last executing test programs: 23.7107622s ago: executing program 3 (id=2280): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000c0000000600000000160009030000000c00000003000006040000000f000000020a00000d000000000100000c0000000000000201000000005f0061de306161305f5f000000000000000000"], &(0x7f0000000140)=""/22, 0x60, 0x16, 0x1, 0x4}, 0x28) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3, 0x0, &(0x7f0000000c40)=[{0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x4, 0x10006}]}, 0x94) (async) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xa, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4}, 0x50) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0xb, [@int={0x10, 0x0, 0x0, 0x1, 0x0, 0x7a, 0x0, 0x20, 0x3}]}, {0x0, [0x0, 0x2e, 0x61, 0x61, 0x0, 0x30, 0x30, 0x2e, 0x2e]}}, &(0x7f0000000500)=""/161, 0x33, 0xa1, 0x0, 0x5}, 0x28) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x1a4, 0x0, 0x1, 0x7, '\x00', 0x0, r0, 0x4, 0x3, 0x1}, 0x50) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x5, 0x8, 0x4, 0x0, 0xffffffffffffffff, 0xffffffff}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7020000010000e1850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000780)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)='%+9llu \x00'}, 0x20) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r8 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r8, 0x89e1, &(0x7f0000000100)) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xc8ae}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000007c0)={0x1, 0xffffffffffffffff}, 0x4) (async) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000840)=@o_path={&(0x7f0000000800)='./file0\x00', 0x0, 0x10, r0}, 0x18) (async) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@base={0x19, 0x7, 0x3443, 0xa647, 0x1000, 0x1, 0x7fff, '\x00', 0x0, r0, 0x1, 0x2, 0x4}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x18, 0x12, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x83}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@jmp={0x5, 0x1, 0xb, 0x4, 0x3, 0x0, 0xfffffffffffffff0}, @exit, @alu={0x4, 0x1, 0xb, 0x5, 0x3, 0xc, 0xffffffffffffffff}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000300)='syzkaller\x00', 0x8000, 0xeb, &(0x7f0000000340)=""/235, 0x40f00, 0x14, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f0000000600)={0x1, 0x2}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0x9, 0x51e, 0x7f}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000900)=[r3, r5, r6, r7, r9, r10, r11], &(0x7f0000000940)=[{0x2, 0x4, 0x9, 0x5}, {0x7, 0x4, 0x5, 0x4}], 0x10, 0x40}, 0x94) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac00000000000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x1) (async) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e}, 0x94) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r12}, 0x38) (async) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000003000000000000000040150018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000700000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r13}, 0xc) r14 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r14, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002d000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) (async) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x3, 0x8, 0x2, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x5}, 0x100808, 0x0, 0x8000, 0x0, 0x0, 0x3, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r15 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r15) (async) ioctl$TUNSETLINK(r15, 0x400454cd, 0x109) 23.536171595s ago: executing program 3 (id=2282): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90424fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) 23.414218787s ago: executing program 3 (id=2283): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00e00010008188e6b62aa73f72cc9f0ba1f848030000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x24088054) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r1, &(0x7f0000000180), 0x40010) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x40, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d2f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb010018000000000000009000000090000000040000000f0000000000000700000000010000000000001101000000000000000b000000010000850300000019000000050000060400000005000000020000000a000000010000000800001202000000030000000000000901000000010000000000000c05000000020000000000000e050000001a0000000c0000000000000201000000003000"/172], &(0x7f0000000280)=""/250, 0xac, 0xfa, 0x1, 0x81, 0x10000, @value=r1}, 0x28) socket$kcm(0x29, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r2, 0x0, 0x2, 0x0) close(0x3) r3 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180000000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) close(0xffffffffffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETCARRIER(r5, 0x400454e2, &(0x7f0000000100)) ioctl$TUNSETLINK(r5, 0x400454cd, 0x301) mkdir(&(0x7f00000000c0)='./file0\x00', 0x4) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) 22.886797241s ago: executing program 3 (id=2285): r0 = perf_event_open(&(0x7f0000000b00)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x4, 0x10, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'cpu'}]}, 0x5) write$cgroup_int(r5, &(0x7f0000000580)=0xe605, 0x12) 22.775340083s ago: executing program 3 (id=2289): bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000000)={0x7, 0x0}, 0x8) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r0, 0x1b5}, 0xc) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x8, &(0x7f00000002c0)=ANY=[@ANYBLOB="180800000000000000000000000000008510000003000000180000000000000000000000000000009500000000000000bfa000000000000095"], &(0x7f00000003c0)='GPL\x00', 0x2, 0x14f, &(0x7f0000000400)=""/261, 0xb6df4c32c1d5c814, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x15}, 0x94) r3 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r3, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x4e24, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac141411e0000001000000002800000000000000000000000700000094040007441405", @ANYBLOB="f3"], 0x48}, 0x0) r4 = perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000100)=0x8000000000000000, 0x12) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) 22.600003558s ago: executing program 3 (id=2292): socket$kcm(0xa, 0x5, 0x0) r0 = socket$kcm(0x2, 0x3, 0x106) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) r2 = socket$kcm(0x21, 0x2, 0x2) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008c0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) r4 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/29], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0xa, 0x2, 0x73) close(r6) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.sectors\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r7, 0x89e1, &(0x7f0000000100)={r0}) setsockopt$sock_attach_bpf(r1, 0x107, 0x2, 0x0, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f0000000000)=ANY=[@ANYRES16=r8], 0xfe33) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000700)="fb", 0x1}, {&(0x7f0000000680)="660f829e3add48b05d82", 0xa}, {&(0x7f0000000800)="adb34727cc508abe1092fb01d95f9d", 0xf}], 0x3}, 0x0) 18.652727666s ago: executing program 1 (id=2315): r0 = perf_event_open(&(0x7f0000000b00)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x4, 0x10, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'cpu'}]}, 0x5) write$cgroup_int(r5, &(0x7f0000000580)=0xe605, 0x12) 18.50086859s ago: executing program 0 (id=2316): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x15, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000001400)={0x2, 0x80, 0xed, 0xff, 0x0, 0x0, 0x0, 0x1800000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x1, 0xfe, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x80000000, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x8, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x4, &(0x7f0000001080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0xd, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x2, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socket$kcm(0x1e, 0x4, 0x0) r3 = perf_event_open(&(0x7f0000000200)={0x0, 0x80, 0x37, 0x0, 0x0, 0x0, 0x0, 0x7683, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x87dc, 0x0, @perf_config_ext={0x0, 0x100000000}, 0x0, 0x800000, 0x0, 0x7, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000031c0)={&(0x7f00000006c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x40}, 0x80, 0x0, 0x0, 0x0, 0x18}, 0x8080) socketpair(0x1, 0x801, 0x0, 0x0) r4 = socket$kcm(0xa, 0x6, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000002280)=ANY=[@ANYRES16=r2], &(0x7f00000013c0)='syzkaller\x00', 0x4, 0x1000, &(0x7f0000000300)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x3, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, &(0x7f0000000200)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000001300)={0x5, 0x80, 0x0, 0xf1, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x8000, 0x7, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, r2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@cred={{0x1c}}], 0x20}, 0x0) setsockopt$sock_attach_bpf(r4, 0x29, 0x1b, &(0x7f0000000100)=r5, 0x120) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef59510525ba56dcd79a36c23d3b9844e1571a86ea1698fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000014c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, r9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x20, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000180000018110000", @ANYRES32=r9, @ANYRES16=r3, @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000180100002020782500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000957500008500000006000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0xffffffffffffffff, 0x58}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) 18.426066572s ago: executing program 1 (id=2317): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="620000001800000016000000000000005c000000000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, 0xffffffffffffffff, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8, 0x0, 0xffffffffffffffff, 0xfe8e}, 0x3f) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9b, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x1, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) sendmsg$inet(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000780)='}', 0x1}], 0x1}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f00000002c0)=r0}, 0x20) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvmsg$unix(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000800)=""/229, 0x8ec1}], 0x1}, 0x2002) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) (async) close(r0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) (async) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="620000001800000016000000000000005c000000000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, 0xffffffffffffffff, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8, 0x0, 0xffffffffffffffff, 0xfe8e}, 0x3f) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) (async) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9b, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x1, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) (async) sendmsg$inet(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000780)='}', 0x1}], 0x1}, 0x0) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f00000002c0)=r0}, 0x20) (async) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) (async) recvmsg$unix(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000800)=""/229, 0x8ec1}], 0x1}, 0x2002) (async) 18.11653219s ago: executing program 0 (id=2319): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0b00000007000000010001000900000001000000", @ANYRES32, @ANYBLOB="f8ffffff0000486200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x9, 0x0, r0, 0xb482, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x4}, 0x50) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000008c0)={0xffffffffffffffff, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x3, &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0], 0x0, 0xa4, &(0x7f0000000680)=[{}, {}], 0x10, 0x10, &(0x7f00000006c0), &(0x7f0000000700), 0x8, 0x6f, 0x8, 0x8, &(0x7f0000000780)}}, 0x10) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000900), 0x8) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000640)={{r4, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000100)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r4, r4}, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x10, &(0x7f0000000e00)=ANY=[@ANYBLOB="18000000bfffffff0000000000000000b7080000000000007b8af8ff00000000b7080000ffffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa40000000000000704000000ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback=0xccee5849be245758, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r6, 0x0, 0xe, 0x0, &(0x7f0000000040)="f4b84de4115d64244a0e839e9900", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000940)=@bloom_filter={0x1e, 0x0, 0xfffffff9, 0x8, 0x8000, r1, 0x2, '\x00', r2, r3, 0x4, 0x3, 0x1, 0x1}, 0x50) r7 = socket$kcm(0xa, 0x2, 0x73) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000100000006"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000780850000000f"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r9}, 0xc) sendmsg$sock(r7, &(0x7f0000000000)={&(0x7f00000001c0)=@nl=@unspec={0x0, 0x0, 0x0, 0xd8ff}, 0x80, 0x0}, 0x4014) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x31, 0x31, 0x5, [@datasec={0x1, 0x3, 0x0, 0xf, 0x1, [{0x2, 0x4, 0x35f}, {0x5, 0x6, 0xd}, {0x5, 0x3e, 0x3}], "ba"}]}, {0x0, [0x30, 0x5f, 0x5f]}}, &(0x7f00000002c0)=""/241, 0x51, 0xf1, 0x0, 0x200, 0x10000}, 0x28) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000480)=0xffffffffffffffff, 0x4) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="1b0000007ca62500000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r12 = perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r13 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x7, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r11}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x21}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r12, 0x40042408, r13) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0x800000, 0x7ff, 0x9, 0x2c4c4, r0, 0x3ff, '\x00', 0x0, r10, 0x2, 0x3, 0x4, 0x2, @value=r10}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r14, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r14, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'macvlan0\x00', 0x1}) socketpair(0x1, 0x5, 0x0, &(0x7f0000000040)) 17.974786233s ago: executing program 1 (id=2320): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x3, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x11, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r0}, &(0x7f0000001c40), &(0x7f0000001c80)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xd50, 0x0, &(0x7f0000000080)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 17.804360317s ago: executing program 0 (id=2321): bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d40)={0x11, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000d00)='GPL\x00'}, 0x94) r3 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000001b80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=ANY=[], 0x18}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="14000000040000000400000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000000)={r4, &(0x7f0000000140), &(0x7f0000000200)=""/221}, 0x20) close(r2) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x20083500, 0x0, 0x0, 0x0, 0x0, 0x0) 17.619472632s ago: executing program 1 (id=2322): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xca, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000200)={[{0x2b, 'hugetlb'}, {0x2b, 'pids'}, {0x2b, 'cpuset'}, {0x2d, 'memory'}]}, 0x1f) 17.29044836s ago: executing program 1 (id=2323): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00e00010008188e6b62aa73f72cc9f0ba1f848030000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x24088054) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r1, &(0x7f0000000180), 0x40010) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x40, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d2f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb010018000000000000009000000090000000040000000f0000000000000700000000010000000000001101000000000000000b000000010000850300000019000000050000060400000005000000020000000a000000010000000800001202000000030000000000000901000000010000000000000c05000000020000000000000e050000001a0000000c0000000000000201000000003000"/172], &(0x7f0000000280)=""/250, 0xac, 0xfa, 0x1, 0x81, 0x10000, @value=r1}, 0x28) socket$kcm(0x29, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r2, 0x0, 0x2, 0x0) close(0x3) r3 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180000000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) close(0xffffffffffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETCARRIER(r5, 0x400454e2, &(0x7f0000000100)) ioctl$TUNSETLINK(r5, 0x400454cd, 0x301) mkdir(&(0x7f00000000c0)='./file0\x00', 0x4) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) 16.836114841s ago: executing program 2 (id=2324): r0 = perf_event_open(&(0x7f0000000b00)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x4, 0x10, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'cpu'}]}, 0x5) write$cgroup_int(r5, &(0x7f0000000580)=0xe605, 0x12) 16.747860833s ago: executing program 2 (id=2325): r0 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xa1, 0xffffffffffffff80}, 0x104101, 0x4, 0x0, 0x1, 0x9, 0x10000000, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x3) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095", @ANYRES16=r4, @ANYRES64=r1, @ANYRES16=0x0, @ANYRES16=r3], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001a40)=ANY=[@ANYBLOB="1e00000400", @ANYRES32=r4, @ANYBLOB="ff0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0400000005000000040000000a00"/28], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000010080000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r5, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000016c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=r6, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00%>\x00'/20, @ANYRES32=r9, @ANYRES32, @ANYBLOB="00000000050000000200"/28], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000a40)={&(0x7f0000000300)="91d17b3161f371af52110c662276b1f7e4a897edadd13174be59642e3d5fd3a73aa55f50a07c29f6efe90736454b4fb4b5522e9960c8c7acd30a22f872a08f30f2d02319798088121c44b5db08ef78488c01dfe17b931d0baa49c249026cee5b365b52c3a2b475feade140d2fe051f767b8afb2f83ee8c59e77d0ef1ee6259978fccaf1cd39429e4359fcc87c423476abba0c5b3f6", &(0x7f00000003c0)=""/10, &(0x7f0000000400)="d740753718a4cfc5cb927cf94e3a10c5c3e841d4d710daed2bccd8dc10aa228660a23517ec08c6b19b3c52f76a3bcb08264fd1e8e2b9a9df8fae27", &(0x7f0000000800)="6cf768ee6a59a4ade1f65005b90d91239697f7bfe80416575d375138107bbe28cade378f4e57f2831497e54b2d8845ddf5fb98a6d1d9fa1f4f6dff7ebed24aca8f83ad74ae6078eff85d0c1a97c95ac64965e0aa96e24f0d3606ad8c8e706622bb13fd21dce2fcdb0ca2914804a0d838d472977a4353ad931bde3d5fe66c1d809aca202866214399b542ce151642cba4301cf87084f207b2af221af5edb32958114934f0ee8784e194e5c3ab43376ba36b756bb1caecdd329a6ce87703965882e50899e5d3b6066aaea86aec18e8d189fbfd581d109913b3efd0dde24260e6eea309b07cedc9c3699bf53a34e84e15ef976a28e5cc00663626a5490a", 0x2, r10, 0x4}, 0x38) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0xf, &(0x7f0000001800)=ANY=[@ANYRESOCT=r0, @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b7000000ce0300f46430227f2345bcf3"], &(0x7f00000007c0)='syzkaller\x00', 0xfffffffe, 0x0, 0x0, 0x40f00, 0x0, '\x00', r9}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001600)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001400)=""/232, 0xe8}], 0x4}, 0x2000) r13 = socket$kcm(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001340)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000ffffffff7a0af0fff8ffff5979a4f0ff00000000b7060000ffffffff2d6405000000000065040400014741001404000001007d60b7030000000000006a0a00fe40000900850000001f000000b70000000004000095000000000000006623848adf1dc9a7645100b2ffbdb0ab51a064e0ff0c9b27a26293fddf0180000071ff31f1622271d5518193e09483c5a020c334f8c76334d8ce8303b01ddaa52e8756ad60a07d6f27c125e16d024098f755d8583da60f27c162dbba0700002ac9170f50f2568836077b7f711a18ebf608d87b885297b6a79819782748b376358c33c9f53bfd989b1ca58949a54d5827df14faecea46408a05d572077f1252fbb72c3d099c501bc4ded6fca17a3447222c95edb47b77aafa63b9dd5fa5c53e9cf53ce129a9ecd3b4dd15100f2b450f98526a0d8cac7c97fc2f64015306a1bd7e43fe1ca8345710fb6379b4c53cf55eefb4c0974486a8d25a363adbd83b49e13fbd1777b27020bd9b8cff3f48c9411670c34f23ab8caf7851b290feb3045a1b622f20c4383a0280f040de7667f8b1d0842835e81c358ebe73af41e5b5b924275cb1749289b44e9728e7a73f148ac8206afe120c1437490d99000000110000fdffffffffffffffaf580278e1342aabd1b623f6c4f128858e4eb6b42f2173184c2b99b645f6ec0e14e5d7c95a0008000000f30f6c0000000000ff0000b8f5001a1d2a34dc0973ec302bc23211d3e3b6e6dad65a51e5497a3419cecec38126247b2f113ad4c7915c8f82c333a7b350802f03b0057010d1ed50c18411aa6900daccc02f4ba4b078f07e41f781eee222c7d071d5a94d82ca9a0846c1af59cee16639b4970f8f0a82c6a712fd5722d637d406160ffaffffffb4e0bde6749aa52c408b74251914c5d3255fd88a42e7ebb69ebcd8eee623e51dbb1f1b548c91a6825c0686fdc16be1cbb72c217fda18bd746253ca66093daf35923300b600000000ac376e0a4649a8a84e1d293a6b109c5e59b366bca5cc3d936c53d4a48c05099e6fc36d5aa23bff8cce06"], 0x0}, 0x94) r14 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r14, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x10040) recvmsg$kcm(r14, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000500)=""/4086, 0xff6}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xf, &(0x7f0000000c40)=ANY=[@ANYBLOB="18080000c0000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bc09"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @cgroup_skb, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(r13, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002e000b12d25a80648c2594f90124fc60100c03400a000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) ioctl$SIOCSIFHWADDR(r12, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) setsockopt$sock_attach_bpf(r12, 0x1, 0x32, &(0x7f0000000040)=r11, 0x4) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}, 0x104101, 0x4, 0x0, 0x1, 0x9, 0x10000000, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 16.587732087s ago: executing program 0 (id=2326): r0 = perf_event_open(0x0, 0x0, 0xf, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffff80, 0x2}, 0x0, 0x0, 0x0, 0x4, 0x8000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000004780)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000ac0)={0x0, r0, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) r3 = socket$kcm(0x2, 0x200000000000003, 0x106) setsockopt$sock_attach_bpf(r3, 0x0, 0x16, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xf, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x1, @perf_bp={0x0, 0x1}, 0x104722, 0x0, 0x0, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x1, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb01001800000000000000440000004400000004000000020000000000000e0400000001000000000000000000000105000000080000000200000000000000430000000003000000020000000b000000006161002ae408b250"], 0x0, 0x60}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005080000000000008200000018010000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000048000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a6000000850000000700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ffffffff38c4642f55442360d2e10000000003000000002c000000850000002a0000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x359}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r6, 0x0, 0xe, 0x0, &(0x7f0000000140)="410c49bc3c388e38d0da5a20564e", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) perf_event_open(&(0x7f00000006c0)={0x2, 0x80, 0x9a, 0x8, 0x0, 0x2, 0x0, 0xaf, 0xc001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4be3f9cbb2623032, @perf_config_ext={0x5, 0xfffffffffffffffd}, 0xc02, 0x0, 0x0, 0xe80a6b4847db2a6d, 0x5f, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d40)={0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000000b00)={0x0, 0xf22fff7f, &(0x7f0000000180)=[{&(0x7f0000000080)="31de76fb398bc62d058b8a96924594f5476a0824be53f7a5949f80614c42391e4b80412938c955d34d37eb96ba7849c3eb823bb36724bd6f6d0219cfe5c884afcd2bdea5acf9c877c03dcdbbb3e47417b6707c27d4c5c1db1924071f6b6f23c7d199c799c9b0c41101e625fcdb7bbfd12a3eeeef4540a5698f058aaf6a141e5d333929b92a7f64e925bf0ef424c3ef29fcd5fd4721c547fde6abe4d47048b64511693624b0d786711abe4a66e250fcbfe95ac9037e58f331b26b6ed0d08e5c73ba4c49", 0x8ec0}], 0x9, &(0x7f00000001c0)=ANY=[@ANYBLOB="000026d4f47f0000000000000100000000000000000000001400000000000000000000000000000014000000000000000000000002000000000000000000000011000000000000000000000001000000000000000027b53c701bd651db689e89e9398d22000000110000000000000002000000010000000000000000000000000000000000000000000000070000008300000000960000206a77bdd1a0041290"], 0xf}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r8 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0xc}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r8, 0x40042409, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f00000005c0)=ANY=[@ANYRES16=r1], &(0x7f00000000c0)='GPL\x00', 0x5}, 0x94) 16.335476303s ago: executing program 1 (id=2327): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'bond0\x00', 0xca58c30f81b6079f}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1}, &(0x7f0000000500), &(0x7f0000000040)}, 0xfd19) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000001000)=""/126, 0x7e}, {&(0x7f0000003ac0)=""/4100, 0x1004}, {&(0x7f0000004b00)=""/4108, 0x100c}, {&(0x7f0000000b00)=""/137, 0x89}], 0x4}, 0x40000102) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xeb, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xe, 0x66c}, 0x30414f, 0x8, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xfffffffe}, 0x0, 0x1, 0xffffffffffffffff, 0xf) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d80000001e0081054e81f782db4cb9040a1d080006007c095dd2086518000a800d00000003600e1208000f0000000406a80016c0080009", 0x37}], 0x1}, 0x24000010) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) 16.270216745s ago: executing program 2 (id=2328): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000700000000000000000000001801000820646c250000e900002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000850000002300000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x727c45cd4283345, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11540, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x8, &(0x7f0000001340)=@framed={{0xbe, 0xa, 0xa, 0x0, 0x0, 0x79, 0x10, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}]}, &(0x7f0000000480)='syzkaller\x00'}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1}, &(0x7f0000000240), &(0x7f0000000280)=r2}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r3) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') 16.131996289s ago: executing program 0 (id=2329): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x3, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x11, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r0}, &(0x7f0000001c40), &(0x7f0000001c80)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xd50, 0x0, &(0x7f0000000080)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 16.131113099s ago: executing program 2 (id=2330): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xca, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000200)={[{0x2b, 'hugetlb'}, {0x2b, 'pids'}, {0x2b, 'cpuset'}, {0x2d, 'memory'}]}, 0x1f) 16.021568992s ago: executing program 0 (id=2331): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2f, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40a7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x28, 0x1, 0x6, 0x0, 0x0, 0x9, 0x640a9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x18142, 0x5, 0x43a1bd76, 0x6, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2007}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, 0x0, 0x0) r1 = socket$kcm(0x2c, 0x3, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x49, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="5c00000026006bab9a3fe3d86e17aa31106b876cff0000007ea60864160af36504001a0038001d004231a0e69ee517d34460bc06000000a70d251e6182949a3651f60a84c9f4d4938037e70e4509c5bb5b64f69853362ac3407173ec", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080) recvmsg$kcm(r0, 0x0, 0x2020) recvmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x40000100) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/13], 0x50) sendmsg$sock(r1, &(0x7f00000005c0)={&(0x7f00000001c0)=@un=@abs={0x1, 0x0, 0x4e23}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1}, 0x40000) socketpair(0x22, 0x2, 0x3, &(0x7f0000000000)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000"], 0x17) recvmsg(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, 0x0}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0xa, 0x1, 0x106) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000180)=@l2tp6={0xa, 0x0, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}, 0x80, 0x0}, 0x2004c040) sendmsg$kcm(r4, &(0x7f00000019c0)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @local, 0x0, 0xfffffffd}, 0x80, 0x0}, 0x20040010) sendmsg$kcm(r3, 0x0, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x96, 0x1, 0x0, 0x0, 0x0, 0x2, 0x60260, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, @perf_config_ext={0xfffffffffffffff9, 0x4}, 0x111030, 0x2, 0x0, 0x0, 0x5, 0xfffffe84, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r7 = openat$cgroup_devices(r6, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r7, &(0x7f0000000500)=ANY=[@ANYBLOB='c *:*'], 0x8) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d80000001c0081044e81f782db44b9040a1d08020a000000401296a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 15.976461463s ago: executing program 2 (id=2332): r0 = perf_event_open(&(0x7f0000000b00)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x4, 0x10, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'cpu'}]}, 0x5) write$cgroup_int(r5, &(0x7f0000000580)=0xe605, 0x12) 15.884107145s ago: executing program 2 (id=2333): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) perf_event_open(0x0, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}, 0x104101, 0x4, 0x0, 0x5, 0xc, 0x1, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x4, 0x640b9, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34, 0x2, @perf_bp={0x0, 0x5}, 0x8000, 0x5, 0x47a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0xf7, 0x0, 0x0, 0x5c31, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x27, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x10) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000d80)) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20488, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x111d09, 0x4, 0x10000, 0x1, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0xbf}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES32=r2], 0x9a) 1.174088401s ago: executing program 32 (id=2327): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'bond0\x00', 0xca58c30f81b6079f}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1}, &(0x7f0000000500), &(0x7f0000000040)}, 0xfd19) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000001000)=""/126, 0x7e}, {&(0x7f0000003ac0)=""/4100, 0x1004}, {&(0x7f0000004b00)=""/4108, 0x100c}, {&(0x7f0000000b00)=""/137, 0x89}], 0x4}, 0x40000102) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xeb, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0xe, 0x66c}, 0x30414f, 0x8, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xfffffffe}, 0x0, 0x1, 0xffffffffffffffff, 0xf) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d80000001e0081054e81f782db4cb9040a1d080006007c095dd2086518000a800d00000003600e1208000f0000000406a80016c0080009", 0x37}], 0x1}, 0x24000010) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) 57.843119ms ago: executing program 33 (id=2331): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2f, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x8, 0x40a7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x28, 0x1, 0x6, 0x0, 0x0, 0x9, 0x640a9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x18142, 0x5, 0x43a1bd76, 0x6, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2007}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, 0x0, 0x0) r1 = socket$kcm(0x2c, 0x3, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x49, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="5c00000026006bab9a3fe3d86e17aa31106b876cff0000007ea60864160af36504001a0038001d004231a0e69ee517d34460bc06000000a70d251e6182949a3651f60a84c9f4d4938037e70e4509c5bb5b64f69853362ac3407173ec", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080) recvmsg$kcm(r0, 0x0, 0x2020) recvmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x40000100) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/13], 0x50) sendmsg$sock(r1, &(0x7f00000005c0)={&(0x7f00000001c0)=@un=@abs={0x1, 0x0, 0x4e23}, 0x80, &(0x7f0000000580)=[{0x0}], 0x1}, 0x40000) socketpair(0x22, 0x2, 0x3, &(0x7f0000000000)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000"], 0x17) recvmsg(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, 0x0}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0xa, 0x1, 0x106) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000180)=@l2tp6={0xa, 0x0, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}, 0x80, 0x0}, 0x2004c040) sendmsg$kcm(r4, &(0x7f00000019c0)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @local, 0x0, 0xfffffffd}, 0x80, 0x0}, 0x20040010) sendmsg$kcm(r3, 0x0, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x96, 0x1, 0x0, 0x0, 0x0, 0x2, 0x60260, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, @perf_config_ext={0xfffffffffffffff9, 0x4}, 0x111030, 0x2, 0x0, 0x0, 0x5, 0xfffffe84, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r7 = openat$cgroup_devices(r6, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r7, &(0x7f0000000500)=ANY=[@ANYBLOB='c *:*'], 0x8) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d80000001c0081044e81f782db44b9040a1d08020a000000401296a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 0s ago: executing program 34 (id=2333): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) perf_event_open(0x0, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}, 0x104101, 0x4, 0x0, 0x5, 0xc, 0x1, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x4, 0x640b9, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34, 0x2, @perf_bp={0x0, 0x5}, 0x8000, 0x5, 0x47a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0xf7, 0x0, 0x0, 0x5c31, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x27, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x10) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000d80)) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20488, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x111d09, 0x4, 0x10000, 0x1, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0xbf}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES32=r2], 0x9a) kernel console output (not intermixed with test programs): 6][ T9820] RBP: 00007f2ba703d090 R08: 0000000000000000 R09: 0000000000000000 [ 266.618626][ T9820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 266.626595][ T9820] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 266.634589][ T9820] [ 267.993390][ T9876] netlink: 'syz.3.1482': attribute type 5 has an invalid length. [ 268.253089][ T9882] netlink: 'syz.1.1485': attribute type 5 has an invalid length. [ 268.266096][ T9882] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1485'. [ 268.640329][ T9893] FAULT_INJECTION: forcing a failure. [ 268.640329][ T9893] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.653800][ T9893] CPU: 1 PID: 9893 Comm: syz.0.1489 Not tainted syzkaller #0 [ 268.661213][ T9893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 268.671301][ T9893] Call Trace: [ 268.674612][ T9893] [ 268.677543][ T9893] dump_stack_lvl+0x18c/0x250 [ 268.682229][ T9893] ? show_regs_print_info+0x20/0x20 [ 268.687426][ T9893] ? load_image+0x420/0x420 [ 268.691960][ T9893] ? __might_fault+0xaa/0x120 [ 268.696643][ T9893] ? __lock_acquire+0x7eb0/0x7eb0 [ 268.701670][ T9893] should_fail_ex+0x394/0x4c0 [ 268.706352][ T9893] _copy_from_user+0x2f/0xe0 [ 268.710944][ T9893] ___sys_sendmsg+0x1c7/0x360 [ 268.715628][ T9893] ? __sys_sendmsg+0x2b0/0x2b0 [ 268.720405][ T9893] ? __lock_acquire+0x7eb0/0x7eb0 [ 268.725444][ T9893] __se_sys_sendmsg+0x1d0/0x2c0 [ 268.730295][ T9893] ? __x64_sys_sendmsg+0x80/0x80 [ 268.735248][ T9893] ? lockdep_hardirqs_on+0x98/0x150 [ 268.740444][ T9893] do_syscall_64+0x55/0xb0 [ 268.744857][ T9893] ? clear_bhb_loop+0x40/0x90 [ 268.749531][ T9893] ? clear_bhb_loop+0x40/0x90 [ 268.754206][ T9893] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 268.760106][ T9893] RIP: 0033:0x7f2ba619e199 [ 268.764517][ T9893] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.784120][ T9893] RSP: 002b:00007f2ba701c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 268.792534][ T9893] RAX: ffffffffffffffda RBX: 00007f2ba6426090 RCX: 00007f2ba619e199 [ 268.800503][ T9893] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 268.808466][ T9893] RBP: 00007f2ba701c090 R08: 0000000000000000 R09: 0000000000000000 [ 268.816432][ T9893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 268.824396][ T9893] R13: 00007f2ba6426128 R14: 00007f2ba6426090 R15: 00007ffc4976c2b8 [ 268.832375][ T9893] [ 269.169932][ T9906] netlink: 'syz.1.1496': attribute type 15 has an invalid length. [ 269.193438][ T9906] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.1496'. [ 269.811913][ T9930] FAULT_INJECTION: forcing a failure. [ 269.811913][ T9930] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 269.838241][ T9930] CPU: 1 PID: 9930 Comm: syz.3.1504 Not tainted syzkaller #0 [ 269.845659][ T9930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 269.855729][ T9930] Call Trace: [ 269.859021][ T9930] [ 269.861965][ T9930] dump_stack_lvl+0x18c/0x250 [ 269.866668][ T9930] ? show_regs_print_info+0x20/0x20 [ 269.871885][ T9930] ? load_image+0x420/0x420 [ 269.876413][ T9930] ? __might_fault+0xaa/0x120 [ 269.881111][ T9930] ? __lock_acquire+0x7eb0/0x7eb0 [ 269.886165][ T9930] should_fail_ex+0x394/0x4c0 [ 269.890870][ T9930] _copy_from_iter+0x1cd/0x1290 [ 269.895727][ T9930] ? __might_fault+0xaa/0x120 [ 269.900406][ T9930] ? copyout_mc+0x70/0x70 [ 269.904741][ T9930] ? copyout_mc+0x70/0x70 [ 269.909069][ T9930] ? __virt_addr_valid+0x10c/0x380 [ 269.914179][ T9930] ? page_copy_sane+0x16a/0x270 [ 269.919029][ T9930] copy_page_from_iter+0x7b/0x100 [ 269.924055][ T9930] skb_copy_datagram_from_iter+0x2ea/0x6f0 [ 269.929865][ T9930] tun_get_user+0xc99/0x3d30 [ 269.934462][ T9930] ? aa_file_perm+0x3e3/0xee0 [ 269.939138][ T9930] ? rcu_read_unlock+0xa0/0xa0 [ 269.943908][ T9930] ? tun_get+0x1c/0x2e0 [ 269.948063][ T9930] ? __lock_acquire+0x7eb0/0x7eb0 [ 269.953086][ T9930] ? tun_get+0x1c/0x2e0 [ 269.957243][ T9930] tun_chr_write_iter+0x119/0x200 [ 269.962267][ T9930] vfs_write+0x474/0x9a0 [ 269.966512][ T9930] ? file_end_write+0x250/0x250 [ 269.971362][ T9930] ? __fget_files+0x3fc/0x460 [ 269.976039][ T9930] ? __fdget_pos+0x1d8/0x330 [ 269.980636][ T9930] ? ksys_write+0x74/0x260 [ 269.985064][ T9930] ksys_write+0x151/0x260 [ 269.989393][ T9930] ? __ia32_sys_read+0x90/0x90 [ 269.994158][ T9930] ? lockdep_hardirqs_on+0x98/0x150 [ 269.999354][ T9930] do_syscall_64+0x55/0xb0 [ 270.003760][ T9930] ? clear_bhb_loop+0x40/0x90 [ 270.008433][ T9930] ? clear_bhb_loop+0x40/0x90 [ 270.013102][ T9930] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 270.018998][ T9930] RIP: 0033:0x7fcb40b9e199 [ 270.023406][ T9930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 270.043007][ T9930] RSP: 002b:00007fcb41b24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 270.051416][ T9930] RAX: ffffffffffffffda RBX: 00007fcb40e25fa0 RCX: 00007fcb40b9e199 [ 270.059381][ T9930] RDX: 000000000000cfa4 RSI: 0000200000000000 RDI: 00000000000000c8 [ 270.067348][ T9930] RBP: 00007fcb41b24090 R08: 0000000000000000 R09: 0000000000000000 [ 270.075311][ T9930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 270.083280][ T9930] R13: 00007fcb40e26038 R14: 00007fcb40e25fa0 R15: 00007ffc076527f8 [ 270.091260][ T9930] [ 270.215212][ T9932] FAULT_INJECTION: forcing a failure. [ 270.215212][ T9932] name failslab, interval 1, probability 0, space 0, times 0 [ 270.242193][ T9932] CPU: 0 PID: 9932 Comm: syz.1.1506 Not tainted syzkaller #0 [ 270.249624][ T9932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 270.259694][ T9932] Call Trace: [ 270.262988][ T9932] [ 270.265930][ T9932] dump_stack_lvl+0x18c/0x250 [ 270.270631][ T9932] ? show_regs_print_info+0x20/0x20 [ 270.275843][ T9932] ? load_image+0x420/0x420 [ 270.280334][ T9932] ? __might_sleep+0xe0/0xe0 [ 270.284913][ T9932] ? __lock_acquire+0x7eb0/0x7eb0 [ 270.289942][ T9932] should_fail_ex+0x394/0x4c0 [ 270.294650][ T9932] should_failslab+0x9/0x20 [ 270.299181][ T9932] slab_pre_alloc_hook+0x59/0x300 [ 270.304228][ T9932] ? __xdp_reg_mem_model+0x1e3/0x5a0 [ 270.309537][ T9932] __kmem_cache_alloc_node+0x53/0x250 [ 270.314940][ T9932] ? __xdp_reg_mem_model+0x1e3/0x5a0 [ 270.320243][ T9932] kmalloc_trace+0x2a/0xe0 [ 270.324685][ T9932] __xdp_reg_mem_model+0x1e3/0x5a0 [ 270.329813][ T9932] ? kvmalloc_node+0x70/0x180 [ 270.334510][ T9932] ? kvmalloc_node+0x70/0x180 [ 270.339206][ T9932] ? xdp_reg_mem_model+0x40/0x40 [ 270.344167][ T9932] xdp_reg_mem_model+0x22/0x40 [ 270.348954][ T9932] bpf_test_run_xdp_live+0x262/0x1b30 [ 270.354350][ T9932] ? 0xffffffffa0004c80 [ 270.358522][ T9932] ? 0xffffffffa0004c80 [ 270.362693][ T9932] ? bpf_dispatcher_change_prog+0xc96/0xf10 [ 270.368617][ T9932] ? xdp_convert_md_to_buff+0x330/0x330 [ 270.374215][ T9932] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 270.380475][ T9932] ? _copy_from_user+0xa5/0xe0 [ 270.385260][ T9932] ? bpf_test_init+0x119/0x140 [ 270.390044][ T9932] ? xdp_convert_md_to_buff+0x5b/0x330 [ 270.395525][ T9932] bpf_prog_test_run_xdp+0x7d8/0x1140 [ 270.400925][ T9932] ? __lock_acquire+0x7eb0/0x7eb0 [ 270.405978][ T9932] ? dev_put+0x80/0x80 [ 270.410088][ T9932] ? dev_put+0x80/0x80 [ 270.414180][ T9932] bpf_prog_test_run+0x31f/0x390 [ 270.419144][ T9932] __sys_bpf+0x49d/0x890 [ 270.423411][ T9932] ? bpf_link_show_fdinfo+0x560/0x560 [ 270.428814][ T9932] ? lock_chain_count+0x20/0x20 [ 270.433691][ T9932] __x64_sys_bpf+0x7c/0x90 [ 270.438128][ T9932] do_syscall_64+0x55/0xb0 [ 270.442569][ T9932] ? clear_bhb_loop+0x40/0x90 [ 270.447261][ T9932] ? clear_bhb_loop+0x40/0x90 [ 270.451955][ T9932] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 270.457866][ T9932] RIP: 0033:0x7f76b4d9e199 [ 270.462278][ T9932] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 270.481879][ T9932] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 270.490288][ T9932] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 270.498255][ T9932] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 270.506221][ T9932] RBP: 00007f76b5d32090 R08: 0000000000000000 R09: 0000000000000000 [ 270.514185][ T9932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 270.522148][ T9932] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 270.530125][ T9932] [ 270.755464][ T9952] syzkaller0: entered promiscuous mode [ 270.760986][ T9952] syzkaller0: entered allmulticast mode [ 270.769604][ T9950] FAULT_INJECTION: forcing a failure. [ 270.769604][ T9950] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 270.827080][ T9950] CPU: 1 PID: 9950 Comm: syz.1.1514 Not tainted syzkaller #0 [ 270.834514][ T9950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 270.844594][ T9950] Call Trace: [ 270.847895][ T9950] [ 270.850843][ T9950] dump_stack_lvl+0x18c/0x250 [ 270.855551][ T9950] ? show_regs_print_info+0x20/0x20 [ 270.860775][ T9950] ? load_image+0x420/0x420 [ 270.865310][ T9950] ? __lock_acquire+0x7eb0/0x7eb0 [ 270.870364][ T9950] ? snprintf+0xe9/0x140 [ 270.874634][ T9950] should_fail_ex+0x394/0x4c0 [ 270.879345][ T9950] _copy_to_user+0x2f/0xa0 [ 270.883792][ T9950] simple_read_from_buffer+0xe7/0x150 [ 270.889190][ T9950] proc_fail_nth_read+0x1e8/0x260 [ 270.894251][ T9950] ? proc_fault_inject_write+0x360/0x360 [ 270.899919][ T9950] ? fsnotify_perm+0x271/0x5e0 [ 270.904715][ T9950] ? proc_fault_inject_write+0x360/0x360 [ 270.910378][ T9950] vfs_read+0x298/0x990 [ 270.914571][ T9950] ? kernel_read+0x1e0/0x1e0 [ 270.919191][ T9950] ? __fget_files+0x28/0x460 [ 270.923809][ T9950] ? __fget_files+0x3fc/0x460 [ 270.928528][ T9950] ? __fdget_pos+0x2a3/0x330 [ 270.933151][ T9950] ? ksys_read+0x74/0x260 [ 270.937518][ T9950] ksys_read+0x151/0x260 [ 270.941801][ T9950] ? vfs_write+0x9a0/0x9a0 [ 270.946256][ T9950] ? lockdep_hardirqs_on+0x98/0x150 [ 270.951486][ T9950] do_syscall_64+0x55/0xb0 [ 270.955927][ T9950] ? clear_bhb_loop+0x40/0x90 [ 270.960626][ T9950] ? clear_bhb_loop+0x40/0x90 [ 270.965328][ T9950] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 270.971248][ T9950] RIP: 0033:0x7f76b4d5e9ce [ 270.975681][ T9950] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 270.995314][ T9950] RSP: 002b:00007f76b5d31fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 271.003761][ T9950] RAX: ffffffffffffffda RBX: 00007f76b5d326c0 RCX: 00007f76b4d5e9ce [ 271.011764][ T9950] RDX: 000000000000000f RSI: 00007f76b5d320a0 RDI: 000000000000000b [ 271.019763][ T9950] RBP: 00007f76b5d32090 R08: 0000000000000000 R09: 0000000000000000 [ 271.027760][ T9950] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 271.035758][ T9950] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 271.043777][ T9950] [ 271.166671][ T9957] syzkaller0: entered promiscuous mode [ 271.175116][ T9957] syzkaller0: entered allmulticast mode [ 271.972809][ T5775] Bluetooth: hci1: unexpected event 0x0b length: 15 > 11 [ 273.138577][ T9973] netlink: 'syz.1.1520': attribute type 1 has an invalid length. [ 273.154360][ T9973] netlink: 161700 bytes leftover after parsing attributes in process `syz.1.1520'. [ 273.319092][ T9974] netlink: 'syz.1.1520': attribute type 4 has an invalid length. [ 273.332378][ T9974] netlink: 206236 bytes leftover after parsing attributes in process `syz.1.1520'. [ 274.735501][ T9984] FAULT_INJECTION: forcing a failure. [ 274.735501][ T9984] name failslab, interval 1, probability 0, space 0, times 0 [ 274.770675][ T9989] netlink: 'syz.1.1525': attribute type 5 has an invalid length. [ 274.778735][ T9984] CPU: 0 PID: 9984 Comm: syz.2.1524 Not tainted syzkaller #0 [ 274.786136][ T9984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 274.796203][ T9984] Call Trace: [ 274.799483][ T9984] [ 274.802414][ T9984] dump_stack_lvl+0x18c/0x250 [ 274.807093][ T9984] ? show_regs_print_info+0x20/0x20 [ 274.812285][ T9984] ? load_image+0x420/0x420 [ 274.816791][ T9984] ? __might_sleep+0xe0/0xe0 [ 274.821379][ T9984] ? __lock_acquire+0x7eb0/0x7eb0 [ 274.826401][ T9984] ? rcu_is_watching+0x15/0xb0 [ 274.831168][ T9984] should_fail_ex+0x394/0x4c0 [ 274.835855][ T9984] should_failslab+0x9/0x20 [ 274.840360][ T9984] slab_pre_alloc_hook+0x59/0x300 [ 274.845380][ T9984] ? netlink_dump+0xf8/0xec0 [ 274.849970][ T9984] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 274.856044][ T9984] kmem_cache_alloc_node+0x5e/0x310 [ 274.861243][ T9984] ? __alloc_skb+0x103/0x2c0 [ 274.865837][ T9984] __alloc_skb+0x103/0x2c0 [ 274.870252][ T9984] netlink_dump+0x1ee/0xec0 [ 274.874758][ T9984] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 274.880738][ T9984] ? lock_chain_count+0x20/0x20 [ 274.885584][ T9984] ? netlink_lookup+0x200/0x200 [ 274.890442][ T9984] ? slab_free_freelist_hook+0x130/0x1a0 [ 274.896072][ T9984] ? netlink_recvmsg+0x5e7/0xe60 [ 274.901006][ T9984] ? kmem_cache_free+0xf8/0x290 [ 274.905866][ T9984] netlink_recvmsg+0x693/0xe60 [ 274.910634][ T9984] ? netlink_sendmsg+0xbf0/0xbf0 [ 274.915572][ T9984] ? aa_af_perm+0x330/0x330 [ 274.920073][ T9984] ? __lock_acquire+0x135d/0x7eb0 [ 274.925107][ T9984] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 274.930393][ T9984] ? security_socket_recvmsg+0x89/0xb0 [ 274.935854][ T9984] ? netlink_sendmsg+0xbf0/0xbf0 [ 274.940789][ T9984] ____sys_recvmsg+0x2bd/0x5d0 [ 274.945562][ T9984] ? __sys_recvmsg_sock+0x50/0x50 [ 274.950599][ T9984] ? import_iovec+0x73/0xa0 [ 274.955106][ T9984] ___sys_recvmsg+0x214/0x590 [ 274.959784][ T9984] ? __sys_recvmsg+0x2a0/0x2a0 [ 274.964553][ T9984] ? ksys_write+0x1d2/0x260 [ 274.969064][ T9984] ? __fget_files+0x3fc/0x460 [ 274.973751][ T9984] __x64_sys_recvmsg+0x21e/0x2f0 [ 274.978692][ T9984] ? ___sys_recvmsg+0x590/0x590 [ 274.983556][ T9984] ? lockdep_hardirqs_on+0x98/0x150 [ 274.988753][ T9984] do_syscall_64+0x55/0xb0 [ 274.993162][ T9984] ? clear_bhb_loop+0x40/0x90 [ 274.997838][ T9984] ? clear_bhb_loop+0x40/0x90 [ 275.002512][ T9984] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 275.008405][ T9984] RIP: 0033:0x7fc3b4f9e199 [ 275.012817][ T9984] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.032421][ T9984] RSP: 002b:00007fc3b5d98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 275.040829][ T9984] RAX: ffffffffffffffda RBX: 00007fc3b5225fa0 RCX: 00007fc3b4f9e199 [ 275.048796][ T9984] RDX: 0000000040000000 RSI: 0000200000000440 RDI: 0000000000000003 [ 275.056761][ T9984] RBP: 00007fc3b5d98090 R08: 0000000000000000 R09: 0000000000000000 [ 275.064725][ T9984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 275.072693][ T9984] R13: 00007fc3b5226038 R14: 00007fc3b5225fa0 R15: 00007fffa282f3b8 [ 275.080677][ T9984] [ 275.270210][ T9996] netlink: 'syz.0.1527': attribute type 10 has an invalid length. [ 275.314054][ T9996] team0: Port device geneve1 added [ 275.850297][T10017] netlink: 'syz.1.1535': attribute type 19 has an invalid length. [ 275.941120][T10021] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 276.057428][T10023] FAULT_INJECTION: forcing a failure. [ 276.057428][T10023] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 276.072391][T10023] CPU: 0 PID: 10023 Comm: syz.1.1539 Not tainted syzkaller #0 [ 276.079887][T10023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 276.089957][T10023] Call Trace: [ 276.093250][T10023] [ 276.096211][T10023] dump_stack_lvl+0x18c/0x250 [ 276.100920][T10023] ? show_regs_print_info+0x20/0x20 [ 276.106142][T10023] ? load_image+0x420/0x420 [ 276.110670][T10023] ? __might_fault+0xaa/0x120 [ 276.115370][T10023] should_fail_ex+0x394/0x4c0 [ 276.120069][T10023] copyin+0x1a/0x90 [ 276.123896][T10023] _copy_from_iter+0x3ec/0x1290 [ 276.128766][T10023] ? sock_alloc_send_pskb+0x8a1/0x9a0 [ 276.134165][T10023] ? copyout_mc+0x70/0x70 [ 276.138518][T10023] ? __virt_addr_valid+0x10c/0x380 [ 276.143643][T10023] ? __virt_addr_valid+0x10c/0x380 [ 276.148769][T10023] ? __virt_addr_valid+0x10c/0x380 [ 276.153898][T10023] ? __check_object_size+0x4fc/0xa40 [ 276.159197][T10023] skb_copy_datagram_from_iter+0xf2/0x6f0 [ 276.164935][T10023] ? skb_put+0x112/0x210 [ 276.169193][T10023] unix_stream_sendmsg+0x562/0xbf0 [ 276.174331][T10023] ? unix_show_fdinfo+0x280/0x280 [ 276.179364][T10023] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 276.185794][T10023] ? apparmor_socket_sendmsg+0x8e/0x330 [ 276.191354][T10023] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 276.196649][T10023] ? security_socket_sendmsg+0x80/0xa0 [ 276.202116][T10023] ? unix_show_fdinfo+0x280/0x280 [ 276.207155][T10023] ____sys_sendmsg+0x61b/0x980 [ 276.211937][T10023] ? __asan_memset+0x22/0x40 [ 276.216536][T10023] ? __sys_sendmsg_sock+0x30/0x30 [ 276.221565][T10023] ? __import_iovec+0x3fa/0x850 [ 276.226449][T10023] ? import_iovec+0x73/0xa0 [ 276.230970][T10023] ___sys_sendmsg+0x2a6/0x360 [ 276.235661][T10023] ? get_pid_task+0x20/0x1e0 [ 276.240265][T10023] ? __sys_sendmsg+0x2b0/0x2b0 [ 276.245062][T10023] ? __lock_acquire+0x7eb0/0x7eb0 [ 276.250115][T10023] __se_sys_sendmsg+0x1d0/0x2c0 [ 276.254982][T10023] ? __x64_sys_sendmsg+0x80/0x80 [ 276.259950][T10023] ? lockdep_hardirqs_on+0x98/0x150 [ 276.265159][T10023] do_syscall_64+0x55/0xb0 [ 276.269579][T10023] ? clear_bhb_loop+0x40/0x90 [ 276.274267][T10023] ? clear_bhb_loop+0x40/0x90 [ 276.278948][T10023] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 276.284856][T10023] RIP: 0033:0x7f76b4d9e199 [ 276.289279][T10023] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 276.308892][T10023] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 276.317312][T10023] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 276.325295][T10023] RDX: 0000000000000003 RSI: 0000200000000980 RDI: 0000000000000003 [ 276.333275][T10023] RBP: 00007f76b5d32090 R08: 0000000000000000 R09: 0000000000000000 [ 276.341251][T10023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 276.349227][T10023] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 276.357229][T10023] [ 276.595644][T10032] netlink: 201392 bytes leftover after parsing attributes in process `syz.3.1542'. [ 276.650944][T10032] netlink: zone id is out of range [ 276.662152][T10032] netlink: zone id is out of range [ 276.667349][T10032] netlink: zone id is out of range [ 276.686822][T10032] netlink: zone id is out of range [ 276.696965][T10032] netlink: zone id is out of range [ 276.712137][T10032] netlink: zone id is out of range [ 276.715824][T10043] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.1544'. [ 276.724688][T10032] netlink: zone id is out of range [ 276.747324][T10032] netlink: zone id is out of range [ 276.754004][T10032] netlink: zone id is out of range [ 276.759295][T10032] netlink: zone id is out of range [ 276.799970][T10046] netlink: 'syz.2.1547': attribute type 10 has an invalid length. [ 276.859674][T10046] team0: Port device geneve1 added [ 277.016041][T10052] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1550'. [ 277.097639][T10057] netlink: 'syz.0.1552': attribute type 10 has an invalid length. [ 277.106989][T10057] macvlan0: entered promiscuous mode [ 277.113261][T10057] macvlan0: entered allmulticast mode [ 278.042279][T10092] netlink: 'syz.0.1567': attribute type 21 has an invalid length. [ 278.053297][T10094] netlink: 188 bytes leftover after parsing attributes in process `syz.0.1567'. [ 278.190778][T10102] FAULT_INJECTION: forcing a failure. [ 278.190778][T10102] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 278.204048][T10102] CPU: 0 PID: 10102 Comm: syz.3.1570 Not tainted syzkaller #0 [ 278.211525][T10102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 278.221578][T10102] Call Trace: [ 278.224851][T10102] [ 278.227776][T10102] dump_stack_lvl+0x18c/0x250 [ 278.232452][T10102] ? show_regs_print_info+0x20/0x20 [ 278.237640][T10102] ? load_image+0x420/0x420 [ 278.242141][T10102] ? __might_fault+0xaa/0x120 [ 278.246810][T10102] ? __lock_acquire+0x7eb0/0x7eb0 [ 278.251828][T10102] should_fail_ex+0x394/0x4c0 [ 278.256507][T10102] _copy_to_user+0x2f/0xa0 [ 278.260918][T10102] bpf_prog_test_run_raw_tp+0x4e2/0x680 [ 278.266468][T10102] ? trace_bpf_test_finish+0x1a0/0x1a0 [ 278.271966][T10102] ? trace_bpf_test_finish+0x1a0/0x1a0 [ 278.277430][T10102] bpf_prog_test_run+0x31f/0x390 [ 278.282365][T10102] __sys_bpf+0x49d/0x890 [ 278.286600][T10102] ? bpf_link_show_fdinfo+0x560/0x560 [ 278.291979][T10102] ? lock_chain_count+0x20/0x20 [ 278.296828][T10102] __x64_sys_bpf+0x7c/0x90 [ 278.301235][T10102] do_syscall_64+0x55/0xb0 [ 278.305642][T10102] ? clear_bhb_loop+0x40/0x90 [ 278.310308][T10102] ? clear_bhb_loop+0x40/0x90 [ 278.314978][T10102] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 278.320867][T10102] RIP: 0033:0x7fcb40b9e199 [ 278.325273][T10102] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.344872][T10102] RSP: 002b:00007fcb41b24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 278.353283][T10102] RAX: ffffffffffffffda RBX: 00007fcb40e25fa0 RCX: 00007fcb40b9e199 [ 278.361244][T10102] RDX: 000000000000000c RSI: 0000200000000880 RDI: 000000000000000a [ 278.369208][T10102] RBP: 00007fcb41b24090 R08: 0000000000000000 R09: 0000000000000000 [ 278.377170][T10102] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 278.385131][T10102] R13: 00007fcb40e26038 R14: 00007fcb40e25fa0 R15: 00007ffc076527f8 [ 278.393108][T10102] [ 278.408341][T10100] netlink: 'syz.1.1569': attribute type 10 has an invalid length. [ 278.430998][T10100] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.440588][T10100] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.454839][T10100] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.465462][T10100] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 278.500435][T10100] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.520517][T10100] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.529652][T10100] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.539414][T10100] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.554937][T10100] team0: Port device geneve1 added [ 278.639166][T10105] syzkaller0: entered promiscuous mode [ 278.648204][T10105] syzkaller0: entered allmulticast mode [ 278.674344][T10113] tap0: tun_chr_ioctl cmd 1074025676 [ 278.679817][T10113] tap0: owner set to 776 [ 280.394743][T10127] FAULT_INJECTION: forcing a failure. [ 280.394743][T10127] name failslab, interval 1, probability 0, space 0, times 0 [ 280.412713][T10127] CPU: 1 PID: 10127 Comm: syz.2.1580 Not tainted syzkaller #0 [ 280.420208][T10127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 280.430255][T10127] Call Trace: [ 280.433534][T10127] [ 280.436467][T10127] dump_stack_lvl+0x18c/0x250 [ 280.441137][T10127] ? show_regs_print_info+0x20/0x20 [ 280.446326][T10127] ? load_image+0x420/0x420 [ 280.450850][T10127] ? verify_lock_unused+0x140/0x140 [ 280.456048][T10127] ? perf_trace_lock+0xfc/0x3b0 [ 280.460906][T10127] should_fail_ex+0x394/0x4c0 [ 280.465578][T10127] should_failslab+0x9/0x20 [ 280.470073][T10127] slab_pre_alloc_hook+0x59/0x300 [ 280.475101][T10127] kmem_cache_alloc+0x5a/0x2c0 [ 280.479873][T10127] ? skb_clone+0x1eb/0x370 [ 280.484287][T10127] skb_clone+0x1eb/0x370 [ 280.488522][T10127] __netlink_deliver_tap+0x411/0x7f0 [ 280.493826][T10127] ? netlink_deliver_tap+0x2e/0x1b0 [ 280.499034][T10127] netlink_deliver_tap+0x19c/0x1b0 [ 280.504139][T10127] netlink_sendskb+0x68/0x130 [ 280.508805][T10127] netlink_ack+0xcd5/0x1160 [ 280.513314][T10127] ? __dev_queue_xmit+0x272/0x37e0 [ 280.518452][T10127] ? netlink_dump+0xec0/0xec0 [ 280.523129][T10127] ? perf_trace_lock+0x303/0x3b0 [ 280.528083][T10127] netlink_rcv_skb+0x2b3/0x4c0 [ 280.532851][T10127] ? rtnetlink_bind+0x80/0x80 [ 280.537538][T10127] ? netlink_ack+0x1160/0x1160 [ 280.542316][T10127] ? __lock_acquire+0x7eb0/0x7eb0 [ 280.547353][T10127] ? netlink_deliver_tap+0x2e/0x1b0 [ 280.552601][T10127] netlink_unicast+0x7b1/0x930 [ 280.557378][T10127] netlink_sendmsg+0x8d0/0xbf0 [ 280.562154][T10127] ? netlink_getsockopt+0x590/0x590 [ 280.567378][T10127] ? apparmor_socket_sendmsg+0x8e/0x330 [ 280.572955][T10127] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 280.578247][T10127] ? security_socket_sendmsg+0x80/0xa0 [ 280.583694][T10127] ? netlink_getsockopt+0x590/0x590 [ 280.588882][T10127] ____sys_sendmsg+0x61b/0x980 [ 280.593655][T10127] ? __asan_memset+0x22/0x40 [ 280.598253][T10127] ? __sys_sendmsg_sock+0x30/0x30 [ 280.603282][T10127] ? __import_iovec+0x3fa/0x850 [ 280.608146][T10127] ? import_iovec+0x73/0xa0 [ 280.612655][T10127] ___sys_sendmsg+0x2a6/0x360 [ 280.617344][T10127] ? __sys_sendmsg+0x2b0/0x2b0 [ 280.622133][T10127] ? __lock_acquire+0x7eb0/0x7eb0 [ 280.627181][T10127] __se_sys_sendmsg+0x1d0/0x2c0 [ 280.632041][T10127] ? __x64_sys_sendmsg+0x80/0x80 [ 280.636999][T10127] ? lockdep_hardirqs_on+0x98/0x150 [ 280.642203][T10127] do_syscall_64+0x55/0xb0 [ 280.646637][T10127] ? clear_bhb_loop+0x40/0x90 [ 280.651321][T10127] ? clear_bhb_loop+0x40/0x90 [ 280.655985][T10127] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 280.661870][T10127] RIP: 0033:0x7fc3b4f9e199 [ 280.666273][T10127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.685868][T10127] RSP: 002b:00007fc3b5d98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 280.694280][T10127] RAX: ffffffffffffffda RBX: 00007fc3b5225fa0 RCX: 00007fc3b4f9e199 [ 280.702266][T10127] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000007 [ 280.710243][T10127] RBP: 00007fc3b5d98090 R08: 0000000000000000 R09: 0000000000000000 [ 280.718200][T10127] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 280.726159][T10127] R13: 00007fc3b5226038 R14: 00007fc3b5225fa0 R15: 00007fffa282f3b8 [ 280.734154][T10127] [ 280.895087][T10137] netlink: 'syz.0.1582': attribute type 27 has an invalid length. [ 281.159965][T10153] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.1591'. [ 281.171437][T10153] FAULT_INJECTION: forcing a failure. [ 281.171437][T10153] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 281.181923][T10155] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 281.185184][T10153] CPU: 1 PID: 10153 Comm: syz.1.1591 Not tainted syzkaller #0 [ 281.201728][T10153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 281.211781][T10153] Call Trace: [ 281.215057][T10153] [ 281.217984][T10153] dump_stack_lvl+0x18c/0x250 [ 281.222664][T10153] ? show_regs_print_info+0x20/0x20 [ 281.227859][T10153] ? load_image+0x420/0x420 [ 281.232365][T10153] ? __might_fault+0xaa/0x120 [ 281.237039][T10153] should_fail_ex+0x394/0x4c0 [ 281.241721][T10153] copyout+0x1a/0x90 [ 281.245620][T10153] _copy_to_iter+0x42b/0x1110 [ 281.250297][T10153] ? __virt_addr_valid+0x10c/0x380 [ 281.255414][T10153] ? iov_iter_init+0x1e0/0x1e0 [ 281.260173][T10153] ? __virt_addr_valid+0x10c/0x380 [ 281.265284][T10153] ? __virt_addr_valid+0x10c/0x380 [ 281.270388][T10153] ? __virt_addr_valid+0x10c/0x380 [ 281.275498][T10153] ? __check_object_size+0x4fc/0xa40 [ 281.280780][T10153] __skb_datagram_iter+0xdb/0x780 [ 281.285814][T10153] ? skb_copy_datagram_iter+0x200/0x200 [ 281.291358][T10153] skb_copy_datagram_iter+0xb1/0x200 [ 281.296638][T10153] netlink_recvmsg+0x2d4/0xe60 [ 281.301403][T10153] ? netlink_sendmsg+0xbf0/0xbf0 [ 281.306339][T10153] ? aa_af_perm+0x330/0x330 [ 281.310841][T10153] ? __lock_acquire+0x135d/0x7eb0 [ 281.315866][T10153] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 281.321148][T10153] ? security_socket_recvmsg+0x89/0xb0 [ 281.326602][T10153] ? netlink_sendmsg+0xbf0/0xbf0 [ 281.331536][T10153] ____sys_recvmsg+0x2bd/0x5d0 [ 281.336307][T10153] ? __sys_recvmsg_sock+0x50/0x50 [ 281.341342][T10153] ? import_iovec+0x73/0xa0 [ 281.345847][T10153] ___sys_recvmsg+0x214/0x590 [ 281.350529][T10153] ? __sys_recvmsg+0x2a0/0x2a0 [ 281.355297][T10153] ? ksys_write+0x1d2/0x260 [ 281.359824][T10153] ? __fget_files+0x3fc/0x460 [ 281.364511][T10153] __x64_sys_recvmsg+0x21e/0x2f0 [ 281.369463][T10153] ? ___sys_recvmsg+0x590/0x590 [ 281.374324][T10153] ? lockdep_hardirqs_on+0x98/0x150 [ 281.379532][T10153] do_syscall_64+0x55/0xb0 [ 281.383938][T10153] ? clear_bhb_loop+0x40/0x90 [ 281.388606][T10153] ? clear_bhb_loop+0x40/0x90 [ 281.393276][T10153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 281.399168][T10153] RIP: 0033:0x7f76b4d9e199 [ 281.403577][T10153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 281.423178][T10153] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 281.431582][T10153] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 281.439549][T10153] RDX: 0000000000000040 RSI: 0000200000000080 RDI: 0000000000000003 [ 281.447513][T10153] RBP: 00007f76b5d32090 R08: 0000000000000000 R09: 0000000000000000 [ 281.455476][T10153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.463441][T10153] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 281.471416][T10153] [ 282.909988][T10184] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 283.228847][T10203] netlink: 'syz.2.1612': attribute type 10 has an invalid length. [ 283.239873][T10203] macvlan0: entered promiscuous mode [ 283.250904][T10203] macvlan0: entered allmulticast mode [ 283.269748][T10203] veth1_vlan: entered allmulticast mode [ 283.305601][T10203] : (slave macvlan0): Enslaving as an active interface with an up link [ 283.573158][T10216] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 283.704392][T10218] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1619'. [ 283.840914][T10218] team0: Port device  removed [ 283.873877][T10218]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 283.945226][T10218]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 284.025067][T10218]  (unregistering): (slave macvlan0): Releasing backup interface [ 284.065063][T10218] veth1_vlan: left allmulticast mode [ 284.128086][T10218]  (unregistering): Released all slaves [ 284.539720][T10237] netlink: 'syz.2.1627': attribute type 29 has an invalid length. [ 284.567616][T10237] netlink: 'syz.2.1627': attribute type 29 has an invalid length. [ 284.613768][T10241] netlink: 'syz.3.1629': attribute type 19 has an invalid length. [ 284.646313][T10237] IPv6: …: Disabled Multicast RS [ 284.754114][T10247] netlink: 160 bytes leftover after parsing attributes in process `syz.0.1632'. [ 284.936608][T10254] netlink: 'syz.0.1635': attribute type 21 has an invalid length. [ 284.945471][T10254] netlink: 'syz.0.1635': attribute type 1 has an invalid length. [ 284.954968][T10254] netlink: 16098 bytes leftover after parsing attributes in process `syz.0.1635'. [ 285.022776][T10254] syz.0.1635 (10254) used obsolete PPPIOCDETACH ioctl [ 285.075244][T10256] IPv6: NLM_F_CREATE should be specified when creating new route [ 285.401079][T10266] netlink: 'syz.3.1641': attribute type 19 has an invalid length. [ 285.412172][T10270] netlink: 'syz.0.1642': attribute type 10 has an invalid length. [ 285.563260][T10273] netlink: 'syz.3.1644': attribute type 23 has an invalid length. [ 285.594760][T10273] netlink: 156008 bytes leftover after parsing attributes in process `syz.3.1644'. [ 285.838436][T10282] FAULT_INJECTION: forcing a failure. [ 285.838436][T10282] name failslab, interval 1, probability 0, space 0, times 0 [ 285.869131][T10282] CPU: 1 PID: 10282 Comm: syz.1.1646 Not tainted syzkaller #0 [ 285.876640][T10282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 285.886713][T10282] Call Trace: [ 285.890008][T10282] [ 285.892952][T10282] dump_stack_lvl+0x18c/0x250 [ 285.897647][T10282] ? show_regs_print_info+0x20/0x20 [ 285.902845][T10282] ? load_image+0x420/0x420 [ 285.907383][T10282] ? __might_sleep+0xe0/0xe0 [ 285.912001][T10282] ? __lock_acquire+0x7eb0/0x7eb0 [ 285.917052][T10282] should_fail_ex+0x394/0x4c0 [ 285.921754][T10282] should_failslab+0x9/0x20 [ 285.926276][T10282] slab_pre_alloc_hook+0x59/0x300 [ 285.931316][T10282] ? __lock_acquire+0x7eb0/0x7eb0 [ 285.936359][T10282] kmem_cache_alloc_node+0x5e/0x310 [ 285.941567][T10282] ? __alloc_skb+0x103/0x2c0 [ 285.946159][T10282] __alloc_skb+0x103/0x2c0 [ 285.950574][T10282] netlink_sendmsg+0x66a/0xbf0 [ 285.955342][T10282] ? netlink_getsockopt+0x590/0x590 [ 285.960539][T10282] ? apparmor_socket_sendmsg+0x8e/0x330 [ 285.966080][T10282] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 285.971360][T10282] ? security_socket_sendmsg+0x80/0xa0 [ 285.976812][T10282] ? netlink_getsockopt+0x590/0x590 [ 285.982012][T10282] ____sys_sendmsg+0x61b/0x980 [ 285.986774][T10282] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 285.992928][T10282] ? __asan_memset+0x22/0x40 [ 285.997513][T10282] ? __sys_sendmsg_sock+0x30/0x30 [ 286.002532][T10282] ? __import_iovec+0x5f2/0x850 [ 286.007390][T10282] ? import_iovec+0x73/0xa0 [ 286.011893][T10282] ___sys_sendmsg+0x2a6/0x360 [ 286.016572][T10282] ? __sys_sendmsg+0x2b0/0x2b0 [ 286.021355][T10282] ? ktime_get+0x7f/0x280 [ 286.025703][T10282] __se_sys_sendmsg+0x1d0/0x2c0 [ 286.030552][T10282] ? perf_trace_preemptirq_template+0x269/0x330 [ 286.036794][T10282] ? __x64_sys_sendmsg+0x80/0x80 [ 286.041742][T10282] ? lockdep_hardirqs_on+0x98/0x150 [ 286.046941][T10282] do_syscall_64+0x55/0xb0 [ 286.051349][T10282] ? clear_bhb_loop+0x40/0x90 [ 286.056020][T10282] ? clear_bhb_loop+0x40/0x90 [ 286.060691][T10282] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 286.066584][T10282] RIP: 0033:0x7f76b4d9e199 [ 286.070993][T10282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.090591][T10282] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 286.099000][T10282] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 286.106964][T10282] RDX: 0000000000048040 RSI: 0000200000000940 RDI: 0000000000000008 [ 286.114930][T10282] RBP: 00007f76b5d32090 R08: 0000000000000000 R09: 0000000000000000 [ 286.122892][T10282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.130855][T10282] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 286.138832][T10282] [ 286.200611][T10282] netlink: 188 bytes leftover after parsing attributes in process `syz.1.1646'. [ 286.291887][T10291] FAULT_INJECTION: forcing a failure. [ 286.291887][T10291] name failslab, interval 1, probability 0, space 0, times 0 [ 286.418272][T10291] CPU: 0 PID: 10291 Comm: syz.2.1649 Not tainted syzkaller #0 [ 286.425803][T10291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 286.435874][T10291] Call Trace: [ 286.439184][T10291] [ 286.442147][T10291] dump_stack_lvl+0x18c/0x250 [ 286.446864][T10291] ? show_regs_print_info+0x20/0x20 [ 286.452098][T10291] ? load_image+0x420/0x420 [ 286.456651][T10291] ? verify_lock_unused+0x140/0x140 [ 286.461886][T10291] ? perf_trace_lock_acquire+0x342/0x400 [ 286.467568][T10291] should_fail_ex+0x394/0x4c0 [ 286.472297][T10291] should_failslab+0x9/0x20 [ 286.476841][T10291] slab_pre_alloc_hook+0x59/0x300 [ 286.481918][T10291] kmem_cache_alloc+0x5a/0x2c0 [ 286.486721][T10291] ? skb_clone+0x1eb/0x370 [ 286.491192][T10291] skb_clone+0x1eb/0x370 [ 286.495487][T10291] __netlink_deliver_tap+0x411/0x7f0 [ 286.500840][T10291] ? netlink_deliver_tap+0x2e/0x1b0 [ 286.506083][T10291] netlink_deliver_tap+0x19c/0x1b0 [ 286.511241][T10291] netlink_unicast+0x77b/0x930 [ 286.516068][T10291] netlink_sendmsg+0x8d0/0xbf0 [ 286.520891][T10291] ? netlink_getsockopt+0x590/0x590 [ 286.526144][T10291] ? apparmor_socket_sendmsg+0x8e/0x330 [ 286.531737][T10291] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 286.537066][T10291] ? security_socket_sendmsg+0x80/0xa0 [ 286.542562][T10291] ? netlink_getsockopt+0x590/0x590 [ 286.547814][T10291] ____sys_sendmsg+0x61b/0x980 [ 286.552634][T10291] ? __asan_memset+0x22/0x40 [ 286.557267][T10291] ? __sys_sendmsg_sock+0x30/0x30 [ 286.562326][T10291] ? __import_iovec+0x3fa/0x850 [ 286.567237][T10291] ? import_iovec+0x73/0xa0 [ 286.571795][T10291] ___sys_sendmsg+0x2a6/0x360 [ 286.576529][T10291] ? __sys_sendmsg+0x2b0/0x2b0 [ 286.581380][T10291] ? __lock_acquire+0x7eb0/0x7eb0 [ 286.586500][T10291] __se_sys_sendmsg+0x1d0/0x2c0 [ 286.591394][T10291] ? __x64_sys_sendmsg+0x80/0x80 [ 286.596408][T10291] ? lockdep_hardirqs_on+0x98/0x150 [ 286.601648][T10291] do_syscall_64+0x55/0xb0 [ 286.606089][T10291] ? clear_bhb_loop+0x40/0x90 [ 286.610799][T10291] ? clear_bhb_loop+0x40/0x90 [ 286.615510][T10291] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 286.621440][T10291] RIP: 0033:0x7fc3b4f9e199 [ 286.625886][T10291] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.645614][T10291] RSP: 002b:00007fc3b5d98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 286.654076][T10291] RAX: ffffffffffffffda RBX: 00007fc3b5225fa0 RCX: 00007fc3b4f9e199 [ 286.662083][T10291] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 286.670082][T10291] RBP: 00007fc3b5d98090 R08: 0000000000000000 R09: 0000000000000000 [ 286.678084][T10291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.686083][T10291] R13: 00007fc3b5226038 R14: 00007fc3b5225fa0 R15: 00007fffa282f3b8 [ 286.694120][T10291] [ 287.176356][T10297] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1651'. [ 287.216814][T10297] net_ratelimit: 15 callbacks suppressed [ 287.216857][T10297] A link change request failed with some changes committed already. Interface Q±6ã×\b‹¡Y­4 may have been left with an inconsistent configuration, please check. [ 287.239711][T10301] netlink: 'syz.1.1653': attribute type 10 has an invalid length. [ 287.250506][T10301] macvlan0: entered promiscuous mode [ 287.256228][T10301] macvlan0: entered allmulticast mode [ 287.291893][T10301] veth1_vlan: entered allmulticast mode [ 287.359312][T10301] : (slave macvlan0): Enslaving as an active interface with an up link [ 287.369275][T10302] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1651'. [ 287.381523][T10303] netlink: 'syz.2.1652': attribute type 19 has an invalid length. [ 288.034295][T10329] syzkaller0: entered promiscuous mode [ 288.049904][T10329] syzkaller0: entered allmulticast mode [ 288.072989][T10329] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 288.791134][ T5775] Bluetooth: hci0: ISO packet for unknown connection handle 2622 [ 289.145518][T10355] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1675'. [ 290.065080][T10380] FAULT_INJECTION: forcing a failure. [ 290.065080][T10380] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 290.125749][T10380] CPU: 0 PID: 10380 Comm: syz.3.1678 Not tainted syzkaller #0 [ 290.133270][T10380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 290.143342][T10380] Call Trace: [ 290.146638][T10380] [ 290.149581][T10380] dump_stack_lvl+0x18c/0x250 [ 290.154282][T10380] ? show_regs_print_info+0x20/0x20 [ 290.159499][T10380] ? load_image+0x420/0x420 [ 290.164028][T10380] ? __might_fault+0xaa/0x120 [ 290.168731][T10380] ? __lock_acquire+0x7eb0/0x7eb0 [ 290.173775][T10380] ? __virt_addr_valid+0x10c/0x380 [ 290.178911][T10380] should_fail_ex+0x394/0x4c0 [ 290.183620][T10380] _copy_from_user+0x2f/0xe0 [ 290.188242][T10380] generic_map_update_batch+0x53e/0x800 [ 290.193823][T10380] ? rcu_read_unlock+0xa0/0xa0 [ 290.198611][T10380] ? __fdget+0x180/0x210 [ 290.202879][T10380] ? rcu_read_unlock+0xa0/0xa0 [ 290.207662][T10380] bpf_map_do_batch+0x3f2/0x600 [ 290.212531][T10380] ? bpf_lsm_xfrm_policy_lookup+0x10/0x10 [ 290.218278][T10380] __sys_bpf+0x381/0x890 [ 290.222543][T10380] ? bpf_link_show_fdinfo+0x560/0x560 [ 290.227953][T10380] ? lock_chain_count+0x20/0x20 [ 290.232837][T10380] __x64_sys_bpf+0x7c/0x90 [ 290.237278][T10380] do_syscall_64+0x55/0xb0 [ 290.241710][T10380] ? clear_bhb_loop+0x40/0x90 [ 290.246405][T10380] ? clear_bhb_loop+0x40/0x90 [ 290.251103][T10380] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 290.257024][T10380] RIP: 0033:0x7fcb40b9e199 [ 290.261460][T10380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 290.281085][T10380] RSP: 002b:00007fcb41b03028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 290.289522][T10380] RAX: ffffffffffffffda RBX: 00007fcb40e26090 RCX: 00007fcb40b9e199 [ 290.297508][T10380] RDX: 0000000000000038 RSI: 0000200000000500 RDI: 000000000000001a [ 290.305498][T10380] RBP: 00007fcb41b03090 R08: 0000000000000000 R09: 0000000000000000 [ 290.313484][T10380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 290.321469][T10380] R13: 00007fcb40e26128 R14: 00007fcb40e26090 R15: 00007ffc076527f8 [ 290.329481][T10380] [ 291.108711][T10384] validate_nla: 1 callbacks suppressed [ 291.108745][T10384] netlink: 'syz.3.1679': attribute type 19 has an invalid length. [ 292.532129][T10397] FAULT_INJECTION: forcing a failure. [ 292.532129][T10397] name failslab, interval 1, probability 0, space 0, times 0 [ 292.545870][T10397] CPU: 0 PID: 10397 Comm: syz.2.1685 Not tainted syzkaller #0 [ 292.553365][T10397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 292.563436][T10397] Call Trace: [ 292.566736][T10397] [ 292.569675][T10397] dump_stack_lvl+0x18c/0x250 [ 292.574374][T10397] ? show_regs_print_info+0x20/0x20 [ 292.579587][T10397] ? load_image+0x420/0x420 [ 292.584114][T10397] ? __might_sleep+0xe0/0xe0 [ 292.588723][T10397] ? __lock_acquire+0x7eb0/0x7eb0 [ 292.593777][T10397] should_fail_ex+0x394/0x4c0 [ 292.598490][T10397] should_failslab+0x9/0x20 [ 292.603018][T10397] slab_pre_alloc_hook+0x59/0x300 [ 292.608061][T10397] ? tomoyo_encode+0x2ad/0x570 [ 292.612843][T10397] ? tomoyo_encode+0x2ad/0x570 [ 292.617627][T10397] __kmem_cache_alloc_node+0x53/0x250 [ 292.623028][T10397] ? tomoyo_encode+0x2ad/0x570 [ 292.627808][T10397] __kmalloc+0xa7/0x240 [ 292.631991][T10397] tomoyo_encode+0x2ad/0x570 [ 292.636610][T10397] tomoyo_realpath_from_path+0x57c/0x5c0 [ 292.642261][T10397] ? tomoyo_domain+0xd6/0x120 [ 292.646963][T10397] tomoyo_path_number_perm+0x248/0x5e0 [ 292.652444][T10397] ? tomoyo_path_number_perm+0x217/0x5e0 [ 292.658092][T10397] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 292.663555][T10397] ? ksys_write+0x1d2/0x260 [ 292.668084][T10397] ? __fget_files+0x28/0x460 [ 292.672681][T10397] security_file_ioctl+0x70/0xa0 [ 292.677621][T10397] __se_sys_ioctl+0x48/0x170 [ 292.682211][T10397] do_syscall_64+0x55/0xb0 [ 292.686618][T10397] ? clear_bhb_loop+0x40/0x90 [ 292.691286][T10397] ? clear_bhb_loop+0x40/0x90 [ 292.695955][T10397] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 292.701846][T10397] RIP: 0033:0x7fc3b4f9e199 [ 292.706262][T10397] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.725868][T10397] RSP: 002b:00007fc3b5d98028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 292.734280][T10397] RAX: ffffffffffffffda RBX: 00007fc3b5225fa0 RCX: 00007fc3b4f9e199 [ 292.742242][T10397] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000004 [ 292.750207][T10397] RBP: 00007fc3b5d98090 R08: 0000000000000000 R09: 0000000000000000 [ 292.758175][T10397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 292.766139][T10397] R13: 00007fc3b5226038 R14: 00007fc3b5225fa0 R15: 00007fffa282f3b8 [ 292.774116][T10397] [ 292.785315][T10397] ERROR: Out of memory at tomoyo_realpath_from_path. [ 292.850001][T10404] netlink: 'syz.3.1688': attribute type 19 has an invalid length. [ 293.513059][T10428] netlink: 'syz.2.1699': attribute type 19 has an invalid length. [ 293.669886][T10435] delete_channel: no stack [ 293.677324][T10435] delete_channel: no stack [ 293.875021][T10443] FAULT_INJECTION: forcing a failure. [ 293.875021][T10443] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 293.888439][T10443] CPU: 0 PID: 10443 Comm: syz.2.1704 Not tainted syzkaller #0 [ 293.895926][T10443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 293.906001][T10443] Call Trace: [ 293.909292][T10443] [ 293.912235][T10443] dump_stack_lvl+0x18c/0x250 [ 293.916937][T10443] ? show_regs_print_info+0x20/0x20 [ 293.922155][T10443] ? load_image+0x420/0x420 [ 293.926691][T10443] ? __might_fault+0xaa/0x120 [ 293.931406][T10443] ? __lock_acquire+0x7eb0/0x7eb0 [ 293.936468][T10443] should_fail_ex+0x394/0x4c0 [ 293.941190][T10443] _copy_from_user+0x2f/0xe0 [ 293.945801][T10443] __sys_bpf+0x23e/0x890 [ 293.950046][T10443] ? bpf_link_show_fdinfo+0x560/0x560 [ 293.955441][T10443] ? lock_chain_count+0x20/0x20 [ 293.960316][T10443] __x64_sys_bpf+0x7c/0x90 [ 293.964735][T10443] do_syscall_64+0x55/0xb0 [ 293.969147][T10443] ? clear_bhb_loop+0x40/0x90 [ 293.973821][T10443] ? clear_bhb_loop+0x40/0x90 [ 293.978501][T10443] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 293.984399][T10443] RIP: 0033:0x7fc3b4f9e199 [ 293.988812][T10443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 294.008418][T10443] RSP: 002b:00007fc3b5d98028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 294.016831][T10443] RAX: ffffffffffffffda RBX: 00007fc3b5225fa0 RCX: 00007fc3b4f9e199 [ 294.024798][T10443] RDX: 0000000000000050 RSI: 0000200000000240 RDI: 000000000000000a [ 294.032761][T10443] RBP: 00007fc3b5d98090 R08: 0000000000000000 R09: 0000000000000000 [ 294.040747][T10443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 294.048730][T10443] R13: 00007fc3b5226038 R14: 00007fc3b5225fa0 R15: 00007fffa282f3b8 [ 294.056724][T10443] [ 294.515227][T10457] netlink: 'syz.3.1708': attribute type 19 has an invalid length. [ 295.389852][T10482] netlink: 'syz.3.1720': attribute type 19 has an invalid length. [ 296.495991][T10497] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1726'. [ 296.617517][T10503] netlink: 'syz.1.1729': attribute type 10 has an invalid length. [ 296.639979][T10503] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1729'. [ 296.672298][T10503] netlink: 'syz.1.1729': attribute type 10 has an invalid length. [ 296.680216][T10503] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1729'. [ 297.005011][T10506] netlink: 'syz.0.1730': attribute type 19 has an invalid length. [ 298.437364][T10543] netlink: 'syz.3.1741': attribute type 19 has an invalid length. [ 298.508358][T10545] netlink: 197276 bytes leftover after parsing attributes in process `syz.0.1743'. [ 298.617637][ T5775] Bluetooth: hci3: unexpected subevent 0x19 length: 150 > 28 [ 298.625274][ T5775] Bluetooth: hci3: Unable to find connection with handle 0x0000 [ 299.160075][T10573] netlink: 'syz.0.1754': attribute type 2 has an invalid length. [ 299.184465][T10573] netlink: 'syz.0.1754': attribute type 3 has an invalid length. [ 299.197288][T10573] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1754'. [ 299.428778][T10582] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1759'. [ 299.909009][T10602] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1767'. [ 300.091330][T10607] netlink: 'syz.3.1769': attribute type 11 has an invalid length. [ 300.100036][T10607] netlink: 'syz.3.1769': attribute type 1 has an invalid length. [ 300.108625][T10607] netlink: 'syz.3.1769': attribute type 1 has an invalid length. [ 300.117563][T10607] netlink: 'syz.3.1769': attribute type 2 has an invalid length. [ 300.135486][T10607] netlink: 198100 bytes leftover after parsing attributes in process `syz.3.1769'. [ 300.718684][T10631] netlink: 199820 bytes leftover after parsing attributes in process `syz.3.1778'. [ 300.943821][T10641] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1780'. [ 301.813883][T10676] validate_nla: 3 callbacks suppressed [ 301.813894][T10676] netlink: 'syz.1.1799': attribute type 4 has an invalid length. [ 301.828661][T10676] __nla_validate_parse: 2 callbacks suppressed [ 301.828671][T10676] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1799'. [ 301.845042][T10676] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1799'. [ 301.855111][T10676] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1799'. [ 302.383245][T10696] netlink: 'syz.3.1807': attribute type 21 has an invalid length. [ 302.559790][T10704] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1807'. [ 303.061303][T10726] netlink: 65185 bytes leftover after parsing attributes in process `syz.0.1818'. [ 303.221317][T10730] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.1820'. [ 303.333180][ T5775] Bluetooth: hci3: unexpected subevent 0x19 length: 150 > 28 [ 303.340629][ T5775] Bluetooth: hci3: Unable to find connection with handle 0x0000 [ 303.847262][T10750] netlink: 'syz.1.1830': attribute type 21 has an invalid length. [ 303.910447][T10753] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.1831'. [ 304.029766][T10750] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1830'. [ 304.032709][T10759] netlink: 539 bytes leftover after parsing attributes in process `syz.0.1833'. [ 304.159252][T10764] netlink: 'syz.2.1835': attribute type 16 has an invalid length. [ 304.167376][T10764] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1835'. [ 304.206095][T10761] netlink: 'syz.3.1834': attribute type 10 has an invalid length. [ 304.320512][T10761] team0: Port device geneve1 added [ 305.287667][T10802] netlink: 'syz.1.1853': attribute type 21 has an invalid length. [ 306.903495][T10850] __nla_validate_parse: 7 callbacks suppressed [ 306.903535][T10850] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.1871'. [ 306.940630][T10850] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1871'. [ 307.876026][T10862] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1875'. [ 307.890978][T10855] netlink: 'syz.3.1875': attribute type 21 has an invalid length. [ 308.040681][T10866] netlink: 199364 bytes leftover after parsing attributes in process `syz.2.1876'. [ 308.133905][T10866] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1876'. [ 308.183200][T10866] hsr_slave_0: left promiscuous mode [ 308.193149][T10866] hsr_slave_1: left promiscuous mode [ 308.717930][T10887] Dead loop on virtual device ip6_vti0, fix it urgently! [ 308.809091][T10891] netlink: 'syz.1.1888': attribute type 21 has an invalid length. [ 308.953948][T10895] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1888'. [ 310.567107][T10934] netlink: 'syz.0.1903': attribute type 21 has an invalid length. [ 310.741289][T10939] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1903'. [ 310.780629][T10943] FAULT_INJECTION: forcing a failure. [ 310.780629][T10943] name failslab, interval 1, probability 0, space 0, times 0 [ 310.822163][T10943] CPU: 1 PID: 10943 Comm: syz.1.1907 Not tainted syzkaller #0 [ 310.829708][T10943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 310.839810][T10943] Call Trace: [ 310.843113][T10943] [ 310.846065][T10943] dump_stack_lvl+0x18c/0x250 [ 310.850786][T10943] ? show_regs_print_info+0x20/0x20 [ 310.856021][T10943] ? load_image+0x420/0x420 [ 310.860574][T10943] ? __might_sleep+0xe0/0xe0 [ 310.865206][T10943] ? __lock_acquire+0x7eb0/0x7eb0 [ 310.870299][T10943] should_fail_ex+0x394/0x4c0 [ 310.875035][T10943] should_failslab+0x9/0x20 [ 310.879576][T10943] slab_pre_alloc_hook+0x59/0x300 [ 310.884640][T10943] kmem_cache_alloc_node+0x5e/0x310 [ 310.889854][T10943] ? perf_event_alloc+0x146/0x2150 [ 310.894987][T10943] perf_event_alloc+0x146/0x2150 [ 310.899938][T10943] ? _raw_spin_unlock+0x28/0x40 [ 310.904801][T10943] ? find_lively_task_by_vpid+0x19/0x290 [ 310.910471][T10943] ? find_lively_task_by_vpid+0x19/0x290 [ 310.916144][T10943] __se_sys_perf_event_open+0x796/0x1d40 [ 310.921816][T10943] ? mutex_unlock+0x10/0x10 [ 310.926342][T10943] ? __x64_sys_perf_event_open+0xc0/0xc0 [ 310.932025][T10943] ? lock_chain_count+0x20/0x20 [ 310.936916][T10943] ? lockdep_hardirqs_on+0x98/0x150 [ 310.942124][T10943] ? __x64_sys_perf_event_open+0x20/0xc0 [ 310.947772][T10943] do_syscall_64+0x55/0xb0 [ 310.952195][T10943] ? clear_bhb_loop+0x40/0x90 [ 310.956876][T10943] ? clear_bhb_loop+0x40/0x90 [ 310.961563][T10943] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 310.967464][T10943] RIP: 0033:0x7f76b4d9e199 [ 310.971888][T10943] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 310.991503][T10943] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 310.999929][T10943] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 311.007909][T10943] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000180 [ 311.015887][T10943] RBP: 00007f76b5d32090 R08: 000000000000000a R09: 0000000000000000 [ 311.023859][T10943] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 311.031837][T10943] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 311.039848][T10943] [ 312.453174][T10972] netlink: 'syz.0.1918': attribute type 21 has an invalid length. [ 312.647707][T10972] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1918'. [ 313.981399][T10985] netlink: 'syz.1.1922': attribute type 29 has an invalid length. [ 313.989789][T10985] netlink: 'syz.1.1922': attribute type 29 has an invalid length. [ 314.046536][T10988] netlink: 'syz.1.1922': attribute type 29 has an invalid length. [ 314.065893][T10985] netlink: 'syz.1.1922': attribute type 29 has an invalid length. [ 314.414737][T11007] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.1930'. [ 314.494061][T11009] netlink: 'syz.3.1932': attribute type 21 has an invalid length. [ 314.663628][T11013] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1932'. [ 314.821880][T11021] FAULT_INJECTION: forcing a failure. [ 314.821880][T11021] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 314.838491][T11021] CPU: 0 PID: 11021 Comm: syz.0.1936 Not tainted syzkaller #0 [ 314.845965][T11021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 314.856012][T11021] Call Trace: [ 314.859284][T11021] [ 314.862217][T11021] dump_stack_lvl+0x18c/0x250 [ 314.866905][T11021] ? show_regs_print_info+0x20/0x20 [ 314.872103][T11021] ? load_image+0x420/0x420 [ 314.876627][T11021] ? __might_fault+0xaa/0x120 [ 314.881305][T11021] ? __lock_acquire+0x7eb0/0x7eb0 [ 314.886333][T11021] should_fail_ex+0x394/0x4c0 [ 314.891018][T11021] _copy_to_user+0x2f/0xa0 [ 314.895433][T11021] bpf_prog_test_run_raw_tp+0x4e2/0x680 [ 314.900985][T11021] ? trace_bpf_test_finish+0x1a0/0x1a0 [ 314.906452][T11021] ? trace_bpf_test_finish+0x1a0/0x1a0 [ 314.911918][T11021] bpf_prog_test_run+0x31f/0x390 [ 314.916865][T11021] __sys_bpf+0x49d/0x890 [ 314.921111][T11021] ? bpf_link_show_fdinfo+0x560/0x560 [ 314.926493][T11021] ? lock_chain_count+0x20/0x20 [ 314.931350][T11021] __x64_sys_bpf+0x7c/0x90 [ 314.935763][T11021] do_syscall_64+0x55/0xb0 [ 314.940174][T11021] ? clear_bhb_loop+0x40/0x90 [ 314.944859][T11021] ? clear_bhb_loop+0x40/0x90 [ 314.949544][T11021] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 314.955452][T11021] RIP: 0033:0x7f2ba619e199 [ 314.959873][T11021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 314.979489][T11021] RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 314.987902][T11021] RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199 [ 314.995871][T11021] RDX: 000000000000000c RSI: 0000200000000880 RDI: 000000000000000a [ 315.003835][T11021] RBP: 00007f2ba703d090 R08: 0000000000000000 R09: 0000000000000000 [ 315.011800][T11021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 315.019763][T11021] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 315.027744][T11021] [ 315.223770][T11029] netlink: 'syz.1.1940': attribute type 9 has an invalid length. [ 315.242112][T11029] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.1940'. [ 315.416563][T11030] netlink: 'syz.1.1940': attribute type 9 has an invalid length. [ 315.437930][T11030] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.1940'. [ 315.671771][T11045] FAULT_INJECTION: forcing a failure. [ 315.671771][T11045] name failslab, interval 1, probability 0, space 0, times 0 [ 315.685563][T11045] CPU: 1 PID: 11045 Comm: syz.3.1946 Not tainted syzkaller #0 [ 315.693065][T11045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 315.703140][T11045] Call Trace: [ 315.706432][T11045] [ 315.709371][T11045] dump_stack_lvl+0x18c/0x250 [ 315.714075][T11045] ? show_regs_print_info+0x20/0x20 [ 315.719289][T11045] ? load_image+0x420/0x420 [ 315.723816][T11045] ? __might_sleep+0xe0/0xe0 [ 315.728425][T11045] ? __lock_acquire+0x7eb0/0x7eb0 [ 315.733476][T11045] should_fail_ex+0x394/0x4c0 [ 315.738185][T11045] should_failslab+0x9/0x20 [ 315.742716][T11045] slab_pre_alloc_hook+0x59/0x300 [ 315.747764][T11045] ? page_pool_create+0x71/0x5c0 [ 315.752730][T11045] __kmem_cache_alloc_node+0x53/0x250 [ 315.758131][T11045] ? page_pool_create+0x71/0x5c0 [ 315.763093][T11045] kmalloc_node_trace+0x26/0xe0 [ 315.767967][T11045] page_pool_create+0x71/0x5c0 [ 315.772755][T11045] __veth_napi_enable_range+0x190/0x790 [ 315.778336][T11045] ? __skb_frag_ref+0x1c0/0x1c0 [ 315.783219][T11045] ? netif_napi_add_weight+0x890/0xba0 [ 315.788707][T11045] veth_napi_enable_range+0xd0/0x150 [ 315.794022][T11045] veth_set_features+0x1c8/0x2a0 [ 315.798971][T11045] __netdev_update_features+0x957/0x1790 [ 315.804680][T11045] ? dev_xdp_attach+0x1030/0x1030 [ 315.809720][T11045] ? __might_fault+0xaa/0x120 [ 315.814394][T11045] ? __lock_acquire+0x7eb0/0x7eb0 [ 315.819416][T11045] ? aa_get_newest_label+0xfd/0x5c0 [ 315.824612][T11045] ? __might_fault+0xaa/0x120 [ 315.829284][T11045] ? __might_fault+0xc6/0x120 [ 315.833952][T11045] ? __might_fault+0xaa/0x120 [ 315.838631][T11045] ethtool_set_one_feature+0x2a8/0x2f0 [ 315.844093][T11045] ? apparmor_capable+0x137/0x1a0 [ 315.849116][T11045] ? ethtool_get_one_feature+0x280/0x280 [ 315.854743][T11045] ? security_capable+0x89/0xb0 [ 315.859601][T11045] dev_ethtool+0xfd7/0x18d0 [ 315.864110][T11045] ? ethtool_get_module_eeprom_call+0x170/0x170 [ 315.870344][T11045] ? __lock_acquire+0x7eb0/0x7eb0 [ 315.875368][T11045] ? __might_fault+0xaa/0x120 [ 315.880037][T11045] ? full_name_hash+0x92/0xe0 [ 315.884713][T11045] ? dev_load+0x21/0x1f0 [ 315.888951][T11045] dev_ioctl+0x392/0x1140 [ 315.893284][T11045] sock_do_ioctl+0x239/0x310 [ 315.897881][T11045] ? sock_show_fdinfo+0xb0/0xb0 [ 315.902744][T11045] sock_ioctl+0x5be/0x7e0 [ 315.907075][T11045] ? sock_poll+0x3e0/0x3e0 [ 315.911507][T11045] ? bpf_lsm_file_ioctl+0x9/0x10 [ 315.916442][T11045] ? security_file_ioctl+0x80/0xa0 [ 315.921555][T11045] ? sock_poll+0x3e0/0x3e0 [ 315.925973][T11045] __se_sys_ioctl+0xfd/0x170 [ 315.930568][T11045] do_syscall_64+0x55/0xb0 [ 315.934979][T11045] ? clear_bhb_loop+0x40/0x90 [ 315.939655][T11045] ? clear_bhb_loop+0x40/0x90 [ 315.944331][T11045] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 315.950225][T11045] RIP: 0033:0x7fcb40b9e199 [ 315.954635][T11045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 315.974238][T11045] RSP: 002b:00007fcb41b24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 315.982650][T11045] RAX: ffffffffffffffda RBX: 00007fcb40e25fa0 RCX: 00007fcb40b9e199 [ 315.990616][T11045] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 000000000000002d [ 315.998578][T11045] RBP: 00007fcb41b24090 R08: 0000000000000000 R09: 0000000000000000 [ 316.006543][T11045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.014509][T11045] R13: 00007fcb40e26038 R14: 00007fcb40e25fa0 R15: 00007ffc076527f8 [ 316.022488][T11045] [ 316.064669][ T5775] Bluetooth: hci2: ISO packet too small [ 316.078638][T11045] veth1_to_bond: set_features() failed (-12); wanted 0x000061164fdd59e9, left 0x000061164fdd19e9 [ 316.295265][T11069] netlink: 'syz.1.1953': attribute type 21 has an invalid length. [ 316.393650][T11075] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1953'. [ 317.215281][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.221742][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.472701][T11163] netlink: 'syz.1.1967': attribute type 10 has an invalid length. [ 318.585481][T11163] : (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 318.632461][T11163] : (slave hsr0): The slave device specified does not support setting the MAC address [ 318.654196][T11163] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 318.688932][T11163] : (slave hsr0): Error -22 calling dev_set_mtu [ 318.729440][T11167] netlink: 'syz.0.1968': attribute type 21 has an invalid length. [ 318.896379][T11167] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1968'. [ 319.341103][T11182] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1973'. [ 319.385593][T11182] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1973'. [ 319.420674][T11184] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1973'. [ 320.214062][T11198] FAULT_INJECTION: forcing a failure. [ 320.214062][T11198] name failslab, interval 1, probability 0, space 0, times 0 [ 320.362139][T11198] CPU: 0 PID: 11198 Comm: syz.3.1979 Not tainted syzkaller #0 [ 320.369664][T11198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 320.379735][T11198] Call Trace: [ 320.383034][T11198] [ 320.385976][T11198] dump_stack_lvl+0x18c/0x250 [ 320.390670][T11198] ? show_regs_print_info+0x20/0x20 [ 320.395881][T11198] ? load_image+0x420/0x420 [ 320.400405][T11198] ? __might_sleep+0xe0/0xe0 [ 320.405018][T11198] ? __lock_acquire+0x7eb0/0x7eb0 [ 320.410066][T11198] should_fail_ex+0x394/0x4c0 [ 320.414770][T11198] should_failslab+0x9/0x20 [ 320.419295][T11198] slab_pre_alloc_hook+0x59/0x300 [ 320.424338][T11198] ? sk_prot_alloc+0xe7/0x210 [ 320.429026][T11198] ? sk_prot_alloc+0xe7/0x210 [ 320.433714][T11198] __kmem_cache_alloc_node+0x53/0x250 [ 320.439114][T11198] ? sk_prot_alloc+0xe7/0x210 [ 320.443802][T11198] __kmalloc+0xa7/0x240 [ 320.447982][T11198] sk_prot_alloc+0xe7/0x210 [ 320.452501][T11198] ? sk_alloc+0x24/0x350 [ 320.456764][T11198] sk_alloc+0x3a/0x350 [ 320.460845][T11198] ? bpf_ctx_init+0x154/0x190 [ 320.465546][T11198] bpf_prog_test_run_skb+0x371/0x18f0 [ 320.470945][T11198] ? __fget_files+0x28/0x460 [ 320.475555][T11198] ? __fget_files+0x3fc/0x460 [ 320.480264][T11198] ? cpu_online+0x60/0x60 [ 320.484620][T11198] bpf_prog_test_run+0x31f/0x390 [ 320.489575][T11198] __sys_bpf+0x49d/0x890 [ 320.493830][T11198] ? bpf_link_show_fdinfo+0x560/0x560 [ 320.499232][T11198] ? lock_chain_count+0x20/0x20 [ 320.504105][T11198] __x64_sys_bpf+0x7c/0x90 [ 320.508535][T11198] do_syscall_64+0x55/0xb0 [ 320.512962][T11198] ? clear_bhb_loop+0x40/0x90 [ 320.517649][T11198] ? clear_bhb_loop+0x40/0x90 [ 320.522337][T11198] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 320.528249][T11198] RIP: 0033:0x7fcb40b9e199 [ 320.532675][T11198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.552292][T11198] RSP: 002b:00007fcb41b24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 320.560708][T11198] RAX: ffffffffffffffda RBX: 00007fcb40e25fa0 RCX: 00007fcb40b9e199 [ 320.568692][T11198] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 320.576674][T11198] RBP: 00007fcb41b24090 R08: 0000000000000000 R09: 0000000000000000 [ 320.584652][T11198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 320.592631][T11198] R13: 00007fcb40e26038 R14: 00007fcb40e25fa0 R15: 00007ffc076527f8 [ 320.600630][T11198] [ 321.376757][T11212] netlink: 'syz.0.1983': attribute type 4 has an invalid length. [ 321.388404][T11212] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1983'. [ 321.470943][T11195] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1978'. [ 321.502527][T11195] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 322.699399][T11252] FAULT_INJECTION: forcing a failure. [ 322.699399][T11252] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 322.732123][T11252] CPU: 0 PID: 11252 Comm: syz.0.1993 Not tainted syzkaller #0 [ 322.739642][T11252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.749718][T11252] Call Trace: [ 322.753009][T11252] [ 322.755943][T11252] dump_stack_lvl+0x18c/0x250 [ 322.760636][T11252] ? show_regs_print_info+0x20/0x20 [ 322.765842][T11252] ? load_image+0x420/0x420 [ 322.770351][T11252] ? __might_fault+0xaa/0x120 [ 322.775029][T11252] ? __lock_acquire+0x7eb0/0x7eb0 [ 322.780065][T11252] should_fail_ex+0x394/0x4c0 [ 322.784754][T11252] _copy_from_user+0x2f/0xe0 [ 322.789345][T11252] ___sys_sendmsg+0x1c7/0x360 [ 322.794025][T11252] ? get_pid_task+0x20/0x1e0 [ 322.798625][T11252] ? __sys_sendmsg+0x2b0/0x2b0 [ 322.803410][T11252] ? __lock_acquire+0x7eb0/0x7eb0 [ 322.808459][T11252] __se_sys_sendmsg+0x1d0/0x2c0 [ 322.813319][T11252] ? __x64_sys_sendmsg+0x80/0x80 [ 322.818274][T11252] ? lockdep_hardirqs_on+0x98/0x150 [ 322.823480][T11252] do_syscall_64+0x55/0xb0 [ 322.827895][T11252] ? clear_bhb_loop+0x40/0x90 [ 322.832573][T11252] ? clear_bhb_loop+0x40/0x90 [ 322.837247][T11252] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 322.843145][T11252] RIP: 0033:0x7f2ba619e199 [ 322.847557][T11252] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.867162][T11252] RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 322.875576][T11252] RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199 [ 322.883589][T11252] RDX: 0000000000048055 RSI: 0000200000000ac0 RDI: 0000000000000004 [ 322.891562][T11252] RBP: 00007f2ba703d090 R08: 0000000000000000 R09: 0000000000000000 [ 322.899530][T11252] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 322.907500][T11252] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 322.915485][T11252] [ 324.154388][T11272] netlink: 'syz.0.1994': attribute type 29 has an invalid length. [ 324.207453][T11272] netlink: 'syz.0.1994': attribute type 29 has an invalid length. [ 324.248046][T11272] IPv6: …: Disabled Multicast RS [ 324.355796][T11272] pim6reg1: left promiscuous mode [ 324.367731][T11272] pim6reg1: left allmulticast mode [ 325.055664][T11287] FAULT_INJECTION: forcing a failure. [ 325.055664][T11287] name failslab, interval 1, probability 0, space 0, times 0 [ 325.115185][T11287] CPU: 1 PID: 11287 Comm: syz.0.2002 Not tainted syzkaller #0 [ 325.122713][T11287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 325.132791][T11287] Call Trace: [ 325.136094][T11287] [ 325.139048][T11287] dump_stack_lvl+0x18c/0x250 [ 325.143756][T11287] ? show_regs_print_info+0x20/0x20 [ 325.148976][T11287] ? load_image+0x420/0x420 [ 325.153497][T11287] ? __lock_acquire+0x7eb0/0x7eb0 [ 325.158533][T11287] should_fail_ex+0x394/0x4c0 [ 325.163224][T11287] should_failslab+0x9/0x20 [ 325.167734][T11287] slab_pre_alloc_hook+0x59/0x300 [ 325.172761][T11287] ? bpf_test_init+0x9f/0x140 [ 325.177445][T11287] ? bpf_test_init+0x9f/0x140 [ 325.182134][T11287] __kmem_cache_alloc_node+0x53/0x250 [ 325.187517][T11287] ? bpf_test_init+0x9f/0x140 [ 325.192197][T11287] __kmalloc+0xa7/0x240 [ 325.196359][T11287] bpf_test_init+0x9f/0x140 [ 325.200879][T11287] bpf_prog_test_run_xdp+0x4cd/0x1140 [ 325.206256][T11287] ? __lock_acquire+0x7eb0/0x7eb0 [ 325.211292][T11287] ? dev_put+0x80/0x80 [ 325.215371][T11287] ? bpf_prog_test_run+0x313/0x390 [ 325.220487][T11287] ? dev_put+0x80/0x80 [ 325.224563][T11287] bpf_prog_test_run+0x31f/0x390 [ 325.229505][T11287] __sys_bpf+0x49d/0x890 [ 325.233749][T11287] ? bpf_link_show_fdinfo+0x560/0x560 [ 325.239130][T11287] ? lock_chain_count+0x20/0x20 [ 325.243976][T11287] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 325.249962][T11287] __x64_sys_bpf+0x7c/0x90 [ 325.254380][T11287] do_syscall_64+0x55/0xb0 [ 325.258794][T11287] ? clear_bhb_loop+0x40/0x90 [ 325.263468][T11287] ? clear_bhb_loop+0x40/0x90 [ 325.268145][T11287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 325.274043][T11287] RIP: 0033:0x7f2ba619e199 [ 325.278462][T11287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 325.298068][T11287] RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 325.306482][T11287] RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199 [ 325.314451][T11287] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 325.322426][T11287] RBP: 00007f2ba703d090 R08: 0000000000000000 R09: 0000000000000000 [ 325.330396][T11287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 325.338367][T11287] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 325.346351][T11287] [ 326.010935][ T5775] Bluetooth: hci1: unexpected event 0x03 length: 151 > 11 [ 326.029220][T11300] netlink: 'syz.0.2007': attribute type 9 has an invalid length. [ 326.131168][T11300] netlink: 149864 bytes leftover after parsing attributes in process `syz.0.2007'. [ 326.743797][T11295] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2005'. [ 326.792289][T11295] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 327.372250][T11322] netlink: 'syz.0.2016': attribute type 17 has an invalid length. [ 327.396689][T11322] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2016'. [ 327.441643][T11322] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 327.492327][T11326] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2015'. [ 327.562946][T11329] netlink: 'syz.3.2015': attribute type 19 has an invalid length. [ 327.609015][T11330] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2014'. [ 327.664800][T11332] netlink: 147668 bytes leftover after parsing attributes in process `syz.2.2014'. [ 327.750387][T11332] netlink: 252 bytes leftover after parsing attributes in process `syz.2.2014'. [ 327.892574][T11336] netlink: 10 bytes leftover after parsing attributes in process `syz.0.2017'. [ 328.160645][T11348] netlink: 'syz.0.2021': attribute type 29 has an invalid length. [ 328.179286][T11348] netlink: 'syz.0.2021': attribute type 29 has an invalid length. [ 328.209372][T11349] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 328.220444][T11348] netlink: 'syz.0.2021': attribute type 29 has an invalid length. [ 328.252634][T11348] netlink: 'syz.0.2021': attribute type 29 has an invalid length. [ 328.284081][ T5775] Bluetooth: hci3: unexpected subevent 0x19 length: 150 > 28 [ 328.291514][ T5775] Bluetooth: hci3: Unable to find connection with handle 0x0000 [ 328.301881][T11348] netlink: 'syz.0.2021': attribute type 29 has an invalid length. [ 328.925379][T11358] syzkaller0: entered promiscuous mode [ 328.945717][T11358] syzkaller0: entered allmulticast mode [ 328.985663][T11365] netlink: 'syz.3.2027': attribute type 21 has an invalid length. [ 329.012169][T11365] netlink: 'syz.3.2027': attribute type 1 has an invalid length. [ 329.030690][T11365] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2027'. [ 329.161551][T11373] netlink: 'syz.3.2027': attribute type 21 has an invalid length. [ 332.225566][T11406] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 332.233081][T11406] IPv6: NLM_F_CREATE should be set when creating new route [ 332.236971][T11413] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.2042'. [ 332.240574][T11406] IPv6: NLM_F_CREATE should be set when creating new route [ 332.257416][T11406] IPv6: NLM_F_CREATE should be set when creating new route [ 332.266643][T11412] FAULT_INJECTION: forcing a failure. [ 332.266643][T11412] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 332.280129][T11412] CPU: 0 PID: 11412 Comm: syz.3.2044 Not tainted syzkaller #0 [ 332.287602][T11412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 332.297651][T11412] Call Trace: [ 332.300924][T11412] [ 332.303850][T11412] dump_stack_lvl+0x18c/0x250 [ 332.308529][T11412] ? show_regs_print_info+0x20/0x20 [ 332.313722][T11412] ? load_image+0x420/0x420 [ 332.318226][T11412] ? __lock_acquire+0x7eb0/0x7eb0 [ 332.323246][T11412] ? snprintf+0xe9/0x140 [ 332.327490][T11412] should_fail_ex+0x394/0x4c0 [ 332.332170][T11412] _copy_to_user+0x2f/0xa0 [ 332.336581][T11412] simple_read_from_buffer+0xe7/0x150 [ 332.341955][T11412] proc_fail_nth_read+0x1e8/0x260 [ 332.346983][T11412] ? proc_fault_inject_write+0x360/0x360 [ 332.352619][T11412] ? fsnotify_perm+0x271/0x5e0 [ 332.357384][T11412] ? proc_fault_inject_write+0x360/0x360 [ 332.363016][T11412] vfs_read+0x298/0x990 [ 332.367175][T11412] ? kernel_read+0x1e0/0x1e0 [ 332.371772][T11412] ? __fget_files+0x28/0x460 [ 332.376360][T11412] ? __fget_files+0x3fc/0x460 [ 332.381038][T11412] ? __fdget_pos+0x2a3/0x330 [ 332.385623][T11412] ? ksys_read+0x74/0x260 [ 332.389952][T11412] ksys_read+0x151/0x260 [ 332.394193][T11412] ? vfs_write+0x9a0/0x9a0 [ 332.398610][T11412] ? lockdep_hardirqs_on+0x98/0x150 [ 332.403807][T11412] do_syscall_64+0x55/0xb0 [ 332.408216][T11412] ? clear_bhb_loop+0x40/0x90 [ 332.412884][T11412] ? clear_bhb_loop+0x40/0x90 [ 332.417552][T11412] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 332.423443][T11412] RIP: 0033:0x7fcb40b5e9ce [ 332.427853][T11412] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 332.447454][T11412] RSP: 002b:00007fcb41b23fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 332.455866][T11412] RAX: ffffffffffffffda RBX: 00007fcb41b246c0 RCX: 00007fcb40b5e9ce [ 332.463829][T11412] RDX: 000000000000000f RSI: 00007fcb41b240a0 RDI: 0000000000000005 [ 332.471790][T11412] RBP: 00007fcb41b24090 R08: 0000000000000000 R09: 0000000000000000 [ 332.479758][T11412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.487727][T11412] R13: 00007fcb40e26038 R14: 00007fcb40e25fa0 R15: 00007ffc076527f8 [ 332.495713][T11412] [ 332.512041][T11410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2041'. [ 333.310897][T11444] validate_nla: 4 callbacks suppressed [ 333.310916][T11444] netlink: 'syz.2.2057': attribute type 4 has an invalid length. [ 333.332108][T11444] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2057'. [ 333.371551][T11444] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 333.695137][T11461] netlink: 'syz.0.2062': attribute type 21 has an invalid length. [ 333.909708][T11465] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2062'. [ 336.654637][T11476] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2064'. [ 336.749428][T11470] netlink: 'syz.3.2065': attribute type 4 has an invalid length. [ 336.763158][T11470] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2065'. [ 336.822599][T11483] netlink: 140 bytes leftover after parsing attributes in process `syz.1.2070'. [ 336.832600][T11483] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2070'. [ 336.954205][T11483] : (slave bond_slave_0): Releasing backup interface [ 337.610926][T11483] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 337.857007][T11497] netlink: 'syz.2.2076': attribute type 21 has an invalid length. [ 337.968274][T11504] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2076'. [ 338.105417][T11510] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2081'. [ 338.114890][T11510] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2081'. [ 338.128027][T11510] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2081'. [ 338.151214][T11510] netlink: 'syz.3.2081': attribute type 10 has an invalid length. [ 338.159865][T11510] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.2081'. [ 338.196651][T11513] netlink: 'syz.1.2082': attribute type 10 has an invalid length. [ 338.204808][T11513] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2082'. [ 338.288132][T11516] netlink: 'syz.1.2083': attribute type 21 has an invalid length. [ 338.301072][T11516] netlink: 164 bytes leftover after parsing attributes in process `syz.1.2083'. [ 338.823386][T11537] netlink: 193792 bytes leftover after parsing attributes in process `syz.3.2087'. [ 339.596819][T11564] FAULT_INJECTION: forcing a failure. [ 339.596819][T11564] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 339.615472][T11564] CPU: 1 PID: 11564 Comm: syz.3.2092 Not tainted syzkaller #0 [ 339.622976][T11564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 339.633045][T11564] Call Trace: [ 339.633641][T11566] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2093'. [ 339.636323][T11564] [ 339.645464][T11566] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2093'. [ 339.648182][T11564] dump_stack_lvl+0x18c/0x250 [ 339.661834][T11564] ? show_regs_print_info+0x20/0x20 [ 339.667053][T11564] ? load_image+0x420/0x420 [ 339.669968][T11566] netlink: 'syz.1.2093': attribute type 10 has an invalid length. [ 339.671563][T11564] ? __lock_acquire+0x7eb0/0x7eb0 [ 339.684392][T11564] ? snprintf+0xe9/0x140 [ 339.688663][T11564] should_fail_ex+0x394/0x4c0 [ 339.693364][T11564] _copy_to_user+0x2f/0xa0 [ 339.697773][T11564] simple_read_from_buffer+0xe7/0x150 [ 339.703134][T11564] proc_fail_nth_read+0x1e8/0x260 [ 339.708157][T11564] ? proc_fault_inject_write+0x360/0x360 [ 339.713783][T11564] ? fsnotify_perm+0x271/0x5e0 [ 339.718540][T11564] ? proc_fault_inject_write+0x360/0x360 [ 339.724179][T11564] vfs_read+0x298/0x990 [ 339.728365][T11564] ? kernel_read+0x1e0/0x1e0 [ 339.732972][T11564] ? __fget_files+0x28/0x460 [ 339.737565][T11564] ? __fget_files+0x3fc/0x460 [ 339.742245][T11564] ? __fdget_pos+0x2a3/0x330 [ 339.746831][T11564] ? ksys_read+0x74/0x260 [ 339.751158][T11564] ksys_read+0x151/0x260 [ 339.755400][T11564] ? vfs_write+0x9a0/0x9a0 [ 339.759820][T11564] ? lockdep_hardirqs_on+0x98/0x150 [ 339.765021][T11564] do_syscall_64+0x55/0xb0 [ 339.769432][T11564] ? clear_bhb_loop+0x40/0x90 [ 339.774104][T11564] ? clear_bhb_loop+0x40/0x90 [ 339.778777][T11564] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 339.784669][T11564] RIP: 0033:0x7fcb40b5e9ce [ 339.789083][T11564] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 339.808684][T11564] RSP: 002b:00007fcb41b23fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 339.817100][T11564] RAX: ffffffffffffffda RBX: 00007fcb41b246c0 RCX: 00007fcb40b5e9ce [ 339.825074][T11564] RDX: 000000000000000f RSI: 00007fcb41b240a0 RDI: 0000000000000003 [ 339.833041][T11564] RBP: 00007fcb41b24090 R08: 0000000000000000 R09: 0000000000000000 [ 339.841005][T11564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 339.848968][T11564] R13: 00007fcb40e26038 R14: 00007fcb40e25fa0 R15: 00007ffc076527f8 [ 339.856945][T11564] [ 340.207202][T11574] sit0: entered allmulticast mode [ 340.421028][T11577] sit0: entered promiscuous mode [ 341.025580][T11602] netlink: 'syz.2.2106': attribute type 10 has an invalid length. [ 341.597895][T11614] netlink: 'syz.3.2112': attribute type 10 has an invalid length. [ 341.630195][T11614] veth0_vlan: left promiscuous mode [ 341.657317][T11614] veth0_vlan: left allmulticast mode [ 341.682932][T11614] veth0_vlan: entered promiscuous mode [ 341.734976][T11614] batman_adv: batadv0: Adding interface: veth0_vlan [ 341.772189][T11614] batman_adv: batadv0: The MTU of interface veth0_vlan is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.857410][T11614] batman_adv: batadv0: Interface activated: veth0_vlan [ 342.400198][T11626] netlink: 'syz.3.2116': attribute type 10 has an invalid length. [ 342.666095][T11634] netlink: 'syz.1.2120': attribute type 10 has an invalid length. [ 343.231579][T11646] __nla_validate_parse: 12 callbacks suppressed [ 343.231595][T11646] netlink: 11903 bytes leftover after parsing attributes in process `syz.2.2125'. [ 343.495895][T11648] sit0: entered allmulticast mode [ 343.638092][T11656] sit0: entered promiscuous mode [ 343.863914][T11664] C: renamed from team_slave_0 (while UP) [ 343.917521][T11664] netlink: 'syz.0.2132': attribute type 3 has an invalid length. [ 343.952252][T11664] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2132'. [ 344.361138][T11676] netlink: 'syz.2.2138': attribute type 6 has an invalid length. [ 344.372138][T11676] netlink: 164 bytes leftover after parsing attributes in process `syz.2.2138'. [ 344.987261][T11689] sit0: entered allmulticast mode [ 345.097917][T11694] netlink: 'syz.1.2145': attribute type 9 has an invalid length. [ 345.119024][T11694] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.2145'. [ 345.162583][T11692] sit0: entered promiscuous mode [ 345.335348][T11695] netlink: 'syz.1.2145': attribute type 9 has an invalid length. [ 345.356850][T11695] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.2145'. [ 345.454115][T11700] netlink: 'syz.2.2147': attribute type 3 has an invalid length. [ 345.461908][T11700] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2147'. [ 345.573888][T11704] FAULT_INJECTION: forcing a failure. [ 345.573888][T11704] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 345.596549][T11704] CPU: 0 PID: 11704 Comm: syz.2.2149 Not tainted syzkaller #0 [ 345.604057][T11704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 345.614134][T11704] Call Trace: [ 345.617427][T11704] [ 345.620370][T11704] dump_stack_lvl+0x18c/0x250 [ 345.625072][T11704] ? show_regs_print_info+0x20/0x20 [ 345.630285][T11704] ? load_image+0x420/0x420 [ 345.634812][T11704] ? __lock_acquire+0x7eb0/0x7eb0 [ 345.639856][T11704] ? snprintf+0xe9/0x140 [ 345.644120][T11704] should_fail_ex+0x394/0x4c0 [ 345.648819][T11704] _copy_to_user+0x2f/0xa0 [ 345.653254][T11704] simple_read_from_buffer+0xe7/0x150 [ 345.658649][T11704] proc_fail_nth_read+0x1e8/0x260 [ 345.663696][T11704] ? proc_fault_inject_write+0x360/0x360 [ 345.669352][T11704] ? fsnotify_perm+0x271/0x5e0 [ 345.674131][T11704] ? proc_fault_inject_write+0x360/0x360 [ 345.679792][T11704] vfs_read+0x298/0x990 [ 345.683973][T11704] ? kernel_read+0x1e0/0x1e0 [ 345.688580][T11704] ? __fget_files+0x28/0x460 [ 345.693186][T11704] ? __fget_files+0x3fc/0x460 [ 345.697917][T11704] ? __fdget_pos+0x2a3/0x330 [ 345.702518][T11704] ? ksys_read+0x74/0x260 [ 345.706865][T11704] ksys_read+0x151/0x260 [ 345.711124][T11704] ? vfs_write+0x9a0/0x9a0 [ 345.715560][T11704] ? lockdep_hardirqs_on+0x98/0x150 [ 345.720771][T11704] do_syscall_64+0x55/0xb0 [ 345.725208][T11704] ? clear_bhb_loop+0x40/0x90 [ 345.729902][T11704] ? clear_bhb_loop+0x40/0x90 [ 345.734592][T11704] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 345.740498][T11704] RIP: 0033:0x7fc3b4f5e9ce [ 345.744926][T11704] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 345.764543][T11704] RSP: 002b:00007fc3b5d97fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 345.772971][T11704] RAX: ffffffffffffffda RBX: 00007fc3b5d986c0 RCX: 00007fc3b4f5e9ce [ 345.780953][T11704] RDX: 000000000000000f RSI: 00007fc3b5d980a0 RDI: 0000000000000006 [ 345.788932][T11704] RBP: 00007fc3b5d98090 R08: 0000000000000000 R09: 0000000000000000 [ 345.796910][T11704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 345.804890][T11704] R13: 00007fc3b5226038 R14: 00007fc3b5225fa0 R15: 00007fffa282f3b8 [ 345.812890][T11704] [ 345.849945][T11708] netlink: 'syz.3.2150': attribute type 6 has an invalid length. [ 345.862063][T11708] netlink: 164 bytes leftover after parsing attributes in process `syz.3.2150'. [ 345.963628][T11709] C: renamed from team_slave_0 [ 346.035408][T11709] netlink: 'syz.1.2148': attribute type 3 has an invalid length. [ 346.058664][T11709] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2148'. [ 346.512236][T11722] FAULT_INJECTION: forcing a failure. [ 346.512236][T11722] name failslab, interval 1, probability 0, space 0, times 0 [ 346.530425][T11722] CPU: 0 PID: 11722 Comm: syz.2.2155 Not tainted syzkaller #0 [ 346.537928][T11722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 346.547998][T11722] Call Trace: [ 346.551266][T11722] [ 346.554186][T11722] dump_stack_lvl+0x18c/0x250 [ 346.558855][T11722] ? show_regs_print_info+0x20/0x20 [ 346.564043][T11722] ? load_image+0x420/0x420 [ 346.568651][T11722] ? perf_trace_lock+0xfc/0x3b0 [ 346.573496][T11722] ? verify_lock_unused+0x140/0x140 [ 346.578716][T11722] ? perf_trace_lock+0xfc/0x3b0 [ 346.583574][T11722] should_fail_ex+0x394/0x4c0 [ 346.588269][T11722] should_failslab+0x9/0x20 [ 346.592779][T11722] slab_pre_alloc_hook+0x59/0x300 [ 346.597834][T11722] kmem_cache_alloc+0x5a/0x2c0 [ 346.602634][T11722] ? skb_clone+0x1eb/0x370 [ 346.607084][T11722] skb_clone+0x1eb/0x370 [ 346.611351][T11722] __netlink_deliver_tap+0x411/0x7f0 [ 346.616678][T11722] ? netlink_deliver_tap+0x2e/0x1b0 [ 346.621904][T11722] netlink_deliver_tap+0x19c/0x1b0 [ 346.627038][T11722] netlink_unicast+0x77b/0x930 [ 346.631835][T11722] netlink_sendmsg+0x8d0/0xbf0 [ 346.636655][T11722] ? netlink_getsockopt+0x590/0x590 [ 346.641882][T11722] ? apparmor_socket_sendmsg+0x8e/0x330 [ 346.647449][T11722] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 346.652755][T11722] ? security_socket_sendmsg+0x80/0xa0 [ 346.658230][T11722] ? netlink_getsockopt+0x590/0x590 [ 346.663450][T11722] ____sys_sendmsg+0x61b/0x980 [ 346.668244][T11722] ? __asan_memset+0x22/0x40 [ 346.672855][T11722] ? __sys_sendmsg_sock+0x30/0x30 [ 346.677896][T11722] ? __import_iovec+0x5f2/0x850 [ 346.682776][T11722] ? import_iovec+0x73/0xa0 [ 346.687302][T11722] ___sys_sendmsg+0x2a6/0x360 [ 346.692002][T11722] ? __sys_sendmsg+0x2b0/0x2b0 [ 346.696805][T11722] ? __lock_acquire+0x7eb0/0x7eb0 [ 346.701878][T11722] __se_sys_sendmsg+0x1d0/0x2c0 [ 346.706749][T11722] ? __x64_sys_sendmsg+0x80/0x80 [ 346.711731][T11722] ? lockdep_hardirqs_on+0x98/0x150 [ 346.716951][T11722] do_syscall_64+0x55/0xb0 [ 346.721379][T11722] ? clear_bhb_loop+0x40/0x90 [ 346.726069][T11722] ? clear_bhb_loop+0x40/0x90 [ 346.730764][T11722] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 346.736678][T11722] RIP: 0033:0x7fc3b4f9e199 [ 346.741112][T11722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.760732][T11722] RSP: 002b:00007fc3b5d98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 346.769163][T11722] RAX: ffffffffffffffda RBX: 00007fc3b5225fa0 RCX: 00007fc3b4f9e199 [ 346.777153][T11722] RDX: 0000000004040000 RSI: 0000200000000640 RDI: 0000000000000003 [ 346.778370][T11726] netlink: 'syz.3.2157': attribute type 11 has an invalid length. [ 346.785125][T11722] RBP: 00007fc3b5d98090 R08: 0000000000000000 R09: 0000000000000000 [ 346.785141][T11722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 346.785152][T11722] R13: 00007fc3b5226038 R14: 00007fc3b5225fa0 R15: 00007fffa282f3b8 [ 346.785295][T11722] [ 347.084757][T11736] netlink: 'syz.3.2160': attribute type 27 has an invalid length. [ 347.098497][T11736] netlink: 'syz.3.2160': attribute type 25 has an invalid length. [ 347.177024][T11738] C: renamed from team_slave_0 (while UP) [ 347.263961][T11738] netlink: 'syz.2.2162': attribute type 3 has an invalid length. [ 347.306678][T11738] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2162'. [ 347.320028][T11743] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2163'. [ 347.502728][T11747] netlink: 'syz.3.2164': attribute type 10 has an invalid length. [ 347.529221][T11747] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.572971][T11747] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.580401][T11747] bridge0: port 1(bridge_slave_0) entered forwarding state [ 347.627156][T11747] team0: Port device bridge0 added [ 348.056770][T11758] syzkaller0: entered promiscuous mode [ 348.072043][T11758] syzkaller0: entered allmulticast mode [ 348.304083][T11768] __nla_validate_parse: 4 callbacks suppressed [ 348.304099][T11768] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2173'. [ 350.895126][T11768] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2173'. [ 350.925556][T11775] netlink: 'syz.1.2174': attribute type 46 has an invalid length. [ 351.190542][T11790] FAULT_INJECTION: forcing a failure. [ 351.190542][T11790] name failslab, interval 1, probability 0, space 0, times 0 [ 351.219159][T11790] CPU: 0 PID: 11790 Comm: syz.1.2181 Not tainted syzkaller #0 [ 351.226664][T11790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 351.236723][T11790] Call Trace: [ 351.240000][T11790] [ 351.242934][T11790] dump_stack_lvl+0x18c/0x250 [ 351.247617][T11790] ? show_regs_print_info+0x20/0x20 [ 351.252814][T11790] ? load_image+0x420/0x420 [ 351.257321][T11790] ? __might_sleep+0xe0/0xe0 [ 351.261913][T11790] ? __lock_acquire+0x7eb0/0x7eb0 [ 351.266950][T11790] should_fail_ex+0x394/0x4c0 [ 351.271638][T11790] should_failslab+0x9/0x20 [ 351.276141][T11790] slab_pre_alloc_hook+0x59/0x300 [ 351.281164][T11790] ? tomoyo_encode+0x2ad/0x570 [ 351.285927][T11790] ? tomoyo_encode+0x2ad/0x570 [ 351.290688][T11790] __kmem_cache_alloc_node+0x53/0x250 [ 351.296081][T11790] ? tomoyo_encode+0x2ad/0x570 [ 351.300840][T11790] __kmalloc+0xa7/0x240 [ 351.305007][T11790] tomoyo_encode+0x2ad/0x570 [ 351.309603][T11790] tomoyo_realpath_from_path+0x57c/0x5c0 [ 351.315242][T11790] ? tomoyo_domain+0xd6/0x120 [ 351.319930][T11790] tomoyo_path_number_perm+0x248/0x5e0 [ 351.325425][T11790] ? tomoyo_path_number_perm+0x217/0x5e0 [ 351.331062][T11790] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 351.336527][T11790] ? ksys_write+0x1d2/0x260 [ 351.341077][T11790] ? __fget_files+0x28/0x460 [ 351.345685][T11790] security_file_ioctl+0x70/0xa0 [ 351.350632][T11790] __se_sys_ioctl+0x48/0x170 [ 351.355226][T11790] do_syscall_64+0x55/0xb0 [ 351.359652][T11790] ? clear_bhb_loop+0x40/0x90 [ 351.364415][T11790] ? clear_bhb_loop+0x40/0x90 [ 351.369091][T11790] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 351.374987][T11790] RIP: 0033:0x7f76b4d9e199 [ 351.379411][T11790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.399018][T11790] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 351.407434][T11790] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 351.415406][T11790] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000005 [ 351.423375][T11790] RBP: 00007f76b5d32090 R08: 0000000000000000 R09: 0000000000000000 [ 351.431342][T11790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 351.439309][T11790] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 351.447301][T11790] [ 351.484206][T11790] ERROR: Out of memory at tomoyo_realpath_from_path. [ 351.587509][T11791] delete_channel: no stack [ 351.622457][T11791] delete_channel: no stack [ 351.951346][T11806] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2187'. [ 351.991131][T11806] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2187'. [ 352.032222][T11811] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2187'. [ 352.483194][T11826] netlink: 'syz.1.2192': attribute type 5 has an invalid length. [ 352.491403][T11826] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2192'. [ 352.506620][T11826] lo: entered allmulticast mode [ 352.533311][T11826] Q±6ã`Ò˜: renamed from lo [ 352.675912][T11826] syzkaller0: entered promiscuous mode [ 352.681432][T11826] syzkaller0: entered allmulticast mode [ 354.399622][T11848] netlink: 'syz.0.2200': attribute type 27 has an invalid length. [ 354.407637][T11848] netlink: 'syz.0.2200': attribute type 25 has an invalid length. [ 354.513880][T11850] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2202'. [ 354.525057][T11850] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2202'. [ 354.552781][T11850] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2202'. [ 354.574551][T11850] netlink: 65055 bytes leftover after parsing attributes in process `syz.2.2202'. [ 354.583229][T11856] FAULT_INJECTION: forcing a failure. [ 354.583229][T11856] name failslab, interval 1, probability 0, space 0, times 0 [ 354.612822][T11856] CPU: 1 PID: 11856 Comm: syz.0.2205 Not tainted syzkaller #0 [ 354.620324][T11856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 354.630394][T11856] Call Trace: [ 354.633681][T11856] [ 354.636621][T11856] dump_stack_lvl+0x18c/0x250 [ 354.641316][T11856] ? show_regs_print_info+0x20/0x20 [ 354.646533][T11856] ? load_image+0x420/0x420 [ 354.651063][T11856] ? verify_lock_unused+0x140/0x140 [ 354.656376][T11856] should_fail_ex+0x394/0x4c0 [ 354.661068][T11856] should_failslab+0x9/0x20 [ 354.665582][T11856] slab_pre_alloc_hook+0x59/0x300 [ 354.670615][T11856] kmem_cache_alloc+0x5a/0x2c0 [ 354.675387][T11856] ? skb_clone+0x1eb/0x370 [ 354.679811][T11856] skb_clone+0x1eb/0x370 [ 354.684052][T11856] __netlink_deliver_tap+0x411/0x7f0 [ 354.689342][T11856] ? netlink_deliver_tap+0x2e/0x1b0 [ 354.694539][T11856] netlink_deliver_tap+0x19c/0x1b0 [ 354.699646][T11856] netlink_unicast+0x77b/0x930 [ 354.704419][T11856] netlink_sendmsg+0x8d0/0xbf0 [ 354.709189][T11856] ? netlink_getsockopt+0x590/0x590 [ 354.714387][T11856] ? apparmor_socket_sendmsg+0x8e/0x330 [ 354.719928][T11856] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 354.725216][T11856] ? security_socket_sendmsg+0x80/0xa0 [ 354.730667][T11856] ? netlink_getsockopt+0x590/0x590 [ 354.735867][T11856] ____sys_sendmsg+0x61b/0x980 [ 354.740635][T11856] ? __asan_memset+0x22/0x40 [ 354.745223][T11856] ? __sys_sendmsg_sock+0x30/0x30 [ 354.750241][T11856] ? __import_iovec+0x5f2/0x850 [ 354.755098][T11856] ? import_iovec+0x73/0xa0 [ 354.759604][T11856] ___sys_sendmsg+0x2a6/0x360 [ 354.764281][T11856] ? get_pid_task+0x20/0x1e0 [ 354.768875][T11856] ? __sys_sendmsg+0x2b0/0x2b0 [ 354.773655][T11856] ? __lock_acquire+0x7eb0/0x7eb0 [ 354.778698][T11856] __se_sys_sendmsg+0x1d0/0x2c0 [ 354.783550][T11856] ? __x64_sys_sendmsg+0x80/0x80 [ 354.788504][T11856] ? lockdep_hardirqs_on+0x98/0x150 [ 354.793701][T11856] do_syscall_64+0x55/0xb0 [ 354.798112][T11856] ? clear_bhb_loop+0x40/0x90 [ 354.802788][T11856] ? clear_bhb_loop+0x40/0x90 [ 354.807457][T11856] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 354.814134][T11856] RIP: 0033:0x7f2ba619e199 [ 354.818541][T11856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 354.838140][T11856] RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 354.846545][T11856] RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199 [ 354.854509][T11856] RDX: 0000000004040000 RSI: 0000200000000640 RDI: 0000000000000003 [ 354.862472][T11856] RBP: 00007f2ba703d090 R08: 0000000000000000 R09: 0000000000000000 [ 354.870458][T11856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 354.878422][T11856] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 354.886399][T11856] [ 354.933936][T11856] netlink: 'syz.0.2205': attribute type 27 has an invalid length. [ 354.942057][T11856] netlink: 'syz.0.2205': attribute type 25 has an invalid length. [ 355.013475][T11861] raw_sendmsg: syz.1.2206 forgot to set AF_INET. Fix it! [ 355.177559][T11895] FAULT_INJECTION: forcing a failure. [ 355.177559][T11895] name failslab, interval 1, probability 0, space 0, times 0 [ 355.194988][T11895] CPU: 0 PID: 11895 Comm: syz.1.2211 Not tainted syzkaller #0 [ 355.202473][T11895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 355.212522][T11895] Call Trace: [ 355.215786][T11895] [ 355.218700][T11895] dump_stack_lvl+0x18c/0x250 [ 355.223383][T11895] ? show_regs_print_info+0x20/0x20 [ 355.228593][T11895] ? load_image+0x420/0x420 [ 355.233100][T11895] ? __might_sleep+0xe0/0xe0 [ 355.237686][T11895] ? __lock_acquire+0x7eb0/0x7eb0 [ 355.242712][T11895] should_fail_ex+0x394/0x4c0 [ 355.247391][T11895] should_failslab+0x9/0x20 [ 355.251891][T11895] slab_pre_alloc_hook+0x59/0x300 [ 355.256913][T11895] ? stack_trace_save+0x100/0x100 [ 355.261936][T11895] ? kvmalloc_node+0x70/0x180 [ 355.266619][T11895] ? kvmalloc_node+0x70/0x180 [ 355.271290][T11895] __kmem_cache_alloc_node+0x53/0x250 [ 355.276666][T11895] ? kvmalloc_node+0x70/0x180 [ 355.281341][T11895] __kmalloc_node+0xa6/0x240 [ 355.285932][T11895] kvmalloc_node+0x70/0x180 [ 355.290432][T11895] bpf_test_run_xdp_live+0x1c2/0x1b30 [ 355.295798][T11895] ? verify_lock_unused+0x140/0x140 [ 355.300995][T11895] ? perf_trace_lock+0xfc/0x3b0 [ 355.305833][T11895] ? __kmalloc+0xb7/0x240 [ 355.310160][T11895] ? bpf_test_init+0x9f/0x140 [ 355.314836][T11895] ? perf_trace_lock+0xfc/0x3b0 [ 355.319682][T11895] ? xdp_convert_md_to_buff+0x330/0x330 [ 355.325237][T11895] ? __lock_acquire+0x7eb0/0x7eb0 [ 355.330259][T11895] ? __virt_addr_valid+0x10c/0x380 [ 355.335368][T11895] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 355.341604][T11895] ? _copy_from_user+0xa5/0xe0 [ 355.346366][T11895] ? bpf_test_init+0x119/0x140 [ 355.351130][T11895] ? xdp_convert_md_to_buff+0x5b/0x330 [ 355.356586][T11895] bpf_prog_test_run_xdp+0x7d8/0x1140 [ 355.361964][T11895] ? __lock_acquire+0x7eb0/0x7eb0 [ 355.367003][T11895] ? dev_put+0x80/0x80 [ 355.371086][T11895] ? dev_put+0x80/0x80 [ 355.375153][T11895] bpf_prog_test_run+0x31f/0x390 [ 355.380088][T11895] __sys_bpf+0x49d/0x890 [ 355.384415][T11895] ? bpf_link_show_fdinfo+0x560/0x560 [ 355.389795][T11895] ? lock_chain_count+0x20/0x20 [ 355.394646][T11895] __x64_sys_bpf+0x7c/0x90 [ 355.399066][T11895] do_syscall_64+0x55/0xb0 [ 355.403477][T11895] ? clear_bhb_loop+0x40/0x90 [ 355.408147][T11895] ? clear_bhb_loop+0x40/0x90 [ 355.412819][T11895] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 355.418712][T11895] RIP: 0033:0x7f76b4d9e199 [ 355.423125][T11895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 355.442725][T11895] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 355.451133][T11895] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 355.459095][T11895] RDX: 0000000000000050 RSI: 0000200000000100 RDI: 000000000000000a [ 355.467057][T11895] RBP: 00007f76b5d32090 R08: 0000000000000000 R09: 0000000000000000 [ 355.475019][T11895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 355.482987][T11895] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 355.490968][T11895] [ 355.770306][T11927] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2217'. [ 355.779609][T11927] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2217'. [ 355.798159][T11927] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2217'. [ 355.827851][T11930] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2216'. [ 355.857324][T11927] netlink: 65055 bytes leftover after parsing attributes in process `syz.0.2217'. [ 357.491744][T11964] netlink: 'syz.2.2226': attribute type 10 has an invalid length. [ 357.511142][T11964] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2226'. [ 357.536965][T11964] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 357.569764][T11964] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 358.886589][ T5775] Bluetooth: hci2: ISO packet for unknown connection handle 15 [ 359.168380][T12033] FAULT_INJECTION: forcing a failure. [ 359.168380][T12033] name failslab, interval 1, probability 0, space 0, times 0 [ 359.181817][T12033] CPU: 0 PID: 12033 Comm: syz.0.2252 Not tainted syzkaller #0 [ 359.189310][T12033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 359.199380][T12033] Call Trace: [ 359.202678][T12033] [ 359.205618][T12033] dump_stack_lvl+0x18c/0x250 [ 359.210321][T12033] ? show_regs_print_info+0x20/0x20 [ 359.215542][T12033] ? load_image+0x420/0x420 [ 359.220071][T12033] ? verify_lock_unused+0x140/0x140 [ 359.225282][T12033] should_fail_ex+0x394/0x4c0 [ 359.229956][T12033] should_failslab+0x9/0x20 [ 359.234462][T12033] slab_pre_alloc_hook+0x59/0x300 [ 359.239501][T12033] kmem_cache_alloc+0x5a/0x2c0 [ 359.244271][T12033] ? skb_clone+0x1eb/0x370 [ 359.248697][T12033] skb_clone+0x1eb/0x370 [ 359.252947][T12033] __netlink_deliver_tap+0x411/0x7f0 [ 359.258240][T12033] ? netlink_deliver_tap+0x2e/0x1b0 [ 359.263437][T12033] netlink_deliver_tap+0x19c/0x1b0 [ 359.268548][T12033] netlink_unicast+0x77b/0x930 [ 359.273319][T12033] netlink_sendmsg+0x8d0/0xbf0 [ 359.278088][T12033] ? netlink_getsockopt+0x590/0x590 [ 359.283288][T12033] ? apparmor_socket_sendmsg+0x8e/0x330 [ 359.288829][T12033] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 359.294109][T12033] ? security_socket_sendmsg+0x80/0xa0 [ 359.299559][T12033] ? netlink_getsockopt+0x590/0x590 [ 359.304757][T12033] ____sys_sendmsg+0x61b/0x980 [ 359.309532][T12033] ? __asan_memset+0x22/0x40 [ 359.314120][T12033] ? __sys_sendmsg_sock+0x30/0x30 [ 359.319141][T12033] ? __import_iovec+0x5f2/0x850 [ 359.323999][T12033] ? import_iovec+0x73/0xa0 [ 359.328505][T12033] ___sys_sendmsg+0x2a6/0x360 [ 359.333184][T12033] ? __sys_sendmsg+0x2b0/0x2b0 [ 359.337963][T12033] ? trace_call_bpf+0xc3/0x6c0 [ 359.342742][T12033] __se_sys_sendmsg+0x1d0/0x2c0 [ 359.347590][T12033] ? __x64_sys_sendmsg+0x80/0x80 [ 359.352536][T12033] ? lockdep_hardirqs_on+0x98/0x150 [ 359.357734][T12033] do_syscall_64+0x55/0xb0 [ 359.362141][T12033] ? clear_bhb_loop+0x40/0x90 [ 359.366811][T12033] ? clear_bhb_loop+0x40/0x90 [ 359.371483][T12033] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 359.377374][T12033] RIP: 0033:0x7f2ba619e199 [ 359.381787][T12033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.401386][T12033] RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 359.409796][T12033] RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199 [ 359.417762][T12033] RDX: 0000000004040000 RSI: 0000200000000640 RDI: 0000000000000003 [ 359.425725][T12033] RBP: 00007f2ba703d090 R08: 0000000000000000 R09: 0000000000000000 [ 359.433687][T12033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 359.441657][T12033] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 359.449641][T12033] [ 359.463892][T12033] netlink: 'syz.0.2252': attribute type 27 has an invalid length. [ 359.488062][T12033] netlink: 'syz.0.2252': attribute type 25 has an invalid length. [ 359.557051][T12038] Dead loop on virtual device ip6_vti0, fix it urgently! [ 359.625997][T12043] netlink: 'syz.3.2256': attribute type 29 has an invalid length. [ 359.642710][T12043] netlink: 'syz.3.2256': attribute type 29 has an invalid length. [ 359.749749][T12047] __nla_validate_parse: 10 callbacks suppressed [ 359.749766][T12047] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2259'. [ 359.848471][T12057] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2262'. [ 359.867896][T12058] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2261'. [ 359.899939][T12057] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2262'. [ 359.922825][T12059] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2262'. [ 360.797223][T12085] FAULT_INJECTION: forcing a failure. [ 360.797223][T12085] name failslab, interval 1, probability 0, space 0, times 0 [ 360.820538][T12085] CPU: 0 PID: 12085 Comm: syz.0.2271 Not tainted syzkaller #0 [ 360.828046][T12085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 360.838117][T12085] Call Trace: [ 360.841408][T12085] [ 360.844357][T12085] dump_stack_lvl+0x18c/0x250 [ 360.849047][T12085] ? show_regs_print_info+0x20/0x20 [ 360.854246][T12085] ? load_image+0x420/0x420 [ 360.858759][T12085] ? __might_sleep+0xe0/0xe0 [ 360.863354][T12085] ? __lock_acquire+0x7eb0/0x7eb0 [ 360.868378][T12085] should_fail_ex+0x394/0x4c0 [ 360.873059][T12085] should_failslab+0x9/0x20 [ 360.877563][T12085] slab_pre_alloc_hook+0x59/0x300 [ 360.882583][T12085] ? prepend_path+0x8a7/0x950 [ 360.887253][T12085] ? tomoyo_encode+0x2ad/0x570 [ 360.892016][T12085] ? tomoyo_encode+0x2ad/0x570 [ 360.896776][T12085] __kmem_cache_alloc_node+0x53/0x250 [ 360.902155][T12085] ? tomoyo_encode+0x2ad/0x570 [ 360.906910][T12085] __kmalloc+0xa7/0x240 [ 360.911068][T12085] tomoyo_encode+0x2ad/0x570 [ 360.915658][T12085] tomoyo_realpath_from_path+0x57c/0x5c0 [ 360.921298][T12085] tomoyo_check_open_permission+0x224/0x460 [ 360.927193][T12085] ? tomoyo_check_open_permission+0x1cf/0x460 [ 360.933262][T12085] ? tomoyo_check_path_number_acl+0x280/0x280 [ 360.939339][T12085] ? __asan_memset+0x22/0x40 [ 360.943949][T12085] ? __rwlock_init+0x150/0x150 [ 360.948712][T12085] ? tomoyo_file_open+0xed/0x180 [ 360.953647][T12085] security_file_open+0x62/0xa0 [ 360.958498][T12085] do_dentry_open+0x32b/0x14b0 [ 360.963266][T12085] ? __asan_memcpy+0x40/0x70 [ 360.967858][T12085] path_openat+0x284f/0x3270 [ 360.972463][T12085] ? do_sys_openat2+0xda/0x1d0 [ 360.977230][T12085] ? do_filp_open+0x430/0x430 [ 360.981921][T12085] do_filp_open+0x1f2/0x430 [ 360.986434][T12085] ? vfs_tmpfile+0x620/0x620 [ 360.991041][T12085] ? _raw_spin_unlock+0x28/0x40 [ 360.995889][T12085] ? alloc_fd+0x590/0x640 [ 361.000224][T12085] do_sys_openat2+0x134/0x1d0 [ 361.004902][T12085] ? do_sys_open+0xe0/0xe0 [ 361.009314][T12085] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 361.015296][T12085] ? lock_chain_count+0x20/0x20 [ 361.020149][T12085] __x64_sys_openat+0x139/0x160 [ 361.025006][T12085] do_syscall_64+0x55/0xb0 [ 361.029413][T12085] ? clear_bhb_loop+0x40/0x90 [ 361.034083][T12085] ? clear_bhb_loop+0x40/0x90 [ 361.038756][T12085] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 361.044649][T12085] RIP: 0033:0x7f2ba619e199 [ 361.049057][T12085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 361.068656][T12085] RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 361.077066][T12085] RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199 [ 361.085043][T12085] RDX: 000000000000275a RSI: 0000200000000400 RDI: ffffffffffffff9c [ 361.093017][T12085] RBP: 00007f2ba703d090 R08: 0000000000000000 R09: 0000000000000000 [ 361.100988][T12085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 361.108960][T12085] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 361.116946][T12085] [ 361.145832][T12089] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2273'. [ 361.169426][T12089] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2273'. [ 361.180178][T12089] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2273'. [ 361.182394][T12085] ERROR: Out of memory at tomoyo_realpath_from_path. [ 361.195421][T12089] netlink: 'syz.3.2273': attribute type 10 has an invalid length. [ 361.211840][T12089] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.2273'. [ 361.768595][T12119] Â: renamed from ip6gretap0 (while UP) [ 362.112033][T12124] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2284'. [ 362.193682][T12124] netlink: 'syz.0.2284': attribute type 10 has an invalid length. [ 362.468675][T12132] netlink: 'syz.2.2287': attribute type 19 has an invalid length. [ 362.870936][T12148] netlink: 'syz.1.2294': attribute type 10 has an invalid length. [ 363.038953][T12153] netlink: 'syz.1.2296': attribute type 21 has an invalid length. [ 364.015425][ T5779] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 364.029471][ T5779] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 364.043262][ T5779] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 364.052944][ T5779] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 364.062222][ T5779] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 364.069592][ T5779] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 364.136582][ T5775] Bluetooth: hci2: unexpected subevent 0x19 length: 150 > 28 [ 364.144593][ T5775] Bluetooth: hci2: Unable to find connection with handle 0x0000 [ 364.436879][T11913] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.573681][T11913] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.614384][T12163] chnl_net:caif_netlink_parms(): no params data found [ 364.665085][T11913] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.710852][T12188] netlink: 'syz.2.2307': attribute type 21 has an invalid length. [ 364.805254][T11913] team0: Port device netdevsim0 removed [ 364.820514][T11913] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.889828][T12188] __nla_validate_parse: 10 callbacks suppressed [ 364.889862][T12188] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2307'. [ 364.970324][T12163] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.989955][T12163] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.997712][T12163] bridge_slave_0: entered allmulticast mode [ 365.017597][T12163] bridge_slave_0: entered promiscuous mode [ 365.046437][T12163] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.070448][T12163] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.078110][T12163] bridge_slave_1: entered allmulticast mode [ 365.091434][T12163] bridge_slave_1: entered promiscuous mode [ 365.177067][T12163] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.196046][T12163] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.322228][T12163] team0: Port device team_slave_0 added [ 365.364248][T12163] team0: Port device team_slave_1 added [ 365.456969][T11913] tipc: Left network mode [ 365.465108][T12163] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 365.488949][T12163] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 365.527825][T12163] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 365.694228][T12163] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 365.711712][T12163] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 365.763707][T12163] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 366.165129][ T5775] Bluetooth: hci4: command tx timeout [ 366.218561][T12221] netlink: 'syz.0.2313': attribute type 3 has an invalid length. [ 366.248540][T12221] netlink: 'syz.0.2313': attribute type 1 has an invalid length. [ 366.272970][T12221] netlink: 'syz.0.2313': attribute type 6 has an invalid length. [ 366.290454][T12221] netlink: 144448 bytes leftover after parsing attributes in process `syz.0.2313'. [ 366.457341][T12163] hsr_slave_0: entered promiscuous mode [ 366.497908][T12163] hsr_slave_1: entered promiscuous mode [ 366.526046][T12223] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2314'. [ 366.928265][T12244] netlink: 'syz.0.2316': attribute type 2 has an invalid length. [ 367.027659][T12248] netlink: 'syz.2.2318': attribute type 10 has an invalid length. [ 367.056042][T12248] veth1_macvtap: left promiscuous mode [ 368.243681][ T5775] Bluetooth: hci4: command tx timeout [ 368.675575][T12287] netlink: 'syz.2.2325': attribute type 3 has an invalid length. [ 368.703236][T12287] netlink: 'syz.2.2325': attribute type 1 has an invalid length. [ 368.725599][T12287] netlink: 'syz.2.2325': attribute type 6 has an invalid length. [ 368.743931][T12287] netlink: 144448 bytes leftover after parsing attributes in process `syz.2.2325'. [ 368.979730][T12298] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2327'. [ 369.019994][T12298] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2327'. [ 369.065465][T12296] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2327'. [ 369.096490][T11913] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 369.115463][T11913] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 369.144702][T11913] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 369.153816][T11913] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 369.161718][T11913] batman_adv: batadv0: Interface deactivated: veth0_vlan [ 369.169181][T11913] batman_adv: batadv0: Removing interface: veth0_vlan [ 369.192953][T11913] bridge_slave_0: left allmulticast mode [ 369.199719][T11913] bridge_slave_0: left promiscuous mode [ 369.206831][T11913] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.258194][T11913] veth1_macvtap: left promiscuous mode [ 369.268928][T11913] veth0_macvtap: left promiscuous mode [ 369.277324][T11913] veth1_vlan: left promiscuous mode [ 369.286420][T11913] veth0_vlan: left promiscuous mode [ 370.322821][ T5775] Bluetooth: hci4: command tx timeout [ 372.402167][ T5775] Bluetooth: hci4: command tx timeout [ 378.645068][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.651406][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 384.528423][ T5779] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 384.539282][ T5779] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 384.562506][ T5779] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 384.574663][ T5779] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 384.582725][ T5779] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 384.594291][ T5779] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 385.651186][ T5775] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 385.661133][ T5775] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 385.670594][ T5775] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 385.686950][ T5775] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 385.703216][ T5775] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 385.710699][ T5775] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 385.738859][ T5779] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 385.748509][ T5779] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 385.756700][ T5779] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 385.767590][ T5779] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 385.782063][ T5779] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 385.789650][ T5779] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 386.642090][ T5779] Bluetooth: hci1: command tx timeout [ 387.762437][ T5779] Bluetooth: hci5: command tx timeout [ 387.842115][ T5779] Bluetooth: hci6: command tx timeout [ 388.722137][ T5779] Bluetooth: hci1: command tx timeout [ 389.842525][ T5779] Bluetooth: hci5: command tx timeout [ 389.923476][ T5779] Bluetooth: hci6: command tx timeout [ 390.812002][ T5779] Bluetooth: hci1: command tx timeout [ 391.923748][ T5779] Bluetooth: hci5: command tx timeout [ 392.002069][ T5779] Bluetooth: hci6: command tx timeout [ 392.882219][ T5779] Bluetooth: hci1: command tx timeout [ 394.002390][ T5779] Bluetooth: hci5: command tx timeout [ 394.081995][ T5779] Bluetooth: hci6: command tx timeout [ 423.543320][ T5775] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 423.558707][ T5775] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 423.566899][ T5775] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 423.580872][ T5775] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 423.588864][ T5775] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 423.602341][ T5775] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 425.692041][ T5779] Bluetooth: hci7: command tx timeout [ 427.762111][ T5779] Bluetooth: hci7: command tx timeout [ 429.842121][ T5779] Bluetooth: hci7: command tx timeout [ 431.922084][ T5779] Bluetooth: hci7: command tx timeout [ 440.087055][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.093769][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.627508][ T5775] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 444.637772][ T5775] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 444.646686][ T5775] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 444.654946][ T5775] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 444.663400][ T5775] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 444.670787][ T5775] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 445.985398][ T5779] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 445.994773][ T5779] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 446.002900][ T5779] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 446.022094][ T5779] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 446.031827][ T5779] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 446.039529][ T5779] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 446.196787][ T5779] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 446.206769][ T5779] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 446.215183][ T5779] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 446.223734][ T5779] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 446.231477][ T5779] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3 [ 446.239015][ T5779] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 446.722051][ T5779] Bluetooth: hci8: command tx timeout [ 448.082271][ T5779] Bluetooth: hci9: command tx timeout [ 448.332166][ T5779] Bluetooth: hci10: command tx timeout [ 448.802129][ T5779] Bluetooth: hci8: command tx timeout [ 450.162081][ T5779] Bluetooth: hci9: command tx timeout [ 450.402035][ T5779] Bluetooth: hci10: command tx timeout [ 450.882823][ T5779] Bluetooth: hci8: command tx timeout [ 452.242200][ T5775] Bluetooth: hci9: command tx timeout [ 452.481953][ T5775] Bluetooth: hci10: command tx timeout [ 452.962118][ T5775] Bluetooth: hci8: command tx timeout [ 454.328087][ T5775] Bluetooth: hci9: command tx timeout [ 454.562102][ T5775] Bluetooth: hci10: command tx timeout [ 483.868090][ T5779] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 483.882703][ T5779] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 483.891077][ T5779] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 483.900047][ T5779] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 483.908639][ T5779] Bluetooth: hci11: unexpected cc 0x0c25 length: 249 > 3 [ 483.916958][ T5779] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 486.002017][ T5775] Bluetooth: hci11: command tx timeout [ 488.082462][ T5779] Bluetooth: hci11: command tx timeout [ 488.242075][ T5779] Bluetooth: hci4: command 0x0406 tx timeout [ 490.162049][ T5775] Bluetooth: hci11: command tx timeout [ 492.242053][ T5775] Bluetooth: hci11: command tx timeout [ 501.525839][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.532395][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 504.947750][ T5779] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 504.961357][ T5779] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 504.970120][ T5779] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 504.984404][ T5779] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 504.992987][ T5779] Bluetooth: hci12: unexpected cc 0x0c25 length: 249 > 3 [ 505.001283][ T5779] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 506.108850][ T5775] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 506.119811][ T5775] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 506.129171][ T5775] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 506.138076][ T5775] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 506.146851][ T5775] Bluetooth: hci13: unexpected cc 0x0c25 length: 249 > 3 [ 506.154894][ T5775] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 506.218252][ T5779] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 506.228269][ T5779] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 506.236633][ T5779] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 506.246986][ T5779] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 506.256712][ T5779] Bluetooth: hci14: unexpected cc 0x0c25 length: 249 > 3 [ 506.265458][ T5779] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 507.042163][T12358] Bluetooth: hci12: command tx timeout [ 508.242345][T12358] Bluetooth: hci13: command tx timeout [ 508.322132][T12358] Bluetooth: hci14: command tx timeout [ 508.722458][T12358] Bluetooth: hci1: command 0x0406 tx timeout [ 508.729500][T12358] Bluetooth: hci5: command 0x0406 tx timeout [ 508.736472][T12357] Bluetooth: hci6: command 0x0406 tx timeout [ 509.121999][ T5779] Bluetooth: hci12: command tx timeout [ 510.321980][ T5779] Bluetooth: hci13: command tx timeout [ 510.407197][ T5779] Bluetooth: hci14: command tx timeout [ 511.202034][ T5779] Bluetooth: hci12: command tx timeout [ 512.402404][ T5779] Bluetooth: hci13: command tx timeout [ 512.481983][ T5779] Bluetooth: hci14: command tx timeout [ 513.281981][ T5779] Bluetooth: hci12: command tx timeout [ 514.481978][ T5779] Bluetooth: hci13: command tx timeout [ 514.571969][ T5779] Bluetooth: hci14: command tx timeout [ 514.963781][ T29] INFO: task dhcpcd:5434 blocked for more than 143 seconds. [ 514.971208][ T29] Not tainted syzkaller #0 [ 514.976360][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 514.992780][ T29] task:dhcpcd state:D stack:21032 pid:5434 ppid:5433 flags:0x00004002 [ 515.002301][ T29] Call Trace: [ 515.005597][ T29] [ 515.008529][ T29] __schedule+0x15ae/0x4660 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 515.020845][ T29] ? lock_chain_count+0x20/0x20 [ 515.026354][ T29] ? asan.module_dtor+0x20/0x20 [ 515.031419][ T29] ? __mutex_lock+0x66e/0xc80 [ 515.042027][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 515.047547][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 515.063690][ T29] schedule+0xbd/0x170 [ 515.067815][ T29] schedule_preempt_disabled+0x13/0x20 [ 515.074805][ T29] __mutex_lock+0x673/0xc80 [ 515.079361][ T29] ? __mutex_lock+0x4d2/0xc80 [ 515.084237][ T29] ? rtnetlink_rcv_msg+0x7ed/0xf90 [ 515.089398][ T29] ? mutex_lock_nested+0x20/0x20 [ 515.094508][ T29] rtnetlink_rcv_msg+0x7ed/0xf90 [ 515.099482][ T29] ? rtnetlink_rcv_msg+0x220/0xf90 [ 515.104709][ T29] ? rtnetlink_bind+0x80/0x80 [ 515.109420][ T29] ? mark_lock+0x94/0x320 [ 515.114229][ T29] ? __lock_acquire+0x135d/0x7eb0 [ 515.119321][ T29] ? mark_lock+0x94/0x320 [ 515.124338][ T29] ? mark_lock+0x94/0x320 [ 515.128867][ T29] ? __lock_acquire+0x135d/0x7eb0 [ 515.134392][ T29] ? __stack_depot_save+0x1f/0x660 [ 515.139567][ T29] ? kmalloc_reserve+0x95/0x240 [ 515.144981][ T29] ? verify_lock_unused+0x140/0x140 [ 515.150230][ T29] ? verify_lock_unused+0x140/0x140 [ 515.155958][ T29] netlink_rcv_skb+0x235/0x4c0 [ 515.160773][ T29] ? rtnetlink_bind+0x80/0x80 [ 515.166160][ T29] ? netlink_ack+0x1160/0x1160 [ 515.170991][ T29] ? __lock_acquire+0x7eb0/0x7eb0 [ 515.176545][ T29] ? net_generic+0x1e/0x240 [ 515.181600][ T29] ? netlink_deliver_tap+0x2e/0x1b0 [ 515.221674][ T29] netlink_unicast+0x7b1/0x930 [ 515.241965][ T29] netlink_sendmsg+0x8d0/0xbf0 [ 515.246807][ T29] ? netlink_getsockopt+0x590/0x590 [ 515.272260][ T29] ? apparmor_socket_sendmsg+0x8e/0x330 [ 515.277858][ T29] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 515.287039][ T29] ? security_socket_sendmsg+0x80/0xa0 [ 515.292607][ T29] ? netlink_getsockopt+0x590/0x590 [ 515.297840][ T29] ____sys_sendmsg+0x61b/0x980 [ 515.302727][ T29] ? __asan_memset+0x22/0x40 [ 515.307332][ T29] ? __sys_sendmsg_sock+0x30/0x30 [ 515.312432][ T29] ? __import_iovec+0x5f2/0x850 [ 515.317336][ T29] ? import_iovec+0x73/0xa0 [ 515.321987][ T29] ___sys_sendmsg+0x2a6/0x360 [ 515.326685][ T29] ? sock_read_iter+0x2ff/0x3f0 [ 515.331644][ T29] ? __sys_sendmsg+0x2b0/0x2b0 [ 515.336475][ T29] ? sock_read_iter+0x2ff/0x3f0 [ 515.341388][ T29] ? kernel_read+0x1e0/0x1e0 [ 515.346270][ T29] __se_sys_sendmsg+0x1d0/0x2c0 [ 515.351171][ T29] ? __x64_sys_sendmsg+0x80/0x80 [ 515.356256][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 515.361479][ T29] do_syscall_64+0x55/0xb0 [ 515.366177][ T29] ? clear_bhb_loop+0x40/0x90 [ 515.370892][ T29] ? clear_bhb_loop+0x40/0x90 [ 515.375656][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 515.381575][ T29] RIP: 0033:0x7fbcad6b0407 [ 515.386064][ T29] RSP: 002b:00007fffdf995bb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 515.394585][ T29] RAX: ffffffffffffffda RBX: 00007fbcad626740 RCX: 00007fbcad6b0407 [ 515.402646][ T29] RDX: 0000000000000000 RSI: 00007fffdf9a9d90 RDI: 0000000000000004 [ 515.410638][ T29] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 515.418756][ T29] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fffdf9b9fc0 [ 515.426853][ T29] R13: 00007fbcad6266c8 R14: 0000000000000048 R15: 00007fffdf9a9d90 [ 515.437178][ T29] [ 515.440247][ T29] INFO: task kworker/0:10:8849 blocked for more than 143 seconds. [ 515.454544][ T29] Not tainted syzkaller #0 [ 515.459511][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 515.471889][ T29] task:kworker/0:10 state:D stack:27272 pid:8849 ppid:2 flags:0x00004000 [ 515.481130][ T29] Workqueue: events switchdev_deferred_process_work [ 515.495171][ T29] Call Trace: [ 515.498475][ T29] [ 515.501408][ T29] __schedule+0x15ae/0x4660 [ 515.509290][ T29] ? mark_lock+0x94/0x320 [ 515.518256][ T29] ? asan.module_dtor+0x20/0x20 [ 515.531901][ T29] ? __lock_acquire+0x7eb0/0x7eb0 [ 515.537110][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 515.549920][ T29] schedule+0xbd/0x170 [ 515.554086][ T29] schedule_preempt_disabled+0x13/0x20 [ 515.559562][ T29] __mutex_lock+0x673/0xc80 [ 515.565500][ T29] ? __mutex_lock+0x4d2/0xc80 [ 515.570209][ T29] ? switchdev_deferred_process_work+0xe/0x20 [ 515.576499][ T29] ? mutex_lock_nested+0x20/0x20 [ 515.581480][ T29] ? _raw_spin_unlock_irq+0x23/0x50 [ 515.586830][ T29] ? process_scheduled_works+0x975/0x1600 [ 515.592620][ T29] ? process_scheduled_works+0x975/0x1600 [ 515.598363][ T29] switchdev_deferred_process_work+0xe/0x20 [ 515.604381][ T29] process_scheduled_works+0xa60/0x1600 [ 515.610023][ T29] ? worker_attach_to_pool+0x370/0x370 [ 515.615587][ T29] ? assign_work+0x3cc/0x5d0 [ 515.620225][ T29] worker_thread+0xa5e/0xfe0 [ 515.624956][ T29] ? _raw_spin_unlock+0x40/0x40 [ 515.629844][ T29] ? __kthread_parkme+0x71/0x1c0 [ 515.634882][ T29] kthread+0x2fa/0x390 [ 515.639086][ T29] ? pr_cont_work+0x550/0x550 [ 515.643897][ T29] ? kthread_blkcg+0xd0/0xd0 [ 515.648523][ T29] ret_from_fork+0x48/0x80 [ 515.653151][ T29] ? kthread_blkcg+0xd0/0xd0 [ 515.657779][ T29] ret_from_fork_asm+0x11/0x20 [ 515.670583][ T29] [ 515.674601][ T29] INFO: task kworker/u4:54:11911 blocked for more than 144 seconds. [ 515.700936][ T29] Not tainted syzkaller #0 [ 515.706001][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 515.714934][ T29] task:kworker/u4:54 state:D stack:24392 pid:11911 ppid:2 flags:0x00004000 [ 515.724280][ T29] Workqueue: events_unbound linkwatch_event [ 515.730204][ T29] Call Trace: [ 515.741025][ T29] [ 515.744121][ T29] __schedule+0x15ae/0x4660 [ 515.748711][ T29] ? asan.module_dtor+0x20/0x20 [ 515.753840][ T29] ? __mutex_lock+0x66e/0xc80 [ 515.758559][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 515.764190][ T29] ? kthread_data+0x4f/0xc0 [ 515.768714][ T29] ? wq_worker_sleeping+0x63/0x240 [ 515.775173][ T29] schedule+0xbd/0x170 [ 515.779288][ T29] schedule_preempt_disabled+0x13/0x20 [ 515.784913][ T29] __mutex_lock+0x673/0xc80 [ 515.789463][ T29] ? __mutex_lock+0x4d2/0xc80 [ 515.794451][ T29] ? linkwatch_event+0xe/0x60 [ 515.799166][ T29] ? mutex_lock_nested+0x20/0x20 [ 515.804237][ T29] ? _raw_spin_unlock_irq+0x23/0x50 [ 515.809467][ T29] ? process_scheduled_works+0x975/0x1600 [ 515.815277][ T29] ? process_scheduled_works+0x975/0x1600 [ 515.821030][ T29] linkwatch_event+0xe/0x60 [ 515.825613][ T29] process_scheduled_works+0xa60/0x1600 [ 515.831234][ T29] ? worker_attach_to_pool+0x370/0x370 [ 515.836779][ T29] ? assign_work+0x3cc/0x5d0 [ 515.841400][ T29] worker_thread+0xa5e/0xfe0 [ 515.846425][ T29] kthread+0x2fa/0x390 [ 515.850536][ T29] ? pr_cont_work+0x550/0x550 [ 515.855308][ T29] ? kthread_blkcg+0xd0/0xd0 [ 515.859914][ T29] ret_from_fork+0x48/0x80 [ 515.864435][ T29] ? kthread_blkcg+0xd0/0xd0 [ 515.869053][ T29] ret_from_fork_asm+0x11/0x20 [ 515.873927][ T29] [ 515.877004][ T29] INFO: task syz-executor:12163 blocked for more than 144 seconds. [ 515.885500][ T29] Not tainted syzkaller #0 [ 515.890467][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 515.899235][ T29] task:syz-executor state:D stack:22344 pid:12163 ppid:1 flags:0x00004006 [ 515.908758][ T29] Call Trace: [ 515.912136][ T29] [ 515.915084][ T29] __schedule+0x15ae/0x4660 [ 515.919630][ T29] ? nsim_udp_tunnels_info_create+0x2de/0x760 [ 515.926686][ T29] ? asan.module_dtor+0x20/0x20 [ 515.931555][ T29] ? __mutex_lock+0x66e/0xc80 [ 515.936296][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 515.941777][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 515.948148][ T29] ? mutex_spin_on_owner+0x7d/0x330 [ 515.953468][ T29] schedule+0xbd/0x170 [ 515.957577][ T29] schedule_preempt_disabled+0x13/0x20 [ 515.963461][ T29] __mutex_lock+0x673/0xc80 [ 515.968018][ T29] ? __mutex_lock+0x4d2/0xc80 [ 515.972784][ T29] ? nsim_create+0x378/0x4a0 [ 515.977417][ T29] ? mutex_lock_nested+0x20/0x20 [ 515.982500][ T29] ? kmemdup+0x55/0x70 [ 515.986625][ T29] nsim_create+0x378/0x4a0 [ 515.991086][ T29] __nsim_dev_port_add+0x761/0xb90 [ 515.996290][ T29] ? nsim_drv_port_add+0x130/0x130 [ 516.001430][ T29] ? queue_delayed_work_on+0x114/0x200 [ 516.006995][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 516.012520][ T29] nsim_dev_port_add_all+0x35/0xe0 [ 516.017673][ T29] nsim_drv_probe+0x8ad/0xb90 [ 516.022488][ T29] ? nsim_dev_get_vfs+0xa0/0xa0 [ 516.027369][ T29] ? kernfs_put+0x309/0x360 [ 516.032006][ T29] ? driver_sysfs_add+0x1f5/0x210 [ 516.037066][ T29] ? nsim_bus_exit+0x210/0x210 [ 516.041995][ T29] really_probe+0x247/0xae0 [ 516.046519][ T29] ? pm_runtime_barrier+0x14b/0x1c0 [ 516.051795][ T29] __driver_probe_device+0x1f5/0x390 [ 516.057258][ T29] driver_probe_device+0x4f/0x420 [ 516.062513][ T29] __device_attach_driver+0x2ca/0x510 [ 516.067951][ T29] bus_for_each_drv+0x252/0x2e0 [ 516.073195][ T29] ? coredump_store+0x90/0x90 [ 516.077908][ T29] ? bus_find_device+0x300/0x300 [ 516.083574][ T29] __device_attach+0x2c1/0x420 [ 516.088371][ T29] ? device_attach+0x20/0x20 [ 516.093381][ T29] ? __kmem_cache_free+0xba/0x1f0 [ 516.098456][ T29] ? do_raw_spin_unlock+0x121/0x230 [ 516.104219][ T29] bus_probe_device+0x180/0x260 [ 516.109117][ T29] device_add+0x87c/0xc40 [ 516.113957][ T29] new_device_store+0x37c/0x690 [ 516.118864][ T29] ? nsim_num_vf+0x50/0x50 [ 516.125044][ T29] ? sysfs_kf_write+0x187/0x2a0 [ 516.129927][ T29] ? sysfs_kf_read+0x360/0x360 [ 516.135103][ T29] kernfs_fop_write_iter+0x3a4/0x520 [ 516.140418][ T29] vfs_write+0x474/0x9a0 [ 516.145270][ T29] ? file_end_write+0x250/0x250 [ 516.150336][ T29] ? do_sys_openat2+0x170/0x1d0 [ 516.155268][ T29] ? __fdget_pos+0x2ba/0x330 [ 516.160057][ T29] ksys_write+0x151/0x260 [ 516.164842][ T29] ? __ia32_sys_read+0x90/0x90 [ 516.169642][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 516.174929][ T29] do_syscall_64+0x55/0xb0 [ 516.179485][ T29] ? clear_bhb_loop+0x40/0x90 [ 516.184267][ T29] ? clear_bhb_loop+0x40/0x90 [ 516.189058][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 516.195071][ T29] RIP: 0033:0x7f0cd695e9ce [ 516.199505][ T29] RSP: 002b:00007ffdfb4151b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 516.208002][ T29] RAX: ffffffffffffffda RBX: 0000555584062500 RCX: 00007f0cd695e9ce [ 516.216052][ T29] RDX: 0000000000000003 RSI: 00007ffdfb415240 RDI: 0000000000000005 [ 516.224161][ T29] RBP: 00007f0cd6a3612f R08: 0000000000000000 R09: 0000000000000000 [ 516.232377][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 516.240364][ T29] R13: 00007ffdfb415240 R14: 00007f0cd7754620 R15: 0000000000000003 [ 516.248567][ T29] [ 516.251638][ T29] INFO: task syz.1.2327:12295 blocked for more than 144 seconds. [ 516.259610][ T29] Not tainted syzkaller #0 [ 516.264646][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 516.273366][ T29] task:syz.1.2327 state:D stack:27048 pid:12295 ppid:5769 flags:0x00004004 [ 516.282677][ T29] Call Trace: [ 516.285962][ T29] [ 516.288889][ T29] __schedule+0x15ae/0x4660 [ 516.293482][ T29] ? trace_event_raw_event_lock+0x240/0x240 [ 516.299407][ T29] ? asan.module_dtor+0x20/0x20 [ 516.304367][ T29] ? __mutex_lock+0x66e/0xc80 [ 516.309070][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 516.314616][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 516.320815][ T29] schedule+0xbd/0x170 [ 516.324992][ T29] schedule_preempt_disabled+0x13/0x20 [ 516.330480][ T29] __mutex_lock+0x673/0xc80 [ 516.335098][ T29] ? __mutex_lock+0x4d2/0xc80 [ 516.339815][ T29] ? tun_chr_close+0x41/0x1c0 [ 516.344837][ T29] ? mutex_lock_nested+0x20/0x20 [ 516.349803][ T29] ? tun_chr_open+0x510/0x510 [ 516.354927][ T29] tun_chr_close+0x41/0x1c0 [ 516.359615][ T29] ? tun_chr_open+0x510/0x510 [ 516.364388][ T29] __fput+0x221/0x940 [ 516.368517][ T29] task_work_run+0x1d4/0x260 [ 516.373219][ T29] ? task_work_cancel+0x220/0x220 [ 516.378293][ T29] ? exit_to_user_mode_loop+0x3b/0x110 [ 516.384066][ T29] exit_to_user_mode_loop+0xe6/0x110 [ 516.389392][ T29] exit_to_user_mode_prepare+0xee/0x180 [ 516.395028][ T29] syscall_exit_to_user_mode+0x1a/0x50 [ 516.400515][ T29] do_syscall_64+0x61/0xb0 [ 516.405407][ T29] ? clear_bhb_loop+0x40/0x90 [ 516.410132][ T29] ? clear_bhb_loop+0x40/0x90 [ 516.414899][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 516.420961][ T29] RIP: 0033:0x7f76b4d9e199 [ 516.425461][ T29] RSP: 002b:00007ffc640eb518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 516.434099][ T29] RAX: 0000000000000000 RBX: 00007f76b5027da0 RCX: 00007f76b4d9e199 [ 516.442183][ T29] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 516.450167][ T29] RBP: 00007f76b5027da0 R08: 0000000000000006 R09: 0000000000000000 [ 516.458535][ T29] R10: 00007f76b5027cb0 R11: 0000000000000246 R12: 000000000005a43f [ 516.466620][ T29] R13: 00007f76b5025fac R14: 000000000005a1d8 R15: 00007ffc640eb620 [ 516.474703][ T29] [ 516.477822][ T29] INFO: task syz.1.2327:12296 blocked for more than 144 seconds. [ 516.485674][ T29] Not tainted syzkaller #0 [ 516.490631][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 516.499372][ T29] task:syz.1.2327 state:D stack:25768 pid:12296 ppid:5769 flags:0x00004004 [ 516.508647][ T29] Call Trace: [ 516.511983][ T29] [ 516.514956][ T29] __schedule+0x15ae/0x4660 [ 516.519496][ T29] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 516.525713][ T29] ? asan.module_dtor+0x20/0x20 [ 516.530603][ T29] ? __mutex_lock+0x66e/0xc80 [ 516.535393][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 516.540872][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 516.547124][ T29] schedule+0xbd/0x170 [ 516.551210][ T29] schedule_preempt_disabled+0x13/0x20 [ 516.557054][ T29] __mutex_lock+0x673/0xc80 [ 516.561679][ T29] ? __mutex_lock+0x4d2/0xc80 [ 516.567134][ T29] ? rtnetlink_rcv_msg+0x7ed/0xf90 [ 516.572351][ T29] ? mutex_lock_nested+0x20/0x20 [ 516.577494][ T29] rtnetlink_rcv_msg+0x7ed/0xf90 [ 516.582570][ T29] ? rtnetlink_rcv_msg+0x220/0xf90 [ 516.587846][ T29] ? rtnetlink_bind+0x80/0x80 [ 516.592617][ T29] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 516.598639][ T29] ? lock_chain_count+0x20/0x20 [ 516.603615][ T29] ? __local_bh_enable_ip+0x13a/0x1c0 [ 516.609008][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 516.614312][ T29] ? __local_bh_enable_ip+0x13a/0x1c0 [ 516.619700][ T29] ? _local_bh_enable+0xa0/0xa0 [ 516.624656][ T29] ? __dev_queue_xmit+0x272/0x37e0 [ 516.629791][ T29] ? __dev_queue_xmit+0x1329/0x37e0 [ 516.635071][ T29] ? __dev_queue_xmit+0x272/0x37e0 [ 516.640380][ T29] ? ref_tracker_free+0x686/0x830 [ 516.646030][ T29] ? __kasan_kmalloc_large+0x8b/0xa0 [ 516.651381][ T29] netlink_rcv_skb+0x235/0x4c0 [ 516.656261][ T29] ? rtnetlink_bind+0x80/0x80 [ 516.660965][ T29] ? netlink_ack+0x1160/0x1160 [ 516.670827][ T29] ? __lock_acquire+0x7eb0/0x7eb0 [ 516.679176][ T29] ? netlink_deliver_tap+0x2e/0x1b0 [ 516.688959][ T29] netlink_unicast+0x7b1/0x930 [ 516.696855][ T29] netlink_sendmsg+0x8d0/0xbf0 [ 516.701660][ T29] ? netlink_getsockopt+0x590/0x590 [ 516.711463][ T29] ? apparmor_socket_sendmsg+0x8e/0x330 [ 516.717200][ T29] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 516.731904][ T29] ? security_socket_sendmsg+0x80/0xa0 [ 516.737408][ T29] sock_write_iter+0x2dc/0x420 [ 516.742698][ T29] ? sock_read_iter+0x3f0/0x3f0 [ 516.747607][ T29] ? common_file_perm+0x198/0x1f0 [ 516.753625][ T29] vfs_write+0x474/0x9a0 [ 516.757893][ T29] ? file_end_write+0x250/0x250 [ 516.768042][ T29] ? __fget_files+0x3fc/0x460 [ 516.773671][ T29] ? __fdget_pos+0x1d8/0x330 [ 516.778276][ T29] ? ksys_write+0x74/0x260 [ 516.786202][ T29] ksys_write+0x151/0x260 [ 516.790610][ T29] ? __ia32_sys_read+0x90/0x90 [ 516.795671][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 516.800916][ T29] do_syscall_64+0x55/0xb0 [ 516.805720][ T29] ? clear_bhb_loop+0x40/0x90 [ 516.810436][ T29] ? clear_bhb_loop+0x40/0x90 [ 516.815300][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 516.821222][ T29] RIP: 0033:0x7f76b4d9e199 [ 516.825699][ T29] RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 516.834219][ T29] RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199 [ 516.842263][ T29] RDX: 000000000000fe33 RSI: 0000200000000040 RDI: 0000000000000005 [ 516.850262][ T29] RBP: 00007f76b4e35888 R08: 0000000000000000 R09: 0000000000000000 [ 516.858353][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 516.866399][ T29] R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8 [ 516.874825][ T29] [ 516.877884][ T29] INFO: task syz.0.2331:12306 blocked for more than 145 seconds. [ 516.886598][ T29] Not tainted syzkaller #0 [ 516.891560][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 516.900382][ T29] task:syz.0.2331 state:D stack:24872 pid:12306 ppid:5767 flags:0x00004004 [ 516.909664][ T29] Call Trace: [ 516.913247][ T29] [ 516.916208][ T29] __schedule+0x15ae/0x4660 [ 516.920741][ T29] ? lock_chain_count+0x20/0x20 [ 516.925674][ T29] ? asan.module_dtor+0x20/0x20 [ 516.930554][ T29] ? __mutex_lock+0x66e/0xc80 [ 516.935403][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 516.940898][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 516.947127][ T29] schedule+0xbd/0x170 [ 516.951232][ T29] schedule_preempt_disabled+0x13/0x20 [ 516.956868][ T29] __mutex_lock+0x673/0xc80 [ 516.961401][ T29] ? lock_chain_count+0x20/0x20 [ 516.966320][ T29] ? __mutex_lock+0x4d2/0xc80 [ 516.971133][ T29] ? netlink_dump+0x77c/0xec0 [ 516.976007][ T29] ? mutex_lock_nested+0x20/0x20 [ 516.980997][ T29] netlink_dump+0x77c/0xec0 [ 516.985618][ T29] ? netlink_lookup+0x200/0x200 [ 516.990538][ T29] ? netlink_lookup+0x30/0x200 [ 516.995499][ T29] ? netlink_lookup+0x30/0x200 [ 517.000306][ T29] __netlink_dump_start+0x57c/0x7a0 [ 517.005587][ T29] rtnetlink_rcv_msg+0xe19/0xf90 [ 517.010547][ T29] ? rtnetlink_rcv_msg+0x220/0xf90 [ 517.015877][ T29] ? tc_get_qdisc+0xce0/0xce0 [ 517.020608][ T29] ? rtnetlink_bind+0x80/0x80 [ 517.025542][ T29] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 517.031550][ T29] ? lock_chain_count+0x20/0x20 [ 517.036871][ T29] ? __local_bh_enable_ip+0x13a/0x1c0 [ 517.042592][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 517.047815][ T29] ? __local_bh_enable_ip+0x13a/0x1c0 [ 517.053758][ T29] ? _local_bh_enable+0xa0/0xa0 [ 517.058660][ T29] ? __dev_queue_xmit+0x272/0x37e0 [ 517.064056][ T29] ? __dev_queue_xmit+0x1329/0x37e0 [ 517.069299][ T29] ? __dev_queue_xmit+0x272/0x37e0 [ 517.074998][ T29] ? tc_get_qdisc+0xce0/0xce0 [ 517.079709][ T29] ? ref_tracker_free+0x686/0x830 [ 517.084807][ T29] netlink_rcv_skb+0x235/0x4c0 [ 517.089592][ T29] ? rtnetlink_bind+0x80/0x80 [ 517.094445][ T29] ? netlink_ack+0x1160/0x1160 [ 517.099274][ T29] ? __lock_acquire+0x7eb0/0x7eb0 [ 517.104405][ T29] ? netlink_deliver_tap+0x2e/0x1b0 [ 517.109646][ T29] netlink_unicast+0x7b1/0x930 [ 517.114637][ T29] netlink_sendmsg+0x8d0/0xbf0 [ 517.119467][ T29] ? netlink_getsockopt+0x590/0x590 [ 517.124948][ T29] ? apparmor_socket_sendmsg+0x8e/0x330 [ 517.130538][ T29] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 517.136147][ T29] ? security_socket_sendmsg+0x80/0xa0 [ 517.141653][ T29] ? netlink_getsockopt+0x590/0x590 [ 517.146942][ T29] ____sys_sendmsg+0x61b/0x980 [ 517.151754][ T29] ? __asan_memset+0x22/0x40 [ 517.156575][ T29] ? __sys_sendmsg_sock+0x30/0x30 [ 517.161624][ T29] ? __import_iovec+0x5f2/0x850 [ 517.166560][ T29] ? import_iovec+0x73/0xa0 [ 517.171126][ T29] ___sys_sendmsg+0x2a6/0x360 [ 517.176176][ T29] ? __sys_sendmsg+0x2b0/0x2b0 [ 517.181022][ T29] __se_sys_sendmsg+0x1d0/0x2c0 [ 517.186031][ T29] ? __x64_sys_sendmsg+0x80/0x80 [ 517.191013][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 517.196401][ T29] do_syscall_64+0x55/0xb0 [ 517.200853][ T29] ? clear_bhb_loop+0x40/0x90 [ 517.205610][ T29] ? clear_bhb_loop+0x40/0x90 [ 517.210324][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 517.224295][ T29] RIP: 0033:0x7f2ba619e199 [ 517.228723][ T29] RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 517.237618][ T29] RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199 [ 517.246054][ T29] RDX: 0000000000004080 RSI: 0000200000000080 RDI: 0000000000000006 [ 517.254284][ T29] RBP: 00007f2ba6235888 R08: 0000000000000000 R09: 0000000000000000 [ 517.262328][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 517.270325][ T29] R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8 [ 517.278681][ T29] [ 517.281758][ T29] INFO: task syz.0.2331:12313 blocked for more than 145 seconds. [ 517.289710][ T29] Not tainted syzkaller #0 [ 517.294767][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 517.303508][ T29] task:syz.0.2331 state:D stack:26376 pid:12313 ppid:5767 flags:0x00004004 [ 517.312850][ T29] Call Trace: [ 517.316156][ T29] [ 517.319113][ T29] __schedule+0x15ae/0x4660 [ 517.323703][ T29] ? trace_event_raw_event_lock+0x240/0x240 [ 517.329661][ T29] ? asan.module_dtor+0x20/0x20 [ 517.334624][ T29] ? __mutex_lock+0x66e/0xc80 [ 517.339322][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 517.344906][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 517.351108][ T29] schedule+0xbd/0x170 [ 517.355448][ T29] schedule_preempt_disabled+0x13/0x20 [ 517.360949][ T29] __mutex_lock+0x673/0xc80 [ 517.365581][ T29] ? __mutex_lock+0x4d2/0xc80 [ 517.370289][ T29] ? rtnetlink_rcv_msg+0x7ed/0xf90 [ 517.375495][ T29] ? mutex_lock_nested+0x20/0x20 [ 517.380646][ T29] rtnetlink_rcv_msg+0x7ed/0xf90 [ 517.385660][ T29] ? rtnetlink_rcv_msg+0x220/0xf90 [ 517.390798][ T29] ? rtnetlink_bind+0x80/0x80 [ 517.395565][ T29] ? perf_trace_preemptirq_template+0xac/0x330 [ 517.401764][ T29] ? perf_trace_run_bpf_submit+0x1c0/0x1c0 [ 517.407622][ T29] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 517.413763][ T29] ? __dev_queue_xmit+0x272/0x37e0 [ 517.418900][ T29] ? __dev_queue_xmit+0x272/0x37e0 [ 517.424094][ T29] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 517.429863][ T29] ? perf_trace_lock+0x303/0x3b0 [ 517.434957][ T29] netlink_rcv_skb+0x235/0x4c0 [ 517.439745][ T29] ? rtnetlink_bind+0x80/0x80 [ 517.444616][ T29] ? netlink_ack+0x1160/0x1160 [ 517.449445][ T29] ? __lock_acquire+0x7eb0/0x7eb0 [ 517.454619][ T29] ? netlink_deliver_tap+0x2e/0x1b0 [ 517.459869][ T29] netlink_unicast+0x7b1/0x930 [ 517.464927][ T29] netlink_sendmsg+0x8d0/0xbf0 [ 517.469750][ T29] ? netlink_getsockopt+0x590/0x590 [ 517.475059][ T29] ? apparmor_socket_sendmsg+0x8e/0x330 [ 517.480640][ T29] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 517.486193][ T29] ? security_socket_sendmsg+0x80/0xa0 [ 517.491693][ T29] ? netlink_getsockopt+0x590/0x590 [ 517.497061][ T29] ____sys_sendmsg+0x61b/0x980 [ 517.501925][ T29] ? __asan_memset+0x22/0x40 [ 517.506558][ T29] ? __sys_sendmsg_sock+0x30/0x30 [ 517.511599][ T29] ? __import_iovec+0x5f2/0x850 [ 517.516568][ T29] ? import_iovec+0x73/0xa0 [ 517.521113][ T29] ___sys_sendmsg+0x2a6/0x360 [ 517.526051][ T29] ? __sys_sendmsg+0x2b0/0x2b0 [ 517.530959][ T29] __se_sys_sendmsg+0x1d0/0x2c0 [ 517.535902][ T29] ? __x64_sys_sendmsg+0x80/0x80 [ 517.540881][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 517.546198][ T29] do_syscall_64+0x55/0xb0 [ 517.550645][ T29] ? clear_bhb_loop+0x40/0x90 [ 517.556440][ T29] ? clear_bhb_loop+0x40/0x90 [ 517.561167][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 517.567362][ T29] RIP: 0033:0x7f2ba619e199 [ 517.571798][ T29] RSP: 002b:00007f2ba6fda028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 517.580610][ T29] RAX: ffffffffffffffda RBX: 00007f2ba6426270 RCX: 00007f2ba619e199 [ 517.588777][ T29] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000009 [ 517.596809][ T29] RBP: 00007f2ba6235888 R08: 0000000000000000 R09: 0000000000000000 [ 517.604901][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 517.612969][ T29] R13: 00007f2ba6426308 R14: 00007f2ba6426270 R15: 00007ffc4976c2b8 [ 517.620975][ T29] [ 517.624176][ T29] INFO: task syz.2.2333:12310 blocked for more than 146 seconds. [ 517.632005][ T29] Not tainted syzkaller #0 [ 517.637021][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 517.645753][ T29] task:syz.2.2333 state:D stack:27048 pid:12310 ppid:5768 flags:0x00004004 [ 517.655174][ T29] Call Trace: [ 517.658475][ T29] [ 517.661421][ T29] __schedule+0x15ae/0x4660 [ 517.665999][ T29] ? trace_event_raw_event_lock+0x240/0x240 [ 517.672116][ T29] ? asan.module_dtor+0x20/0x20 [ 517.677003][ T29] ? __mutex_lock+0x66e/0xc80 [ 517.681698][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 517.687510][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 517.693921][ T29] schedule+0xbd/0x170 [ 517.698031][ T29] schedule_preempt_disabled+0x13/0x20 [ 517.703555][ T29] __mutex_lock+0x673/0xc80 [ 517.708085][ T29] ? __mutex_lock+0x4d2/0xc80 [ 517.712940][ T29] ? tun_chr_close+0x41/0x1c0 [ 517.717649][ T29] ? mutex_lock_nested+0x20/0x20 [ 517.722704][ T29] ? tun_chr_open+0x510/0x510 [ 517.727399][ T29] tun_chr_close+0x41/0x1c0 [ 517.732065][ T29] ? tun_chr_open+0x510/0x510 [ 517.736802][ T29] __fput+0x221/0x940 [ 517.740836][ T29] task_work_run+0x1d4/0x260 [ 517.745507][ T29] ? task_work_cancel+0x220/0x220 [ 517.750558][ T29] ? exit_to_user_mode_loop+0x3b/0x110 [ 517.756217][ T29] exit_to_user_mode_loop+0xe6/0x110 [ 517.761549][ T29] exit_to_user_mode_prepare+0xee/0x180 [ 517.779427][ T29] syscall_exit_to_user_mode+0x1a/0x50 [ 517.785022][ T29] do_syscall_64+0x61/0xb0 [ 517.789552][ T29] ? clear_bhb_loop+0x40/0x90 [ 517.794556][ T29] ? clear_bhb_loop+0x40/0x90 [ 517.799258][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 517.805210][ T29] RIP: 0033:0x7fc3b4f9e199 [ 517.809642][ T29] RSP: 002b:00007fffa282f518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 517.818219][ T29] RAX: 0000000000000000 RBX: 00007fffa282f600 RCX: 00007fc3b4f9e199 [ 517.826276][ T29] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 517.834411][ T29] RBP: 000000000005a2b1 R08: 0000000000000001 R09: 0000000000000000 [ 517.842613][ T29] R10: 0000001b2c520000 R11: 0000000000000246 R12: 00007fffa282f640 [ 517.850600][ T29] R13: 00007fc3b5225fac R14: 000000000005a303 R15: 00007fc3b5225fa0 [ 517.858760][ T29] [ 517.861973][ T29] [ 517.861973][ T29] Showing all locks held in the system: [ 517.869724][ T29] 1 lock held by khungtaskd/29: [ 517.875163][ T29] #0: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 517.885333][ T29] 1 lock held by dhcpcd/5434: [ 517.890030][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 517.899737][ T29] 2 locks held by getty/5526: [ 517.904651][ T29] #0: ffff88814cc120a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 517.914760][ T29] #1: ffffc9000327e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 517.925601][ T29] 3 locks held by kworker/1:5/5809: [ 517.930832][ T29] #0: ffff888018872538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 517.943311][ T29] #1: ffffc900048bfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 517.954645][ T29] #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 [ 517.964580][ T29] 3 locks held by kworker/0:10/8849: [ 517.969881][ T29] #0: ffff888018870d38 ((wq_completion)events#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 517.981296][ T29] #1: ffffc9000cd6fd00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 517.992711][ T29] #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xe/0x20 [ 518.003651][ T29] 5 locks held by kworker/u4:52/11909: [ 518.009139][ T29] 3 locks held by kworker/u4:53/11910: [ 518.015231][ T29] #0: ffff88802cee7138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 518.027222][ T29] #1: ffffc90004137d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 518.041301][ T29] #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 [ 518.051075][ T29] 3 locks held by kworker/u4:54/11911: [ 518.056711][ T29] #0: ffff888018871938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 518.068489][ T29] #1: ffffc90004167d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 518.079580][ T29] #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 [ 518.088675][ T29] 4 locks held by kworker/u4:56/11913: [ 518.095310][ T29] #0: ffff88801ae5d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 518.106707][ T29] #1: ffffc90004187d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 518.117449][ T29] #2: ffffffff8f1c5810 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x140/0xb00 [ 518.127134][ T29] #3: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xf2/0xa00 [ 518.137303][ T29] 7 locks held by syz-executor/12163: [ 518.142735][ T29] #0: ffff8880313ee418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 518.151684][ T29] #1: ffff88805ddbd888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 [ 518.161579][ T29] #2: ffff88802508c1f8 (kn->active#54){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x236/0x520 [ 518.171996][ T29] #3: ffffffff8eab8268 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: new_device_store+0x13d/0x690 [ 518.183510][ T29] #4: ffff8880602ac130 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420 [ 518.192928][ T29] #5: ffff8880602af250 (&devlink->lock_key#5){+.+.}-{3:3}, at: nsim_drv_probe+0xc8/0xb90 [ 518.203240][ T29] #6: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: nsim_create+0x378/0x4a0 [ 518.212257][ T29] 1 lock held by syz.1.2327/12295: [ 518.217368][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 [ 518.226426][ T29] 1 lock held by syz.1.2327/12296: [ 518.231549][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.241254][ T29] 2 locks held by syz.0.2331/12306: [ 518.246518][ T29] #0: ffff88807962d690 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0xf4/0x7a0 [ 518.256929][ T29] #1: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x77c/0xec0 [ 518.266015][ T29] 1 lock held by syz.0.2331/12313: [ 518.271145][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.280674][ T29] 1 lock held by syz.2.2333/12310: [ 518.285897][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 [ 518.295094][ T29] 1 lock held by syz-executor/12315: [ 518.300402][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.313323][ T29] 1 lock held by syz-executor/12321: [ 518.318633][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.328107][ T29] 1 lock held by syz-executor/12323: [ 518.333510][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.343182][ T29] 1 lock held by syz-executor/12326: [ 518.348495][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.358018][ T29] 1 lock held by syz-executor/12331: [ 518.363351][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.372878][ T29] 1 lock held by syz-executor/12337: [ 518.378180][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.387679][ T29] 1 lock held by syz-executor/12339: [ 518.393072][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.402596][ T29] 1 lock held by syz-executor/12342: [ 518.407975][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.418716][ T29] 1 lock held by syz-executor/12347: [ 518.425158][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.434724][ T29] 1 lock held by syz-executor/12352: [ 518.440013][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.449519][ T29] 1 lock held by syz-executor/12354: [ 518.455040][ T29] #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 [ 518.464589][ T29] [ 518.466942][ T29] ============================================= [ 518.466942][ T29] [ 518.475465][ T29] NMI backtrace for cpu 1 [ 518.479818][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 518.487017][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 518.497078][ T29] Call Trace: [ 518.500361][ T29] [ 518.503317][ T29] dump_stack_lvl+0x18c/0x250 [ 518.508028][ T29] ? nmi_cpu_backtrace+0x1b6/0x3e0 [ 518.513164][ T29] ? show_regs_print_info+0x20/0x20 [ 518.518414][ T29] ? load_image+0x420/0x420 [ 518.522984][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 518.527941][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 518.534130][ T29] ? load_image+0x420/0x420 [ 518.538652][ T29] ? wq_watchdog_touch+0xef/0x170 [ 518.543687][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 518.549769][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 518.555756][ T29] watchdog+0xf59/0xfa0 [ 518.559920][ T29] ? watchdog+0x1e1/0xfa0 [ 518.564270][ T29] kthread+0x2fa/0x390 [ 518.568339][ T29] ? hungtask_pm_notify+0x50/0x50 [ 518.573370][ T29] ? kthread_blkcg+0xd0/0xd0 [ 518.577960][ T29] ret_from_fork+0x48/0x80 [ 518.582378][ T29] ? kthread_blkcg+0xd0/0xd0 [ 518.586967][ T29] ret_from_fork_asm+0x11/0x20 [ 518.591755][ T29] [ 518.595288][ T29] Sending NMI from CPU 1 to CPUs 0: [ 518.600521][ C0] NMI backtrace for cpu 0 [ 518.600531][ C0] CPU: 0 PID: 11912 Comm: kworker/u4:55 Not tainted syzkaller #0 [ 518.600547][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 518.600556][ C0] Workqueue: bat_events batadv_nc_worker [ 518.600574][ C0] RIP: 0010:__lock_acquire+0x2f9/0x7eb0 [ 518.600594][ C0] Code: 00 00 4c 89 7c 24 68 41 83 ff 30 0f 93 c0 83 3d 2c e3 a6 16 00 74 02 31 c0 84 c0 0f 85 c7 15 00 00 4c 89 74 24 38 44 8b 6d 30 <44> 8b 75 20 48 c7 c0 c0 93 95 91 48 29 c3 48 c1 fb 04 48 ba c5 4e [ 518.600608][ C0] RSP: 0018:ffffc900041777c0 EFLAGS: 00000046 [ 518.600620][ C0] RAX: 0000000000000000 RBX: ffffffff9195ae90 RCX: ffffffff980f8403 [ 518.600631][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8df320e0 [ 518.600641][ C0] RBP: ffffc90004177a08 R08: dffffc0000000000 R09: 0000000000000000 [ 518.600651][ C0] R10: dffffc0000000000 R11: fffffbfff1ed8b5e R12: 0000000000000000 [ 518.600662][ C0] R13: 0000000000000000 R14: ffff8880331328e0 R15: 0000000000000002 [ 518.600672][ C0] FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 518.600685][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 518.600695][ C0] CR2: 00005584d8262000 CR3: 000000000dd32000 CR4: 00000000003506f0 [ 518.600709][ C0] DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 [ 518.600719][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 518.600729][ C0] Call Trace: [ 518.600734][ C0] [ 518.600752][ C0] ? __mod_timer+0x9b0/0xd60 [ 518.600767][ C0] ? verify_lock_unused+0x140/0x140 [ 518.600787][ C0] ? perf_trace_lock+0xfc/0x3b0 [ 518.600803][ C0] ? trace_event_raw_event_lock+0x240/0x240 [ 518.600819][ C0] ? trace_event_raw_event_lock+0x240/0x240 [ 518.600835][ C0] lock_acquire+0x19e/0x420 [ 518.600851][ C0] ? batadv_nc_worker+0xd2/0x600 [ 518.600869][ C0] ? batadv_nc_worker+0xd2/0x600 [ 518.600883][ C0] ? read_lock_is_recursive+0x20/0x20 [ 518.600901][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 518.600917][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 518.600935][ C0] ? batadv_nc_worker+0xd2/0x600 [ 518.600955][ C0] batadv_nc_worker+0xef/0x600 [ 518.600968][ C0] ? batadv_nc_worker+0xd2/0x600 [ 518.600983][ C0] ? process_scheduled_works+0x975/0x1600 [ 518.601003][ C0] process_scheduled_works+0xa60/0x1600 [ 518.601036][ C0] ? worker_attach_to_pool+0x370/0x370 [ 518.601057][ C0] ? assign_work+0x3cc/0x5d0 [ 518.601077][ C0] worker_thread+0xa5e/0xfe0 [ 518.601101][ C0] ? _raw_spin_unlock+0x40/0x40 [ 518.601120][ C0] ? __kthread_parkme+0x71/0x1c0 [ 518.601139][ C0] kthread+0x2fa/0x390 [ 518.601153][ C0] ? pr_cont_work+0x550/0x550 [ 518.601171][ C0] ? kthread_blkcg+0xd0/0xd0 [ 518.601185][ C0] ret_from_fork+0x48/0x80 [ 518.601201][ C0] ? kthread_blkcg+0xd0/0xd0 [ 518.601216][ C0] ret_from_fork_asm+0x11/0x20 [ 518.601242][ C0] [ 518.601707][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 518.889652][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 518.896852][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 518.906902][ T29] Call Trace: [ 518.910176][ T29] [ 518.913107][ T29] dump_stack_lvl+0x18c/0x250 [ 518.917791][ T29] ? show_regs_print_info+0x20/0x20 [ 518.923018][ T29] ? load_image+0x420/0x420 [ 518.927538][ T29] panic+0x2ca/0x720 [ 518.931438][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 518.935942][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 518.941491][ T29] ? preempt_schedule_thunk+0x1a/0x30 [ 518.946865][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 518.953028][ T29] watchdog+0xf98/0xfa0 [ 518.957188][ T29] ? watchdog+0x1e1/0xfa0 [ 518.961524][ T29] kthread+0x2fa/0x390 [ 518.965590][ T29] ? hungtask_pm_notify+0x50/0x50 [ 518.970615][ T29] ? kthread_blkcg+0xd0/0xd0 [ 518.975205][ T29] ret_from_fork+0x48/0x80 [ 518.979619][ T29] ? kthread_blkcg+0xd0/0xd0 [ 518.984203][ T29] ret_from_fork_asm+0x11/0x20 [ 518.988986][ T29] [ 518.992242][ T29] Kernel Offset: disabled [ 518.996574][ T29] Rebooting in 86400 seconds..