188] netlink: 'syz.2.5065': attribute type 6 has an invalid length. [ 1006.084989][T25196] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5065'. [ 1006.166691][T25203] netlink: 'syz.0.5064': attribute type 3 has an invalid length. [ 1006.204294][T25203] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5064'. [ 1006.717123][T25215] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.5069'. [ 1007.176427][T22566] Bluetooth: hci2: command tx timeout [ 1007.426478][T10227] veth0_to_team: left allmulticast mode [ 1007.432095][T10227] veth0_to_team: left promiscuous mode [ 1007.447851][T10227] Ÿë: port 1(veth0_to_team) entered disabled state [ 1007.487345][T10227] bond0: left allmulticast mode [ 1007.492263][T10227] bond_slave_0: left allmulticast mode [ 1007.508259][T10227] bond_slave_1: left allmulticast mode [ 1007.514079][T10227] bridge0: port 3(bond0) entered disabled state [ 1007.531309][T10227] bridge_slave_1: left allmulticast mode [ 1007.542085][T10227] bridge_slave_1: left promiscuous mode [ 1007.548821][T10227] bridge0: port 2(bridge_slave_1) entered disabled state [ 1007.558371][T10227] bridge_slave_0: left allmulticast mode [ 1007.574937][T10227] bridge_slave_0: left promiscuous mode [ 1007.584986][T10227] bridge0: port 1(bridge_slave_0) entered disabled state [ 1007.627560][T10227] veth1_vlan: left promiscuous mode [ 1008.303606][T10227] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1008.312956][T10227] bond_slave_1 (unregistering): left promiscuous mode [ 1008.356858][T10227] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1008.366374][T10227] bond_slave_0 (unregistering): left promiscuous mode [ 1008.639607][T10227] bond0 (unregistering): Released all slaves [ 1008.833439][T25252] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1009.183257][T25085] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1009.254084][T22566] Bluetooth: hci2: command tx timeout [ 1009.300856][T25085] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1009.383775][T25085] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1009.696939][T25085] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1010.513732][T25285] C: renamed from team_slave_0 (while UP) [ 1010.523958][T25285] netlink: 'syz.0.5085': attribute type 1 has an invalid length. [ 1010.532434][T25285] netlink: 152 bytes leftover after parsing attributes in process `syz.0.5085'. [ 1010.735655][T25085] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1010.789733][T25085] 8021q: adding VLAN 0 to HW filter on device team0 [ 1010.821092][T10219] bridge0: port 1(bridge_slave_0) entered blocking state [ 1010.828330][T10219] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1010.878318][T21360] bridge0: port 2(bridge_slave_1) entered blocking state [ 1010.885502][T21360] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1011.375695][T25085] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1011.469747][T25085] veth0_vlan: entered promiscuous mode [ 1011.501876][T25085] veth1_vlan: entered promiscuous mode [ 1011.568687][T25085] veth0_macvtap: entered promiscuous mode [ 1011.593102][T25085] veth1_macvtap: entered promiscuous mode [ 1011.791192][T25085] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1011.802016][T25085] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1011.812639][T25085] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1011.833729][T25085] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1011.853139][T25085] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1011.870083][T25085] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1011.888782][T25085] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1011.902218][T25085] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1011.913629][T25085] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1011.931971][T25085] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1011.943224][T25085] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1011.963649][T25085] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1011.984282][T25085] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1012.016882][T25085] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1012.049497][T25085] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.063589][T25085] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.081288][T25085] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.092149][T25085] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.229963][T25354] netlink: 'syz.2.5096': attribute type 12 has an invalid length. [ 1012.264188][T25354] netlink: 'syz.2.5096': attribute type 11 has an invalid length. [ 1012.272313][T25354] netlink: 188816 bytes leftover after parsing attributes in process `syz.2.5096'. [ 1012.391752][T21360] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1012.435726][T21360] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1012.547234][T10227] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1012.573410][T10227] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1012.634456][T25360] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5098'. [ 1012.862321][T25378] netlink: 'syz.0.5101': attribute type 21 has an invalid length. [ 1012.871211][T25378] netlink: 'syz.0.5101': attribute type 1 has an invalid length. [ 1012.927203][T25378] netlink: 'syz.0.5101': attribute type 4 has an invalid length. [ 1012.964418][T25378] netlink: 152 bytes leftover after parsing attributes in process `syz.0.5101'. [ 1013.019111][T25378] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 1013.898349][T25408] netlink: 'syz.3.5106': attribute type 10 has an invalid length. [ 1014.384752][T25422] pim6reg1: entered promiscuous mode [ 1014.398445][T25422] pim6reg1: entered allmulticast mode [ 1014.672160][T25437] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.5114'. [ 1014.711496][T25437] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1014.744494][T25437] CPU: 0 PID: 25437 Comm: syz.2.5114 Not tainted syzkaller #0 [ 1014.752010][T25437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1014.762078][T25437] Call Trace: [ 1014.765366][T25437] [ 1014.768320][T25437] dump_stack_lvl+0x18c/0x250 [ 1014.773020][T25437] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1014.779196][T25437] ? show_regs_print_info+0x20/0x20 [ 1014.784416][T25437] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1014.790606][T25437] sysfs_warn_dup+0x8e/0xa0 [ 1014.795126][T25437] sysfs_do_create_link_sd+0xc0/0x110 [ 1014.800518][T25437] device_add_class_symlinks+0x1cf/0x240 [ 1014.806175][T25437] device_add+0x507/0xc20 [ 1014.810532][T25437] wiphy_register+0x1dad/0x2ae0 [ 1014.815424][T25437] ? cfg80211_event_work+0x40/0x40 [ 1014.820544][T25437] ? minstrel_ht_alloc+0x88a/0x990 [ 1014.825681][T25437] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1014.831778][T25437] ieee80211_register_hw+0x3464/0x4250 [ 1014.837461][T25437] ? ieee80211_tasklet_handler+0x20/0x20 [ 1014.843110][T25437] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1014.849023][T25437] ? __debug_object_init+0xec/0x450 [ 1014.854251][T25437] ? __asan_memset+0x22/0x40 [ 1014.858863][T25437] ? __hrtimer_init+0x186/0x270 [ 1014.863722][T25437] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1014.869450][T25437] ? lock_chain_count+0x20/0x20 [ 1014.874317][T25437] ? mac80211_hwsim_free+0x220/0x220 [ 1014.879604][T25437] ? kstrndup+0xbd/0x140 [ 1014.883850][T25437] ? memcpy_orig+0x97/0x120 [ 1014.888356][T25437] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1014.893472][T25437] ? __nla_validate+0x50/0x50 [ 1014.898158][T25437] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1014.904505][T25437] ? __nla_parse+0x40/0x50 [ 1014.908916][T25437] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1014.915242][T25437] genl_family_rcv_msg_doit+0x211/0x310 [ 1014.920796][T25437] ? end_current_label_crit_section+0x170/0x170 [ 1014.927035][T25437] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1014.932929][T25437] ? bpf_lsm_capable+0x9/0x10 [ 1014.937604][T25437] ? security_capable+0x89/0xb0 [ 1014.942454][T25437] genl_rcv_msg+0x619/0x7a0 [ 1014.946954][T25437] ? genl_bind+0x360/0x360 [ 1014.951360][T25437] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1014.957704][T25437] netlink_rcv_skb+0x241/0x4d0 [ 1014.962468][T25437] ? genl_bind+0x360/0x360 [ 1014.966880][T25437] ? netlink_ack+0x1180/0x1180 [ 1014.971659][T25437] ? __lock_acquire+0x7d40/0x7d40 [ 1014.976682][T25437] ? down_read+0x1ac/0x2e0 [ 1014.981093][T25437] genl_rcv+0x28/0x40 [ 1014.985065][T25437] netlink_unicast+0x751/0x8d0 [ 1014.989832][T25437] netlink_sendmsg+0x8d0/0xbf0 [ 1014.994603][T25437] ? netlink_getsockopt+0x590/0x590 [ 1014.999801][T25437] ? aa_sock_msg_perm+0x94/0x150 [ 1015.004739][T25437] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1015.010024][T25437] ? security_socket_sendmsg+0x80/0xa0 [ 1015.015471][T25437] ? netlink_getsockopt+0x590/0x590 [ 1015.020664][T25437] ____sys_sendmsg+0x5ba/0x960 [ 1015.025424][T25437] ? __asan_memset+0x22/0x40 [ 1015.030010][T25437] ? __sys_sendmsg_sock+0x30/0x30 [ 1015.035026][T25437] ? __import_iovec+0x5f2/0x850 [ 1015.039883][T25437] ? import_iovec+0x73/0xa0 [ 1015.044378][T25437] ___sys_sendmsg+0x2a6/0x360 [ 1015.049076][T25437] ? __sys_sendmsg+0x2a0/0x2a0 [ 1015.053863][T25437] ? seqcount_lockdep_reader_access+0x17b/0x1d0 [ 1015.060132][T25437] __se_sys_sendmsg+0x1c2/0x2b0 [ 1015.064988][T25437] ? __x64_sys_sendmsg+0x80/0x80 [ 1015.069935][T25437] ? lockdep_hardirqs_on+0x98/0x150 [ 1015.075137][T25437] do_syscall_64+0x55/0xa0 [ 1015.079552][T25437] ? clear_bhb_loop+0x40/0x90 [ 1015.084835][T25437] ? clear_bhb_loop+0x40/0x90 [ 1015.089505][T25437] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1015.095389][T25437] RIP: 0033:0x7f777699c799 [ 1015.099799][T25437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1015.119489][T25437] RSP: 002b:00007f777787d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1015.127896][T25437] RAX: ffffffffffffffda RBX: 00007f7776c16090 RCX: 00007f777699c799 [ 1015.135860][T25437] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 1015.143823][T25437] RBP: 00007f7776a32c99 R08: 0000000000000000 R09: 0000000000000000 [ 1015.151789][T25437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1015.159751][T25437] R13: 00007f7776c16128 R14: 00007f7776c16090 R15: 00007ffc8762e7f8 [ 1015.167733][T25437] [ 1015.710829][T25457] netlink: 'syz.0.5119': attribute type 10 has an invalid length. [ 1016.274583][T25468] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 1016.902026][T25481] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5126'. [ 1016.920496][T25481] netlink: 'syz.1.5126': attribute type 29 has an invalid length. [ 1016.956871][T25481] netlink: 'syz.1.5126': attribute type 29 has an invalid length. [ 1018.055816][T25524] netlink: 156 bytes leftover after parsing attributes in process `syz.2.5137'. [ 1018.115463][T25522] netlink: 156 bytes leftover after parsing attributes in process `syz.2.5137'. [ 1018.351130][T25533] netlink: 'syz.3.5140': attribute type 3 has an invalid length. [ 1018.390292][T25533] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5140'. [ 1018.523288][T25540] netlink: 'syz.2.5142': attribute type 3 has an invalid length. [ 1018.537939][T25540] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5142'. [ 1018.825274][T25548] sit0: entered allmulticast mode [ 1018.929012][T25557] netlink: 'syz.0.5147': attribute type 1 has an invalid length. [ 1018.948267][T25557] netlink: 'syz.0.5147': attribute type 4 has an invalid length. [ 1018.984105][T25557] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.5147'. [ 1019.061956][T25564] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5148'. [ 1019.082150][T25564] netlink: 'syz.2.5148': attribute type 21 has an invalid length. [ 1019.091176][T25564] netlink: 156 bytes leftover after parsing attributes in process `syz.2.5148'. [ 1020.409250][T25597] netlink: 192436 bytes leftover after parsing attributes in process `syz.1.5161'. [ 1020.430198][T25597] openvswitch: netlink: Duplicate key (type 0). [ 1020.451057][T22566] Bluetooth: hci2: SCO packet for unknown connection handle 0 [ 1021.951474][T25639] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.5175'. [ 1022.547535][T25650] netlink: 'syz.0.5179': attribute type 6 has an invalid length. [ 1022.567596][T25650] netlink: 'syz.0.5179': attribute type 1 has an invalid length. [ 1022.578578][T25650] netlink: 199820 bytes leftover after parsing attributes in process `syz.0.5179'. [ 1022.973083][T25667] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1023.148277][T25671] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.5186'. [ 1023.643743][T25671] netlink: 'syz.0.5186': attribute type 10 has an invalid length. [ 1023.713319][T25671] team0: Device ipvlan1 failed to register rx_handler [ 1023.852969][T25690] netlink: 14560 bytes leftover after parsing attributes in process `syz.1.5190'. [ 1024.089613][T25693] IPv6: Can't replace route, no match found [ 1024.862950][T25694] delete_channel: no stack [ 1024.882584][T25701] netlink: 'syz.0.5194': attribute type 4 has an invalid length. [ 1024.894052][T25701] netlink: 152 bytes leftover after parsing attributes in process `syz.0.5194'. [ 1024.930715][T25701] .`: renamed from bond0 (while UP) [ 1025.162559][T25715] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1025.467767][T25731] netlink: 'syz.3.5204': attribute type 9 has an invalid length. [ 1025.480980][T25731] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.5204'. [ 1025.648665][T25729] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5203'. [ 1025.668428][T25731] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.5204'. [ 1026.131377][T25758] netlink: 'syz.0.5211': attribute type 9 has an invalid length. [ 1026.153031][T25758] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.5211'. [ 1026.251454][T25762] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.5211'. [ 1026.338121][T25762] netlink: 'syz.0.5211': attribute type 9 has an invalid length. [ 1026.370140][T25762] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.5211'. [ 1026.856375][T25781] netlink: 'syz.3.5217': attribute type 9 has an invalid length. [ 1026.909205][T25781] netlink: 399 bytes leftover after parsing attributes in process `syz.3.5217'. [ 1027.145004][T25757] delete_channel: no stack [ 1032.463014][T25766] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.5214'. [ 1032.970329][T25820] netlink: 180 bytes leftover after parsing attributes in process `syz.1.5229'. [ 1033.271047][T25821] netlink: 'syz.0.5228': attribute type 29 has an invalid length. [ 1033.279317][T25821] netlink: 'syz.0.5228': attribute type 29 has an invalid length. [ 1033.485922][T25834] netlink: 'syz.0.5228': attribute type 29 has an invalid length. [ 1033.548277][T25821] netlink: 'syz.0.5228': attribute type 29 has an invalid length. [ 1033.823384][T25831] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5232'. [ 1033.998021][T25841] netlink: 'syz.2.5233': attribute type 10 has an invalid length. [ 1034.231867][T25841] team0 (unregistering): Port device team_slave_0 removed [ 1034.245887][T25852] netlink: 'syz.3.5236': attribute type 3 has an invalid length. [ 1034.258789][T25852] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5236'. [ 1034.269594][T25841] team0 (unregistering): Port device team_slave_1 removed [ 1034.289723][T25842] netlink: 'syz.2.5233': attribute type 10 has an invalid length. [ 1034.456675][T25861] netlink: 'syz.1.5238': attribute type 21 has an invalid length. [ 1034.469288][T25861] netlink: 'syz.1.5238': attribute type 10 has an invalid length. [ 1034.478259][T25861] netlink: 'syz.1.5238': attribute type 12 has an invalid length. [ 1034.511256][T25861] netlink: 12226 bytes leftover after parsing attributes in process `syz.1.5238'. [ 1034.566818][T25861] tap0: tun_chr_ioctl cmd 2148553947 [ 1035.128883][T25884] netlink: 3403 bytes leftover after parsing attributes in process `syz.3.5246'. [ 1036.599013][T25876] netlink: 188 bytes leftover after parsing attributes in process `syz.1.5244'. [ 1036.899973][T25893] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1036.943853][T25893] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1037.052729][T25901] netlink: 152 bytes leftover after parsing attributes in process `syz.3.5252'. [ 1037.133076][T25901] .`: renamed from bond0 (while UP) [ 1037.433757][T25914] netlink: 61211 bytes leftover after parsing attributes in process `syz.3.5257'. [ 1037.476017][T25914] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1037.675738][T25925] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5261'. [ 1038.046268][T25936] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.5263'. [ 1038.220113][T25931] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.5263'. [ 1038.468095][T25933] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.5264'. [ 1038.533053][T25943] validate_nla: 16 callbacks suppressed [ 1038.533069][T25943] netlink: 'syz.1.5267': attribute type 29 has an invalid length. [ 1038.698248][T25945] netlink: 'syz.0.5268': attribute type 49 has an invalid length. [ 1038.742140][T25933] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 1038.783990][T25943] netlink: 'syz.1.5267': attribute type 29 has an invalid length. [ 1038.805879][T25945] netlink: 'syz.0.5268': attribute type 49 has an invalid length. [ 1040.323175][T26008] netlink: 'syz.0.5282': attribute type 29 has an invalid length. [ 1040.351231][T26008] netlink: 'syz.0.5282': attribute type 29 has an invalid length. [ 1040.372923][T26009] netlink: 'syz.1.5284': attribute type 29 has an invalid length. [ 1040.392571][T26004] bridge_slave_0: left allmulticast mode [ 1040.570915][T26009] netlink: 'syz.1.5284': attribute type 29 has an invalid length. [ 1040.707632][T26001] netlink: 'syz.1.5284': attribute type 29 has an invalid length. [ 1040.832872][T26010] netlink: 'syz.1.5284': attribute type 29 has an invalid length. [ 1040.974420][T26012] netlink: 830 bytes leftover after parsing attributes in process `syz.2.5286'. [ 1041.020465][T26021] netlink: 194488 bytes leftover after parsing attributes in process `syz.3.5288'. [ 1041.255704][T14548] Bluetooth: hci1: command 0x0406 tx timeout [ 1041.378102][T26029] syzkaller0: entered promiscuous mode [ 1041.383769][T26029] syzkaller0: entered allmulticast mode [ 1042.351697][T26049] netlink: 199820 bytes leftover after parsing attributes in process `syz.3.5295'. [ 1054.542216][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.548615][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 1087.334245][T14548] Bluetooth: hci0: command 0x0406 tx timeout [ 1093.334636][ T8] page_pool_release_retry() stalled pool shutdown 1 inflight 60 sec [ 1095.337947][T26056] Bluetooth: hci3: command 0x0406 tx timeout [ 1115.979625][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.986099][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 1147.254020][ C1] rcu: INFO: rcu_preempt self-detected stall on CPU [ 1147.260668][ C1] rcu: 1-....: (10499 ticks this GP) idle=afec/1/0x4000000000000000 softirq=108325/108325 fqs=5201 [ 1147.272452][ C1] rcu: hardirqs softirqs csw/system [ 1147.278859][ C1] rcu: number: 1375475 0 0 [ 1147.285258][ C1] rcu: cputime: 28849 23630 36 ==> 52510(ms) [ 1147.293047][ C1] rcu: (t=10503 jiffies g=140389 q=527 ncpus=2) [ 1147.299366][ C1] CPU: 1 PID: 26044 Comm: syz.2.5294 Not tainted syzkaller #0 [ 1147.306901][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1147.316948][ C1] RIP: 0010:unwind_next_frame+0xe21/0x2970 [ 1147.322749][ C1] Code: 48 89 c2 48 89 54 24 08 49 8d 5f 01 48 8b 44 24 48 42 0f b6 04 28 84 c0 0f 85 d2 15 00 00 48 89 d8 48 c1 e8 03 48 89 44 24 28 <42> 0f b6 04 28 84 c0 0f 85 d9 15 00 00 45 0f b6 77 01 41 83 e6 07 [ 1147.342361][ C1] RSP: 0018:ffffc900001f0338 EFLAGS: 00000a06 [ 1147.348425][ C1] RAX: 1ffffffff1f2a617 RBX: ffffffff8f9530b9 RCX: ffff888018755a00 [ 1147.356389][ C1] RDX: ffffc900001f0900 RSI: ffffffff8cfa0760 RDI: 0000000000000005 [ 1147.364354][ C1] RBP: ffffc900001f0458 R08: ffff888018755a00 R09: 0000000000000008 [ 1147.372314][ C1] R10: 0000000000000009 R11: 0000000000000100 R12: ffffc900001f0408 [ 1147.380276][ C1] R13: dffffc0000000000 R14: ffffffff8f9530b5 R15: ffffffff8f9530b8 [ 1147.388238][ C1] FS: 00007f777789e6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 1147.397158][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1147.403730][ C1] CR2: 0000000100000000 CR3: 0000000048f0f000 CR4: 00000000003506e0 [ 1147.411695][ C1] DR0: 0000200000000300 DR1: 0000200000000300 DR2: 0000000000000000 [ 1147.419662][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1147.427626][ C1] Call Trace: [ 1147.430898][ C1] [ 1147.433742][ C1] ? icmp6_dst_alloc+0x7b/0x400 [ 1147.438589][ C1] ? icmp6_dst_alloc+0x7b/0x400 [ 1147.443430][ C1] ? stack_trace_save+0x100/0x100 [ 1147.448450][ C1] arch_stack_walk+0x144/0x190 [ 1147.453210][ C1] ? icmp6_dst_alloc+0x7b/0x400 [ 1147.458055][ C1] stack_trace_save+0xaa/0x100 [ 1147.462810][ C1] ? stack_trace_snprint+0xf0/0xf0 [ 1147.467914][ C1] ? __lock_acquire+0x1273/0x7d40 [ 1147.472932][ C1] kasan_set_track+0x4e/0x70 [ 1147.477516][ C1] ? kasan_set_track+0x4e/0x70 [ 1147.482269][ C1] ? __kasan_slab_alloc+0x6c/0x80 [ 1147.487282][ C1] ? slab_post_alloc_hook+0x6e/0x4b0 [ 1147.492567][ C1] ? kmem_cache_alloc+0x11a/0x2d0 [ 1147.497585][ C1] ? dst_alloc+0x105/0x170 [ 1147.501989][ C1] ? icmp6_dst_alloc+0x7b/0x400 [ 1147.506865][ C1] __kasan_slab_alloc+0x6c/0x80 [ 1147.511709][ C1] slab_post_alloc_hook+0x6e/0x4b0 [ 1147.516820][ C1] kmem_cache_alloc+0x11a/0x2d0 [ 1147.521662][ C1] ? dst_alloc+0x105/0x170 [ 1147.526071][ C1] ? ipv6_sysctl_rtcache_flush+0xf0/0xf0 [ 1147.531695][ C1] dst_alloc+0x105/0x170 [ 1147.535931][ C1] icmp6_dst_alloc+0x7b/0x400 [ 1147.540602][ C1] ? icmpv6_flow_init+0x62/0x120 [ 1147.545543][ C1] ndisc_send_skb+0x44e/0x14f0 [ 1147.550296][ C1] ? ndisc_send_skb+0x1f5/0x14f0 [ 1147.555225][ C1] ? ndisc_alloc_skb+0x18c/0x450 [ 1147.560154][ C1] ? ndisc_mc_map+0x680/0x680 [ 1147.564819][ C1] ? __build_skb_around+0x255/0x3d0 [ 1147.570022][ C1] ? __asan_memset+0x22/0x40 [ 1147.574610][ C1] addrconf_rs_timer+0x2d5/0x630 [ 1147.579547][ C1] ? addrconf_disable_policy_idev+0x480/0x480 [ 1147.585603][ C1] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1147.591586][ C1] call_timer_fn+0x189/0x540 [ 1147.596170][ C1] ? addrconf_disable_policy_idev+0x480/0x480 [ 1147.602226][ C1] ? call_timer_fn+0xd2/0x540 [ 1147.606894][ C1] ? __run_timers+0x800/0x800 [ 1147.611569][ C1] ? addrconf_disable_policy_idev+0x480/0x480 [ 1147.617632][ C1] __run_timers+0x542/0x800 [ 1147.622131][ C1] ? detach_timer+0x2b0/0x2b0 [ 1147.626807][ C1] run_timer_softirq+0x67/0xf0 [ 1147.631563][ C1] handle_softirqs+0x280/0x820 [ 1147.636324][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 1147.641083][ C1] ? do_softirq+0x1a0/0x1a0 [ 1147.645580][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 1147.650772][ C1] __irq_exit_rcu+0xd3/0x190 [ 1147.655353][ C1] ? irq_exit_rcu+0x20/0x20 [ 1147.659850][ C1] irq_exit_rcu+0x9/0x20 [ 1147.664082][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1147.669705][ C1] [ 1147.672636][ C1] [ 1147.675561][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1147.681534][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60 [ 1147.687681][ C1] Code: 50 99 7c 7e 65 8b 15 51 99 7c 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 1c 16 00 00 00 74 2c 8b 91 f8 15 00 00 <83> fa 02 75 21 48 8b 91 00 16 00 00 48 8b 32 48 8d 7e 01 8b 89 fc [ 1147.707277][ C1] RSP: 0018:ffffc9000f0b7a68 EFLAGS: 00000246 [ 1147.713338][ C1] RAX: ffffffff8a7460cf RBX: ffffc90000a2b3c8 RCX: ffff888018755a00 [ 1147.721302][ C1] RDX: 0000000000000002 RSI: ffffc90000a2b3c8 RDI: ffffc9000f0b7c68 [ 1147.729285][ C1] RBP: 1ffff92000145679 R08: ffff888018755a1b R09: 1ffff110030eab43 [ 1147.737250][ C1] R10: dffffc0000000000 R11: ffffed10030eab44 R12: 1ffff9200014567a [ 1147.745217][ C1] R13: ffffc90000a2b3c8 R14: ffffc90000a2b3c8 R15: ffffc90000a2b3d0 [ 1147.753184][ C1] ? plist_add+0x30f/0x490 [ 1147.757600][ C1] plist_add+0x30f/0x490 [ 1147.761844][ C1] __futex_queue+0xe9/0x150 [ 1147.766340][ C1] ? futex_wait_queue+0x27/0x1b0 [ 1147.771268][ C1] futex_wait_queue+0x91/0x1b0 [ 1147.776026][ C1] futex_wait+0x1ec/0x5e0 [ 1147.780351][ C1] ? futex_wait_setup+0x270/0x270 [ 1147.785388][ C1] do_futex+0x2ff/0x3e0 [ 1147.789536][ C1] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1147.795529][ C1] __se_sys_futex+0x3a9/0x440 [ 1147.800220][ C1] ? __x64_sys_futex+0xf0/0xf0 [ 1147.804983][ C1] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1147.810986][ C1] ? __x64_sys_futex+0x21/0xf0 [ 1147.815762][ C1] do_syscall_64+0x55/0xa0 [ 1147.820186][ C1] ? clear_bhb_loop+0x40/0x90 [ 1147.824858][ C1] ? clear_bhb_loop+0x40/0x90 [ 1147.829530][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1147.835418][ C1] RIP: 0033:0x7f777699c799 [ 1147.839826][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1147.859431][ C1] RSP: 002b:00007f777789e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1147.867841][ C1] RAX: ffffffffffffffda RBX: 00007f7776c15fa8 RCX: 00007f777699c799 [ 1147.875807][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7776c15fa8 [ 1147.883859][ C1] RBP: 00007f7776c15fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1147.891835][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1147.899801][ C1] R13: 00007f7776c16038 R14: 00007ffc8762e710 R15: 00007ffc8762e7f8 [ 1147.907783][ C1] [ 1154.134405][T11918] page_pool_release_retry() stalled pool shutdown 1 inflight 121 sec