last executing test programs: 5.008921259s ago: executing program 0 (id=10149): bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffff7e, 0x0, 0x0, 0x0}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000300)=r5) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe8000002c000000", @ANYRESDEC], 0xffdd) 4.743564642s ago: executing program 3 (id=10151): r0 = socket$kcm(0x2c, 0x3, 0x0) r1 = socket$kcm(0xf, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000e200000000611118"], 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x1}) sendmsg$inet(r1, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events.local\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x11b, 0x3, &(0x7f0000000040)=r2, 0x4) r3 = socket$kcm(0x10, 0x2, 0x4) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x600, &(0x7f0000000000)=[{&(0x7f00000000c0)="d8000000140081044e81f782db44b904021d080207000000040000a118000200e000000100000e1208000f0100810401a80016ea1f000840032e5f54c92011148ed08734843c8802033d0803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="5c00000014006b030231a6080c000af32c0cae93000f00e5aa000017d34460bc24ea000007000000000000002756f475ce36c2d13b48df0000ecb8f6ec63c9f4d493803fd88635a6d10000f8ea56a52600e6657594f1817d00000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x10) 2.662825761s ago: executing program 2 (id=10158): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$kcm(0x2, 0x1, 0x84) r3 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d00028422fb564500006e23e3f58e76110165f450e71bfc74e3002500028d459e37000f0000000000bf9367a17e51f60a64c9f4d4938037e786a6d0bdd700000000000000000051fd1f33597225", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40000) r4 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, 0xffffffffffffffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES8=r5], 0x9a) 2.611452304s ago: executing program 0 (id=10159): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r0, &(0x7f0000000140)={'full'}, 0xfffffdef) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmsg(0xffffffffffffffff, 0x0, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) unlink(&(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00') r1 = socket$kcm(0x10, 0x2, 0x4) close(r1) socket$kcm(0x10, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="d8000000180081064e81f789db4cb904021d080006007c09e8ee55a10a001500040014260500000008000f0000000401a8001600200008801c000100a0e4e8e702ef52a98516277ce06bba519554e2686715dc86e5c9ce8017cbec4c2ee5a73536138f00001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb3adbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9a0000d5d9001901df60e1b6649682e1cace81ed0bffece0b42abf", 0xd8}], 0x1}, 0x4040) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0xf9c, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1080, 0x0, 0x0, 0x6, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="143e12e0efca305509bdf60de4020000000400000400"/33, @ANYRES32=0x1, @ANYBLOB='\x00'/10, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, &(0x7f0000004440)={&(0x7f0000000ec0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x2}}, 0x10, &(0x7f0000004340)=[{&(0x7f0000000f00)="34cbf9c55466da0eadc249236ab3cbf316717306be4c08c8c7da1f1ee04ab4b4eac14995ebdf620ff778a4e3452587e42a3c6aa1bd35dfd99f23b525893bc3b5f9f3bed1986bf8d0dddd7c5cdada611f9bf641e421ed71a842d84fa289a542f941d6e06b2b14e2a706ce30acf7d82f224f3e30cadd9d15f3dddbb29dbeb9f68fb68bedb91e0b1ef48832778fe36699c7ebf101659a8f476c4a065eac71d6d1e7fafc6f25ec2c9a8f431fe347a2d30e912c5b2397613ce784637ec71e37566eb0548b461f71028459c6f137c18737d58b56949d022bf1eaf486692bb76836a233c7879d740ad0beaf5159d3380442824f536a41bb22d08fe53952b9c6fed2605d53311c71b455655f96ea6a87e41e9211e90170b0a2b1a2098175ebcd33d517085d224122264cddadd82a3d11bc4a33ce66108b22b1abc6243d306d8f6b8a2ddb5373c190d8f859a3174a200936b079f85edcac7fc03fb993ec0ff8b83f1fd3f1b888d192d99c7ede5d381784d25410cccf1b0bf26a54f065e1e3ec59cc5704fb658fc980a0ac4287ef884ee82007554be3f1e163c81468d0c26c95e3e12393776e32800bb4f086f19080c4fca3d72e8569a5627ce98f2ae0bdb3ec42c23847d47e10b1c58da7e9cea990da842d96e3a51ed7d892f7b28a10486424a69a9109ebd4d7d5a3768400ac000a6d7556ca192e5cd45efb82001ac7b53e03036b6019a07ffb545cd3853e077f08a015f6232488c1139a9409c95ed005261e36b307406ba5714ef395129345866109341feb6c7c458ce08c147a983b46375ddb3621cee0312ba1a434bcd6081e1a8ae8b6d518988b9965faf9aff86df8173b93342cceaec357a100e59b4d66553633626b0b12e9622b8f8fdfe26545b87c57f8ce8609fb8e19b0f6d1cd64e8de85c7327f543b2f38cf3086b57f85e1aaa4add723e4bc4e3ea2c27acec1e545ae3fc870bd42422f6eaf17a1f82699c9cadf224ea1e5d1705b49118d91cc3731aeed60e41bf15a9613aeda8e63a29bc7a95b2d993d23269a310b91f69d16a71243c0f4080d3359f5ddd63c7032bef14ab25eb7df4b28b2132bcbf94a281c8f5de79885a6d679f145fca292b599bb09a1864726d86b65d4781408320b968e2224c23ce7a56d8892970043737ae47f071aaeb219716bc21e3304e301eb5cd32aea951a70621eb870214a72e6c474c3a20f5bd8e089ba16326cc9a80a1a4f5f0e8f58629e20b1c73eb8af330744b187a5cfdb410466378313700ca44eb6dcbc8f3d70f58e134202546f0b1a3b61a298f2a1184b1533bdad308fa2f960087e0f239d2ccbaee3889ddc1a2bea2183b98854d255a6f708909134fab83f42f13e7604f602e264f4a3b2b2a08c673c7ce2813218159b472d3b20ecbf26dd2f7b3ba5298a4ff7444ea0936e098c126f590b05e7697ed8a3d52ba1abc7285de2f160b9b081cb775a5ab77aad1bb98d47e3da53fc4c11d4db47de1e4e6f56ad671f5d8389b33260cc546e4f0bf34fec9b2abd209e6b89e6e381367774676ed6e6eaffe42b07241c276f3c84f17a0762de83eb769bdf28991ddbc23758f01c9ecfba4ab2ca2118fcedd7adde9ff47f643c13e3ad2f13b576985128f233e329fe269d5745cd2b30e5762452a4ff58fdec30623175f8d575ced1c43411e2869aadbe6f1e79a010bca334cb08d545bc2808f359b7777d1bb5675ee210574b9f72cdeb071e07eeaa0988086213a37a972647cf21d3a3bcbd7359da327bacad41b93c5e0e494669109dddcec781774f248f5663e4fac187d42ffccf68335de2adac4f8d3e1bf04b95a9464960186ed019773ffeda18f9827a61edc5fc4088eb0965cb1bd8af1185aa3972b8f73839b4611e303bcbc1f84a330f60fa0a7795ea3cffe0e338406533e12c7deef0b5906c513eab4619a8f02fdd65dcfb7297ef971c4601ad079f7ad38278ae3ff455b37d5492af546975535450693fd4593c8157b3fdb16fd3a106d2f1509d1c06dabb8933269d790a1c5e5f7bdd4a57e1e670d7043cfed88c365b5f8eefe530ef7da5322df981723332c088fce89c2ceee23b420f64332243b9c606d67d538810a94e0ffbd37a119d8fc4d6caec0def40e62613873c74feabde63e12cb2016c1d35cf1bb95bf59e01a63be8825cb3118b74b106f21eef5ee2f41e5fb39fdde058050f780d98ced247c66fc3a03ba04edaf14d698859ba303d511cf0845dc5e269aef2287770a247fd5ae1299b45819ff41725f9da3e4dab7770eb83992b53ae9a9de69e764f6e3aee3e27cfb1bacf531a91605894ae209da6d25872fb54bf36b2ed450b51aa8ee4875b9bc7e55753f61e12a323d301faceb2ecff0686b1359343a94774a6a098dc2df440725cd8331f527d4e22f8090d8879ef4765849705b99465d7ebdf661b81c303d13b87270dc1f227d5954fcbc93bbce6fde2a1f8d573d9cd8130c173a14706f1e9dabc4d16a5b003dd3239faf91769e25cf007b0623141e4e57f11746cd62f20d73956fa84c6a12e1756b6671a64bd7a474ba425907e1a61ba6d2ffa1149165a713a141bfec0f1af51afebdb84d5f14eb51acc284403627d6ce48fd028dc04e00ed963de37f85d155c33e2b4ceb09044c4f1c7791348216b674a8831a232a638f8bfb396fabbe1f880944bc5dcac55df8abc78f804306c88617acfd4adfbb5a055d3d3e91abb763ad84e701cc5679498e04600570f4b2e57c70542043dc590ab363215e6ab3f0bd89383748783d01c9227229edac723d4e2eaa061a44f2630691f25ca6093775183fdf432e01322203dd654b336670116a6a52a27ff2032b1103a4e4be0cc2fb05b24352d72e374e90cc3db2a5a691c7f6b8d1058d7730433c742d8ce52074318b1bce9bb104cf90c8b7f65293c2b74434661444f38d94d977e03433440517f6155a3cad2621c5502dd6148b867a40e6a40be4c8265ec2164b5257f06da1784e98991f42003ced4ba67c23b8c654b542d2d31168fd853cf56cc2c464d7a8a9fbcd2715968788f8527c597ab5f917753c1f1708d2c19972373c5a22af71847de22b9f1e9d38a04ea4dd291da3099cb836a696350bf1263c3c275c27b8b82f604625451a24490b0b5367c2fd05e699546ddf17709d2e2c2710f4361d9dd6e2de2b4353b7f4f8141f6f989dc1a798a974565978e4f9ec0c59a7dbc04bcab072c8513b9ca782c22cdd31fb116c10081740fd8f7d0cbd5c54f1069297f20b45d79bb9ace8e851a655fedf47b2dc76fd30b9ba9f09c9b50d6910ffcdec7078c36fe1e9b19dbb110197496349560a43c0ab42b4ce286643e73a92246ecb71e95ce0d54114772f8477c7d5604c1a52d2f680c5868cf08a2688dd9fef492a01836112cec824483e77da93d104a9e18d06bddf9a4007740a0537ac1a5e09900acc65d52680212a15b68b0ef887228e06f533c1ca95b8f9d81b9fc6608cb5bacf4b867922999c69d46048ec3f408866789f49fcb176fc99ed9d3e6c357ed2e3ce2665925773e5d86c2ceaf8f18519a00d9d2e19e9a6b16af0a53fd7df6974f5db00494460e7f3de6ff6b642859335e020513bb525adddabf0d7d6ae85e7e56e32ca8acc07fe86b7b445358966ba3914c1dfa7b814d9e846ff02a6a8c8f5713a0f727024b5d1ea7e4ce7c64f9b24dd3337a3df33714c5404403b0304b25a66fe3ac85083965877117b3d721e7922f0ac7e278feeb8dc09f58cbcfbb81b11d4699737f37ac240a24b9c4b2b587e68974f7ca5561856f32e389d32056f7d58e4de24c11bd5c5afaa441120370d0c48341e1b8146a6bbca8c15f23c155d2533e97a8e6496bc00533ec83be8488d020708d97385a03bcbf57cadc2c1e575e1ac134cdb5047f3f88eae0230751626cea1c85da9b74ddace668afebb2dc66d302ddf3c5f8f21ac0c0535d00839457e7cac9282a8e49d018b077e38ea512cf28eacff5d98e880abfb5af2e7c039d2e1f1edaad2642963ef29d715f754e2715caa6af046a298b285e3582d903be726b608619332e1a82be48b0f5adf6838f41ff776e5290de8269794bce8fb971267d036bd6bd30e42df918125d573ced78263251bcae2b7b40f1ba855b4f2472312ea8752c4a0e09468bd25615a6c00a9b44c484c5507b8400537f20890e9499ec94ed2b6aeff21e57c6e8a93d80097f85ac9316b03a5f768721bf7d041bb9a6a03eabd615e3c4d74f56c429d53b8fec4b5e86c5b311a6cd4a86f03e04dab25ad65b68a8b8d9053993fd2440ff2b81768213084c831d31a0f8c646aff9090b5463cbee452abd6318340ec41b50f1deba7ffb60b326751de3f6dbf9b17714299233d5c43071367ece2e53212e7f4e084fea60850d4d16908d9bbbb531fbf72143fdb62d1b40afde3d0b2ac2c94c32e456bbef62f8d677e332aec8ccc8eedbac61e7b89b32d57157a39ad5c456258d9c36db0edc82c2baead990ee78007ed89c8f450e92d5e209cc25f7c13f5909ca404fddbdbeff89cc42350c91e9f1fdf9753c6e95f71257f8cbb97838684461cd1244c938b9939a4e9c7727902b6f1a5434e0a06d3fc221771dd87572ae801c5ce6886122f0c91dae57440ffc7ace4e8e0041a1d245103aaadbfc2ecff622228daed2b0cd30f7f59b2617f6f0571ee4403d84e652d78b8e64d5450b6483ef70582dcda9351f2dddd3a4ac84f514f708d3af6242501bd041beae78e6b29b517b534148ea91ef85653fec824d6ddb0c0fa2555ab2564ba29227b1046b48a11ee0e6aafda9d0b80b0f05a8d057cbeb16264cb579aea3ba2b2000052d03c77844ab7c81be3110a36a27aeffe0ad5a8a7385a1913a64fb2db630e8fc8017828cea60f327c3a510b441d94d32584e55f7c2320d89b2ba3d44d832b8e7c5f45442de9ef37d057e6d0c6664e8d74e23f18336d41a3e38c2cda49050cb32ca7040a388c75741ac07d3befc714df35dc92ff70ad041cf17b70a971c142bb89ecfe25290750e989c8666560a61b62fdc4fadef7f30b6269a669ef99be7e7ba7ddddf99949fedc0c331796988c6eedb5c66cbe2870a2affce0b550c3411a2aaf302481ee93398c0fbc0c815cfe1e78bf8fed7f19f2c2dae17a4533aa85f6b787f8072adda379118d76dbba3cebfc4c8aacbb1f79a28ec3a0ec99816e3c8721ddcde1ce73b0704063474", 0xe24}, {0x0, 0x4000}, {0x0}, {0x0}, {&(0x7f00000020c0), 0x500}], 0x5}, 0x0) socket$kcm(0x10, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x13, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000000)={'vlan0\x00', @random="010000201000"}) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="1c00000020006bcd210000006e0400000a000000000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x44004) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) 2.611075504s ago: executing program 3 (id=10160): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0), 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fb0800000000000000000000850000004100000085000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r0}, 0x4) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000060002007a17d30460bc24eab556a705251e6182949a36c23d3b48dfd8cdbfb367b498fa51f60a64c9f4d4938037e786a6d0bdd70000b6c00400b9239d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0x11, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x91, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x36}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x29, 0x4, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r4) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x7fffffff}, 0x48) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000000)={0x0, 0x0}) close(r6) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(r7, 0x10f, 0x87, &(0x7f0000000180), 0x127) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r8) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000180), 0x40001) setsockopt$sock_attach_bpf(r9, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x0, 0x401}, 0x48) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r10) setsockopt$sock_attach_bpf(r11, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) close(r11) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 2.418510494s ago: executing program 2 (id=10161): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x10000, 0x0, 0x1, 0x400, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x5}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r3 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f00000001c0)='./file0\x00', 0x0, 0x4008, r0}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f0000000500)}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000c00)={0xffffffffffffffff, 0xe0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000900)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, &(0x7f0000000940)=[0x0, 0x0, 0x0], &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc6, &(0x7f00000009c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000a40), &(0x7f0000000a80), 0x8, 0x52, 0x8, 0x8, &(0x7f0000000ac0)}}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000d40)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000cc0), &(0x7f0000000d00)='%-010d \x00'}, 0x20) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000d80)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xffffff7f, '\x00', 0x0, r0, 0x3, 0x4}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000e40)={0x6, 0x36, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@btf_id={0x18, 0xb, 0x3, 0x0, 0x5}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0xfffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @jmp={0x5, 0x1, 0x4, 0x0, 0x7, 0xfffffffffffffffe, 0x4}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x7}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_idx={0x18, 0x8, 0x5, 0x0, 0xc}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0x10000}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000880)='syzkaller\x00', 0x3, 0x34, &(0x7f00000008c0)=""/52, 0x41100, 0x8, '\x00', r5, 0x25, r0, 0x8, &(0x7f0000000c40)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000000c80)={0x3, 0xa, 0x6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000e00)=[0x1, r6, r7], 0x0, 0x10, 0x4}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r8 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r8, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) sendmsg$sock(r8, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="7a6eca88ca428c8d4f36c8b8fc2047659bdcb41a9ebe5ac0bed120663c7a3c234c937452515eae867806e58adcd922e70fa89f0e436ab6", 0x37}, {&(0x7f0000000100), 0xfffffeda}], 0x2}, 0x4804) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000400)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r0, @ANYBLOB="27be00c0aec9795bb6b1c352c6b255353dfcc8878844ef2d1fc39a15bae73af6273de1f17e2b17bd97d4a3147296558703d76a9016943f6bd334b371798c57c94b885cfc8c5093356d11fa322ce224a5d2e68808ef66da1f1f197f12a3509ed0de4953e9e47a5b7e3eb078a024bd8a70c5791945af58c4c8221d81254ad985e51d19c55221254778bf4360a5d1fdcb", @ANYRES32=r0, @ANYRES64=r0], &(0x7f0000000000)='GPL\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0x9}, 0x10}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r9, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000015c0), 0x0, 0xff66, 0x10, 0x8, 0xffffffffffffff5a, 0x0}}, 0x10) 2.29948284s ago: executing program 3 (id=10163): socketpair$unix(0x1, 0x5, 0x0, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$kcm(0x2, 0x1, 0x84) socket$kcm(0x10, 0x2, 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYRES8, @ANYBLOB="3eca", @ANYRES8=r1], 0x9a) 2.129665069s ago: executing program 3 (id=10164): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0x1000000}, 0x50) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x1, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8915, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0x6a0a1, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0xc}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@call={0x85, 0x0, 0x0, 0x8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x3, 0x3, 0x3, 0xa, 0x8, 0xfff8, 0xfeff}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.042100033s ago: executing program 1 (id=10165): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc008000200070002", 0x2b}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000085100000ffffffff"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f00}, 0x94) r1 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d640a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x5, 0xf, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000ea000000000000000700000218110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000e6ff008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f00000005c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100ff}, 0x94) 1.993451826s ago: executing program 3 (id=10166): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_devices(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x10000) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r3 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r3) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x100) setsockopt$sock_attach_bpf(r3, 0x84, 0x6e, &(0x7f0000000000)=r5, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x0, 0x0, &(0x7f00000001c0)='syzkaller\x00', 0x2002, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x37, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'gre0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000f0ffffffffff030000000035"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x7ff) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x89f1, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/27], 0x50) socket$kcm(0xa, 0x0, 0x3a) 1.991118996s ago: executing program 0 (id=10167): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x804, 0x14c9, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x803, 0x0, @perf_config_ext={0x1, 0x4}, 0xa0, 0x58, 0x0, 0x4, 0x2, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) close(r1) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x40008}, 0x0, 0xc, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x31}, 0x81c0) write$cgroup_subtree(r4, &(0x7f0000000180)=ANY=[@ANYRES8=r1, @ANYBLOB=','], 0x9a) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="d80000001a0081044e81f782db4cb9040a1d0800fe007c05e8fe55a115211c000200142603600e12080005007a010401a80016002000034004000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="160000000000000061b1000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xd3c0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000240)='ns/user\x00') perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x200000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x69, 0x10, 0x16}}, &(0x7f0000000480)='GPL\x00'}, 0x80) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8946, &(0x7f0000000080)) sendmsg$kcm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f8480b0000005e140602000000000e0027001000000002800000121f", 0x2e}, {&(0x7f00000002c0)="709799cea957bc334b0cd168dfc33c85b9f44a1ee68d2a5e26750cc9c24e485c04295f0128d2fd45ee6bb522b20348a7534ce328e57d7a0e3fc204954190cb27f24d38d8055dc3137ecf46833c083e95f9c14502ef25a45c005a13161a489b112a04774eb1ed5264e28358dba1dd8c8624ea9675381316fcb21423b5d235", 0x7e}, {&(0x7f0000000340), 0x13}], 0x3}, 0xc094) 1.9048326s ago: executing program 1 (id=10168): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x64099, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b81, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x9, 0x9, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001240)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d19f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981179186e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2a434b9048ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d6356e4450d043ed20d313cd56a56d2e4cdf26f19af9a41695a58a9b6b45af1ca939b18d7b57791b99cfc6ec2a0848c29fea4eb8b82395a38e8aca5ab4bfc2ad8acf2e51b766f8ecd16194ad41ec097082f7fa32179ef99dafa6c2aa206a25ddc33e6f0a09169eeff428c71f54e1dfcfcd7cfc8f6e169f11c47d504"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d0e, 0x80218, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x7}, 0x2005, 0x0, 0x51, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x26, 0x0, &(0x7f0000000500)="b9ff03076804268cb89e14f088a847e0ffff2000000000010000ac141416e000000129a13011", 0x0, 0x2800, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x50) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r1, 0x0, 0x41) close(0x4) 1.673274772s ago: executing program 2 (id=10169): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa1", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$kcm(0x2, 0x1, 0x84) r3 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d00028422fb564500006e23e3f58e76110165f450e71bfc74e3002500028d459e37000f0000000000bf9367a17e51f60a64c9f4d4938037e786a6d0bdd700000000000000000051fd1f33597225", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40000) r4 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, 0xffffffffffffffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES8=r5], 0x9a) 1.498875922s ago: executing program 1 (id=10170): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000040), 0x8}, 0x440}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe49, 0x2, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYRES64=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={0xffffffffffffffff}) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000310081044e81f782db44b904021d080005000000e8fe55a1180015000600142603600e120900210000000401a8001600a40001", 0x37}], 0x1}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="33fe00004a00530c8e5eb88edc5a9c0e0a9b80"], 0xfe33) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4080) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800001bc81a000000000000000001851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000101180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa10000000000000701000000ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e0ffff200000000021000aac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) sendmsg$inet(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3e}}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000380)="a415f760d4be4fa32a8ccf89223b70be6c788012b847791472116a1561efdeb55d9164b390a03d0b945f1f57c98d2d262e158b27637a75c5c75e8afb27", 0x3d}, {&(0x7f00000003c0)="acf08fce01f3af2cb6672ccdc5d6108fc6323580806be30f7032c1922e91d8f433a88669ce37e9aedd55bb57", 0x2c}, {&(0x7f0000000400)="56e257db22b145dd7e0e421db8835ce8d167ddf39e488b5212ec8c8985b13ace1b2c25822f6f11efd445267a05d8dda00035e9600e109a2422e13761d625ab6cde2ef1cee39b8e84f26744eb34ee26804eb274199ea81daaeb8fb86f2a6979021b70a2990125c38cf3d8fc538e0956ca6f8ef8cca302c62b3183daafc661", 0x7e}, {&(0x7f0000000500)="963c2a6a9e6bf954c883ccc7f4989eca5cca636f", 0x14}], 0x4, &(0x7f0000000780)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32, @ANYBLOB="e00000010a010101000000001c000000000000000000000007000000890b5c7f000001ac14141a00000000001c000000000000000000000008000000", @ANYRES32, @ANYBLOB="00000000ac1414aa000000001400000000000000000000000100000004000000000000001400000000000000000000000100000007000000000000001c000000000000000000000008000000", @ANYRES32, @ANYBLOB="bce8a40407e4"], 0xb0}, 0x4040) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe80, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 1.475898503s ago: executing program 0 (id=10171): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x6, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb}, [@map_val={0x18, 0xa, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa}, @generic={0xbd, 0x5, 0x6, 0x2, 0x10d}]}, &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000001c0)={0x5, 0x1, 0xe4b0, 0x8}, 0x10, 0x0, 0x0, 0x4, &(0x7f00000002c0)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000300)=[{0x3, 0x2, 0x9, 0x3}, {0x4, 0x3, 0x8, 0xf}, {0x2, 0x1, 0xa, 0x5}, {0x5, 0x5, 0x9, 0x5}], 0x10, 0x7ff}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0}, 0x94) r2 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, 0xffffffffffffffff) bpf$ITER_CREATE(0xb, 0x0, 0x0) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x23ad, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x4}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000480)={r0, r3}, 0xc) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0x12, 0x0, &(0x7f0000001a00)="000000000000000022385ba988a88dc288a8", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.403665306s ago: executing program 2 (id=10172): socketpair$unix(0x1, 0x5, 0x0, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$kcm(0x2, 0x1, 0x84) socket$kcm(0x10, 0x2, 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYRES8, @ANYBLOB="3eca", @ANYRES8=r1], 0x9a) 1.227425666s ago: executing program 0 (id=10173): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_to_bond\x00', 0x200}) socketpair(0x1, 0x1, 0x0, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8946, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000002b21c90b000000000000721a5dbb56a3d9e16e7c2179c9b5b24722944820e624fc5b17d0822ca4232c98a9936ba722475ca5", 0x72}, {&(0x7f0000000440)="63f805d7649496db72959832930469edc7b700c9e37eed5653ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d33330e2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5aa2ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb00"/135, 0xfca6}, {&(0x7f0000001400)="7f4ba13c5a27118dc920175650f0c9ba1809dd13a6e2d5b38f40adfa278c09e0e3bd05add4d780cd753b50f06f3b51f43761c7783f38ceaefc2dad57889d8b3a2d21314410f64ec2fa92e3a14b0141b39c020021d1edd011fbccb808a317fff4cf49aab12da619d67102048ec43c76cdb9d395e8b7b6e589d788aeeecb5080fc3d5ec6ccd656e49c0a642671d3fc363b46240bbc46ad965399b71db3c8f2b269b20870a3d2a6a8de5213b0f9d41c510c827056b7284391da244ec7653648b670f9a3483b314d861992ed7fb369eda093e1643c300b94d996fc592adb22c379be070ce5cd806da85a492dd4199cceb4c5b750222485325cf1073bf87e93bdf7da8af8f5f626541afd142e24ee8f4be9f038453c0edf500deabfe4d1a7a9de51df012bc2f3b767b3c03be6ace8c37ad571323cd363116e01f98a8ff8148d3900a65b788e99ddf9d9a2383f1730c7868d2dd031034bce5a77bd1ef3385105968be7bd830bde788092f657be36f89ea55ced486e18982d01339ed04a934a43c7b3be5e6bd03cbe773a938f621809345ec07cfceb013e3d76d500d97c8bee6ff54980ac3d221fcb35724ba64adb29ae8db909e097d78ff9542196635a14266944b850c9d436e96cc806a88090cbfc9db7ce83231bc043ded67966cfd68b800f6030a85f6bb070a2a5b372be2dacea7884b42e76e164af04e47f90ce0694623dce23cd1471f1a6029f68331317073e1a2d8cfb16f821c867d35a609649cf36aa781fa0a381f934844366d4e3ab8dd239c6ec35c15f307a7ed07869aacec38d787fd9c08e9dda1a28bf1a15b004bb1d88aa429ee8e927f5a1e1445685d8923cad92c90c79726d5e73dfe741de35498842cf51a4f09b97b1c14d33213705b95e84a8853fab4e1ced6faecea9d9203b038594bceb202a9d47f862c4f1853db9a0a7bf98ed9d2e3012358b38d092bd1ed7efb1a9e582ac5ef30c9b476e185f537f40ae8189528b480436122a939967e8d862e01172245ebced9f5251dd302e7e974c1db40be1e9e79799c27384caf6485e7c469b77cd6b28f71e39f84d2adbe074dd2bed6636e6853655adc3d1a47eff697e8edba53e6b281aea94798d82da7d3e86d09d869e5e345316eeeced4e15fc39234a0b0104e0b205c95eda632d0e86b095b284f441a62cb0e7262bc1967ee75f5c2d459011b0c15f4c85b02150a8834eda7f84cc96dde04e4abbdf5985a9c7218797820251b5804cae80c9a726afddf36793ae52cfb38e4e19740d6e07e4ed7c01001ab87b7fb12d5b70a75938d234c83d863b1763aec37b41d204fc319c6e802734ed681ea179fe6cad4857c3ca0e236e7b9867688d8bd7749e919f2d4f57f2249c9ccaf76a23760569b0fbde2db12ca0169e74982c1f4f0494aae13f4838b3f50d9ab0f6e328250d6fc34c0156e4b754c5c648b4ef8af32c91859f9706048f029634cefd0d767e8b7743262cb8a468ad37dfa47a745495e3f03cfa1d4ed71af55453c0a25fa1122a9054bcc4d9960c9a54f36b6db55154ab7dd19890d9f8ff3549e0fbd5a655319566b7f9c72be0242e7ffb59020356c3ffb5b9c43858e69d7b677a9bc5b8a64721a51b75a254e07199a73726834bea05901455ad53b38116b953c970b2002d0d1f91deb73ccb7266fbb21aa8555599daed7585575ef3efbd737f2523018ba4645d862889d5c3d91b12f04166db8bffecde54ee278d0d5351f3bf1f8902ff3f4c24a8c0c8a4e6addc9baadc471813589324d3128a1b193137c15c01be9f367317b1c885301ff8e9df728efa37df27f65eb0464055091f2ed469fdab48f413e3978f73ff9dffeb85453e841f86594612ac91b50add8d14910748bfa903033662f3e735ce6d299ce52338a96035aa89f63bd59d151fb20c38125236cbc0d795ac6f8da4cafc74714ed62a23b017e15adcaade58385b78c6945fb30a2539c42b1e415879433b9fb6966c6d19ed19f9f90cbd360d936a8b9f8e03bca5a83c063651b4636a7783bbda6417c83e470a16dfb115344a527436242ace9341432b5816b5e6609d97d600e142ca3cf74cbc00e1d9ee203cdfad339ce460b294f3931c5bd8ae6da8fc14d66a01bae4a212ef3d914e58c13217c8ad91628636b56257c7ca41b404cc2d4b5d50e26ebefc74656c62b1b4e9b6c5b6cc8d79101460f719d95925630bf99e042018439c50026513d680ea573620132ded57dea9e2da4e16f17dbc171642b1e80a3f41311ee73441302285668792160db6614fdb30d25a5719d2ae03ab98ea167597c48dd8197e7faf6189d801134462027901506c5ff1ae2558d96722217f65131d2f429693ae9fae19c101319473608976d08cc1c0d98f789b0c364e8aca574321ab2857af1015f1588afd313503085db4d99961a9391db06c10477ceb44199f1648594e8f9b452fafdab49b1962d02ee77ebd31b7931174a729fa943cb18102130e7e08eaba77df066069c2c3564fc85881ba0dad12c4f06a9e6dea9fea53931ff85e38505eb7ad60a52e2a8a248b3f4d0d55eee31f75f110c70e3b12409a79a5a98b0156c6d2a5d94604b8fa202b12746a365c708c671316cc0ffff6e9b7139b337953be22672a4910e1eb28cccc023b77028e20a6d377a339372f0dc235069f41c2692b0a3a7e0f315f4aebeef435a46b2e8b8462739293f9184c01b1434e87bf3fd48be54bf437056a1d2cff0c7aa52578013f96b1d5100ca936ff029cfd6f9a093621f684196ed7e1d363a97c647c34fe5f2370e7ab9dc718a1fc317779ab8a04bc12c01b778d17eea0b546bce03475fc6373c860714df0322dde550186c553ebd61ed18c0b80655f0827a63d209117ca23b026c1ad30bac4d43a4611292c7049f855b829a3a17fd2b83c142078beed8ca07b7cb7cd624705ccc160246c81174a4d3a9f2057caffe84b1ac073375e065c1ff4e9e22e7d87b3adb40ff796132e4ed86e5fc9f9616f8e4116be96497621692fb516e9316cfd15ad01742a1de4aa35fe02861236295823edf4c48fc37faf55226044e393a3733d58e8ef0f0c7941bc30f09739f37dea2f395f2e9e9b2c31a11923a2d6c9b14f1bacce15094cbbd6445f3581c6d45b76943b4d0db8fd4d4acbdb91780f57c872827abd7a1f13290a0d17dda220493476c92ce65e33f07afcf763aec0e67450f547101f1a5ada0f760c8f12137679324e22c7a13fdf78575115acb0ae4a2818b7b3ead27eea5eccba6f7a34c61819382eebfad742a3c603c6d2f332726996b3e8fcbdfd56b436c1173b1b3bc1ab66a717e31f2f918f0bea3f4801e04c14c881c59324fd9bc38745dd0e47da6bc8e98fe74a760304d74f17cd3cfceb33503397cf592d2b6a51b641d559ba8d6dc449e19b289fd1a4b3772b3998181e787723fe3893362d8f3e346c0ab0abe933e9bdd9a82b377914018377af9d2cbc58ab4fc08cea2623174239cea585603b8acd20da923a44799b1745c3bd65640508f96a0d92a6a2fd8314573f10b4f6e6cbf61e8828bd6e69b1b0c47f5795917a5035b3424dc3cadd2aadbbafb9d18349fab41d79ba13660f2c9400ff87784b26c3e88785db8522c93d3d4f12608736a235c8b9fff98a17934fe36792cb1992ea1b72b5e151cfe82b4ebc4f510882e4b34ee9f6ada188b104ba36e8acbd7bafe39b32f957da45c2743017545fd61667d36d58952de0cdbacb3abc549e1001bf6d9b19f9a353bb84bd152e04c061c691b514d6f1b36a8895424ce210a4cd75d537443a2791dc68e9fff510358f7586d3b73ed04223e683adf6a1c79d3bc92aa595cc6167", 0xa91}], 0x3}, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x1f00) close(r2) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)}, 0x0) 1.121462161s ago: executing program 2 (id=10174): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac141411cf26000100000000280000000000000000010000070000000144"], 0x48}, 0x200040c4) 1.104360352s ago: executing program 0 (id=10175): perf_event_open(&(0x7f0000000540)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x100c, 0x7, 0x0, 0x9, 0x0, 0x7, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000008c0)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0x2a133, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_config_ext={0xffffffffffffffff, 0x2b4}, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) sendmsg$kcm(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000180)="ad", 0x1}], 0x1}, 0x800) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x894b, &(0x7f0000000140)) sendmsg$inet(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="6000000022007f029e607dd75fcb520002a124b244de91f7f414adcf41bfafdd1b1e93c6292aefa3ca89563a63fb94b2584ca2faa20f2c308b0fe298acec10e3019e1e26e6efd0166e6c1b01132e5423294ac2f4d53c3870c3068461957e5357", 0x60}], 0x1, 0x0, 0x0, 0x6}, 0x0) recvmsg$kcm(r0, &(0x7f0000002a80)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYRES64=r0, @ANYRESDEC=0x0, @ANYRESOCT=r0], 0x50) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) openat$cgroup_int(r2, &(0x7f00000000c0)='cpuset.memory_migrate\x00', 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)=@o_path={0x0, 0x0, 0x4008}, 0x18) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="2e0000003e000511d25a01000000000000000149926e0c400d0001", 0x1b}], 0x1, 0x0, 0x0, 0x39c}, 0x4000) r3 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="c00e00007200911fdabcf8b30771a54a07"], 0xfe33) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r4) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000180)={0x0, 0x0}) ioctl$TUNGETVNETLE(r4, 0x40107446, &(0x7f0000000180)) r5 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$TUNSETOFFLOAD(r5, 0x4004743d, 0x110e22fff6) r6 = getpid() socket$kcm(0x11, 0x200000000000003, 0x300) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) close(0xffffffffffffffff) perf_event_open(&(0x7f0000001100)={0x5, 0x80, 0x9, 0x8, 0xb, 0xfb, 0x0, 0x3c, 0xc002, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x18842, 0x0, 0x7fffffff, 0x2, 0x3cd, 0x2, 0x7, 0x0, 0x0, 0x0, 0x7}, r6, 0x0, 0xffffffffffffffff, 0x2) syz_clone(0x41064400, 0x0, 0x0, 0x0, 0x0, 0x0) 1.093585623s ago: executing program 1 (id=10176): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc008000200070002", 0x2b}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000085100000ffffffff"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f00}, 0x94) r1 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d640a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x5, 0xf, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000ea000000000000000700000218110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000e6ff008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f00000005c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100ff}, 0x94) 988.099888ms ago: executing program 2 (id=10177): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x804, 0x14c9, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x803, 0x0, @perf_config_ext={0x1, 0x4}, 0xa0, 0x58, 0x0, 0x4, 0x2, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) close(r1) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x40008}, 0x0, 0xc, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x31}, 0x81c0) write$cgroup_subtree(r4, &(0x7f0000000180)=ANY=[@ANYRES8=r1, @ANYBLOB=','], 0x9a) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="d80000001a0081044e81f782db4cb9040a1d0800fe007c05e8fe55a115001c000200142603600e12080005007a010401a80016002000034004000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="160000000000000061b1000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xd3c0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000240)='ns/user\x00') perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x200000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x69, 0x10, 0x16}}, &(0x7f0000000480)='GPL\x00'}, 0x80) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8946, &(0x7f0000000080)) sendmsg$kcm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f8480b0000005e140602000000600e0027001000000002800000121f", 0x2e}, {&(0x7f00000002c0)="709799cea957bc334b0cd168dfc33c85b9f44a1ee68d2a5e26750cc9c24e485c04295f0128d2fd45ee6bb522b20348a7534ce328e57d7a0e3fc204954190cb27f24d38d8055dc3137ecf46833c083e95f9c14502ef25a45c005a13161a489b112a04774eb1ed5264e28358dba1dd8c8624ea9675381316fcb21423b5d235", 0x7e}, {&(0x7f0000000340), 0x13}], 0x3}, 0xc094) 780.291809ms ago: executing program 1 (id=10178): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)="5c00000014006b02c84e21100af32c6e0a0675f8d34460400000000000005c1e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d493803792684b71bdd70000b6c0504bb9183132be471b93c91b5d7870743719b4b53cf2", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x500000000000000) 779.805249ms ago: executing program 3 (id=10179): r0 = socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000480)="d80000001a0081044e81f782db4cb904021d0800fe007c05e81156a10a0015000200142603600e12080010007a010401a8001600200002400400077c035c0400a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7eef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e101ce81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a9412dd09206da6f7ddef7b39b27ee", 0xd8}], 0x1}, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x6, &(0x7f0000000040), 0x4) r2 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000, 0x0, 0x0, 0x1, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0xa, 0x2, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x6}, 0x5000, 0x0, 0x0, 0x0, 0x0, 0xa}, 0xffffffffffffffff, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@o_path={&(0x7f00000001c0)='./file0\x00', 0x0, 0x4000, r0}, 0x18) setsockopt$sock_attach_bpf(r3, 0x29, 0x23, &(0x7f0000000040)=r4, 0x4) sendmsg$kcm(r3, &(0x7f0000001240)={&(0x7f0000000940)=@generic={0xa, "8ab77fa26849ff263ef30c98b353011a5990650042e2dacdc165ececece6be1862e2adacd2737d00ad6f9fa9f3d7145e15dd9fb1a7adc211220963ad5def53b911ba5b9da13641f982757012a7496de0b3a36f5849f260c603dbc317f54b901ee80ea6132ca6e88c776553e1833052ca376304313c5637786a36a4b83857"}, 0x80, 0x0}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffebe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018edff00000000000c0000000c00000002000000030000000000008c000000000000"], 0x0, 0x26, 0x0, 0x4}, 0x28) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89a0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x89a2, &(0x7f0000000080)) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x45, 0x0, 0xb, 0x200004}, {0x0, 0x3, 0x9}]}) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030033000b23d25a806c8c6f94f90424fc60100005000a000200053582c137153e37000c0680050002000300", 0x33fe0}], 0x1}, 0x0) socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f0000000180)='+]:)!]$^\x00') 0s ago: executing program 1 (id=10180): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa1", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$kcm(0x2, 0x1, 0x84) r3 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d00028422fb564500006e23e3f58e76110165f450e71bfc74e3002500028d459e37000f0000000000bf9367a17e51f60a64c9f4d4938037e786a6d0bdd700000000000000000051fd1f33597225", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40000) r4 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, 0xffffffffffffffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES8=r5], 0x9a) kernel console output (not intermixed with test programs): 517': attribute type 10 has an invalid length. [ 1423.827053][ T5782] Bluetooth: hci4: unexpected subevent 0x12 length: 150 > 5 [ 1423.876997][T32644] netlink: 'syz.1.8521': attribute type 19 has an invalid length. [ 1423.886197][T32644] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8521'. [ 1424.140213][T32646] netlink: 'syz.1.8521': attribute type 10 has an invalid length. [ 1424.262344][T32646] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8521'. [ 1424.347261][T32646] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1424.503022][T32649] netlink: 'syz.3.8520': attribute type 1 has an invalid length. [ 1424.576943][T32649] netlink: 112860 bytes leftover after parsing attributes in process `syz.3.8520'. [ 1425.631879][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1426.289167][T32696] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1426.393716][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1426.453941][T32706] netlink: 'syz.1.8544': attribute type 19 has an invalid length. [ 1426.482113][T32706] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8544'. [ 1426.591354][T32711] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.8546'. [ 1426.828436][T32716] netlink: 'syz.1.8544': attribute type 10 has an invalid length. [ 1426.865688][T32716] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8544'. [ 1426.875841][T32716] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1427.864561][ T5782] Bluetooth: hci1: unexpected subevent 0x12 length: 150 > 5 [ 1428.617959][T32755] netlink: 'syz.0.8562': attribute type 19 has an invalid length. [ 1428.656394][T32755] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8562'. [ 1429.175009][T32757] netlink: 134736 bytes leftover after parsing attributes in process `syz.1.8561'. [ 1429.286886][T32762] netlink: 'syz.0.8562': attribute type 10 has an invalid length. [ 1429.369580][T32762] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8562'. [ 1429.459308][T32762] bridge0: port 3(ipvlan1) entered blocking state [ 1429.465890][T32762] bridge0: port 3(ipvlan1) entered disabled state [ 1429.519073][T32762] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1430.067816][ T314] netlink: 'syz.3.8570': attribute type 10 has an invalid length. [ 1430.301131][ T320] netlink: 'syz.3.8571': attribute type 21 has an invalid length. [ 1430.531253][ T316] netlink: 160444 bytes leftover after parsing attributes in process `syz.2.8567'. [ 1430.625927][ T316] openvswitch: netlink: Geneve option length err (len 1788, max 255). [ 1430.648297][ T5782] Bluetooth: hci2: unexpected subevent 0x12 length: 150 > 5 [ 1430.873795][ T324] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8572'. [ 1431.200757][ T330] netlink: 'syz.2.8575': attribute type 10 has an invalid length. [ 1431.240275][ T330] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1431.495265][ T337] netlink: 'syz.3.8577': attribute type 9 has an invalid length. [ 1431.529076][ T337] netlink: 399 bytes leftover after parsing attributes in process `syz.3.8577'. [ 1431.625379][ T341] netlink: 'syz.1.8578': attribute type 19 has an invalid length. [ 1431.643243][ T341] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8578'. [ 1431.982705][ T346] netlink: 'syz.1.8578': attribute type 10 has an invalid length. [ 1432.036245][ T346] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8578'. [ 1432.114639][ T346] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1432.720699][ T5782] Bluetooth: hci4: unexpected subevent 0x12 length: 150 > 5 [ 1433.660992][ T374] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1433.765792][ T374] bond0 (unregistering): Released all slaves [ 1433.838908][ T371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8585'. [ 1434.326557][ T385] netlink: 'syz.0.8594': attribute type 19 has an invalid length. [ 1434.334491][ T385] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8594'. [ 1434.670013][ T387] delete_channel: no stack [ 1434.789079][ T387] delete_channel: no stack [ 1434.814244][ T395] netlink: 'syz.0.8594': attribute type 10 has an invalid length. [ 1434.875166][ T395] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8594'. [ 1434.929575][ T395] bridge0: port 3(ipvlan1) entered blocking state [ 1434.958897][ T395] bridge0: port 3(ipvlan1) entered disabled state [ 1435.059843][ T395] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1436.746883][ T5782] Bluetooth: hci1: unexpected event 0x2c length: 151 > 17 [ 1436.750762][ T421] netlink: 'syz.0.8606': attribute type 28 has an invalid length. [ 1436.766227][ T421] netlink: 'syz.0.8606': attribute type 3 has an invalid length. [ 1436.776570][ T421] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8606'. [ 1437.013069][ T421] netlink: 'syz.0.8606': attribute type 39 has an invalid length. [ 1438.088006][ T435] netlink: 'syz.2.8610': attribute type 21 has an invalid length. [ 1438.140609][ T435] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8610'. [ 1439.057372][ T452] netlink: 'syz.1.8615': attribute type 19 has an invalid length. [ 1439.065274][ T452] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8615'. [ 1439.474985][ T460] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8617'. [ 1439.747332][ T467] netlink: 'syz.1.8615': attribute type 10 has an invalid length. [ 1439.786536][ T467] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8615'. [ 1439.853182][ T467] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1440.324557][ T477] netlink: 'syz.3.8624': attribute type 21 has an invalid length. [ 1440.355395][ T479] netlink: zone id is out of range [ 1440.365558][ T477] netlink: 164 bytes leftover after parsing attributes in process `syz.3.8624'. [ 1440.379203][ T479] netlink: set zone limit has 8 unknown bytes [ 1440.548073][ T481] netlink: 'syz.3.8624': attribute type 10 has an invalid length. [ 1440.569242][ T481] netlink: 55 bytes leftover after parsing attributes in process `syz.3.8624'. [ 1441.038244][ T477] netlink: 'syz.3.8624': attribute type 10 has an invalid length. [ 1441.057033][ T477] netlink: 55 bytes leftover after parsing attributes in process `syz.3.8624'. [ 1441.572400][ T500] netlink: 14 bytes leftover after parsing attributes in process `syz.0.8631'. [ 1441.873376][ T504] netlink: 'syz.3.8632': attribute type 10 has an invalid length. [ 1442.686532][ T535] netlink: 'syz.2.8643': attribute type 19 has an invalid length. [ 1442.714651][ T5782] Bluetooth: hci0: unexpected event 0x2c length: 151 > 17 [ 1442.716534][ T535] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8643'. [ 1442.735575][ T537] netlink: 'syz.3.8644': attribute type 28 has an invalid length. [ 1442.756840][ T537] netlink: 'syz.3.8644': attribute type 3 has an invalid length. [ 1442.776207][ T537] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8644'. [ 1442.895766][ T537] netlink: 'syz.3.8644': attribute type 39 has an invalid length. [ 1443.171861][ T544] netlink: 'syz.2.8643': attribute type 10 has an invalid length. [ 1443.238380][ T544] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8643'. [ 1443.257696][ T544] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1443.962810][ T562] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.8652'. [ 1444.162104][ T565] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8655'. [ 1444.563698][ T578] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8659'. [ 1444.951004][ T595] netlink: 'syz.3.8664': attribute type 3 has an invalid length. [ 1444.967650][ T595] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.8664'. [ 1444.993928][ T593] tap0: tun_chr_ioctl cmd 1074025677 [ 1445.026864][ T593] tap0: linktype set to 778 [ 1445.031742][ T590] tap0: tun_chr_ioctl cmd 1074025673 [ 1445.055616][ T590] tap0: tun_chr_ioctl cmd 1074025673 [ 1445.117313][ T592] tap0: tun_chr_ioctl cmd 2147767511 [ 1445.822424][ T619] netlink: 'syz.1.8672': attribute type 2 has an invalid length. [ 1445.843732][ T619] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.8672'. [ 1445.894984][ T621] netlink: 'syz.3.8670': attribute type 21 has an invalid length. [ 1445.909325][ T621] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8670'. [ 1446.150949][ T625] netlink: 'syz.2.8673': attribute type 19 has an invalid length. [ 1446.170055][ T625] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8673'. [ 1446.447088][ T627] netlink: 'syz.2.8673': attribute type 10 has an invalid length. [ 1446.473631][ T627] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1447.268478][ T650] netlink: 'syz.3.8682': attribute type 39 has an invalid length. [ 1448.388829][ T665] __nla_validate_parse: 1 callbacks suppressed [ 1448.388865][ T665] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8689'. [ 1448.783135][ T676] netlink: 'syz.1.8691': attribute type 19 has an invalid length. [ 1448.800365][ T676] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8691'. [ 1448.829012][ T674] netlink: 'syz.0.8690': attribute type 2 has an invalid length. [ 1448.876468][ T674] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.8690'. [ 1448.993108][ T680] netlink: 'syz.1.8691': attribute type 10 has an invalid length. [ 1449.036524][ T680] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8691'. [ 1449.086973][ T680] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1449.480627][ T684] netlink: 152 bytes leftover after parsing attributes in process `syz.2.8694'. [ 1450.374861][ T691] netlink: 'syz.0.8697': attribute type 2 has an invalid length. [ 1450.407125][ T691] netlink: 51 bytes leftover after parsing attributes in process `syz.0.8697'. [ 1450.446912][ T692] netlink: 'syz.0.8697': attribute type 2 has an invalid length. [ 1450.484664][ T692] netlink: 51 bytes leftover after parsing attributes in process `syz.0.8697'. [ 1450.843431][ T699] netlink: 'syz.2.8699': attribute type 21 has an invalid length. [ 1450.866373][ T699] netlink: 'syz.2.8699': attribute type 4 has an invalid length. [ 1450.887321][ T699] netlink: 152 bytes leftover after parsing attributes in process `syz.2.8699'. [ 1451.040849][ T702] netlink: 'syz.0.8700': attribute type 27 has an invalid length. [ 1451.072365][ T702] netlink: 164 bytes leftover after parsing attributes in process `syz.0.8700'. [ 1452.349089][ T715] netlink: 'syz.0.8706': attribute type 10 has an invalid length. [ 1452.367850][ T715] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8706'. [ 1452.396497][ T715] batman_adv: batadv0: Adding interface: vlan1 [ 1452.408682][ T720] netlink: 'syz.2.8708': attribute type 29 has an invalid length. [ 1452.417507][ T715] batman_adv: batadv0: The MTU of interface vlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1452.488733][ T715] batman_adv: batadv0: Interface activated: vlan1 [ 1452.588546][ T720] netlink: 'syz.2.8708': attribute type 29 has an invalid length. [ 1453.099967][ T733] sit0: entered allmulticast mode [ 1453.177585][ T729] netlink: 'syz.1.8711': attribute type 19 has an invalid length. [ 1453.273060][ T736] sit0: entered promiscuous mode [ 1453.334740][ T729] netlink: 'syz.1.8711': attribute type 10 has an invalid length. [ 1453.353936][ T729] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1454.792787][ T765] __nla_validate_parse: 3 callbacks suppressed [ 1454.792805][ T765] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8721'. [ 1454.812629][ T765] batman_adv: batadv0: Adding interface: vlan1 [ 1454.820094][ T765] batman_adv: batadv0: The MTU of interface vlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1454.846118][ T765] batman_adv: batadv0: Interface activated: vlan1 [ 1455.608430][ T792] validate_nla: 1 callbacks suppressed [ 1455.608448][ T792] netlink: 'syz.3.8733': attribute type 19 has an invalid length. [ 1455.666684][ T792] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8733'. [ 1455.994334][ T5782] Bluetooth: hci4: unexpected subevent 0x12 length: 150 > 5 [ 1455.998066][ T802] netlink: 'syz.3.8733': attribute type 10 has an invalid length. [ 1456.074982][ T802] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8733'. [ 1456.134593][ T802] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1456.947823][ T812] netlink: 14601 bytes leftover after parsing attributes in process `syz.0.8739'. [ 1456.995415][ T817] FAULT_INJECTION: forcing a failure. [ 1456.995415][ T817] name failslab, interval 1, probability 0, space 0, times 0 [ 1457.008146][ T817] CPU: 0 PID: 817 Comm: syz.1.8741 Not tainted syzkaller #0 [ 1457.015470][ T817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1457.025564][ T817] Call Trace: [ 1457.028891][ T817] [ 1457.031862][ T817] dump_stack_lvl+0x18c/0x250 [ 1457.036606][ T817] ? lock_chain_count+0x20/0x20 [ 1457.041505][ T817] ? show_regs_print_info+0x20/0x20 [ 1457.046757][ T817] ? load_image+0x420/0x420 [ 1457.051312][ T817] ? lockdep_hardirqs_on+0x98/0x150 [ 1457.056558][ T817] ? finish_task_switch+0x265/0x8f0 [ 1457.061807][ T817] should_fail_ex+0x39d/0x4d0 [ 1457.066541][ T817] should_failslab+0x9/0x20 [ 1457.071102][ T817] slab_pre_alloc_hook+0x59/0x310 [ 1457.076183][ T817] kmem_cache_alloc+0x5a/0x2d0 [ 1457.080992][ T817] ? skb_clone+0x1eb/0x370 [ 1457.085443][ T817] skb_clone+0x1eb/0x370 [ 1457.089725][ T817] bpf_clone_redirect+0x167/0x4a0 [ 1457.094828][ T817] bpf_prog_6893982b85ceadf7+0x5e/0x63 [ 1457.100317][ T817] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1457.106340][ T817] ? preempt_schedule+0xc0/0xd0 [ 1457.111243][ T817] ? bpf_test_run+0x174/0x870 [ 1457.115980][ T817] ? preempt_schedule_common+0x82/0xc0 [ 1457.121502][ T817] ? schedule_preempt_disabled+0x20/0x20 [ 1457.127181][ T817] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1457.133206][ T817] ? lockdep_softirqs_on+0x580/0x580 [ 1457.138540][ T817] ? lock_chain_count+0x20/0x20 [ 1457.143428][ T817] ? preempt_schedule_thunk+0x1a/0x30 [ 1457.148847][ T817] ? __local_bh_disable_ip+0x108/0x1a0 [ 1457.154347][ T817] ? __cant_sleep+0x220/0x220 [ 1457.159066][ T817] ? __local_bh_enable_ip+0x14b/0x1c0 [ 1457.164470][ T817] ? _local_bh_enable+0xa0/0xa0 [ 1457.169364][ T817] ? bpf_test_timer_continue+0x135/0x380 [ 1457.175048][ T817] ? bpf_test_run+0x174/0x870 [ 1457.179762][ T817] bpf_test_run+0x2df/0x870 [ 1457.184322][ T817] ? bpf_test_run+0x174/0x870 [ 1457.189044][ T817] ? convert___skb_to_skb+0x590/0x590 [ 1457.194468][ T817] ? eth_get_headlen+0x210/0x210 [ 1457.199462][ T817] ? slab_build_skb+0x25f/0x3f0 [ 1457.204353][ T817] ? convert___skb_to_skb+0x3d/0x590 [ 1457.209681][ T817] bpf_prog_test_run_skb+0xad2/0x12b0 [ 1457.215114][ T817] ? cpu_online+0x60/0x60 [ 1457.219484][ T817] bpf_prog_test_run+0x321/0x390 [ 1457.224458][ T817] __sys_bpf+0x49d/0x890 [ 1457.228743][ T817] ? bpf_link_show_fdinfo+0x390/0x390 [ 1457.234187][ T817] ? lock_chain_count+0x20/0x20 [ 1457.239103][ T817] __x64_sys_bpf+0x7c/0x90 [ 1457.243556][ T817] do_syscall_64+0x55/0xa0 [ 1457.248004][ T817] ? clear_bhb_loop+0x40/0x90 [ 1457.252725][ T817] ? clear_bhb_loop+0x40/0x90 [ 1457.257529][ T817] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1457.263454][ T817] RIP: 0033:0x7f0ff8f9c819 [ 1457.267897][ T817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1457.287533][ T817] RSP: 002b:00007f0ff9ec9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1457.296013][ T817] RAX: ffffffffffffffda RBX: 00007f0ff9215fa0 RCX: 00007f0ff8f9c819 [ 1457.304025][ T817] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 1457.312032][ T817] RBP: 00007f0ff9ec9090 R08: 0000000000000000 R09: 0000000000000000 [ 1457.320035][ T817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1457.328039][ T817] R13: 00007f0ff9216038 R14: 00007f0ff9215fa0 R15: 00007fff7b9a6d98 [ 1457.336082][ T817] [ 1458.344447][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1458.387564][ T834] syzkaller0: entered promiscuous mode [ 1458.393272][ T834] syzkaller0: entered allmulticast mode [ 1461.531353][ T842] netlink: 'syz.1.8748': attribute type 19 has an invalid length. [ 1461.539686][ T842] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8748'. [ 1461.559437][ T845] netlink: 'syz.1.8748': attribute type 10 has an invalid length. [ 1461.570685][ T845] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8748'. [ 1461.602053][ T845] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1463.287604][ T5782] Bluetooth: hci4: unexpected subevent 0x12 length: 150 > 5 [ 1463.894146][ T882] netlink: 'syz.0.8759': attribute type 19 has an invalid length. [ 1463.907509][ T882] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8759'. [ 1464.104173][ T889] netlink: 'syz.0.8759': attribute type 10 has an invalid length. [ 1464.112725][ T889] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8759'. [ 1464.132114][ T889] bridge0: port 3(ipvlan1) entered blocking state [ 1464.169795][ T890] netlink: 121460 bytes leftover after parsing attributes in process `syz.2.8761'. [ 1464.203487][ T889] bridge0: port 3(ipvlan1) entered disabled state [ 1464.257496][ T889] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1464.385789][ T890] netlink: 22856 bytes leftover after parsing attributes in process `syz.2.8761'. [ 1465.179807][ T903] netlink: 16222 bytes leftover after parsing attributes in process `syz.2.8764'. [ 1466.620121][ T953] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1466.647498][ T951] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1467.789854][ T976] netlink: 'syz.2.8781': attribute type 21 has an invalid length. [ 1467.949928][ T978] syzkaller0: entered promiscuous mode [ 1467.990627][ T978] syzkaller0: entered allmulticast mode [ 1468.655295][ T998] netlink: 'syz.0.8786': attribute type 28 has an invalid length. [ 1468.657772][ T5782] Bluetooth: hci1: unexpected event 0x2c length: 151 > 17 [ 1468.688911][ T998] netlink: 'syz.0.8786': attribute type 3 has an invalid length. [ 1468.749336][ T998] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8786'. [ 1471.376478][ T1000] Bluetooth: hci1: command 0x0406 tx timeout [ 1471.645219][ T996] netlink: 'syz.3.8785': attribute type 10 has an invalid length. [ 1471.654047][ T996] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1471.664180][ T999] netlink: 'syz.0.8786': attribute type 39 has an invalid length. [ 1472.185018][ T1018] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.8793'. [ 1472.654656][ T1029] netlink: 'syz.0.8795': attribute type 21 has an invalid length. [ 1472.679244][ T1029] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8795'. [ 1473.025942][ T5782] Bluetooth: hci2: unexpected subevent 0x12 length: 150 > 5 [ 1473.488826][ T5782] Bluetooth: hci2: ISO packet for unknown connection handle 10 [ 1473.961289][ T1077] netlink: 'syz.0.8809': attribute type 21 has an invalid length. [ 1473.982252][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1473.985414][ T1077] netlink: 'syz.0.8809': attribute type 1 has an invalid length. [ 1474.022107][ T1077] netlink: 144 bytes leftover after parsing attributes in process `syz.0.8809'. [ 1474.113068][ T1084] netlink: 14 bytes leftover after parsing attributes in process `syz.0.8812'. [ 1474.133594][ T1084] hsr_slave_0: left promiscuous mode [ 1474.159842][ T1084] hsr_slave_1: left promiscuous mode [ 1474.403398][ T1085] netlink: 'syz.1.8811': attribute type 21 has an invalid length. [ 1474.438553][ T1090] netlink: 199824 bytes leftover after parsing attributes in process `syz.3.8814'. [ 1474.457907][ T1085] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8811'. [ 1474.950762][ T1106] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.8820'. [ 1474.999588][ T5782] Bluetooth: hci2: unexpected subevent 0x12 length: 150 > 5 [ 1475.166647][ T1117] netlink: 'syz.3.8823': attribute type 2 has an invalid length. [ 1475.192376][ T1117] netlink: 'syz.3.8823': attribute type 1 has an invalid length. [ 1475.869878][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1476.121316][ T1145] netlink: 'syz.3.8835': attribute type 10 has an invalid length. [ 1476.690815][ T1172] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8841'. [ 1477.666798][ T1198] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.8850'. [ 1477.686741][ T1198] bridge_slave_1: default FDB implementation only supports local addresses [ 1477.792195][ T1200] netlink: 'syz.2.8851': attribute type 10 has an invalid length. [ 1478.012591][ T1215] netlink: 'syz.2.8855': attribute type 21 has an invalid length. [ 1478.027882][ T1215] netlink: 'syz.2.8855': attribute type 1 has an invalid length. [ 1478.052940][ T1215] netlink: 144 bytes leftover after parsing attributes in process `syz.2.8855'. [ 1478.285961][ T1222] netlink: 'syz.2.8858': attribute type 19 has an invalid length. [ 1478.329020][ T1222] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8858'. [ 1478.367917][ T1223] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8857'. [ 1478.697727][ T1228] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1480.134192][ T1251] validate_nla: 2 callbacks suppressed [ 1480.134244][ T1251] netlink: 'syz.1.8866': attribute type 21 has an invalid length. [ 1480.177403][ T1251] netlink: 'syz.1.8866': attribute type 1 has an invalid length. [ 1480.197936][ T1251] __nla_validate_parse: 1 callbacks suppressed [ 1480.197977][ T1251] netlink: 144 bytes leftover after parsing attributes in process `syz.1.8866'. [ 1480.322150][ T1259] netlink: 'syz.3.8870': attribute type 1 has an invalid length. [ 1480.353118][ T1260] netlink: 'syz.0.8868': attribute type 21 has an invalid length. [ 1480.384379][ T1260] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8868'. [ 1480.500660][ T1262] netlink: 'syz.1.8871': attribute type 19 has an invalid length. [ 1480.567273][ T1262] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8871'. [ 1480.907386][ T1271] netlink: 'syz.1.8871': attribute type 10 has an invalid length. [ 1480.952016][ T1271] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8871'. [ 1480.977099][ T1271] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1482.622527][ T1294] netlink: 'syz.3.8879': attribute type 21 has an invalid length. [ 1482.641935][ T1294] netlink: 'syz.3.8879': attribute type 1 has an invalid length. [ 1482.652425][ T1294] netlink: 144 bytes leftover after parsing attributes in process `syz.3.8879'. [ 1482.667636][ T1297] netlink: 14 bytes leftover after parsing attributes in process `syz.2.8881'. [ 1482.685434][ T1297] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1482.708690][ T1297] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1482.743132][ T1297] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1482.766877][ T1297] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1482.792184][ T1297] batman_adv: batadv0: Interface deactivated: veth1_virt_wifi [ 1482.812460][ T1297] batman_adv: batadv0: Removing interface: veth1_virt_wifi [ 1483.958221][ T1313] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.8884'. [ 1484.660503][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.670159][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.725600][ T1331] netlink: 152 bytes leftover after parsing attributes in process `syz.0.8890'. [ 1484.764248][ T1331] bond0: (slave bond_slave_0): Releasing backup interface [ 1484.788966][ T1331] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1485.045209][ T1334] syzkaller0: entered promiscuous mode [ 1485.089379][ T1334] syzkaller0: entered allmulticast mode [ 1486.062385][ T1360] netlink: 'syz.0.8898': attribute type 27 has an invalid length. [ 1486.086703][ T1360] netlink: 164 bytes leftover after parsing attributes in process `syz.0.8898'. [ 1488.364858][ T1347] netlink: 'syz.2.8895': attribute type 19 has an invalid length. [ 1488.373015][ T1347] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8895'. [ 1488.402484][ T1358] netlink: 'syz.2.8895': attribute type 10 has an invalid length. [ 1488.410420][ T1358] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8895'. [ 1488.421668][ T1358] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1488.441196][ T1363] netlink: 'syz.1.8899': attribute type 2 has an invalid length. [ 1488.449750][ T1363] netlink: 'syz.1.8899': attribute type 8 has an invalid length. [ 1488.458104][ T1363] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8899'. [ 1488.467696][ T1364] netlink: 'syz.1.8899': attribute type 2 has an invalid length. [ 1488.475456][ T1364] netlink: 'syz.1.8899': attribute type 8 has an invalid length. [ 1488.483626][ T1364] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8899'. [ 1488.756652][ T1376] netlink: 'syz.3.8902': attribute type 21 has an invalid length. [ 1488.764874][ T1376] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8902'. [ 1489.260457][ T1388] netlink: 'syz.0.8912': attribute type 21 has an invalid length. [ 1489.286083][ T1388] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8912'. [ 1489.552097][ T1394] netlink: 'syz.1.8908': attribute type 10 has an invalid length. [ 1489.634122][ T1397] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.8909'. [ 1490.425195][ T1410] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.8922'. [ 1490.680916][ T1419] netlink: 21 bytes leftover after parsing attributes in process `syz.1.8916'. [ 1490.714212][ T1419] ksmbd: Unknown IPC event: 0, ignore. [ 1491.123747][ T1435] validate_nla: 5 callbacks suppressed [ 1491.123803][ T1435] netlink: 'syz.2.8923': attribute type 10 has an invalid length. [ 1491.631632][ T1439] aaaaaaaaaaaaaaa: entered promiscuous mode [ 1491.903735][ T1452] netlink: 'syz.0.8928': attribute type 9 has an invalid length. [ 1491.912040][ T1452] __nla_validate_parse: 3 callbacks suppressed [ 1491.912053][ T1452] netlink: 399 bytes leftover after parsing attributes in process `syz.0.8928'. [ 1492.025626][ T1454] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.8929'. [ 1492.368270][ T1467] netlink: 'syz.1.8933': attribute type 10 has an invalid length. [ 1492.433407][ T1468] netlink: 'syz.0.8932': attribute type 21 has an invalid length. [ 1492.475668][ T1468] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8932'. [ 1493.029046][ T1481] netlink: 'syz.0.8938': attribute type 39 has an invalid length. [ 1493.289475][ T1489] netlink: 'syz.0.8941': attribute type 27 has an invalid length. [ 1493.298805][ T1489] netlink: 164 bytes leftover after parsing attributes in process `syz.0.8941'. [ 1493.723213][ T1494] netlink: 'syz.0.8942': attribute type 10 has an invalid length. [ 1493.733467][ T1494] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1494.190882][ T1508] netlink: 'syz.3.8946': attribute type 21 has an invalid length. [ 1494.227857][ T1508] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8946'. [ 1494.471495][ T1522] netlink: 'syz.0.8952': attribute type 2 has an invalid length. [ 1494.482791][ T1522] netlink: 'syz.0.8952': attribute type 8 has an invalid length. [ 1494.495547][ T1522] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8952'. [ 1494.509059][ T1522] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8952'. [ 1495.227132][ T1528] FAULT_INJECTION: forcing a failure. [ 1495.227132][ T1528] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1495.262991][ T1528] CPU: 1 PID: 1528 Comm: syz.1.8954 Not tainted syzkaller #0 [ 1495.270451][ T1528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1495.280549][ T1528] Call Trace: [ 1495.283866][ T1528] [ 1495.286833][ T1528] dump_stack_lvl+0x18c/0x250 [ 1495.291559][ T1528] ? show_regs_print_info+0x20/0x20 [ 1495.296891][ T1528] ? load_image+0x420/0x420 [ 1495.301435][ T1528] ? __lock_acquire+0x7d40/0x7d40 [ 1495.306494][ T1528] ? snprintf+0xe9/0x140 [ 1495.310780][ T1528] should_fail_ex+0x39d/0x4d0 [ 1495.315528][ T1528] _copy_to_user+0x2f/0xa0 [ 1495.319983][ T1528] simple_read_from_buffer+0xe7/0x150 [ 1495.325398][ T1528] proc_fail_nth_read+0x1e8/0x260 [ 1495.330465][ T1528] ? proc_fault_inject_write+0x360/0x360 [ 1495.336134][ T1528] ? fsnotify_perm+0x271/0x5e0 [ 1495.340972][ T1528] ? proc_fault_inject_write+0x360/0x360 [ 1495.346644][ T1528] vfs_read+0x28b/0x970 [ 1495.350857][ T1528] ? kernel_read+0x1e0/0x1e0 [ 1495.355487][ T1528] ? __fget_files+0x28/0x4b0 [ 1495.360117][ T1528] ? __fget_files+0x28/0x4b0 [ 1495.364824][ T1528] ? __fget_files+0x43d/0x4b0 [ 1495.369558][ T1528] ? __fdget_pos+0x2a3/0x330 [ 1495.374170][ T1528] ? ksys_read+0x75/0x260 [ 1495.378532][ T1528] ksys_read+0x150/0x260 [ 1495.382815][ T1528] ? vfs_write+0x990/0x990 [ 1495.387268][ T1528] ? lockdep_hardirqs_on+0x98/0x150 [ 1495.392492][ T1528] do_syscall_64+0x55/0xa0 [ 1495.396936][ T1528] ? clear_bhb_loop+0x40/0x90 [ 1495.401651][ T1528] ? clear_bhb_loop+0x40/0x90 [ 1495.406369][ T1528] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1495.412302][ T1528] RIP: 0033:0x7f0ff8f5d04e [ 1495.416749][ T1528] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1495.436391][ T1528] RSP: 002b:00007f0ff9ec8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1495.444839][ T1528] RAX: ffffffffffffffda RBX: 00007f0ff9ec96c0 RCX: 00007f0ff8f5d04e [ 1495.452825][ T1528] RDX: 000000000000000f RSI: 00007f0ff9ec90a0 RDI: 0000000000000006 [ 1495.460821][ T1528] RBP: 00007f0ff9ec9090 R08: 0000000000000000 R09: 0000000000000000 [ 1495.468819][ T1528] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1495.476815][ T1528] R13: 00007f0ff9216038 R14: 00007f0ff9215fa0 R15: 00007fff7b9a6d98 [ 1495.484829][ T1528] [ 1495.892245][ T1537] syzkaller0: entered promiscuous mode [ 1495.898306][ T1537] syzkaller0: entered allmulticast mode [ 1498.296433][ T1549] validate_nla: 2 callbacks suppressed [ 1498.296469][ T1549] netlink: 'syz.2.8961': attribute type 21 has an invalid length. [ 1498.317257][ T1549] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8961'. [ 1498.767484][ T1571] netlink: 'syz.3.8968': attribute type 21 has an invalid length. [ 1498.798474][ T1571] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8968'. [ 1498.874545][ T1577] netlink: 'syz.0.8971': attribute type 2 has an invalid length. [ 1498.883945][ T1577] netlink: 'syz.0.8971': attribute type 8 has an invalid length. [ 1498.919272][ T1577] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8971'. [ 1498.932797][ T1579] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.8972'. [ 1498.970231][ T1580] netlink: 'syz.0.8971': attribute type 2 has an invalid length. [ 1499.028965][ T1580] netlink: 'syz.0.8971': attribute type 8 has an invalid length. [ 1499.075187][ T1580] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8971'. [ 1499.154761][ T1586] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.8974'. [ 1499.255856][ T1590] netlink: 10 bytes leftover after parsing attributes in process `syz.2.8974'. [ 1499.485572][ T1599] netlink: 'syz.2.8978': attribute type 32 has an invalid length. [ 1499.495374][ T1599] mac80211_hwsim hwsim57 ..ãc¤±: left allmulticast mode [ 1499.813680][ T1605] netlink: 'syz.2.8980': attribute type 10 has an invalid length. [ 1499.822109][ T1605] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8980'. [ 1499.832507][ T1605] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 1500.013221][ T1612] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.8984'. [ 1500.315512][ T1620] netlink: 'syz.2.8985': attribute type 21 has an invalid length. [ 1500.327820][ T1620] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8985'. [ 1500.989031][ T1643] netlink: 'syz.1.8994': attribute type 10 has an invalid length. [ 1501.001835][ T1643] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 1501.708269][ T1657] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1502.124311][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1504.201043][ T1714] __nla_validate_parse: 8 callbacks suppressed [ 1504.201062][ T1714] netlink: 55631 bytes leftover after parsing attributes in process `syz.1.9020'. [ 1504.342955][ T1719] netlink: 14 bytes leftover after parsing attributes in process `syz.0.9022'. [ 1504.352580][ T1719] netlink: get zone limit has 4 unknown bytes [ 1504.375709][ T1719] validate_nla: 5 callbacks suppressed [ 1504.375723][ T1719] netlink: 'syz.0.9022': attribute type 2 has an invalid length. [ 1504.393532][ T1719] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.9022'. [ 1504.439381][ T1717] netlink: 9286 bytes leftover after parsing attributes in process `syz.1.9021'. [ 1504.631216][ T1726] netlink: 'syz.0.9025': attribute type 10 has an invalid length. [ 1504.640624][ T1726] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1504.715595][ T5782] Bluetooth: hci1: unexpected event 0x2c length: 151 > 17 [ 1504.718784][ T1730] netlink: 'syz.0.9028': attribute type 28 has an invalid length. [ 1504.735180][ T1730] netlink: 'syz.0.9028': attribute type 3 has an invalid length. [ 1504.746888][ T1730] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9028'. [ 1504.832150][ T1730] netlink: 'syz.0.9028': attribute type 39 has an invalid length. [ 1505.067541][ T1743] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.9031'. [ 1505.298502][ T1745] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.9033'. [ 1505.325899][ T1751] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9036'. [ 1505.335822][ T1751] netlink: 'syz.2.9036': attribute type 10 has an invalid length. [ 1505.520110][ T1760] delete_channel: no stack [ 1505.524792][ T1760] delete_channel: no stack [ 1505.609601][ T5782] Bluetooth: hci2: unexpected event 0x2c length: 151 > 17 [ 1505.610251][ T1764] netlink: 'syz.1.9042': attribute type 28 has an invalid length. [ 1505.626152][ T1764] netlink: 'syz.1.9042': attribute type 3 has an invalid length. [ 1505.634621][ T1764] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9042'. [ 1505.789412][ T1764] netlink: 'syz.1.9042': attribute type 39 has an invalid length. [ 1506.436033][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1506.691622][ T1783] netlink: 'syz.1.9048': attribute type 21 has an invalid length. [ 1506.716742][ T1783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9048'. [ 1509.177924][ T1870] FAULT_INJECTION: forcing a failure. [ 1509.177924][ T1870] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1509.191764][ T1870] CPU: 0 PID: 1870 Comm: syz.1.9083 Not tainted syzkaller #0 [ 1509.199177][ T1870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1509.209255][ T1870] Call Trace: [ 1509.212582][ T1870] [ 1509.215530][ T1870] dump_stack_lvl+0x18c/0x250 [ 1509.220243][ T1870] ? show_regs_print_info+0x20/0x20 [ 1509.225475][ T1870] ? load_image+0x420/0x420 [ 1509.230009][ T1870] ? __lock_acquire+0x7d40/0x7d40 [ 1509.235060][ T1870] ? snprintf+0xe9/0x140 [ 1509.239336][ T1870] should_fail_ex+0x39d/0x4d0 [ 1509.244061][ T1870] _copy_to_user+0x2f/0xa0 [ 1509.248502][ T1870] simple_read_from_buffer+0xe7/0x150 [ 1509.253960][ T1870] proc_fail_nth_read+0x1e8/0x260 [ 1509.259035][ T1870] ? proc_fault_inject_write+0x360/0x360 [ 1509.264700][ T1870] ? fsnotify_perm+0x271/0x5e0 [ 1509.269496][ T1870] ? proc_fault_inject_write+0x360/0x360 [ 1509.275165][ T1870] vfs_read+0x28b/0x970 [ 1509.279347][ T1870] ? kernel_read+0x1e0/0x1e0 [ 1509.283978][ T1870] ? __fget_files+0x28/0x4b0 [ 1509.288603][ T1870] ? __fget_files+0x28/0x4b0 [ 1509.293240][ T1870] ? __fget_files+0x43d/0x4b0 [ 1509.297980][ T1870] ? __fdget_pos+0x2a3/0x330 [ 1509.302622][ T1870] ? ksys_read+0x75/0x260 [ 1509.307020][ T1870] ksys_read+0x150/0x260 [ 1509.311322][ T1870] ? vfs_write+0x990/0x990 [ 1509.315766][ T1870] ? lockdep_hardirqs_on+0x98/0x150 [ 1509.321056][ T1870] do_syscall_64+0x55/0xa0 [ 1509.325505][ T1870] ? clear_bhb_loop+0x40/0x90 [ 1509.330211][ T1870] ? clear_bhb_loop+0x40/0x90 [ 1509.334947][ T1870] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1509.340868][ T1870] RIP: 0033:0x7f0ff8f5d04e [ 1509.345329][ T1870] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1509.364951][ T1870] RSP: 002b:00007f0ff9ec8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1509.373417][ T1870] RAX: ffffffffffffffda RBX: 00007f0ff9ec96c0 RCX: 00007f0ff8f5d04e [ 1509.381578][ T1870] RDX: 000000000000000f RSI: 00007f0ff9ec90a0 RDI: 0000000000000006 [ 1509.389607][ T1870] RBP: 00007f0ff9ec9090 R08: 0000000000000000 R09: 0000000000000000 [ 1509.397628][ T1870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1509.405640][ T1870] R13: 00007f0ff9216038 R14: 00007f0ff9215fa0 R15: 00007fff7b9a6d98 [ 1509.413659][ T1870] [ 1509.689986][ T1880] __nla_validate_parse: 10 callbacks suppressed [ 1509.690034][ T1880] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9088'. [ 1509.778908][ T1882] validate_nla: 8 callbacks suppressed [ 1509.778952][ T1882] netlink: 'syz.1.9087': attribute type 21 has an invalid length. [ 1509.818523][ T1882] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9087'. [ 1510.312934][ T1903] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.9097'. [ 1510.531495][ T1915] netlink: 'syz.0.9099': attribute type 21 has an invalid length. [ 1510.553176][ T1915] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9099'. [ 1510.725331][ T1920] netlink: 'syz.1.9103': attribute type 2 has an invalid length. [ 1510.746524][ T1920] netlink: 'syz.1.9103': attribute type 8 has an invalid length. [ 1510.765259][ T1920] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9103'. [ 1510.775767][ T1920] netlink: 'syz.1.9103': attribute type 2 has an invalid length. [ 1510.795873][ T1920] netlink: 'syz.1.9103': attribute type 8 has an invalid length. [ 1510.812257][ T1920] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9103'. [ 1511.268916][ T1937] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9109'. [ 1511.912647][ T1949] netlink: 'syz.3.9112': attribute type 21 has an invalid length. [ 1511.935717][ T1949] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9112'. [ 1512.244122][ T1963] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9119'. [ 1512.481438][ T1970] netlink: 'syz.3.9122': attribute type 10 has an invalid length. [ 1512.502762][ T1971] netlink: 'syz.3.9122': attribute type 10 has an invalid length. [ 1512.523260][ T5782] Bluetooth: hci4: unexpected subevent 0x12 length: 150 > 5 [ 1512.810461][ T1982] netlink: 'syz.3.9125': attribute type 21 has an invalid length. [ 1512.838072][ T1982] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9125'. [ 1513.998757][ T2026] tap0: tun_chr_ioctl cmd 1074025675 [ 1514.005660][ T2026] tap0: persist enabled [ 1514.015440][ T2026] tap0: tun_chr_ioctl cmd 21731 [ 1514.024264][ T2026] tap0: tun_chr_ioctl cmd 1074025675 [ 1514.031016][ T2026] tap0: persist enabled [ 1514.173092][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1514.858325][ T2069] validate_nla: 7 callbacks suppressed [ 1514.858342][ T2069] netlink: 'syz.0.9164': attribute type 19 has an invalid length. [ 1514.872434][ T2069] __nla_validate_parse: 8 callbacks suppressed [ 1514.872449][ T2069] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9164'. [ 1515.140022][ T2073] netlink: 'syz.0.9164': attribute type 10 has an invalid length. [ 1515.166111][ T2073] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9164'. [ 1515.207237][ T2073] bridge0: port 3(ipvlan1) entered blocking state [ 1515.215075][ T2073] bridge0: port 3(ipvlan1) entered disabled state [ 1515.241882][ T2073] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1515.363847][ T2075] netlink: 'syz.3.9165': attribute type 21 has an invalid length. [ 1515.424266][ T2075] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9165'. [ 1516.094892][ T2084] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.9168'. [ 1516.463975][ T2092] netlink: 'syz.3.9180': attribute type 19 has an invalid length. [ 1516.491140][ T2092] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9180'. [ 1516.742712][ T2098] netlink: 'syz.3.9180': attribute type 10 has an invalid length. [ 1516.756482][ T2098] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9180'. [ 1516.786853][ T2098] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1517.914592][ T2109] netlink: 'syz.1.9176': attribute type 21 has an invalid length. [ 1517.949590][ T2109] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9176'. [ 1518.048514][ T2113] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.9178'. [ 1518.488332][ T2120] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.9179'. [ 1518.665428][ T2125] netlink: 152 bytes leftover after parsing attributes in process `syz.1.9184'. [ 1518.865079][ T2130] netlink: 'syz.1.9185': attribute type 27 has an invalid length. [ 1518.890969][ T2130] netlink: 'syz.1.9185': attribute type 4 has an invalid length. [ 1519.561903][ T2146] netlink: 'syz.0.9191': attribute type 2 has an invalid length. [ 1519.583419][ T2146] netlink: 'syz.0.9191': attribute type 8 has an invalid length. [ 1520.224955][ T5782] Bluetooth: hci0: ISO packet for unknown connection handle 2622 [ 1520.706647][ T2164] validate_nla: 3 callbacks suppressed [ 1520.706667][ T2164] netlink: 'syz.1.9198': attribute type 29 has an invalid length. [ 1520.736733][ T2164] netlink: 'syz.1.9198': attribute type 29 has an invalid length. [ 1520.839686][ T2165] netlink: 'syz.3.9196': attribute type 27 has an invalid length. [ 1520.857286][ T2165] netlink: 'syz.3.9196': attribute type 4 has an invalid length. [ 1520.873860][ T2165] __nla_validate_parse: 5 callbacks suppressed [ 1520.873898][ T2165] netlink: 152 bytes leftover after parsing attributes in process `syz.3.9196'. [ 1520.937123][ T2169] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.9200'. [ 1521.480210][ T2185] netlink: 'syz.1.9203': attribute type 21 has an invalid length. [ 1521.498060][ T2185] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9203'. [ 1522.014368][ T2196] netlink: 'syz.1.9210': attribute type 19 has an invalid length. [ 1522.024872][ T2196] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9210'. [ 1522.374949][ T2203] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9212'. [ 1522.655563][ T2196] netlink: 'syz.1.9210': attribute type 10 has an invalid length. [ 1522.717530][ T2196] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9210'. [ 1522.870539][ T2196] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1523.021670][ T2209] netlink: 'syz.0.9213': attribute type 27 has an invalid length. [ 1523.085965][ T2209] netlink: 'syz.0.9213': attribute type 4 has an invalid length. [ 1523.116084][ T2209] netlink: 152 bytes leftover after parsing attributes in process `syz.0.9213'. [ 1523.256813][ T2215] netlink: 'syz.2.9215': attribute type 21 has an invalid length. [ 1523.306681][ T2215] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9215'. [ 1523.908882][ T2233] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9223'. [ 1523.955530][ T2233] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9223'. [ 1524.575085][ T5782] Bluetooth: hci4: ISO packet for unknown connection handle 2622 [ 1524.821107][ T2247] mac80211_hwsim hwsim66 wlan0: entered promiscuous mode [ 1524.842293][ T2247] mac80211_hwsim hwsim66 wlan0: entered allmulticast mode [ 1525.684777][ T2271] FAULT_INJECTION: forcing a failure. [ 1525.684777][ T2271] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1525.716737][ T2271] CPU: 0 PID: 2271 Comm: syz.2.9237 Not tainted syzkaller #0 [ 1525.724190][ T2271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1525.734270][ T2271] Call Trace: [ 1525.737569][ T2271] [ 1525.740521][ T2271] dump_stack_lvl+0x18c/0x250 [ 1525.745239][ T2271] ? show_regs_print_info+0x20/0x20 [ 1525.750478][ T2271] ? load_image+0x420/0x420 [ 1525.755007][ T2271] ? __might_fault+0xaa/0x120 [ 1525.759708][ T2271] ? __lock_acquire+0x7d40/0x7d40 [ 1525.764759][ T2271] should_fail_ex+0x39d/0x4d0 [ 1525.769470][ T2271] _copy_from_user+0x2f/0xe0 [ 1525.774125][ T2271] ___sys_sendmsg+0x1c7/0x360 [ 1525.778832][ T2271] ? __sys_sendmsg+0x2a0/0x2a0 [ 1525.783648][ T2271] __se_sys_sendmsg+0x1c2/0x2b0 [ 1525.788515][ T2271] ? __x64_sys_sendmsg+0x80/0x80 [ 1525.793498][ T2271] do_syscall_64+0x55/0xa0 [ 1525.797931][ T2271] ? clear_bhb_loop+0x40/0x90 [ 1525.802628][ T2271] ? clear_bhb_loop+0x40/0x90 [ 1525.807346][ T2271] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1525.813255][ T2271] RIP: 0033:0x7ff8adb9c819 [ 1525.817731][ T2271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1525.837374][ T2271] RSP: 002b:00007ff8aea0e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1525.845828][ T2271] RAX: ffffffffffffffda RBX: 00007ff8ade15fa0 RCX: 00007ff8adb9c819 [ 1525.853838][ T2271] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 1525.861931][ T2271] RBP: 00007ff8aea0e090 R08: 0000000000000000 R09: 0000000000000000 [ 1525.869926][ T2271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1525.877924][ T2271] R13: 00007ff8ade16038 R14: 00007ff8ade15fa0 R15: 00007ffe1c14a308 [ 1525.885970][ T2271] [ 1525.947655][ T5782] Bluetooth: hci2: ISO packet for unknown connection handle 2622 [ 1526.448160][ T2281] validate_nla: 6 callbacks suppressed [ 1526.448257][ T2281] netlink: 'syz.0.9248': attribute type 21 has an invalid length. [ 1526.484097][ T2281] __nla_validate_parse: 4 callbacks suppressed [ 1526.484115][ T2281] netlink: 16166 bytes leftover after parsing attributes in process `syz.0.9248'. [ 1526.561899][ T2281] netlink: 'syz.0.9248': attribute type 1 has an invalid length. [ 1526.601965][ T2281] netlink: 15999 bytes leftover after parsing attributes in process `syz.0.9248'. [ 1526.612490][ T2285] netlink: 'syz.1.9241': attribute type 10 has an invalid length. [ 1526.903581][ T2288] netlink: 'syz.2.9242': attribute type 10 has an invalid length. [ 1527.777446][ T2307] netlink: 'syz.2.9246': attribute type 21 has an invalid length. [ 1527.831629][ T2307] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9246'. [ 1527.843683][ T2312] netlink: 'syz.0.9251': attribute type 29 has an invalid length. [ 1527.955593][ T2312] netlink: 'syz.0.9251': attribute type 29 has an invalid length. [ 1528.598128][ T2323] netlink: 'syz.0.9255': attribute type 10 has an invalid length. [ 1528.633711][ T2323] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1528.924185][ T2335] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9260'. [ 1529.275897][ T2346] netlink: 'syz.1.9263': attribute type 10 has an invalid length. [ 1529.286804][ T2345] netlink: 'syz.0.9262': attribute type 10 has an invalid length. [ 1529.352428][ T2348] netlink: 121460 bytes leftover after parsing attributes in process `syz.2.9264'. [ 1529.365781][ T2348] netlink: 22856 bytes leftover after parsing attributes in process `syz.2.9264'. [ 1530.833122][ T2399] syzkaller0: entered promiscuous mode [ 1530.861157][ T2399] syzkaller0: entered allmulticast mode [ 1532.217433][ T2434] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1532.377444][ T2444] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.9294'. [ 1535.989363][ T2508] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1537.228614][ T2498] validate_nla: 1 callbacks suppressed [ 1537.228629][ T2498] netlink: 'syz.1.9310': attribute type 2 has an invalid length. [ 1537.242124][ T2498] netlink: 'syz.1.9310': attribute type 8 has an invalid length. [ 1537.249944][ T2498] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9310'. [ 1537.260000][ T2503] netlink: 'syz.1.9310': attribute type 2 has an invalid length. [ 1537.267819][ T2503] netlink: 'syz.1.9310': attribute type 8 has an invalid length. [ 1537.275555][ T2503] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9310'. [ 1537.287191][ T2506] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9311'. [ 1537.968208][ T2540] netlink: 'syz.3.9320': attribute type 10 has an invalid length. [ 1537.976225][ T2540] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9320'. [ 1538.031630][ T2540] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1538.257650][ T5782] Bluetooth: hci1: unexpected event 0x2c length: 151 > 17 [ 1538.286398][ T2542] netlink: 'syz.0.9322': attribute type 28 has an invalid length. [ 1538.316408][ T2542] netlink: 'syz.0.9322': attribute type 3 has an invalid length. [ 1538.324222][ T2542] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9322'. [ 1538.493801][ T2542] netlink: 'syz.0.9322': attribute type 39 has an invalid length. [ 1539.391169][ T5782] Bluetooth: hci2: unexpected event 0x2c length: 151 > 17 [ 1539.394430][ T2568] netlink: 'syz.1.9331': attribute type 28 has an invalid length. [ 1539.436551][ T2568] netlink: 'syz.1.9331': attribute type 3 has an invalid length. [ 1539.448140][ T2568] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9331'. [ 1539.986662][ T2575] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9332'. [ 1539.999945][ T2575] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9332'. [ 1540.189600][ T2577] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1540.197795][ T2577] IPv6: NLM_F_CREATE should be set when creating new route [ 1540.206011][ T2577] IPv6: NLM_F_CREATE should be set when creating new route [ 1540.214098][ T2577] IPv6: NLM_F_CREATE should be set when creating new route [ 1540.862388][ T2592] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9336'. [ 1540.923023][ T2592] bridge0: port 3(ipvlan1) entered blocking state [ 1541.001300][ T2592] bridge0: port 3(ipvlan1) entered disabled state [ 1541.101016][ T2592] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1541.981140][ T5782] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 1543.844344][ T2639] syzkaller0: entered promiscuous mode [ 1543.871410][ T2639] syzkaller0: entered allmulticast mode [ 1544.363161][ T5782] Bluetooth: hci1: unexpected subevent 0x12 length: 150 > 5 [ 1545.135696][ T2658] validate_nla: 12 callbacks suppressed [ 1545.135826][ T2658] netlink: 'syz.3.9355': attribute type 21 has an invalid length. [ 1546.103518][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.119334][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1547.840435][ T2654] netlink: 'syz.1.9352': attribute type 10 has an invalid length. [ 1547.853426][ T2654] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9352'. [ 1547.863219][ T2654] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1548.250152][ T2668] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9357'. [ 1548.366989][ T2670] netlink: 'syz.2.9358': attribute type 2 has an invalid length. [ 1548.395633][ T2670] netlink: 'syz.2.9358': attribute type 8 has an invalid length. [ 1548.416157][ T2670] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9358'. [ 1548.469377][ T2678] netlink: 'syz.2.9358': attribute type 2 has an invalid length. [ 1548.503934][ T2678] netlink: 'syz.2.9358': attribute type 8 has an invalid length. [ 1548.544945][ T2678] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9358'. [ 1549.367613][ T2684] netlink: 'syz.3.9362': attribute type 10 has an invalid length. [ 1549.402072][ T2684] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1549.433401][ T2684] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1549.465359][ T2684] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1549.485297][ T2684] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1549.549512][ T2684] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1549.587220][ T2684] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1549.607018][ T2684] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1549.615845][ T2684] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1549.655339][ T2684] team0: Port device geneve1 added [ 1550.078636][ T5782] Bluetooth: hci1: unexpected subevent 0x12 length: 150 > 5 [ 1550.131562][ T2704] netlink: 'syz.1.9367': attribute type 10 has an invalid length. [ 1550.207350][ T2710] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.9368'. [ 1550.782789][ T2749] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.9380'. [ 1550.844022][ T2753] netlink: 'syz.1.9382': attribute type 3 has an invalid length. [ 1550.854923][ T2753] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.9382'. [ 1551.048246][ T2755] netlink: 'syz.1.9383': attribute type 21 has an invalid length. [ 1551.056765][ T2755] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9383'. [ 1551.513019][ T2777] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.9392'. [ 1551.796587][ T2800] netlink: 'syz.2.9395': attribute type 21 has an invalid length. [ 1551.804748][ T2800] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9395'. [ 1551.826405][ T2801] netlink: 'syz.1.9398': attribute type 2 has an invalid length. [ 1551.834187][ T2801] netlink: 'syz.1.9398': attribute type 8 has an invalid length. [ 1551.853679][ T2801] netlink: 'syz.1.9398': attribute type 2 has an invalid length. [ 1551.863714][ T2801] netlink: 'syz.1.9398': attribute type 8 has an invalid length. [ 1552.514589][ T2834] netlink: 'syz.3.9409': attribute type 21 has an invalid length. [ 1552.903589][ T2854] __nla_validate_parse: 5 callbacks suppressed [ 1552.903606][ T2854] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9416'. [ 1553.877922][ T2875] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.9425'. [ 1554.038420][ T2879] netlink: 44 bytes leftover after parsing attributes in process `syz.3.9426'. [ 1554.527708][ T1000] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1554.540359][ T1000] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1554.557292][ T1000] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1554.565335][ T1000] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1554.587323][ T1000] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1554.604448][ T1000] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1554.787955][T10207] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1554.893677][T10207] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1554.979949][T10207] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1555.056156][T10207] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1555.204455][ T2913] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9436'. [ 1555.220365][ T2890] chnl_net:caif_netlink_parms(): no params data found [ 1555.295313][ T2916] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.9435'. [ 1555.522638][ T2890] bridge0: port 1(bridge_slave_0) entered blocking state [ 1555.535327][ T2890] bridge0: port 1(bridge_slave_0) entered disabled state [ 1555.545149][ T2890] bridge_slave_0: entered allmulticast mode [ 1555.559308][ T2890] bridge_slave_0: entered promiscuous mode [ 1555.571354][ T2890] bridge0: port 2(bridge_slave_1) entered blocking state [ 1555.579188][ T2890] bridge0: port 2(bridge_slave_1) entered disabled state [ 1555.590255][ T2890] bridge_slave_1: entered allmulticast mode [ 1555.599172][ T2890] bridge_slave_1: entered promiscuous mode [ 1555.940235][ T2890] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1556.080107][ T2934] netlink: 'syz.1.9440': attribute type 21 has an invalid length. [ 1556.091052][ T2934] netlink: 'syz.1.9440': attribute type 30 has an invalid length. [ 1556.124713][ T2935] netlink: 'syz.1.9440': attribute type 21 has an invalid length. [ 1556.151675][ T2935] netlink: 'syz.1.9440': attribute type 30 has an invalid length. [ 1556.188827][ T2890] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1556.629192][ T2890] team0: Port device team_slave_0 added [ 1556.666687][ T1000] Bluetooth: hci3: command tx timeout [ 1556.673125][ T2890] team0: Port device team_slave_1 added [ 1556.894205][ T2955] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.9444'. [ 1557.051984][ T2890] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1557.081646][ T2890] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1557.140944][ T2890] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1557.182824][ T2890] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1557.217348][ T2890] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1557.286574][ T2890] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1557.355911][ T2958] netlink: 152 bytes leftover after parsing attributes in process `syz.2.9445'. [ 1557.533107][ T2890] hsr_slave_0: entered promiscuous mode [ 1557.598408][ T2890] hsr_slave_1: entered promiscuous mode [ 1558.746610][ T1000] Bluetooth: hci3: command tx timeout [ 1559.023490][ T2992] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.9454'. [ 1559.176055][T10207] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1559.203846][T10207] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1559.314572][T10207] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1559.347878][T10207] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1559.377543][T10207] batman_adv: batadv0: Interface deactivated: vlan1 [ 1559.384226][T10207] batman_adv: batadv0: Removing interface: vlan1 [ 1559.440182][T10207] veth1_macvtap: left promiscuous mode [ 1559.457610][T10207] veth0_macvtap: left promiscuous mode [ 1559.463291][T10207] veth1_vlan: left promiscuous mode [ 1559.482258][T10207] veth0_vlan: left promiscuous mode [ 1559.805933][ T3007] netlink: 'syz.2.9459': attribute type 29 has an invalid length. [ 1559.838663][T10207] team0 (unregistering): Port device geneve1 removed [ 1560.347126][T10207] team0 (unregistering): Port device 0 removed [ 1560.409878][T10207] team0 (unregistering): Port device team_slave_0 removed [ 1560.826465][ T1000] Bluetooth: hci3: command tx timeout [ 1560.906198][ T3007] netlink: 'syz.2.9459': attribute type 29 has an invalid length. [ 1561.254927][ T2890] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1561.358774][ T2890] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1561.386710][ T2890] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1561.408271][ T2890] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1561.591357][ T2890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1561.658069][ T2890] 8021q: adding VLAN 0 to HW filter on device team0 [ 1561.680441][ T72] bridge0: port 1(bridge_slave_0) entered blocking state [ 1561.687719][ T72] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1561.746930][ T72] bridge0: port 2(bridge_slave_1) entered blocking state [ 1561.754119][ T72] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1562.290773][ T2890] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1562.415922][ T2890] veth0_vlan: entered promiscuous mode [ 1562.452332][ T2890] veth1_vlan: entered promiscuous mode [ 1562.529980][ T2890] veth0_macvtap: entered promiscuous mode [ 1562.559273][ T2890] veth1_macvtap: entered promiscuous mode [ 1562.593984][ T2890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1562.604662][ T2890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1562.616632][ T2890] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1562.640214][ T2890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1562.666323][ T2890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1562.696289][ T2890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1562.716515][ T2890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1562.748758][ T2890] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1562.788647][ T2890] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1562.815375][ T2890] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1562.832663][ T2890] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1562.852914][ T2890] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1562.887907][ T3061] netlink: 'syz.2.9472': attribute type 64 has an invalid length. [ 1562.898852][ T1000] Bluetooth: hci3: command tx timeout [ 1563.143412][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1563.161975][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1563.304416][ T72] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1563.339131][ T72] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1563.392945][ T3086] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9477'. [ 1564.598024][ T3131] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.9490'. [ 1565.324373][ T3145] FAULT_INJECTION: forcing a failure. [ 1565.324373][ T3145] name failslab, interval 1, probability 0, space 0, times 0 [ 1565.381020][ T3145] CPU: 1 PID: 3145 Comm: syz.0.9497 Not tainted syzkaller #0 [ 1565.388499][ T3145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1565.398594][ T3145] Call Trace: [ 1565.401895][ T3145] [ 1565.404884][ T3145] dump_stack_lvl+0x18c/0x250 [ 1565.409611][ T3145] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1565.415801][ T3145] ? show_regs_print_info+0x20/0x20 [ 1565.421047][ T3145] ? load_image+0x420/0x420 [ 1565.425606][ T3145] should_fail_ex+0x39d/0x4d0 [ 1565.430319][ T3145] should_failslab+0x9/0x20 [ 1565.434845][ T3145] slab_pre_alloc_hook+0x59/0x310 [ 1565.439896][ T3145] kmem_cache_alloc_node+0x60/0x320 [ 1565.445126][ T3145] ? __alloc_skb+0xb5/0x2c0 [ 1565.449688][ T3145] ? __alloc_skb+0x103/0x2c0 [ 1565.454324][ T3145] __alloc_skb+0x103/0x2c0 [ 1565.458798][ T3145] netlink_sendmsg+0x66a/0xbf0 [ 1565.463604][ T3145] ? netlink_getsockopt+0x590/0x590 [ 1565.468834][ T3145] ? aa_sock_msg_perm+0x94/0x150 [ 1565.473820][ T3145] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1565.479132][ T3145] ? security_socket_sendmsg+0x80/0xa0 [ 1565.484611][ T3145] ? netlink_getsockopt+0x590/0x590 [ 1565.489846][ T3145] ____sys_sendmsg+0x5ba/0x960 [ 1565.494634][ T3145] ? __asan_memset+0x22/0x40 [ 1565.499261][ T3145] ? __sys_sendmsg_sock+0x30/0x30 [ 1565.504294][ T3145] ? __import_iovec+0x5f2/0x850 [ 1565.509164][ T3145] ? import_iovec+0x73/0xa0 [ 1565.513707][ T3145] ___sys_sendmsg+0x2a6/0x360 [ 1565.518405][ T3145] ? __sys_sendmsg+0x2a0/0x2a0 [ 1565.523222][ T3145] __se_sys_sendmsg+0x1c2/0x2b0 [ 1565.528094][ T3145] ? __x64_sys_sendmsg+0x80/0x80 [ 1565.533067][ T3145] ? syscall_enter_from_user_mode+0x2e/0x80 [ 1565.538984][ T3145] do_syscall_64+0x55/0xa0 [ 1565.543416][ T3145] ? clear_bhb_loop+0x40/0x90 [ 1565.548116][ T3145] ? clear_bhb_loop+0x40/0x90 [ 1565.552819][ T3145] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1565.558748][ T3145] RIP: 0033:0x7f28ca39c819 [ 1565.563195][ T3145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1565.582828][ T3145] RSP: 002b:00007f28cb329028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1565.591259][ T3145] RAX: ffffffffffffffda RBX: 00007f28ca615fa0 RCX: 00007f28ca39c819 [ 1565.599341][ T3145] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 1565.607335][ T3145] RBP: 00007f28cb329090 R08: 0000000000000000 R09: 0000000000000000 [ 1565.615320][ T3145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1565.623303][ T3145] R13: 00007f28ca616038 R14: 00007f28ca615fa0 R15: 00007ffe6f8e5f68 [ 1565.631315][ T3145] [ 1565.713584][ T3155] netlink: 'syz.1.9498': attribute type 9 has an invalid length. [ 1565.733288][ T3155] netlink: 399 bytes leftover after parsing attributes in process `syz.1.9498'. [ 1565.796503][ T3156] netlink: 'syz.2.9493': attribute type 10 has an invalid length. [ 1566.144581][ T3137] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.9493'. [ 1566.154548][ T3137] bridge_slave_1: default FDB implementation only supports local addresses [ 1566.305123][ T3174] netlink: 'syz.0.9503': attribute type 21 has an invalid length. [ 1566.349294][ T3174] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9503'. [ 1566.631223][ T3181] netlink: 'syz.2.9507': attribute type 2 has an invalid length. [ 1566.641115][ T3181] netlink: 'syz.2.9507': attribute type 8 has an invalid length. [ 1566.651483][ T3181] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9507'. [ 1566.665018][ T3181] netlink: 'syz.2.9507': attribute type 2 has an invalid length. [ 1566.674778][ T3184] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.9505'. [ 1566.675057][ T3181] netlink: 'syz.2.9507': attribute type 8 has an invalid length. [ 1566.722504][ T3181] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9507'. [ 1566.870475][ T3188] netlink: 'syz.3.9509': attribute type 10 has an invalid length. [ 1566.897056][ T3188] bridge0: port 2(bridge_slave_1) entered disabled state [ 1566.910177][ T3188] bridge0: port 1(bridge_slave_0) entered disabled state [ 1567.083781][ T3188] bridge0: port 2(bridge_slave_1) entered blocking state [ 1567.092275][ T3188] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1567.101984][ T3188] bridge0: port 1(bridge_slave_0) entered blocking state [ 1567.110554][ T3188] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1567.139495][ T3188] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1567.157961][ T3192] netlink: 'syz.1.9510': attribute type 10 has an invalid length. [ 1567.360246][ T3206] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.9512'. [ 1567.462999][ T3208] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9513'. [ 1567.663296][ T3213] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.9516'. [ 1568.366210][ T3234] validate_nla: 1 callbacks suppressed [ 1568.371925][ T3234] netlink: 'syz.1.9525': attribute type 21 has an invalid length. [ 1568.550370][ T3237] netlink: 'syz.1.9526': attribute type 10 has an invalid length. [ 1568.886533][ T3254] netlink: 'syz.3.9533': attribute type 10 has an invalid length. [ 1568.894960][ T3254] bridge0: port 2(bridge_slave_1) entered disabled state [ 1568.902379][ T3254] bridge0: port 1(bridge_slave_0) entered disabled state [ 1569.031620][ T3260] netlink: 'syz.3.9536': attribute type 10 has an invalid length. [ 1569.922996][ T3302] netlink: 'syz.0.9553': attribute type 4 has an invalid length. [ 1569.960552][ T3302] __nla_validate_parse: 2 callbacks suppressed [ 1569.960568][ T3302] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.9553'. [ 1570.023160][ T3305] netlink: 'syz.2.9554': attribute type 7 has an invalid length. [ 1570.261543][ T3318] netlink: 'syz.0.9560': attribute type 2 has an invalid length. [ 1570.269584][ T3318] netlink: 'syz.0.9560': attribute type 8 has an invalid length. [ 1570.290335][ T3318] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9560'. [ 1570.301163][ T3318] netlink: 'syz.0.9560': attribute type 2 has an invalid length. [ 1570.309602][ T3318] netlink: 'syz.0.9560': attribute type 8 has an invalid length. [ 1570.333490][ T3318] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9560'. [ 1570.894056][ T3331] wg2: entered promiscuous mode [ 1570.903033][ T3331] wg2: entered allmulticast mode [ 1571.427360][ T3355] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1571.673947][ T3375] netlink: 144 bytes leftover after parsing attributes in process `syz.2.9579'. [ 1571.688027][ T3375] C: left promiscuous mode [ 1571.692859][ T3375] C: left allmulticast mode [ 1571.719668][ T3375] team0: Port device C removed [ 1571.725093][ T3375] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1573.150015][ T3423] syzkaller0: entered promiscuous mode [ 1573.155637][ T3423] syzkaller0: entered allmulticast mode [ 1573.356993][ T5782] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1573.366426][ T5782] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1573.376750][ T5782] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1573.394223][ T5782] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1573.402275][ T5782] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1573.410151][ T5782] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1573.480389][T10207] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1575.291691][T10207] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1575.415690][T10207] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1575.456426][ T5782] Bluetooth: hci0: command tx timeout [ 1575.652154][ T3458] validate_nla: 2 callbacks suppressed [ 1575.652173][ T3458] netlink: 'syz.0.9605': attribute type 2 has an invalid length. [ 1575.687040][ T3458] netlink: 'syz.0.9605': attribute type 8 has an invalid length. [ 1575.694892][ T3458] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9605'. [ 1575.732756][ T3458] netlink: 'syz.0.9605': attribute type 2 has an invalid length. [ 1575.740822][ T3458] netlink: 'syz.0.9605': attribute type 8 has an invalid length. [ 1575.755884][ T3458] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9605'. [ 1575.776053][ T3426] chnl_net:caif_netlink_parms(): no params data found [ 1575.841538][T10207] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1576.165323][ T3426] bridge0: port 1(bridge_slave_0) entered blocking state [ 1576.173038][ T3426] bridge0: port 1(bridge_slave_0) entered disabled state [ 1576.183538][ T3426] bridge_slave_0: entered allmulticast mode [ 1576.208930][ T3426] bridge_slave_0: entered promiscuous mode [ 1576.269273][ T3426] bridge0: port 2(bridge_slave_1) entered blocking state [ 1576.310362][ T3426] bridge0: port 2(bridge_slave_1) entered disabled state [ 1576.331462][ T3426] bridge_slave_1: entered allmulticast mode [ 1576.376521][ T3426] bridge_slave_1: entered promiscuous mode [ 1576.707494][ T3470] netlink: 'syz.3.9608': attribute type 29 has an invalid length. [ 1576.767625][ T3468] netlink: 'syz.1.9607': attribute type 10 has an invalid length. [ 1576.775552][ T3468] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9607'. [ 1576.857580][ T3468] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1576.972533][ T3426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1577.022840][ T3470] netlink: 'syz.3.9608': attribute type 29 has an invalid length. [ 1577.078214][ T3426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1577.249651][ T3426] team0: Port device team_slave_0 added [ 1577.276203][T10207] tipc: Left network mode [ 1577.299428][ T3426] team0: Port device team_slave_1 added [ 1577.422455][ T3477] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.9609'. [ 1577.537014][ T5782] Bluetooth: hci0: command tx timeout [ 1578.149570][ T3426] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1578.169768][ T3426] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1578.214262][ T3426] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1578.314919][ T3426] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1578.347006][ T3426] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1578.389768][ T3426] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1578.845984][ T3426] hsr_slave_0: entered promiscuous mode [ 1578.882732][ T3426] hsr_slave_1: entered promiscuous mode [ 1578.898583][ T3426] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1578.926638][ T3426] Cannot create hsr debugfs directory [ 1579.616535][ T5782] Bluetooth: hci0: command tx timeout [ 1580.114380][ T3521] netlink: 'syz.1.9618': attribute type 2 has an invalid length. [ 1580.126603][ T3521] netlink: 'syz.1.9618': attribute type 8 has an invalid length. [ 1580.144701][ T3521] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9618'. [ 1580.166911][ T3526] netlink: 'syz.1.9618': attribute type 2 has an invalid length. [ 1580.193405][ T3526] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9618'. [ 1580.644823][T10207] veth1_macvtap: left promiscuous mode [ 1580.652909][T10207] veth0_macvtap: left promiscuous mode [ 1580.658996][T10207] veth1_vlan: left promiscuous mode [ 1580.664417][T10207] veth0_vlan: left promiscuous mode [ 1580.724121][ T5782] Bluetooth: hci1: unexpected event 0x2c length: 151 > 17 [ 1580.760319][ T3545] validate_nla: 1 callbacks suppressed [ 1580.760356][ T3545] netlink: 'syz.0.9625': attribute type 28 has an invalid length. [ 1580.802698][ T3545] netlink: 'syz.0.9625': attribute type 3 has an invalid length. [ 1580.846458][ T3545] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9625'. [ 1581.696615][ T5782] Bluetooth: hci0: command tx timeout [ 1582.473375][T10207] team_slave_1 (unregistering): left promiscuous mode [ 1582.481205][T10207] team_slave_1 (unregistering): left allmulticast mode [ 1582.499874][T10207] team0 (unregistering): Port device team_slave_1 removed [ 1582.615890][T10207] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1583.158190][T10207] bond0 (unregistering): Released all slaves [ 1583.311680][ T3549] netlink: 'syz.0.9625': attribute type 39 has an invalid length. [ 1583.345057][ T3551] netlink: 'syz.3.9626': attribute type 10 has an invalid length. [ 1583.376659][ T3551] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9626'. [ 1583.386075][ T3551] ipvlan1: entered promiscuous mode [ 1583.396393][ T3551] ipvlan1: entered allmulticast mode [ 1583.401765][ T3551] veth0_vlan: entered allmulticast mode [ 1583.438873][ T3551] bridge0: port 3(ipvlan1) entered blocking state [ 1583.445489][ T3551] bridge0: port 3(ipvlan1) entered disabled state [ 1583.483393][ T3551] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1583.543643][ T3426] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1583.634607][ T3426] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1583.670550][ T3426] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1583.732360][ T3426] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1584.288683][ T3426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1584.497277][ T3426] 8021q: adding VLAN 0 to HW filter on device team0 [ 1584.550630][T25582] bridge0: port 1(bridge_slave_0) entered blocking state [ 1584.557909][T25582] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1584.585974][T25582] bridge0: port 2(bridge_slave_1) entered blocking state [ 1584.593258][T25582] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1585.020124][ T3426] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1585.062329][ T3574] netlink: 'syz.1.9632': attribute type 10 has an invalid length. [ 1585.878492][ T3426] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1585.941642][ T3591] netlink: 'syz.3.9634': attribute type 2 has an invalid length. [ 1585.955880][ T3593] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.9635'. [ 1585.987876][ T3591] netlink: 'syz.3.9634': attribute type 8 has an invalid length. [ 1585.995744][ T3591] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9634'. [ 1586.042589][ T3594] netlink: 'syz.3.9634': attribute type 2 has an invalid length. [ 1586.059953][ T3594] netlink: 'syz.3.9634': attribute type 8 has an invalid length. [ 1586.086619][ T3594] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9634'. [ 1586.205672][ T3426] veth0_vlan: entered promiscuous mode [ 1586.234079][ T3426] veth1_vlan: entered promiscuous mode [ 1586.291174][ T3426] veth0_macvtap: entered promiscuous mode [ 1586.308636][ T3426] veth1_macvtap: entered promiscuous mode [ 1586.349080][ T3426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1586.386407][ T3426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1586.404087][ T3426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1586.419158][ T3426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1586.441493][ T3426] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1586.474078][ T3426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1586.507532][ T3426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1586.529210][ T3426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1586.540096][ T3426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1586.550384][ T3426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1586.569489][ T5782] Bluetooth: hci1: unexpected event 0x2c length: 151 > 17 [ 1586.570210][ T3609] netlink: 'syz.0.9639': attribute type 3 has an invalid length. [ 1586.595695][ T3426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1586.608501][ T3426] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1586.626141][ T3609] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9639'. [ 1586.648958][ T3426] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1586.666293][ T3426] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1586.685543][ T3426] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1586.716350][ T3426] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1586.750583][ T3607] netlink: 'syz.0.9639': attribute type 39 has an invalid length. [ 1586.939103][ T3615] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9640'. [ 1586.939915][T10221] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1586.983546][T10221] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1587.014185][ T3621] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9641'. [ 1587.105308][ T72] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1587.123530][ T72] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1587.451040][ T3629] netlink: 'syz.2.9594': attribute type 10 has an invalid length. [ 1587.540510][ T3629] bridge0: port 2(bridge_slave_1) entered disabled state [ 1587.572668][ T3629] bridge0: port 1(bridge_slave_0) entered disabled state [ 1587.951772][ T3629] bridge0: port 2(bridge_slave_1) entered blocking state [ 1587.962399][ T3629] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1587.986250][ T3629] bridge0: port 1(bridge_slave_0) entered blocking state [ 1587.997363][ T3629] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1588.536194][ T3629] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1588.618336][ T3637] netlink: 'syz.0.9642': attribute type 10 has an invalid length. [ 1588.676896][ T3637] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9642'. [ 1588.697395][ T3637] bridge0: port 3(ipvlan1) entered blocking state [ 1588.717639][ T3637] bridge0: port 3(ipvlan1) entered disabled state [ 1588.800466][ T3637] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1589.372145][ T3651] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9645'. [ 1589.823794][ T3663] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9649'. [ 1590.151703][ T3677] netlink: 'syz.3.9654': attribute type 2 has an invalid length. [ 1590.159889][ T3677] netlink: 'syz.3.9654': attribute type 8 has an invalid length. [ 1590.191898][ T3677] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9654'. [ 1590.984905][ T3712] __nla_validate_parse: 3 callbacks suppressed [ 1590.984922][ T3712] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9665'. [ 1591.218595][ T3723] validate_nla: 3 callbacks suppressed [ 1591.218640][ T3723] netlink: 'syz.1.9666': attribute type 16 has an invalid length. [ 1591.244648][ T3723] netlink: 'syz.1.9666': attribute type 3 has an invalid length. [ 1591.253013][ T3723] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9666'. [ 1592.034382][ T3762] netlink: 'syz.2.9684': attribute type 10 has an invalid length. [ 1592.051403][ T3762] bridge0: port 2(bridge_slave_1) entered disabled state [ 1592.062266][ T3762] bridge0: port 1(bridge_slave_0) entered disabled state [ 1592.632964][ T3772] syzkaller0: entered promiscuous mode [ 1592.639565][ T3772] syzkaller0: entered allmulticast mode [ 1592.794249][ T3781] netlink: 'syz.2.9688': attribute type 21 has an invalid length. [ 1593.524827][ T3799] netlink: 'syz.0.9694': attribute type 3 has an invalid length. [ 1594.869009][ T3805] netlink: 'syz.3.9697': attribute type 10 has an invalid length. [ 1595.253183][ T3823] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9703'. [ 1595.271079][ T3826] netlink: 'syz.0.9701': attribute type 21 has an invalid length. [ 1595.315636][ T3826] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9701'. [ 1595.362923][ T3829] netlink: 'syz.3.9704': attribute type 21 has an invalid length. [ 1595.391944][ T3829] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9704'. [ 1595.565121][ T3836] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9706'. [ 1596.013579][ T3853] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9714'. [ 1596.261675][ T3862] netlink: 'syz.2.9715': attribute type 21 has an invalid length. [ 1596.284596][ T3862] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9715'. [ 1596.433475][ T3866] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.9719'. [ 1596.454472][ T3868] netlink: 'syz.0.9718': attribute type 21 has an invalid length. [ 1596.489047][ T3868] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9718'. [ 1597.135986][ T3888] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9726'. [ 1597.378247][ T3896] netlink: 'syz.2.9729': attribute type 21 has an invalid length. [ 1597.396184][ T3896] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9729'. [ 1597.793171][ T3918] netlink: 'syz.2.9735': attribute type 21 has an invalid length. [ 1597.812278][ T3918] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9735'. [ 1597.828360][ T3917] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9737'. [ 1598.306563][ T3942] netlink: 'syz.1.9743': attribute type 21 has an invalid length. [ 1598.345577][ T3942] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9743'. [ 1598.418459][ T3947] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9748'. [ 1599.318183][ T3987] netlink: 'syz.3.9760': attribute type 21 has an invalid length. [ 1599.510415][ T3993] netlink: 'syz.2.9766': attribute type 21 has an invalid length. [ 1600.013363][ T4010] netlink: 'syz.0.9771': attribute type 10 has an invalid length. [ 1600.104512][ T4010] bond0: (slave netdevsim0): Releasing backup interface [ 1600.121910][ T4010] batman_adv: batadv0: Adding interface: netdevsim0 [ 1600.130655][ T4010] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 1600.579463][ T4037] netlink: 'syz.2.9779': attribute type 21 has an invalid length. [ 1601.148910][ T1000] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1601.166531][ T4047] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1601.179348][ T4047] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1601.199332][ T4047] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1601.209234][ T4047] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1601.219445][ T4047] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1601.294207][ T4049] __nla_validate_parse: 6 callbacks suppressed [ 1601.294239][ T4049] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.9783'. [ 1601.319020][ T4051] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9784'. [ 1601.772373][ T4045] chnl_net:caif_netlink_parms(): no params data found [ 1601.882945][ T4045] bridge0: port 1(bridge_slave_0) entered blocking state [ 1601.890265][ T4045] bridge0: port 1(bridge_slave_0) entered disabled state [ 1601.897953][ T4045] bridge_slave_0: entered allmulticast mode [ 1601.905291][ T4045] bridge_slave_0: entered promiscuous mode [ 1601.914273][ T4045] bridge0: port 2(bridge_slave_1) entered blocking state [ 1601.922545][ T4045] bridge0: port 2(bridge_slave_1) entered disabled state [ 1601.929889][ T4045] bridge_slave_1: entered allmulticast mode [ 1601.938882][ T4045] bridge_slave_1: entered promiscuous mode [ 1602.017942][T25577] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1602.074465][ T4082] netlink: 44 bytes leftover after parsing attributes in process `syz.3.9794'. [ 1602.128949][ T4045] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1602.170659][T25577] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1602.214199][ T4083] netlink: 'syz.2.9792': attribute type 21 has an invalid length. [ 1602.251117][ T4083] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9792'. [ 1602.276078][ T4045] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1602.364539][T25577] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1602.411226][ T4045] team0: Port device team_slave_0 added [ 1602.423656][ T4045] team0: Port device team_slave_1 added [ 1602.463485][ T4045] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1602.471520][ T4045] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1602.499319][ T4045] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1602.532054][T25577] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1602.554927][ T4045] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1602.571085][ T4045] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1602.607947][ T4045] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1602.689126][ T4097] netlink: 'syz.3.9798': attribute type 27 has an invalid length. [ 1602.706393][ T4097] netlink: 164 bytes leftover after parsing attributes in process `syz.3.9798'. [ 1602.808217][ T4045] hsr_slave_0: entered promiscuous mode [ 1602.825180][ T4045] hsr_slave_1: entered promiscuous mode [ 1602.841945][ T4045] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1602.870378][ T4045] Cannot create hsr debugfs directory [ 1603.254788][T25577] tipc: Left network mode [ 1603.296533][ T4047] Bluetooth: hci4: command tx timeout [ 1603.386110][ T4110] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9803'. [ 1603.501302][ T4116] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.9805'. [ 1603.816618][ T4127] netlink: 'syz.3.9806': attribute type 21 has an invalid length. [ 1603.848277][ T4127] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9806'. [ 1603.936796][ T4133] netlink: 'syz.2.9808': attribute type 9 has an invalid length. [ 1603.944629][ T4133] netlink: 399 bytes leftover after parsing attributes in process `syz.2.9808'. [ 1604.487476][ T4045] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1604.524088][ T4045] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1604.563219][ T4045] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1604.602707][ T4157] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9814'. [ 1604.730406][ T4045] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1605.195497][ T4171] netlink: 'syz.2.9817': attribute type 10 has an invalid length. [ 1605.376716][ T4047] Bluetooth: hci4: command tx timeout [ 1605.397475][ T4176] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1605.938038][ T4045] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1605.962127][ T4045] 8021q: adding VLAN 0 to HW filter on device team0 [ 1606.045839][T10221] bridge0: port 1(bridge_slave_0) entered blocking state [ 1606.053088][T10221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1606.142645][T25577] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1606.161763][T25577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1606.197681][T25577] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1606.225687][T25577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1606.374184][T25577] veth1_macvtap: left promiscuous mode [ 1606.384894][T25577] veth1_vlan: left promiscuous mode [ 1607.274546][T25577] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1607.466922][ T4047] Bluetooth: hci4: command tx timeout [ 1607.541047][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.560995][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.635553][T25577] .` (unregistering): Released all slaves [ 1607.674255][ T4195] __nla_validate_parse: 3 callbacks suppressed [ 1607.674267][ T4195] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9820'. [ 1607.700510][T10221] bridge0: port 2(bridge_slave_1) entered blocking state [ 1607.707711][T10221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1607.729491][ T4199] netlink: 'syz.0.9821': attribute type 21 has an invalid length. [ 1607.742459][ T4199] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9821'. [ 1607.835896][ T4206] netlink: 'syz.2.9822': attribute type 10 has an invalid length. [ 1607.875859][ T4206] team0: Device ipvlan1 failed to register rx_handler [ 1608.109476][ T4212] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9824'. [ 1608.401411][ T4045] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1608.426303][ T4224] netlink: 'syz.2.9827': attribute type 10 has an invalid length. [ 1608.505134][ T4045] veth0_vlan: entered promiscuous mode [ 1608.534713][ T4229] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1608.546664][ T4045] veth1_vlan: entered promiscuous mode [ 1608.626636][ T4045] veth0_macvtap: entered promiscuous mode [ 1608.637916][ T4045] veth1_macvtap: entered promiscuous mode [ 1608.663175][ T4045] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1608.676157][ T4045] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1608.687759][ T4045] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1608.698382][ T4045] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1608.708649][ T4045] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1608.719176][ T4045] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1608.730841][ T4045] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1608.756656][ T4045] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1608.772743][ T4045] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1608.796279][ T4045] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1608.819666][ T4045] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1608.839669][ T4045] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1608.853305][ T4045] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1608.873366][ T4045] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1608.892835][ T4045] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1608.911933][ T4045] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1608.921209][ T4045] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1608.935200][ T4045] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1609.042767][ T4239] netlink: 'syz.2.9830': attribute type 21 has an invalid length. [ 1609.063748][ T4239] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9830'. [ 1609.132417][T10221] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1609.162809][T10221] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1609.200844][ T72] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1609.248723][ T72] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1609.401316][ T4249] netlink: 'syz.1.9777': attribute type 29 has an invalid length. [ 1609.413490][ T4249] netlink: 'syz.1.9777': attribute type 29 has an invalid length. [ 1609.501248][ T4251] netlink: 152 bytes leftover after parsing attributes in process `syz.0.9834'. [ 1609.525603][ T4252] netlink: 16399 bytes leftover after parsing attributes in process `syz.0.9834'. [ 1609.537504][ T4047] Bluetooth: hci4: command tx timeout [ 1609.912819][ T4271] netlink: 'syz.3.9841': attribute type 7 has an invalid length. [ 1610.138403][ T4281] netlink: 'syz.0.9844': attribute type 21 has an invalid length. [ 1610.181129][ T4281] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9844'. [ 1610.209906][ T4283] netlink: 14 bytes leftover after parsing attributes in process `syz.2.9846'. [ 1610.244397][ T4283] netlink: 'syz.2.9846': attribute type 3 has an invalid length. [ 1610.272896][ T4283] netlink: 'syz.2.9846': attribute type 1 has an invalid length. [ 1610.290835][ T4283] netlink: 193404 bytes leftover after parsing attributes in process `syz.2.9846'. [ 1610.874653][ T4299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1610.900126][ T4310] netlink: 152 bytes leftover after parsing attributes in process `syz.3.9857'. [ 1610.915173][ T4310] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1611.905709][ T4359] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1612.220824][ T4372] syzkaller0: entered promiscuous mode [ 1612.246569][ T4372] syzkaller0: entered allmulticast mode [ 1612.264729][ T4372] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 65487 [ 1612.514295][ T4373] syzkaller0: entered promiscuous mode [ 1612.521902][ T4373] syzkaller0: entered allmulticast mode [ 1612.639576][ T4047] Bluetooth: hci4: unexpected event 0x2c length: 151 > 17 [ 1612.706758][ T4383] __nla_validate_parse: 3 callbacks suppressed [ 1612.706797][ T4383] netlink: 164 bytes leftover after parsing attributes in process `syz.1.9885'. [ 1612.808205][ T4386] validate_nla: 6 callbacks suppressed [ 1612.808220][ T4386] netlink: 'syz.1.9885': attribute type 39 has an invalid length. [ 1612.851413][ T4388] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1613.149034][ T4390] ref_ctr_offset mismatch. inode: 0x5e offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0xfe [ 1613.675603][ T4400] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1615.075441][ T4396] netlink: 'syz.0.9890': attribute type 10 has an invalid length. [ 1615.292236][ T4411] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9893'. [ 1615.330488][ T4412] netlink: 'syz.1.9894': attribute type 21 has an invalid length. [ 1615.354220][ T4412] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9894'. [ 1615.912759][ T4441] netlink: 'syz.2.9905': attribute type 10 has an invalid length. [ 1615.929138][ T4441] team0: Device ipvlan1 failed to register rx_handler [ 1616.151489][ T4449] netlink: 'syz.0.9909': attribute type 21 has an invalid length. [ 1616.175266][ T4449] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9909'. [ 1616.301470][ T4047] Bluetooth: hci0: unexpected event 0x2c length: 151 > 17 [ 1616.302920][ T4456] netlink: 188 bytes leftover after parsing attributes in process `syz.2.9912'. [ 1616.515127][ T4462] netlink: 'syz.2.9912': attribute type 39 has an invalid length. [ 1617.255897][ T4473] netlink: 'syz.0.9918': attribute type 1 has an invalid length. [ 1617.566002][ T4482] netlink: 'syz.1.9929': attribute type 12 has an invalid length. [ 1617.600907][ T4482] netlink: 'syz.1.9929': attribute type 15 has an invalid length. [ 1617.825724][ T4485] netlink: 'syz.3.9922': attribute type 21 has an invalid length. [ 1617.834519][ T4485] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9922'. [ 1618.972193][ T4507] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.9931'. [ 1619.381182][ T4513] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9933'. [ 1619.747744][ T4519] mac80211_hwsim hwsim66 wlan0: left promiscuous mode [ 1619.765213][ T4519] mac80211_hwsim hwsim66 wlan0: left allmulticast mode [ 1619.845678][ T4525] netlink: 'syz.1.9937': attribute type 1 has an invalid length. [ 1619.853995][ T4525] netlink: 4503 bytes leftover after parsing attributes in process `syz.1.9937'. [ 1620.087813][ T4539] netlink: 'syz.0.9943': attribute type 10 has an invalid length. [ 1620.330249][ T4543] netlink: 'syz.2.9945': attribute type 21 has an invalid length. [ 1620.372047][ T4543] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9945'. [ 1621.272760][ T4567] netlink: 'syz.3.9954': attribute type 10 has an invalid length. [ 1621.537442][ T4573] syzkaller0: entered promiscuous mode [ 1621.543009][ T4573] syzkaller0: entered allmulticast mode [ 1624.354524][ T4586] netlink: 134736 bytes leftover after parsing attributes in process `syz.1.9959'. [ 1624.567011][ T4591] netlink: 'syz.3.9961': attribute type 21 has an invalid length. [ 1626.719016][ T4621] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9970'. [ 1626.813761][ T4625] netlink: 'syz.0.9969': attribute type 21 has an invalid length. [ 1626.854869][ T4625] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9969'. [ 1627.365142][ T4648] netlink: 134736 bytes leftover after parsing attributes in process `syz.0.9980'. [ 1627.531477][ T4652] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9981'. [ 1627.868525][ T4669] netlink: 'syz.1.9985': attribute type 21 has an invalid length. [ 1627.903777][ T4669] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9985'. [ 1628.095656][ T4680] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9992'. [ 1628.134463][ T4681] netlink: 134736 bytes leftover after parsing attributes in process `syz.2.9993'. [ 1628.955933][ T4713] netlink: 60 bytes leftover after parsing attributes in process `syz.1.10005'. [ 1629.014684][ T4717] netlink: 'syz.2.10004': attribute type 21 has an invalid length. [ 1629.055465][ T4717] netlink: 132 bytes leftover after parsing attributes in process `syz.2.10004'. [ 1629.303650][ T4733] netlink: 'syz.0.10010': attribute type 2 has an invalid length. [ 1629.407728][ T4737] netlink: 'syz.0.10012': attribute type 33 has an invalid length. [ 1629.415766][ T4737] netlink: 'syz.0.10012': attribute type 3 has an invalid length. [ 1629.439827][ T4737] __nla_validate_parse: 2 callbacks suppressed [ 1629.439841][ T4737] netlink: 153952 bytes leftover after parsing attributes in process `syz.0.10012'. [ 1629.662511][ T4730] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.10009'. [ 1629.803666][ T4752] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10017'. [ 1630.399418][ T4772] netlink: 'syz.3.10020': attribute type 21 has an invalid length. [ 1630.438199][ T4772] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10020'. [ 1630.481480][ T4775] bridge_slave_1: left allmulticast mode [ 1630.489498][ T4775] bridge_slave_1: left promiscuous mode [ 1630.500354][ T4775] bridge0: port 2(bridge_slave_1) entered disabled state [ 1630.560748][ T4775] bridge_slave_0: left allmulticast mode [ 1630.572474][ T4775] bridge_slave_0: left promiscuous mode [ 1630.604244][ T4775] bridge0: port 1(bridge_slave_0) entered disabled state [ 1631.131867][ T4786] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10027'. [ 1631.163141][ T4776] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10024'. [ 1631.173865][ T4784] netlink: 152 bytes leftover after parsing attributes in process `syz.0.10026'. [ 1631.291625][ T4793] netlink: 'syz.0.10030': attribute type 27 has an invalid length. [ 1631.305621][ T4793] netlink: 164 bytes leftover after parsing attributes in process `syz.0.10030'. [ 1631.722785][ T4810] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10036'. [ 1631.904596][ T4817] FAULT_INJECTION: forcing a failure. [ 1631.904596][ T4817] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1631.929293][ T4818] netlink: 'syz.3.10037': attribute type 21 has an invalid length. [ 1631.954503][ T4817] CPU: 1 PID: 4817 Comm: syz.1.10039 Not tainted syzkaller #0 [ 1631.962028][ T4817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1631.972123][ T4817] Call Trace: [ 1631.975428][ T4817] [ 1631.978422][ T4817] dump_stack_lvl+0x18c/0x250 [ 1631.983159][ T4817] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1631.989382][ T4817] ? show_regs_print_info+0x20/0x20 [ 1631.994635][ T4817] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1632.000840][ T4817] should_fail_ex+0x39d/0x4d0 [ 1632.005571][ T4817] _copy_from_user+0x2f/0xe0 [ 1632.010212][ T4817] __sys_bpf+0x23e/0x890 [ 1632.014535][ T4817] ? bpf_link_show_fdinfo+0x390/0x390 [ 1632.018848][ T4818] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10037'. [ 1632.019937][ T4817] ? lock_chain_count+0x20/0x20 [ 1632.033960][ T4817] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1632.039979][ T4817] __x64_sys_bpf+0x7c/0x90 [ 1632.044431][ T4817] do_syscall_64+0x55/0xa0 [ 1632.048879][ T4817] ? clear_bhb_loop+0x40/0x90 [ 1632.053583][ T4817] ? clear_bhb_loop+0x40/0x90 [ 1632.058370][ T4817] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1632.064298][ T4817] RIP: 0033:0x7ffb0819c819 [ 1632.068741][ T4817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1632.088394][ T4817] RSP: 002b:00007ffb08fe3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1632.096844][ T4817] RAX: ffffffffffffffda RBX: 00007ffb08415fa0 RCX: 00007ffb0819c819 [ 1632.104844][ T4817] RDX: 0000000000000010 RSI: 0000200000000340 RDI: 000000000000000f [ 1632.112833][ T4817] RBP: 00007ffb08fe3090 R08: 0000000000000000 R09: 0000000000000000 [ 1632.120822][ T4817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1632.128814][ T4817] R13: 00007ffb08416038 R14: 00007ffb08415fa0 R15: 00007ffe65dbed68 [ 1632.136823][ T4817] [ 1632.311881][ T4827] netlink: 'syz.1.10042': attribute type 9 has an invalid length. [ 1632.820802][ T4852] mac80211_hwsim hwsim71 wlan1: entered promiscuous mode [ 1632.829321][ T4852] mac80211_hwsim hwsim71 wlan1: entered allmulticast mode [ 1633.005772][ T4863] netlink: 'syz.2.10054': attribute type 10 has an invalid length. [ 1633.176143][ T4864] netlink: 'syz.0.10055': attribute type 10 has an invalid length. [ 1633.220217][ T4869] netlink: 'syz.1.10053': attribute type 21 has an invalid length. [ 1633.411786][ T4875] FAULT_INJECTION: forcing a failure. [ 1633.411786][ T4875] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1633.446825][ T4875] CPU: 0 PID: 4875 Comm: syz.2.10058 Not tainted syzkaller #0 [ 1633.454359][ T4875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1633.464445][ T4875] Call Trace: [ 1633.467760][ T4875] [ 1633.470736][ T4875] dump_stack_lvl+0x18c/0x250 [ 1633.475467][ T4875] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1633.481667][ T4875] ? show_regs_print_info+0x20/0x20 [ 1633.486926][ T4875] ? load_image+0x420/0x420 [ 1633.491497][ T4875] should_fail_ex+0x39d/0x4d0 [ 1633.496235][ T4875] _copy_from_iter+0x1d9/0x12e0 [ 1633.501148][ T4875] ? slab_post_alloc_hook+0x8a/0x4b0 [ 1633.506485][ T4875] ? __virt_addr_valid+0x18c/0x540 [ 1633.511652][ T4875] ? __lock_acquire+0x7d40/0x7d40 [ 1633.516718][ T4875] ? rcu_is_watching+0x15/0xb0 [ 1633.521543][ T4875] ? copyout_mc+0x70/0x70 [ 1633.525919][ T4875] ? __virt_addr_valid+0x18c/0x540 [ 1633.531091][ T4875] ? __virt_addr_valid+0x18c/0x540 [ 1633.536277][ T4875] ? __virt_addr_valid+0x469/0x540 [ 1633.541421][ T4875] ? __check_object_size+0x506/0xa20 [ 1633.546733][ T4875] netlink_sendmsg+0x76b/0xbf0 [ 1633.551525][ T4875] ? lockdep_hardirqs_on+0x98/0x150 [ 1633.556750][ T4875] ? netlink_getsockopt+0x590/0x590 [ 1633.561998][ T4875] ? netlink_getsockopt+0x590/0x590 [ 1633.567217][ T4875] ____sys_sendmsg+0x5ba/0x960 [ 1633.571998][ T4875] ? __asan_memset+0x22/0x40 [ 1633.576613][ T4875] ? __sys_sendmsg_sock+0x30/0x30 [ 1633.581652][ T4875] ? __import_iovec+0x5f2/0x850 [ 1633.586536][ T4875] ? import_iovec+0x73/0xa0 [ 1633.591085][ T4875] ___sys_sendmsg+0x2a6/0x360 [ 1633.595790][ T4875] ? __sys_sendmsg+0x2a0/0x2a0 [ 1633.600599][ T4875] __se_sys_sendmsg+0x1c2/0x2b0 [ 1633.605467][ T4875] ? __x64_sys_sendmsg+0x80/0x80 [ 1633.610433][ T4875] do_syscall_64+0x55/0xa0 [ 1633.614858][ T4875] ? clear_bhb_loop+0x40/0x90 [ 1633.619550][ T4875] ? clear_bhb_loop+0x40/0x90 [ 1633.624241][ T4875] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1633.630158][ T4875] RIP: 0033:0x7f48ad79c819 [ 1633.634599][ T4875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1633.654217][ T4875] RSP: 002b:00007f48ae737028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1633.662657][ T4875] RAX: ffffffffffffffda RBX: 00007f48ada15fa0 RCX: 00007f48ad79c819 [ 1633.670652][ T4875] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 1633.678632][ T4875] RBP: 00007f48ae737090 R08: 0000000000000000 R09: 0000000000000000 [ 1633.686621][ T4875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1633.694618][ T4875] R13: 00007f48ada16038 R14: 00007f48ada15fa0 R15: 00007fff97a4cc98 [ 1633.702610][ T4875] [ 1633.858262][ T4887] netlink: 'syz.1.10062': attribute type 10 has an invalid length. [ 1633.883999][ T4887] team0: Device ipvlan1 failed to register rx_handler [ 1633.936840][ T4889] netlink: 'syz.0.10061': attribute type 2 has an invalid length. [ 1633.944748][ T4889] netlink: 'syz.0.10061': attribute type 8 has an invalid length. [ 1634.612814][ T4913] __nla_validate_parse: 7 callbacks suppressed [ 1634.612846][ T4913] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10069'. [ 1634.746137][ T4921] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.10072'. [ 1634.926055][ T4928] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10075'. [ 1635.103852][ T4936] netlink: 132 bytes leftover after parsing attributes in process `syz.2.10079'. [ 1635.180565][ T4936] bridge_slave_1: left allmulticast mode [ 1635.186983][ T4936] bridge_slave_1: left promiscuous mode [ 1635.193060][ T4936] bridge0: port 2(bridge_slave_1) entered disabled state [ 1635.205833][ T4936] bridge_slave_0: left allmulticast mode [ 1635.216315][ T4936] bridge_slave_0: left promiscuous mode [ 1635.226552][ T4936] bridge0: port 1(bridge_slave_0) entered disabled state [ 1635.269509][ T4936] bond0: (slave bridge0): Releasing backup interface [ 1635.334773][ T4940] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1635.485596][ T4944] netlink: 64859 bytes leftover after parsing attributes in process `syz.2.10082'. [ 1635.681982][ T4947] validate_nla: 9 callbacks suppressed [ 1635.682001][ T4947] netlink: 'syz.1.10083': attribute type 21 has an invalid length. [ 1635.704056][ T4947] netlink: 132 bytes leftover after parsing attributes in process `syz.1.10083'. [ 1635.775173][ T4953] netlink: 60 bytes leftover after parsing attributes in process `syz.3.10085'. [ 1635.795196][ T4951] netlink: 'syz.2.10084': attribute type 10 has an invalid length. [ 1635.887573][ T4957] netlink: 'syz.2.10087': attribute type 10 has an invalid length. [ 1635.991410][ T4955] netlink: 'syz.3.10086': attribute type 28 has an invalid length. [ 1636.319496][ T4966] netlink: 'syz.2.10091': attribute type 7 has an invalid length. [ 1636.358121][ T4968] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.10092'. [ 1636.442697][ T4972] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10094'. [ 1637.032203][ T4993] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10103'. [ 1637.316859][ T4997] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.352491][ T4995] netlink: 'syz.3.10104': attribute type 25 has an invalid length. [ 1637.367592][ T4995] netlink: 'syz.3.10104': attribute type 28 has an invalid length. [ 1637.576006][ T5005] netlink: 'syz.2.10109': attribute type 2 has an invalid length. [ 1637.584570][ T5005] netlink: 'syz.2.10109': attribute type 8 has an invalid length. [ 1637.599634][ T5005] netlink: 'syz.2.10109': attribute type 2 has an invalid length. [ 1640.021830][ T5090] __nla_validate_parse: 12 callbacks suppressed [ 1640.021879][ T5090] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.10144'. [ 1640.065084][ T5092] netlink: 52 bytes leftover after parsing attributes in process `syz.1.10145'. [ 1640.369386][ T5104] syzkaller0: entered promiscuous mode [ 1640.374928][ T5104] syzkaller0: entered allmulticast mode [ 1640.828498][ T5120] netlink: 52 bytes leftover after parsing attributes in process `syz.1.10155'. [ 1641.040980][ T5131] validate_nla: 2 callbacks suppressed [ 1641.040997][ T5131] netlink: 'syz.2.10156': attribute type 2 has an invalid length. [ 1641.063843][ T5131] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.10156'. [ 1642.507154][ T5109] netlink: 'syz.3.10151': attribute type 2 has an invalid length. [ 1642.515203][ T5109] netlink: 'syz.3.10151': attribute type 8 has an invalid length. [ 1642.523312][ T5109] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10151'. [ 1642.680849][ T5139] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.10157'. [ 1642.710991][ T5141] netlink: 'syz.3.10160': attribute type 2 has an invalid length. [ 1642.728420][ T5141] netlink: 60 bytes leftover after parsing attributes in process `syz.3.10160'. [ 1642.819433][ T5143] netlink: 'syz.0.10159': attribute type 21 has an invalid length. [ 1642.829620][ T5143] netlink: 132 bytes leftover after parsing attributes in process `syz.0.10159'. [ 1643.292183][ T5155] netlink: 52 bytes leftover after parsing attributes in process `syz.1.10165'. [ 1643.356465][ T4047] Bluetooth: hci1: unexpected event 0x2c length: 151 > 17 [ 1643.365282][ T5159] netlink: 188 bytes leftover after parsing attributes in process `syz.0.10167'. [ 1643.635864][ T5159] netlink: 'syz.0.10167': attribute type 39 has an invalid length. [ 1644.250035][ T4047] Bluetooth: hci0: unexpected event 0x2c length: 151 > 17 [ 1644.251512][ T5183] netlink: 'syz.2.10177': attribute type 28 has an invalid length. [ 1644.277157][ T5183] netlink: 'syz.2.10177': attribute type 3 has an invalid length. [ 1644.560415][ T5187] netlink: 'syz.2.10177': attribute type 39 has an invalid length. [ 1644.663288][ T5191] netlink: 'syz.3.10179': attribute type 21 has an invalid length. [ 1661.628185][ T5782] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1661.638299][ T5782] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1661.647293][ T5782] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1661.655681][ T5782] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1661.667313][ T5782] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1661.674802][ T5782] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1661.817298][ T4047] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1661.832246][ T4047] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1661.840118][ T4047] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1661.856455][ T4047] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1661.864308][ T4047] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 1661.872094][ T4047] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1662.067320][ T5782] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1662.083426][ T5782] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1662.091599][ T5782] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1662.114084][ T5782] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1662.122352][ T5782] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 1662.130124][ T5782] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1662.276381][ T4047] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1662.285863][ T4047] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1662.294117][ T4047] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1662.302487][ T4047] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1662.317196][ T4047] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 1662.326463][ T4047] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1663.051828][ T5219] chnl_net:caif_netlink_parms(): no params data found [ 1663.144007][ T5215] chnl_net:caif_netlink_parms(): no params data found [ 1663.193087][ T5212] chnl_net:caif_netlink_parms(): no params data found [ 1663.274193][ T5223] chnl_net:caif_netlink_parms(): no params data found [ 1663.750106][ T5219] bridge0: port 1(bridge_slave_0) entered blocking state [ 1663.769177][ T5219] bridge0: port 1(bridge_slave_0) entered disabled state [ 1663.776874][ T4047] Bluetooth: hci2: command tx timeout [ 1663.793249][ T5219] bridge_slave_0: entered allmulticast mode [ 1663.805173][ T5219] bridge_slave_0: entered promiscuous mode [ 1663.823203][ T5219] bridge0: port 2(bridge_slave_1) entered blocking state [ 1663.837095][ T5219] bridge0: port 2(bridge_slave_1) entered disabled state [ 1663.844569][ T5219] bridge_slave_1: entered allmulticast mode [ 1663.858348][ T5219] bridge_slave_1: entered promiscuous mode [ 1663.870716][ T5212] bridge0: port 1(bridge_slave_0) entered blocking state [ 1663.885093][ T5212] bridge0: port 1(bridge_slave_0) entered disabled state [ 1663.897149][ T5212] bridge_slave_0: entered allmulticast mode [ 1663.904586][ T5212] bridge_slave_0: entered promiscuous mode [ 1663.922391][ T5223] bridge0: port 1(bridge_slave_0) entered blocking state [ 1663.937527][ T5223] bridge0: port 1(bridge_slave_0) entered disabled state [ 1663.944738][ T5223] bridge_slave_0: entered allmulticast mode [ 1663.951088][ T4047] Bluetooth: hci5: command tx timeout [ 1663.970830][ T5223] bridge_slave_0: entered promiscuous mode [ 1663.988441][ T5215] bridge0: port 1(bridge_slave_0) entered blocking state [ 1663.995597][ T5215] bridge0: port 1(bridge_slave_0) entered disabled state [ 1664.014105][ T5215] bridge_slave_0: entered allmulticast mode [ 1664.024602][ T5215] bridge_slave_0: entered promiscuous mode [ 1664.066265][ T5212] bridge0: port 2(bridge_slave_1) entered blocking state [ 1664.073429][ T5212] bridge0: port 2(bridge_slave_1) entered disabled state [ 1664.091233][ T5212] bridge_slave_1: entered allmulticast mode [ 1664.105768][ T5212] bridge_slave_1: entered promiscuous mode [ 1664.118250][ T5223] bridge0: port 2(bridge_slave_1) entered blocking state [ 1664.125401][ T5223] bridge0: port 2(bridge_slave_1) entered disabled state [ 1664.143997][ T5223] bridge_slave_1: entered allmulticast mode [ 1664.165525][ T5223] bridge_slave_1: entered promiscuous mode [ 1664.173784][ T5215] bridge0: port 2(bridge_slave_1) entered blocking state [ 1664.181621][ T4047] Bluetooth: hci6: command tx timeout [ 1664.197030][ T5215] bridge0: port 2(bridge_slave_1) entered disabled state [ 1664.215266][ T5215] bridge_slave_1: entered allmulticast mode [ 1664.224270][ T5215] bridge_slave_1: entered promiscuous mode [ 1664.331032][ T5219] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1664.418345][ T5219] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1664.428095][ T4047] Bluetooth: hci7: command tx timeout [ 1664.450153][ T5212] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1664.475025][ T5223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1664.505063][ T5215] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1664.550177][ T5212] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1664.573493][ T5223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1664.594688][ T5215] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1664.663036][ T5219] team0: Port device team_slave_0 added [ 1664.780918][ T5219] team0: Port device team_slave_1 added [ 1664.803854][ T5223] team0: Port device team_slave_0 added [ 1664.860351][ T5212] team0: Port device team_slave_0 added [ 1664.947999][ T5223] team0: Port device team_slave_1 added [ 1664.967208][ T5215] team0: Port device team_slave_0 added [ 1664.987765][ T5212] team0: Port device team_slave_1 added [ 1664.994364][ T5219] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1665.011065][ T5219] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1665.038728][ T5219] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1665.866862][ T4047] Bluetooth: hci2: command tx timeout [ 1666.026956][ T4047] Bluetooth: hci5: command tx timeout [ 1666.267021][ T4047] Bluetooth: hci6: command tx timeout [ 1666.507035][ T4047] Bluetooth: hci7: command tx timeout [ 1667.946840][ T4047] Bluetooth: hci2: command tx timeout [ 1668.096787][ T4047] Bluetooth: hci5: command tx timeout [ 1668.347670][ T4047] Bluetooth: hci6: command tx timeout [ 1668.577903][ T4047] Bluetooth: hci7: command tx timeout [ 1670.016996][ T4047] Bluetooth: hci2: command tx timeout [ 1670.176423][ T4047] Bluetooth: hci5: command tx timeout [ 1670.417033][ T4047] Bluetooth: hci6: command tx timeout [ 1670.656860][ T4047] Bluetooth: hci7: command tx timeout [ 1681.311060][ T4047] Bluetooth: hci3: command 0x0406 tx timeout [ 1696.666241][ T5775] Bluetooth: hci0: command 0x0406 tx timeout [ 1722.426783][ T5256] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1722.446593][ T5256] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1722.460716][ T1000] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1722.471139][ T5258] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1722.484038][ T5258] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 1722.492371][ T5258] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1722.512326][ T5258] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1722.521453][ T5258] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1722.530685][ T5258] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1722.538977][ T5258] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1722.548188][ T5258] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 1722.555577][ T5258] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1722.737226][ T5262] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1722.748279][ T5262] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1722.756659][ T5262] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1722.765017][ T5262] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1722.773997][ T5262] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3 [ 1722.782462][ T5262] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1722.943191][ T5265] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1722.960430][ T5265] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1722.968871][ T5265] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1722.977847][ T5265] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1722.986631][ T5265] Bluetooth: hci11: unexpected cc 0x0c25 length: 249 > 3 [ 1722.994134][ T5265] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1749.716236][ C0] rcu: INFO: rcu_preempt self-detected stall on CPU [ 1749.722872][ C0] rcu: 0-....: (1 GPs behind) idle=381c/1/0x4000000000000000 softirq=175346/175347 fqs=4401 [ 1749.734339][ C0] rcu: hardirqs softirqs csw/system [ 1749.740754][ C0] rcu: number: 1140359 0 0 [ 1749.747179][ C0] rcu: cputime: 17774 34715 73 ==> 52490(ms) [ 1749.755002][ C0] rcu: (t=10500 jiffies g=246849 q=2576 ncpus=2) [ 1749.761450][ C0] CPU: 0 PID: 5181 Comm: syz.0.10175 Not tainted syzkaller #0 [ 1749.769042][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1749.779111][ C0] RIP: 0010:___slab_alloc+0x111a/0x12f0 [ 1749.784669][ C0] Code: c7 44 24 68 00 00 00 00 9c 8f 44 24 68 f7 44 24 68 00 02 00 00 75 7a 41 f7 c6 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 70 0f 85 ef 00 00 00 4c 89 e8 48 83 c4 78 5b 41 5c 41 [ 1749.804278][ C0] RSP: 0018:ffffc90000007740 EFLAGS: 00000206 [ 1749.810359][ C0] RAX: c12c1f70c131bf00 RBX: ffff8880b8e3ffd0 RCX: c12c1f70c131bf00 [ 1749.818348][ C0] RDX: dffffc0000000000 RSI: ffffffff8acac9e0 RDI: ffffffff8b1c8e60 [ 1749.826339][ C0] RBP: ffffffff81debf2f R08: ffffffff911c560f R09: 1ffffffff2238ac1 [ 1749.834314][ C0] R10: dffffc0000000000 R11: fffffbfff2238ac2 R12: 0000000000000000 [ 1749.842295][ C0] R13: ffff88801e2f6680 R14: 0000000000000246 R15: 0000000000000000 [ 1749.850262][ C0] FS: 00007f28cb3296c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1749.859189][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1749.865774][ C0] CR2: 0000000100000000 CR3: 0000000047304000 CR4: 00000000003506f0 [ 1749.873747][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000200000000300 [ 1749.881725][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1749.889706][ C0] Call Trace: [ 1749.892983][ C0] [ 1749.895832][ C0] ? dst_cow_metrics_generic+0x56/0x1b0 [ 1749.901386][ C0] __kmem_cache_alloc_node+0x19e/0x250 [ 1749.906848][ C0] ? dst_cow_metrics_generic+0x56/0x1b0 [ 1749.912415][ C0] ? dst_cow_metrics_generic+0x56/0x1b0 [ 1749.917971][ C0] kmalloc_trace+0x2a/0xe0 [ 1749.922391][ C0] dst_cow_metrics_generic+0x56/0x1b0 [ 1749.927770][ C0] icmp6_dst_alloc+0x22e/0x400 [ 1749.932533][ C0] ? icmpv6_flow_init+0x62/0x120 [ 1749.937479][ C0] ndisc_send_skb+0x44e/0x14f0 [ 1749.942243][ C0] ? ndisc_send_skb+0x1f5/0x14f0 [ 1749.947187][ C0] ? ndisc_alloc_skb+0x18c/0x450 [ 1749.952140][ C0] ? ndisc_mc_map+0x680/0x680 [ 1749.956817][ C0] ? __build_skb_around+0x255/0x3d0 [ 1749.962046][ C0] addrconf_rs_timer+0x2d5/0x630 [ 1749.966990][ C0] ? addrconf_disable_policy_idev+0x480/0x480 [ 1749.973072][ C0] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1749.979056][ C0] call_timer_fn+0x189/0x540 [ 1749.983645][ C0] ? addrconf_disable_policy_idev+0x480/0x480 [ 1749.989715][ C0] ? call_timer_fn+0xd2/0x540 [ 1749.994394][ C0] ? __run_timers+0x800/0x800 [ 1749.999080][ C0] ? addrconf_disable_policy_idev+0x480/0x480 [ 1750.005152][ C0] __run_timers+0x542/0x800 [ 1750.009658][ C0] ? detach_timer+0x2b0/0x2b0 [ 1750.014364][ C0] run_timer_softirq+0x67/0xf0 [ 1750.019132][ C0] handle_softirqs+0x280/0x820 [ 1750.023896][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 1750.028664][ C0] ? do_softirq+0x1a0/0x1a0 [ 1750.033187][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 1750.038392][ C0] __irq_exit_rcu+0xd3/0x190 [ 1750.042976][ C0] ? irq_exit_rcu+0x20/0x20 [ 1750.047480][ C0] irq_exit_rcu+0x9/0x20 [ 1750.051729][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1750.057379][ C0] [ 1750.060307][ C0] [ 1750.063232][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1750.069213][ C0] RIP: 0010:__sanitizer_cov_trace_switch+0x6c/0x120 [ 1750.075809][ C0] Code: 83 f9 07 0f 85 cb 00 00 00 b9 07 00 00 00 48 85 c0 75 13 e9 bc 00 00 00 b9 01 00 00 00 48 85 c0 0f 84 ae 00 00 00 41 57 41 56 <41> 54 53 48 8b 54 24 20 65 4c 8b 05 84 8e 7c 7e 45 31 c9 eb 08 49 [ 1750.095529][ C0] RSP: 0018:ffffc9000537f000 EFLAGS: 00000202 [ 1750.101601][ C0] RAX: 0000000000000008 RBX: 0000000000000000 RCX: 0000000000000003 [ 1750.109589][ C0] RDX: ffffc9000faf9000 RSI: ffffffff8cfa07e0 RDI: 0000000000000004 [ 1750.117566][ C0] RBP: ffffc9000537f138 R08: ffff888021ff3c00 R09: 0000000000000002 [ 1750.125543][ C0] R10: 0000000000000001 R11: 0000000000000002 R12: ffffc9000537f0e8 [ 1750.133538][ C0] R13: dffffc0000000000 R14: 0000000000000004 R15: ffffffff8f19dd9c [ 1750.141531][ C0] unwind_next_frame+0x742/0x2970 [ 1750.146569][ C0] ? kasan_set_track+0x4e/0x70 [ 1750.151338][ C0] ? kasan_set_track+0x4e/0x70 [ 1750.156128][ C0] ? stack_trace_save+0x100/0x100 [ 1750.161159][ C0] arch_stack_walk+0x144/0x190 [ 1750.165946][ C0] ? kasan_set_track+0x4e/0x70 [ 1750.170721][ C0] stack_trace_save+0xaa/0x100 [ 1750.175511][ C0] ? stack_trace_snprint+0xf0/0xf0 [ 1750.180640][ C0] ? __alloc_skb+0x138/0x2c0 [ 1750.185243][ C0] ? __mptcp_push_pending+0x239/0x880 [ 1750.190624][ C0] ? mptcp_sendmsg+0x13a7/0x16d0 [ 1750.195581][ C0] kasan_set_track+0x4e/0x70 [ 1750.200217][ C0] ? kasan_set_track+0x4e/0x70 [ 1750.205047][ C0] __kasan_slab_alloc+0x6c/0x80 [ 1750.209919][ C0] slab_post_alloc_hook+0x6e/0x4b0 [ 1750.215062][ C0] kmem_cache_alloc+0x11a/0x2d0 [ 1750.219942][ C0] ? __skb_ext_alloc+0x1a/0x90 [ 1750.224736][ C0] __skb_ext_alloc+0x1a/0x90 [ 1750.229338][ C0] mptcp_sendmsg_frag+0x634/0x27e0 [ 1750.234479][ C0] __subflow_push_pending+0x21f/0xad0 [ 1750.239914][ C0] __mptcp_push_pending+0x239/0x880 [ 1750.245115][ C0] ? copyout_mc+0x70/0x70 [ 1750.249463][ C0] ? mptcp_check_and_set_pending+0x90/0x90 [ 1750.255266][ C0] ? page_copy_sane+0x4e/0x270 [ 1750.260059][ C0] ? copy_page_from_iter+0xe8/0x100 [ 1750.265280][ C0] mptcp_sendmsg+0x13a7/0x16d0 [ 1750.270082][ C0] ? mptcp_shutdown+0x80/0x80 [ 1750.274773][ C0] ? sock_rps_record_flow+0x19/0x3f0 [ 1750.280071][ C0] ? inet_sendmsg+0x7c/0x2f0 [ 1750.284680][ C0] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1750.289982][ C0] ? security_socket_sendmsg+0x80/0xa0 [ 1750.295449][ C0] ? inet_send_prepare+0x260/0x260 [ 1750.300833][ C0] ____sys_sendmsg+0x5ba/0x960 [ 1750.305613][ C0] ? __asan_memset+0x22/0x40 [ 1750.310214][ C0] ? __sys_sendmsg_sock+0x30/0x30 [ 1750.315238][ C0] ? __import_iovec+0x5f2/0x850 [ 1750.320101][ C0] ? import_iovec+0x73/0xa0 [ 1750.324620][ C0] ___sys_sendmsg+0x2a6/0x360 [ 1750.329327][ C0] ? __sys_sendmsg+0x2a0/0x2a0 [ 1750.334173][ C0] __se_sys_sendmsg+0x1c2/0x2b0 [ 1750.339034][ C0] ? __x64_sys_sendmsg+0x80/0x80 [ 1750.343992][ C0] ? syscall_enter_from_user_mode+0x2e/0x80 [ 1750.349917][ C0] do_syscall_64+0x55/0xa0 [ 1750.354357][ C0] ? clear_bhb_loop+0x40/0x90 [ 1750.359055][ C0] ? clear_bhb_loop+0x40/0x90 [ 1750.363747][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1750.369662][ C0] RIP: 0033:0x7f28ca39c819 [ 1750.374166][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1750.394015][ C0] RSP: 002b:00007f28cb329028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1750.402447][ C0] RAX: ffffffffffffffda RBX: 00007f28ca615fa0 RCX: 00007f28ca39c819 [ 1750.410424][ C0] RDX: 0000000000000800 RSI: 0000200000000800 RDI: 0000000000000006 [ 1750.418401][ C0] RBP: 00007f28ca432c91 R08: 0000000000000000 R09: 0000000000000000 [ 1750.426389][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1750.434366][ C0] R13: 00007f28ca616038 R14: 00007f28ca615fa0 R15: 00007ffe6f8e5f68 [ 1750.442371][ C0]