last executing test programs: 36.268613958s ago: executing program 3 (id=1799): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xa, 0x3, 0x73) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1}, 0x0) 35.986294332s ago: executing program 3 (id=1800): bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000e0000", @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x4, 0xb5, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x8, 0xfffffffffffffffe, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000940)=ANY=[@ANYBLOB="18050000000000000000000000000000851000000600000018100000", @ANYRES32, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000a60a000000000000180000002020782500000000002020207b0af8ff00000000bd510000000000000701000000feffffb702000008000000b7030000000000008500000019000000"], &(0x7f0000000000)='GPL\x00', 0x4, 0xdd, &(0x7f0000000340)=""/221}, 0x94) syz_clone(0x48400, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) r3 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x7, 0x4, 0x8, 0x6, 0x0, 0x1}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000140)={r3, 0x0, 0x0}, 0x20) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110e22fff6) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TUNGETVNETLE(r4, 0x8004745a, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x1) syz_clone(0x20083500, 0x0, 0x0, 0x0, 0x0, 0x0) 34.306304887s ago: executing program 2 (id=1805): r0 = socket$kcm(0xa, 0x2, 0x3a) sendmsg$kcm(r0, &(0x7f0000000440)={&(0x7f0000000800)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000780)}], 0x1, 0x0, 0x0, 0x900}, 0x0) recvmsg$kcm(r0, &(0x7f0000001e00)={&(0x7f0000000080)=@caif, 0x80, &(0x7f0000001d80)=[{&(0x7f0000000c40)=""/4096, 0xfdef}], 0x1}, 0x40000000) 33.224301172s ago: executing program 2 (id=1811): socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x3, 0x0) socket$kcm(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c40)) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0x1}, 0x50) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x5, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x4) sendmsg$inet(r1, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1}, 0x3e8) 33.098381464s ago: executing program 1 (id=1813): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x400000002, 0x0) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r2, 0x107, 0x2, &(0x7f00000000c0), 0x10) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="1b00000019007f089ea6690ca4dc04f11c672274119dd27d616f3a", 0x1b}], 0x1}, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, r3}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r4, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000bc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r6) r7 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r7, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r6, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0xe4, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000240), &(0x7f0000000280), 0x8, 0xd6, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000006c0)=ANY=[@ANYRESDEC=r7], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0xffffffff}, 0x10, r8}, 0x94) r9 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0xe4d, 0x7, 0x40, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r9, 0x40042408, r10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000c00)={r10, 0x0, 0x0}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000880)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000800), &(0x7f0000000840)='%-5lx \x00'}, 0x20) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="090000000400000006000000ff00000042"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000440), &(0x7f0000000080), 0x619, r12}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x10, 0xd, &(0x7f0000000480)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}], &(0x7f0000000740)='GPL\x00', 0x81, 0x0, 0x0, 0x40f00, 0x30, '\x00', r5, @sk_msg=0x7, r2, 0x8, &(0x7f0000000780)={0x1, 0x4}, 0x8, 0x10, &(0x7f00000007c0)={0x2, 0x10, 0x8, 0xf}, 0x10, r8, r10, 0x2, &(0x7f00000008c0)=[r11, r0, r12, 0xffffffffffffffff], &(0x7f0000000900)=[{0x2, 0x1, 0x10, 0x2}, {0x1, 0x3, 0xe, 0x6}], 0x10, 0x4}, 0x94) r13 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0xd, &(0x7f0000000540)=ANY=[@ANYBLOB="f4f72d36cc1500303400c25008fbc018000000ff070000000000000000000018290000ec12d8170d0366fa76ce01d387e39a11536aa8ad9f9879a2553ffaf7958379e8dc0e9a3cfecdcd5a213f77f28866d2248ba821d0dc2fbc22d86d8fa8d270add08e85497d74c7a7dcd7a069994da8e1909aa498d4a716094774fd7ffec24c1f2b24421c9b5b8111fedf20a934636582bb07bea118c2fbaad874dd303b5ced7ee469baad2bbaaaa3e053fe7b1ea1e63791ef8386891d2f1dae1558b5559e41a3d1656da5d675431facb612dc46491290f83a785af5d6f28a8a2377b651ad8c99a2085132beec619ce182a8ab2d06d754b526944898a009991b3806eeca", @ANYRES32, @ANYBLOB="000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300007f00000085000000060000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x401, 0xa9, &(0x7f0000000100)=""/169, 0x100, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000200)={0x5, 0x7, 0x288, 0xfffffff9}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000240)=[0xffffffffffffffff], &(0x7f0000000280)=[{0x3, 0x1, 0x4, 0xa}, {0x0, 0x5, 0xe, 0x4}, {0x5, 0x4, 0x6, 0xa}, {0x2, 0x5, 0x1, 0x3}, {0x0, 0x1, 0x4, 0x9}, {0x0, 0x2, 0x8, 0x4}, {0x0, 0x2, 0x0, 0xa}], 0x10, 0x7}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000003c0)={r1, r13}) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000a80)="d80000001d0081044e81f777db44b9b8021d080201000000040000a1bc0001000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c16fb4007134cf6ee08000a0e408e8d8ef075c11503c6bbace801bcb090000001fb79105000000001b146218a07445d6d930dfe1d9d322107c9fd6", 0x81}, {&(0x7f00000006c0)="54f6d4d87eb3f140c5", 0x9}, {&(0x7f0000000980)="027a64c0072ebbb1512b328dda11b4efd4ba07fc642b7e012bea071dbbdea51e41958755533ccce04d3e635cbe848495e723490d8e93db224d82d4fbfe76bd22fd358cd467795ad7febfc220d72f", 0x4e}], 0x3, 0x0, 0x0, 0x7400}, 0x90) 32.984848416s ago: executing program 1 (id=1815): r0 = perf_event_open(&(0x7f0000001100)={0x5, 0x80, 0x9, 0x8, 0xb, 0xfb, 0x0, 0x3c, 0xc002, 0xf, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x18842, 0x9, 0x7, 0x2, 0x9, 0x3, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000200000004"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000081a000001"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000020001000900000001"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) sendmsg$unix(r6, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2501, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x828, 0x0, 0x0, 0x3, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001100)={0x5, 0x80, 0xb, 0x5, 0xb, 0x7, 0x0, 0x3c, 0xc002, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x18a62, 0x5, 0x7ffffffc, 0x3, 0x7, 0x3, 0x7, 0x0, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0x0, r0, 0x3) 32.888191777s ago: executing program 2 (id=1816): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xb}, @multicast1}}}], 0x20}, 0x4008804) sendmsg$kcm(r0, &(0x7f0000000480)={&(0x7f00000002c0)=@l2tp={0x2, 0x0, @remote, 0xfffffffe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000c40)="3282db78e0ea55c52d87bc2a166b9e46818f5faca0b3a411e056b7928ccacd30019d925e47ecd2f92675d1d80000000000000004007d002ae35902b5d768e71db355cf220bb96b7a64e1d2629c3e21c5decd0e2e6f107e35a8081587d3dc42a0bc0d0c5e85c355c9cbadd6e8f8014acb52d24b961a3989d5102d540829ad660fdca299e7e74a71ed264d75a3e1dfb8331f1b441972bc5941fa418cfee6139c15eda91b1ecf8887e108b15c4c7505c31efe205c875a7c854aa65bcc2e04ea6739f968547df4ae455ecd6b0566ef52705630df27d81e2a544ecc09f8c73cec559d206644acdc56c717e19f04613456b8d7a386c0a700c032d0165c3b3f5716aa7f24e6fca522f91350793d13ba7f887e7b48cd3e6e41139d0d04000000ac59bf750ce0000000000000000000000000f18d233cdc36efdead60d008963851bc819e1b4551b3f13bbf6c18ea0165c66f5261c9ec61f0914c6ffb8506596b61392aa5d906994608b36096a2f5c0f3fef95bf6ddb78c8d07eee5e815c9a2a3d21a054e6fd032be118e9a3f4d016db35b5048e20f1859680e5571822934769e6f9361babb4766dc073d1dabfb220daa1cf4e7206b2b8aa7b55d1396273690ec7a8d36ffbfe2a68a9547758d3ece744be07d320147c0e92e0b63f9bc6ec163917bee3f5602f840a1759670ea43b7f596b347d8b9116506356d0279d21f6a0cab3056c27dec074e8dac12c1d99afcd84f82a47a0cb5093c7a221f7fb624e2f6e9eeca4e5050fc3be50bbdc62d41333b4243336a5590e49658a10b5c8624eb2410d68e64f230fdcf4689495ca41e818d4808b18592610bf62403c2eaad20d1d8fb185ebefac64aa0eb1d36ccacf61ec28b4ec24dba53b21ed5c5f727cccb0d614884908957138d2c30560e88f128af21ccc9fd64d229f35b2f76d0ee9e25f9e4390a55a8600449774ca116e3ba523c9c5d39abcf09a76127c17fc6194711f20307ead0d5bbbe2aa3f677156b8856411a8045159df771ac3e3d5828e359c24a59d65e92f4112fb697ab825536751f82e9d55e89853a03c693d418c4d2cccb61c6f60ad304a68d15fc20edaec9af4725f47c8e1724cfd5099a59147bcc872fafe7565f98c3c3edb83c96b0aff30779783467d4348d5e28d9afd5e77ce5dabc1c4d5d790339490703d9050ef8d919d5d5f71a26bd9b72ea53933eecb6cd8a09bc67f5a6b0450fbfcce6837ab696975ba8387815bfa1c497f37ed8b9151bb1105d5efbf3b5034e5bdde5fdb60f996c1fcf75201c52d47ab3b31a4112d6cb61c3beaeb97d03744cfb01409dd1b1258e0d5856df535c241017509a193043296e202834cc4eb50417c56f93093ca61a9c1373904faa2564ad469d8329dd1256f9648af69d6007d8bca7b566cee8a263c07021e9f71b82c07ca8fbe3", 0x3f3}, {&(0x7f0000002b40)}], 0x2}, 0x8400) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000640)="a1cac048", 0x4}], 0x1}, 0x0) 32.69830756s ago: executing program 0 (id=1817): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={&(0x7f0000000100), 0x2}, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x4, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000780)="f4000900062b3c25fe80000000000000dc8b850f238466cc00007a000000adac911b", 0x22}, {&(0x7f0000000080)="53b12d3fa0ba", 0x6}], 0x2}, 0x0) 32.69816222s ago: executing program 2 (id=1818): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xa, 0x3, 0x73) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000180)}], 0x1}, 0x0) 32.69805637s ago: executing program 1 (id=1819): r0 = socket$kcm(0xa, 0x2, 0x3a) sendmsg$kcm(r0, &(0x7f0000000440)={&(0x7f0000000800)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000780)}], 0x1, 0x0, 0x0, 0x900}, 0x0) recvmsg$kcm(r0, &(0x7f0000001e00)={&(0x7f0000000080)=@caif, 0x80, &(0x7f0000001d80)=[{&(0x7f0000000c40)=""/4096, 0xfdef}], 0x1}, 0x40000000) 32.657983111s ago: executing program 3 (id=1820): r0 = socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000440)=@raw=[@btf_id={0x18, 0x2, 0x3, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x7}], &(0x7f0000000180)='GPL\x00', 0x0, 0x28, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xd, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f0000000000)=[{0x0}], 0x1}, 0x3e8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000880)={'bond0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0}, 0x20002880) 32.531868513s ago: executing program 3 (id=1821): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r2, &(0x7f00000010c0)={&(0x7f0000000140)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000480)='\\', 0x1}], 0x1}, 0x4000040) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x90) r5 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r5, 0x29, 0x1a, &(0x7f0000000140), 0x4) sendmsg$inet(r5, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, 0x0}, 0x3e8) perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000380)=ANY=[@ANYRESHEX], 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1007f}, 0x94) r7 = socket$kcm(0x2c, 0x3, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) setsockopt$sock_attach_bpf(r7, 0x11b, 0x2, &(0x7f0000000040)=r8, 0x4) socket$kcm(0x10, 0x2, 0x4) r9 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000003400)=@generic={&(0x7f00000033c0)='./file0\x00', 0x0, 0x18}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000003500)={0x5, 0x16, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1000}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@generic={0x0, 0x3, 0x3, 0x7, 0x6000}, @alu={0x7, 0x0, 0xd, 0x1, 0x8, 0x20, 0xfffffffffffffffc}, @func={0x85, 0x0, 0x1, 0x0, 0x5}, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @generic={0x4, 0x0, 0xd, 0x970d, 0x3}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000007c0)='GPL\x00', 0x8, 0x1000, &(0x7f0000002340)=""/4096, 0x20980, 0x0, '\x00', 0x0, @fallback=0x2, r8, 0x8, &(0x7f0000003340)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000003380)={0x3, 0x9, 0x1, 0x64}, 0x10, 0x0, r6, 0x6, &(0x7f0000003440)=[r8, r9], &(0x7f0000003480)=[{0x0, 0x3, 0x5, 0xc}, {0x5, 0x5, 0x10, 0x9}, {0x4, 0x4, 0x4, 0xf2fbbf15e5439d8c}, {0x2, 0x4, 0xc, 0x4}, {0x0, 0x3, 0x10, 0x3}, {0x0, 0x2, 0x0, 0x7}], 0x10, 0x9}, 0x94) close(0xffffffffffffffff) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x806, 0x4, 0x8, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)="1c0000001a006bb12214b594e9a36f9e5c4eb100103fe3dc6e080000", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r5, &(0x7f0000002300)={0x0, 0x0, &(0x7f0000002280)=[{&(0x7f0000001100)=""/4096, 0x1000}, {&(0x7f0000002100)=""/212, 0xd4}, {&(0x7f0000002200)=""/100, 0x64}], 0x3, &(0x7f00000022c0)=""/5, 0x5}, 0x10040) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r4, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000140)=[{&(0x7f0000000180)="2e00000011008b88040f80ec59acbc0413a1f8480f0000005e2900421803001825000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 32.446189624s ago: executing program 2 (id=1822): syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x102009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x9cdc2384056b48b8) sendmsg$inet(0xffffffffffffffff, 0x0, 0x40000) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0), 0x8) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000440)={'batadv_slave_1\x00', 0x10}) r3 = socket$kcm(0x10, 0x2, 0x0) recvmsg$kcm(r0, &(0x7f0000001740)={&(0x7f0000000680)=@x25={0x9, @remote}, 0x80, &(0x7f0000001700)=[{&(0x7f0000000700)=""/4096, 0x1000}], 0x1}, 0x10000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x0, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x94) socketpair(0x1, 0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0xca, 0x1, 0x80, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={&(0x7f0000000140), 0x2}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x1ff, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(r3, &(0x7f0000002480)={&(0x7f0000000200)={0x2, 0x0, @local}, 0x10, 0x0, 0x2e, 0x0, 0x5f}, 0x20000044) r4 = socket$kcm(0x2, 0x5, 0x84) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@volatile={0xe, 0x0, 0x0, 0x9, 0x2}, @fwd={0x2}]}, {0x0, [0x2e]}}, &(0x7f0000000580)=""/135, 0x33, 0x87, 0x0, 0xfffffffa}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x4, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x240000, 0x0) close(r8) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000001c0)={'xfrm0\x00', 0x800}) close(r7) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r4, 0x84, 0x64, &(0x7f0000000000)=r9, 0x10) sendmsg$inet(r4, &(0x7f00000000c0)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffe0}], 0x1}, 0x80d1) close(r4) 32.405405134s ago: executing program 0 (id=1823): bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000e0000", @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x4, 0xb5, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x8, 0xfffffffffffffffe, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000940)=ANY=[@ANYBLOB="18050000000000000000000000000000851000000600000018100000", @ANYRES32, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000a60a000000000000180000002020782500000000002020207b0af8ff00000000bd510000000000000701000000feffffb702000008000000b7030000000000008500000019000000"], &(0x7f0000000000)='GPL\x00', 0x4, 0xdd, &(0x7f0000000340)=""/221}, 0x94) syz_clone(0x48400, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) r3 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x7, 0x4, 0x8, 0x6, 0x0, 0x1}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000140)={r3, 0x0, 0x0}, 0x20) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110e22fff6) syz_clone(0x40042700, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TUNGETVNETLE(r4, 0x8004745a, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x1) syz_clone(0x20083500, 0x0, 0x0, 0x0, 0x0, 0x0) 31.748034914s ago: executing program 1 (id=1824): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0xffffffff, 0xfffa, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0xa, 0x2, 0x88) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000001340)={0x2, 0x6, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @multicast1}}}], 0x20}, 0x8000) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000002000)={0x11, 0x10, &(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000100000008500000083000000bf09000000000000550901000000000095000000000000008500000050000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a879809, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f93d24fc60", 0x14}], 0x1}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907003675f37538e486dd6317ce623900fe800000002000e0865a6596aff57b00000000000000000000000000ac14"], 0xfe1b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="850020000000000018100000", @ANYRES32, @ANYBLOB="1700000000000000950000000000000045"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18006f4444bd000001000000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'tunl0\x00'}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f1, &(0x7f0000000080)) 31.636226916s ago: executing program 3 (id=1825): socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x3, 0x0) socket$kcm(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c40)) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0x1}, 0x50) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x5, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x4) sendmsg$inet(r1, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1}, 0x3e8) 31.472772038s ago: executing program 1 (id=1826): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xb}, @multicast1}}}], 0x20}, 0x4008804) sendmsg$kcm(r0, &(0x7f0000000480)={&(0x7f00000002c0)=@l2tp={0x2, 0x0, @remote, 0xfffffffe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000c40)="3282db78e0ea55c52d87bc2a166b9e46818f5faca0b3a411e056b7928ccacd30019d925e47ecd2f92675d1d80000000000000004007d002ae35902b5d768e71db355cf220bb96b7a64e1d2629c3e21c5decd0e2e6f107e35a8081587d3dc42a0bc0d0c5e85c355c9cbadd6e8f8014acb52d24b961a3989d5102d540829ad660fdca299e7e74a71ed264d75a3e1dfb8331f1b441972bc5941fa418cfee6139c15eda91b1ecf8887e108b15c4c7505c31efe205c875a7c854aa65bcc2e04ea6739f968547df4ae455ecd6b0566ef52705630df27d81e2a544ecc09f8c73cec559d206644acdc56c717e19f04613456b8d7a386c0a700c032d0165c3b3f5716aa7f24e6fca522f91350793d13ba7f887e7b48cd3e6e41139d0d04000000ac59bf750ce0000000000000000000000000f18d233cdc36efdead60d008963851bc819e1b4551b3f13bbf6c18ea0165c66f5261c9ec61f0914c6ffb8506596b61392aa5d906994608b36096a2f5c0f3fef95bf6ddb78c8d07eee5e815c9a2a3d21a054e6fd032be118e9a3f4d016db35b5048e20f1859680e5571822934769e6f9361babb4766dc073d1dabfb220daa1cf4e7206b2b8aa7b55d1396273690ec7a8d36ffbfe2a68a9547758d3ece744be07d320147c0e92e0b63f9bc6ec163917bee3f5602f840a1759670ea43b7f596b347d8b9116506356d0279d21f6a0cab3056c27dec074e8dac12c1d99afcd84f82a47a0cb5093c7a221f7fb624e2f6e9eeca4e5050fc3be50bbdc62d41333b4243336a5590e49658a10b5c8624eb2410d68e64f230fdcf4689495ca41e818d4808b18592610bf62403c2eaad20d1d8fb185ebefac64aa0eb1d36ccacf61ec28b4ec24dba53b21ed5c5f727cccb0d614884908957138d2c30560e88f128af21ccc9fd64d229f35b2f76d0ee9e25f9e4390a55a8600449774ca116e3ba523c9c5d39abcf09a76127c17fc6194711f20307ead0d5bbbe2aa3f677156b8856411a8045159df771ac3e3d5828e359c24a59d65e92f4112fb697ab825536751f82e9d55e89853a03c693d418c4d2cccb61c6f60ad304a68d15fc20edaec9af4725f47c8e1724cfd5099a59147bcc872fafe7565f98c3c3edb83c96b0aff30779783467d4348d5e28d9afd5e77ce5dabc1c4d5d790339490703d9050ef8d919d5d5f71a26bd9b72ea53933eecb6cd8a09bc67f5a6b0450fbfcce6837ab696975ba8387815bfa1c497f37ed8b9151bb1105d5efbf3b5034e5bdde5fdb60f996c1fcf75201c52d47ab3b31a4112d6cb61c3beaeb97d03744cfb01409dd1b1258e0d5856df535c241017509a193043296e202834cc4eb50417c56f93093ca61a9c1373904faa2564ad469d8329dd1256f9648af69d6007d8bca7b566cee8a263c07021e9f71b82c07ca8fbe3", 0x3f3}, {&(0x7f0000002b40)="da752f575198baaac222d34e85893d37a6bd281687872ed9151c56f415698f3fecf56eebf5edb42ed5d54e0419b2a13128d3ad19b6eed6b450aad46baaa57203e0d4f567d8d79fe07e7b3142de43e55cf69c65db2469175cf60c82f49d0f9dc4c4dde733a14d57f4117ed2f46aea5950ff0176d73349c2808eee62ce1c7d846ffdf65211f3192dabe5b3ac1516ad90e618d0ca9e4ac2778acabeac244f2f90af2616647e5cf8ab5e2ac404ebf2a866c8a73f68ae2cc4523e63e3a1aa5ab60a23e4c47534bda546042120c5333d91fefc68226bc9149d282937797a2fe036a5", 0xdf}], 0x2}, 0x8400) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000640)="a1cac048", 0x4}], 0x1}, 0x0) 31.426329479s ago: executing program 2 (id=1827): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, r0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x4, 0x2, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x4, 0x2, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0x2121, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0x2121, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x2, 0x3, 0x2) (async) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x891c, &(0x7f0000000040)={'ip6_vti0\x00', @random="02000400"}) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) (async) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x8) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000000)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="c00e020023000b02d25a80d0bcb924f93045fc60040f12", 0x17}], 0x1}, 0x4010) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff8}, [@call={0x85, 0x0, 0x0, 0x36}, @call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff8}, [@call={0x85, 0x0, 0x0, 0x36}, @call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="f7edad00"/14, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r4 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) (async) write$cgroup_subtree(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) 31.421597439s ago: executing program 0 (id=1828): bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00\x00\x00', @ANYRES32], 0x50) r0 = socket$kcm(0xa, 0x922000000003, 0x11) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xfffd, 0x0, 0x0, @mcast1, 0x4, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000780)="f4000900062b3c25fe80000000000000dc8b850f238466cc00007a000000adac911b", 0x22}, {&(0x7f0000000080)="53b12d3fa0ba", 0x6}], 0x2}, 0x0) 31.292471441s ago: executing program 3 (id=1829): r0 = socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000440)=@raw=[@btf_id={0x18, 0x2, 0x3, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x7}], &(0x7f0000000180)='GPL\x00', 0x0, 0x28, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xd, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f0000000000)=[{0x0}], 0x1}, 0x3e8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000880)={'bond0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000140)}, 0x20002880) 31.284913281s ago: executing program 1 (id=1830): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xa, 0x3, 0x73) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000180)}], 0x1}, 0x0) 31.214364222s ago: executing program 0 (id=1831): bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00\x00\x00', @ANYRES32], 0x50) r0 = socket$kcm(0xa, 0x922000000003, 0x11) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x4, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000780)="f4000900062b3c25fe80000000000000dc8b850f238466cc00007a000000adac911b", 0x22}, {&(0x7f0000000080)="53b12d3fa0ba", 0x6}], 0x2}, 0x0) (fail_nth: 5) 30.717695049s ago: executing program 0 (id=1832): r0 = socket$kcm(0xa, 0x2, 0x3a) sendmsg$kcm(r0, &(0x7f0000000440)={&(0x7f0000000800)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000780)="80005b02", 0x4}], 0x1, 0x0, 0x0, 0x900}, 0x0) recvmsg$kcm(r0, &(0x7f0000001e00)={&(0x7f0000000080)=@caif, 0x80, &(0x7f0000001d80)=[{&(0x7f0000000c40)=""/4096, 0xfdef}], 0x1}, 0x40000000) 16.018720296s ago: executing program 32 (id=1830): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xa, 0x3, 0x73) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000180)}], 0x1}, 0x0) 15.925827367s ago: executing program 33 (id=1827): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, r0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x4, 0x2, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x4, 0x2, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0x2121, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0x2121, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x2, 0x3, 0x2) (async) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x891c, &(0x7f0000000040)={'ip6_vti0\x00', @random="02000400"}) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) (async) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x8) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000000)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="c00e020023000b02d25a80d0bcb924f93045fc60040f12", 0x17}], 0x1}, 0x4010) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff8}, [@call={0x85, 0x0, 0x0, 0x36}, @call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff8}, [@call={0x85, 0x0, 0x0, 0x36}, @call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="f7edad00"/14, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r4 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) (async) write$cgroup_subtree(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) 15.243853207s ago: executing program 34 (id=1829): r0 = socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000440)=@raw=[@btf_id={0x18, 0x2, 0x3, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x7}], &(0x7f0000000180)='GPL\x00', 0x0, 0x28, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xd, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10, &(0x7f0000000000)=[{0x0}], 0x1}, 0x3e8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000880)={'bond0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000140)}, 0x20002880) 15.201049747s ago: executing program 0 (id=1836): socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x102009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socket$kcm(0x10, 0x400000002, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000002640)={&(0x7f0000000040)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000002500)=ANY=[], 0x110}, 0x40000) socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x0, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x94) socketpair(0x1, 0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000002480)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x41, 0x0, 0x11}, 0x0) r1 = socket$kcm(0x2, 0x5, 0x84) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@volatile={0xe, 0x0, 0x0, 0x9, 0x2}]}, {0x0, [0x2e]}}, 0x0, 0x27, 0x0, 0x0, 0xfffffffa}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x4, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x240000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000001c0)={'xfrm0\x00', 0x800}) close(r4) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r1, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffe0}], 0x1}, 0x80d1) (fail_nth: 7) close(r1) 0s ago: executing program 35 (id=1836): socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x102009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socket$kcm(0x10, 0x400000002, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000002640)={&(0x7f0000000040)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000002500)=ANY=[], 0x110}, 0x40000) socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x0, 0x0, &(0x7f0000000100)='GPL\x00'}, 0x94) socketpair(0x1, 0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000002480)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x41, 0x0, 0x11}, 0x0) r1 = socket$kcm(0x2, 0x5, 0x84) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@volatile={0xe, 0x0, 0x0, 0x9, 0x2}]}, {0x0, [0x2e]}}, 0x0, 0x27, 0x0, 0x0, 0xfffffffa}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x4, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x240000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000001c0)={'xfrm0\x00', 0x800}) close(r4) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r1, 0x84, 0x64, &(0x7f0000000000)=r6, 0x10) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffe0}], 0x1}, 0x80d1) (fail_nth: 7) close(r1) kernel console output (not intermixed with test programs): 0x4c0 [ 282.171317][ T9005] _copy_from_user+0x2f/0xe0 [ 282.175956][ T9005] __sys_bpf+0x23e/0x890 [ 282.180238][ T9005] ? bpf_link_show_fdinfo+0x390/0x390 [ 282.185648][ T9005] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 282.191852][ T9005] __x64_sys_bpf+0x7c/0x90 [ 282.196303][ T9005] do_syscall_64+0x55/0xb0 [ 282.200753][ T9005] ? clear_bhb_loop+0x40/0x90 [ 282.205457][ T9005] ? clear_bhb_loop+0x40/0x90 [ 282.210158][ T9005] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 282.216095][ T9005] RIP: 0033:0x7f974f79ce59 [ 282.220533][ T9005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 282.240168][ T9005] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 282.248607][ T9005] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 282.256605][ T9005] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 282.264601][ T9005] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 282.272599][ T9005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 282.280593][ T9005] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 282.288608][ T9005] [ 282.589120][ T9012] netlink: 'syz.3.1148': attribute type 10 has an invalid length. [ 282.839633][ T9018] netlink: 207496 bytes leftover after parsing attributes in process `syz.2.1151'. [ 283.062444][ T9023] FAULT_INJECTION: forcing a failure. [ 283.062444][ T9023] name failslab, interval 1, probability 0, space 0, times 0 [ 283.081256][ T9023] CPU: 0 PID: 9023 Comm: syz.3.1154 Not tainted syzkaller #0 [ 283.088716][ T9023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 283.098836][ T9023] Call Trace: [ 283.102152][ T9023] [ 283.105133][ T9023] dump_stack_lvl+0x18c/0x250 [ 283.109883][ T9023] ? show_regs_print_info+0x20/0x20 [ 283.115137][ T9023] ? load_image+0x420/0x420 [ 283.119695][ T9023] ? __might_sleep+0xe0/0xe0 [ 283.124344][ T9023] ? __lock_acquire+0x7d80/0x7d80 [ 283.129429][ T9023] should_fail_ex+0x394/0x4c0 [ 283.134170][ T9023] should_failslab+0x9/0x20 [ 283.138789][ T9023] slab_pre_alloc_hook+0x59/0x300 [ 283.143887][ T9023] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 283.149670][ T9023] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 283.155528][ T9023] __kmem_cache_alloc_node+0x53/0x250 [ 283.161015][ T9023] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 283.166787][ T9023] __kmalloc+0xa7/0x240 [ 283.171015][ T9023] tomoyo_realpath_from_path+0xe6/0x5c0 [ 283.176626][ T9023] ? tomoyo_domain+0xd6/0x120 [ 283.181366][ T9023] tomoyo_path_number_perm+0x248/0x5e0 [ 283.186876][ T9023] ? tomoyo_path_number_perm+0x217/0x5e0 [ 283.192560][ T9023] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 283.198085][ T9023] ? ksys_write+0x1d2/0x260 [ 283.202687][ T9023] ? __fget_files+0x28/0x460 [ 283.207369][ T9023] security_file_ioctl+0x70/0xa0 [ 283.212357][ T9023] __se_sys_ioctl+0x48/0x170 [ 283.217003][ T9023] do_syscall_64+0x55/0xb0 [ 283.221471][ T9023] ? clear_bhb_loop+0x40/0x90 [ 283.226195][ T9023] ? clear_bhb_loop+0x40/0x90 [ 283.230935][ T9023] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 283.236888][ T9023] RIP: 0033:0x7fb98d59ce59 [ 283.241349][ T9023] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 283.261006][ T9023] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 283.269479][ T9023] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 283.277518][ T9023] RDX: 00002000000000c0 RSI: 000000000000541b RDI: 0000000000000003 [ 283.285555][ T9023] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 283.293601][ T9023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 283.301630][ T9023] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 283.309709][ T9023] [ 283.333098][ T9023] ERROR: Out of memory at tomoyo_realpath_from_path. [ 284.107022][ T9036] netlink: 'syz.2.1158': attribute type 10 has an invalid length. [ 284.912093][ T9052] netlink: 188 bytes leftover after parsing attributes in process `syz.0.1165'. [ 285.135508][ T9055] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1166'. [ 285.146380][ T9055] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 285.294227][ T9061] netlink: 9275 bytes leftover after parsing attributes in process `syz.2.1168'. [ 285.687909][ T9073] netlink: 'syz.2.1168': attribute type 26 has an invalid length. [ 285.737340][ T9073] netlink: 62827 bytes leftover after parsing attributes in process `syz.2.1168'. [ 286.860861][ T9091] netlink: 6 bytes leftover after parsing attributes in process `syz.2.1179'. [ 287.345244][ T9108] netlink: 9275 bytes leftover after parsing attributes in process `syz.1.1187'. [ 287.706157][ T9117] netlink: 'syz.1.1187': attribute type 26 has an invalid length. [ 287.714079][ T9117] netlink: 62827 bytes leftover after parsing attributes in process `syz.1.1187'. [ 287.825375][ T9120] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1190'. [ 288.502456][ T9130] FAULT_INJECTION: forcing a failure. [ 288.502456][ T9130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 288.531283][ T9130] CPU: 0 PID: 9130 Comm: syz.3.1195 Not tainted syzkaller #0 [ 288.538753][ T9130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 288.548904][ T9130] Call Trace: [ 288.552236][ T9130] [ 288.555215][ T9130] dump_stack_lvl+0x18c/0x250 [ 288.559962][ T9130] ? show_regs_print_info+0x20/0x20 [ 288.565213][ T9130] ? load_image+0x420/0x420 [ 288.569766][ T9130] ? __might_fault+0xaa/0x120 [ 288.574512][ T9130] ? __lock_acquire+0x7d80/0x7d80 [ 288.579591][ T9130] should_fail_ex+0x394/0x4c0 [ 288.584335][ T9130] _copy_from_user+0x2f/0xe0 [ 288.588982][ T9130] __sys_bpf+0x23e/0x890 [ 288.593278][ T9130] ? bpf_link_show_fdinfo+0x390/0x390 [ 288.598714][ T9130] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 288.604984][ T9130] __x64_sys_bpf+0x7c/0x90 [ 288.609457][ T9130] do_syscall_64+0x55/0xb0 [ 288.613932][ T9130] ? clear_bhb_loop+0x40/0x90 [ 288.618684][ T9130] ? clear_bhb_loop+0x40/0x90 [ 288.623416][ T9130] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 288.629363][ T9130] RIP: 0033:0x7fb98d59ce59 [ 288.633826][ T9130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 288.653499][ T9130] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 288.661968][ T9130] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 288.670026][ T9130] RDX: 0000000000000020 RSI: 00002000000003c0 RDI: 0000000000000002 [ 288.678043][ T9130] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 288.686089][ T9130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 288.694104][ T9130] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 288.702142][ T9130] [ 290.969106][ T9160] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1205'. [ 290.979888][ T9160] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 292.263288][ T9191] netlink: 188 bytes leftover after parsing attributes in process `syz.2.1218'. [ 292.356095][ T9194] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1217'. [ 292.372483][ T9194] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 293.812211][ T9220] FAULT_INJECTION: forcing a failure. [ 293.812211][ T9220] name failslab, interval 1, probability 0, space 0, times 0 [ 293.834422][ T9220] CPU: 0 PID: 9220 Comm: syz.3.1229 Not tainted syzkaller #0 [ 293.841887][ T9220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 293.851991][ T9220] Call Trace: [ 293.855323][ T9220] [ 293.858290][ T9220] dump_stack_lvl+0x18c/0x250 [ 293.863028][ T9220] ? show_regs_print_info+0x20/0x20 [ 293.868272][ T9220] ? load_image+0x420/0x420 [ 293.872824][ T9220] ? __lock_acquire+0x7d80/0x7d80 [ 293.877896][ T9220] ? tomoyo_write_log2+0x24f/0x910 [ 293.883067][ T9220] should_fail_ex+0x394/0x4c0 [ 293.887794][ T9220] should_failslab+0x9/0x20 [ 293.892331][ T9220] slab_pre_alloc_hook+0x59/0x300 [ 293.897397][ T9220] ? ip_options_get+0x50/0x560 [ 293.902189][ T9220] ? ip_options_get+0x50/0x560 [ 293.906984][ T9220] __kmem_cache_alloc_node+0x53/0x250 [ 293.912391][ T9220] ? ip_options_get+0x50/0x560 [ 293.917184][ T9220] __kmalloc+0xa7/0x240 [ 293.921401][ T9220] ip_options_get+0x50/0x560 [ 293.926054][ T9220] ? tomoyo_check_inet_address+0x27d/0x910 [ 293.931928][ T9220] ip_cmsg_send+0x591/0xa70 [ 293.936487][ T9220] raw_sendmsg+0x55d/0x1ba0 [ 293.941045][ T9220] ? __might_sleep+0xe0/0xe0 [ 293.945685][ T9220] ? compat_raw_ioctl+0x70/0x70 [ 293.950608][ T9220] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 293.957071][ T9220] ? sock_rps_record_flow+0x19/0x3f0 [ 293.962404][ T9220] ? inet_sendmsg+0x7e/0x2a0 [ 293.967030][ T9220] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 293.972361][ T9220] ? inet_send_prepare+0x250/0x250 [ 293.977522][ T9220] ____sys_sendmsg+0x61b/0x980 [ 293.982336][ T9220] ? __sys_sendmsg_sock+0x30/0x30 [ 293.987392][ T9220] ? __import_iovec+0x3fa/0x850 [ 293.992282][ T9220] ? import_iovec+0x73/0xa0 [ 293.996851][ T9220] ___sys_sendmsg+0x2a6/0x360 [ 294.001558][ T9220] ? get_pid_task+0x20/0x1e0 [ 294.006183][ T9220] ? __sys_sendmsg+0x2b0/0x2b0 [ 294.010987][ T9220] ? __lock_acquire+0x7d80/0x7d80 [ 294.016085][ T9220] __se_sys_sendmsg+0x1d0/0x2c0 [ 294.020983][ T9220] ? __x64_sys_sendmsg+0x80/0x80 [ 294.025966][ T9220] ? lockdep_hardirqs_on+0x98/0x150 [ 294.031205][ T9220] do_syscall_64+0x55/0xb0 [ 294.035651][ T9220] ? clear_bhb_loop+0x40/0x90 [ 294.040350][ T9220] ? clear_bhb_loop+0x40/0x90 [ 294.045062][ T9220] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 294.051141][ T9220] RIP: 0033:0x7fb98d59ce59 [ 294.055598][ T9220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 294.075253][ T9220] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 294.083715][ T9220] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 294.091719][ T9220] RDX: 00000000200040c4 RSI: 0000200000001640 RDI: 0000000000000003 [ 294.099724][ T9220] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 294.107761][ T9220] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 294.115760][ T9220] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 294.123774][ T9220] [ 297.489052][ T9241] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1231'. [ 297.499618][ T9241] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 297.674945][ T9248] -1: renamed from syzkaller0 [ 297.887663][ T9255] netlink: 'syz.0.1242': attribute type 10 has an invalid length. [ 297.896243][ T9255] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1242'. [ 297.908326][ T9255] vcan0: entered promiscuous mode [ 297.913755][ T9255] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check. [ 299.878866][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 300.411056][ T9333] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1275'. [ 301.429840][ T9364] FAULT_INJECTION: forcing a failure. [ 301.429840][ T9364] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 301.451109][ T9364] CPU: 0 PID: 9364 Comm: syz.1.1290 Not tainted syzkaller #0 [ 301.458554][ T9364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 301.468646][ T9364] Call Trace: [ 301.471969][ T9364] [ 301.474935][ T9364] dump_stack_lvl+0x18c/0x250 [ 301.479634][ T9364] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 301.485818][ T9364] ? show_regs_print_info+0x20/0x20 [ 301.491047][ T9364] ? load_image+0x420/0x420 [ 301.495616][ T9364] should_fail_ex+0x394/0x4c0 [ 301.500352][ T9364] _copy_from_user+0x2f/0xe0 [ 301.505002][ T9364] ___sys_recvmsg+0x174/0x590 [ 301.509710][ T9364] ? __sys_recvmsg+0x2a0/0x2a0 [ 301.514528][ T9364] ? ksys_write+0x1d2/0x260 [ 301.519070][ T9364] ? __fget_files+0x3fc/0x460 [ 301.523775][ T9364] __x64_sys_recvmsg+0x21e/0x2f0 [ 301.528821][ T9364] ? ___sys_recvmsg+0x590/0x590 [ 301.533711][ T9364] ? syscall_enter_from_user_mode+0x2e/0x80 [ 301.539633][ T9364] do_syscall_64+0x55/0xb0 [ 301.544071][ T9364] ? clear_bhb_loop+0x40/0x90 [ 301.548788][ T9364] ? clear_bhb_loop+0x40/0x90 [ 301.553501][ T9364] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 301.559433][ T9364] RIP: 0033:0x7f871c39ce59 [ 301.563882][ T9364] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 301.583524][ T9364] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 301.591962][ T9364] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 301.599974][ T9364] RDX: 00000000400120c3 RSI: 0000200000000700 RDI: 0000000000000007 [ 301.607986][ T9364] RBP: 00007f871d2e4090 R08: 0000000000000000 R09: 0000000000000000 [ 301.615981][ T9364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 301.623975][ T9364] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 301.632077][ T9364] [ 301.928264][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 302.443784][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 302.528634][ T9385] FAULT_INJECTION: forcing a failure. [ 302.528634][ T9385] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 302.544097][ T9385] CPU: 0 PID: 9385 Comm: syz.1.1297 Not tainted syzkaller #0 [ 302.551538][ T9385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 302.561649][ T9385] Call Trace: [ 302.564982][ T9385] [ 302.567956][ T9385] dump_stack_lvl+0x18c/0x250 [ 302.572689][ T9385] ? show_regs_print_info+0x20/0x20 [ 302.577951][ T9385] ? load_image+0x420/0x420 [ 302.582511][ T9385] ? __might_fault+0xaa/0x120 [ 302.587240][ T9385] ? __lock_acquire+0x7d80/0x7d80 [ 302.592313][ T9385] should_fail_ex+0x394/0x4c0 [ 302.597054][ T9385] _copy_from_user+0x2f/0xe0 [ 302.601695][ T9385] ___sys_sendmsg+0x1c7/0x360 [ 302.606433][ T9385] ? __sys_sendmsg+0x2b0/0x2b0 [ 302.611273][ T9385] ? ktime_get+0x7f/0x280 [ 302.615702][ T9385] __se_sys_sendmsg+0x1d0/0x2c0 [ 302.620603][ T9385] ? perf_trace_preemptirq_template+0x269/0x330 [ 302.626898][ T9385] ? __x64_sys_sendmsg+0x80/0x80 [ 302.631899][ T9385] ? lockdep_hardirqs_on+0x98/0x150 [ 302.637176][ T9385] do_syscall_64+0x55/0xb0 [ 302.641699][ T9385] ? clear_bhb_loop+0x40/0x90 [ 302.646428][ T9385] ? clear_bhb_loop+0x40/0x90 [ 302.651161][ T9385] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 302.657113][ T9385] RIP: 0033:0x7f871c39ce59 [ 302.661559][ T9385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 302.681201][ T9385] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 302.689641][ T9385] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 302.697644][ T9385] RDX: 0000000020004800 RSI: 0000200000000080 RDI: 000000000000000a [ 302.705643][ T9385] RBP: 00007f871d2e4090 R08: 0000000000000000 R09: 0000000000000000 [ 302.713642][ T9385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 302.721635][ T9385] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 302.729647][ T9385] [ 302.861595][ T9387] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1298'. [ 303.535089][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 304.275424][ T9415] IPv6: Can't replace route, no match found [ 304.615770][ T9427] FAULT_INJECTION: forcing a failure. [ 304.615770][ T9427] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 304.632042][ T9427] CPU: 0 PID: 9427 Comm: syz.2.1315 Not tainted syzkaller #0 [ 304.639496][ T9427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 304.649611][ T9427] Call Trace: [ 304.652938][ T9427] [ 304.655929][ T9427] dump_stack_lvl+0x18c/0x250 [ 304.660675][ T9427] ? show_regs_print_info+0x20/0x20 [ 304.665941][ T9427] ? load_image+0x420/0x420 [ 304.670519][ T9427] ? __might_fault+0xaa/0x120 [ 304.675257][ T9427] ? __lock_acquire+0x7d80/0x7d80 [ 304.680333][ T9427] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 304.686018][ T9427] should_fail_ex+0x394/0x4c0 [ 304.690803][ T9427] _copy_from_user+0x2f/0xe0 [ 304.695454][ T9427] wext_handle_ioctl+0xc8/0x1e0 [ 304.700364][ T9427] ? call_commit_handler+0xf0/0xf0 [ 304.705547][ T9427] sock_ioctl+0x15d/0x7e0 [ 304.709983][ T9427] ? sock_poll+0x3e0/0x3e0 [ 304.714457][ T9427] ? bpf_lsm_file_ioctl+0x9/0x10 [ 304.719439][ T9427] ? security_file_ioctl+0x80/0xa0 [ 304.724600][ T9427] ? sock_poll+0x3e0/0x3e0 [ 304.729074][ T9427] __se_sys_ioctl+0xfd/0x170 [ 304.733724][ T9427] do_syscall_64+0x55/0xb0 [ 304.738196][ T9427] ? clear_bhb_loop+0x40/0x90 [ 304.742917][ T9427] ? clear_bhb_loop+0x40/0x90 [ 304.747647][ T9427] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 304.753599][ T9427] RIP: 0033:0x7f974f79ce59 [ 304.758059][ T9427] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 304.777805][ T9427] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 304.786325][ T9427] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 304.794362][ T9427] RDX: 0000200000000000 RSI: 0000000000008b14 RDI: 0000000000000003 [ 304.802388][ T9427] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 304.810595][ T9427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 304.818628][ T9427] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 304.826674][ T9427] [ 305.133649][ T9432] netlink: 'syz.2.1317': attribute type 21 has an invalid length. [ 305.158998][ T9432] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1317'. [ 305.179090][ T9432] FAULT_INJECTION: forcing a failure. [ 305.179090][ T9432] name failslab, interval 1, probability 0, space 0, times 0 [ 305.205494][ T9432] CPU: 0 PID: 9432 Comm: syz.2.1317 Not tainted syzkaller #0 [ 305.213402][ T9432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 305.223550][ T9432] Call Trace: [ 305.226876][ T9432] [ 305.229847][ T9432] dump_stack_lvl+0x18c/0x250 [ 305.234771][ T9432] ? show_regs_print_info+0x20/0x20 [ 305.240015][ T9432] ? load_image+0x420/0x420 [ 305.244572][ T9432] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 305.250763][ T9432] should_fail_ex+0x394/0x4c0 [ 305.255469][ T9432] should_failslab+0x9/0x20 [ 305.260083][ T9432] slab_pre_alloc_hook+0x59/0x300 [ 305.265147][ T9432] ? mpls_build_state+0x1b5/0x560 [ 305.270237][ T9432] ? mpls_build_state+0x1b5/0x560 [ 305.275399][ T9432] __kmem_cache_alloc_node+0x53/0x250 [ 305.280797][ T9432] ? mpls_build_state+0x1b5/0x560 [ 305.285843][ T9432] __kmalloc+0xa7/0x240 [ 305.290045][ T9432] mpls_build_state+0x1b5/0x560 [ 305.294956][ T9432] ? mpls_platform_labels+0xcf0/0xcf0 [ 305.300394][ T9432] lwtunnel_build_state+0x37e/0x4b0 [ 305.305628][ T9432] ? lwtunnel_build_state+0xe2/0x4b0 [ 305.310981][ T9432] fib_nh_common_init+0x13c/0x410 [ 305.316055][ T9432] ? fib_dump_info+0x10b0/0x10b0 [ 305.321060][ T9432] ? skb_gro_incr_csum_unnecessary+0x300/0x300 [ 305.327269][ T9432] fib_nh_init+0x9e/0x410 [ 305.331636][ T9432] fib_create_info+0xf11/0x2390 [ 305.336534][ T9432] fib_table_insert+0xc6/0x1af0 [ 305.341427][ T9432] ? fib_trie_table+0x138/0x1c0 [ 305.346316][ T9432] ? fib_new_table+0x27f/0x2d0 [ 305.351121][ T9432] inet_rtm_newroute+0x14b/0x240 [ 305.356089][ T9432] ? rcu_read_unlock+0xa0/0xa0 [ 305.360902][ T9432] ? rcu_read_unlock+0xa0/0xa0 [ 305.365696][ T9432] rtnetlink_rcv_msg+0x843/0xf90 [ 305.370672][ T9432] ? rtnetlink_rcv_msg+0x220/0xf90 [ 305.375905][ T9432] ? rtnetlink_bind+0x80/0x80 [ 305.380625][ T9432] ? trace_call_bpf+0xc3/0x6c0 [ 305.385421][ T9432] ? trace_call_bpf+0xc3/0x6c0 [ 305.390216][ T9432] ? trace_call_bpf+0x5e9/0x6c0 [ 305.395102][ T9432] ? trace_call_bpf+0xc3/0x6c0 [ 305.399900][ T9432] ? mark_lock+0x94/0x320 [ 305.404271][ T9432] ? mark_lock+0x94/0x320 [ 305.408633][ T9432] ? __lock_acquire+0x1262/0x7d80 [ 305.413694][ T9432] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 305.419567][ T9432] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 305.426826][ T9432] ? lock_chain_count+0x20/0x20 [ 305.431707][ T9432] ? verify_lock_unused+0x140/0x140 [ 305.436945][ T9432] ? perf_trace_lock+0xfc/0x3b0 [ 305.441831][ T9432] netlink_rcv_skb+0x235/0x4c0 [ 305.446653][ T9432] ? rtnetlink_bind+0x80/0x80 [ 305.451366][ T9432] ? netlink_ack+0x1160/0x1160 [ 305.456169][ T9432] ? __lock_acquire+0x7d80/0x7d80 [ 305.461230][ T9432] ? net_generic+0x1e/0x240 [ 305.465769][ T9432] ? netlink_deliver_tap+0x2e/0x1b0 [ 305.471004][ T9432] netlink_unicast+0x7b1/0x930 [ 305.475812][ T9432] netlink_sendmsg+0x8d0/0xbf0 [ 305.480611][ T9432] ? lockdep_hardirqs_on+0x98/0x150 [ 305.485879][ T9432] ? netlink_getsockopt+0x590/0x590 [ 305.491114][ T9432] ? bpf_lsm_socket_accept+0x10/0x10 [ 305.496431][ T9432] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 305.501763][ T9432] ? security_socket_sendmsg+0x80/0xa0 [ 305.507259][ T9432] ? netlink_getsockopt+0x590/0x590 [ 305.512493][ T9432] ____sys_sendmsg+0x61b/0x980 [ 305.517297][ T9432] ? __asan_memset+0x22/0x40 [ 305.521918][ T9432] ? __sys_sendmsg_sock+0x30/0x30 [ 305.526971][ T9432] ? __import_iovec+0x5f2/0x850 [ 305.531861][ T9432] ? import_iovec+0x73/0xa0 [ 305.536398][ T9432] ___sys_sendmsg+0x2a6/0x360 [ 305.541109][ T9432] ? __sys_sendmsg+0x2b0/0x2b0 [ 305.545953][ T9432] __se_sys_sendmsg+0x1d0/0x2c0 [ 305.550841][ T9432] ? __x64_sys_sendmsg+0x80/0x80 [ 305.555820][ T9432] ? syscall_enter_from_user_mode+0x2e/0x80 [ 305.561750][ T9432] do_syscall_64+0x55/0xb0 [ 305.566220][ T9432] ? clear_bhb_loop+0x40/0x90 [ 305.570925][ T9432] ? clear_bhb_loop+0x40/0x90 [ 305.575629][ T9432] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 305.581560][ T9432] RIP: 0033:0x7f974f79ce59 [ 305.586008][ T9432] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.605656][ T9432] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 305.614100][ T9432] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 305.622102][ T9432] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000005 [ 305.630117][ T9432] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 305.638139][ T9432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 305.646159][ T9432] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 305.654187][ T9432] [ 306.393002][ T9443] syzkaller0: entered promiscuous mode [ 306.402503][ T9443] syzkaller0: entered allmulticast mode [ 308.800820][ T9448] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1322'. [ 309.351832][ T9475] netlink: 'syz.3.1332': attribute type 10 has an invalid length. [ 309.367214][ T9475] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1332'. [ 309.396952][ T9475] batman_adv: batadv0: Adding interface: veth0_vlan [ 309.410163][ T9475] batman_adv: batadv0: The MTU of interface veth0_vlan is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 309.442107][ T9475] batman_adv: batadv0: Interface activated: veth0_vlan [ 310.011184][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 310.116699][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 311.283637][ T9504] netlink: 'syz.3.1341': attribute type 27 has an invalid length. [ 311.881413][ T9513] netlink: 'syz.3.1345': attribute type 1 has an invalid length. [ 311.900632][ T9513] netlink: 'syz.3.1345': attribute type 3 has an invalid length. [ 311.920193][ T9513] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1345'. [ 312.126676][ T9521] netlink: 763 bytes leftover after parsing attributes in process `syz.0.1347'. [ 312.326685][ C1] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 313.982253][ T9554] FAULT_INJECTION: forcing a failure. [ 313.982253][ T9554] name failslab, interval 1, probability 0, space 0, times 0 [ 314.004004][ T9554] CPU: 0 PID: 9554 Comm: syz.1.1360 Not tainted syzkaller #0 [ 314.011465][ T9554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 314.021573][ T9554] Call Trace: [ 314.024906][ T9554] [ 314.027878][ T9554] dump_stack_lvl+0x18c/0x250 [ 314.032614][ T9554] ? sctp_sendmsg+0x1519/0x27b0 [ 314.037513][ T9554] ? ___sys_sendmsg+0x2a6/0x360 [ 314.042416][ T9554] ? show_regs_print_info+0x20/0x20 [ 314.047672][ T9554] ? load_image+0x420/0x420 [ 314.052243][ T9554] should_fail_ex+0x394/0x4c0 [ 314.056985][ T9554] should_failslab+0x9/0x20 [ 314.061556][ T9554] slab_pre_alloc_hook+0x59/0x300 [ 314.066646][ T9554] ? sctp_add_bind_addr+0x8c/0x360 [ 314.071813][ T9554] __kmem_cache_alloc_node+0x53/0x250 [ 314.077255][ T9554] ? sctp_add_bind_addr+0x8c/0x360 [ 314.082863][ T9554] kmalloc_trace+0x2a/0xe0 [ 314.087349][ T9554] sctp_add_bind_addr+0x8c/0x360 [ 314.092347][ T9554] sctp_copy_local_addr_list+0x31b/0x4e0 [ 314.098048][ T9554] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 314.103825][ T9554] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 314.109957][ T9554] ? sctp_v4_is_any+0x35/0x60 [ 314.114697][ T9554] ? sctp_copy_one_addr+0x8c/0x350 [ 314.119869][ T9554] sctp_bind_addr_copy+0xb3/0x3c0 [ 314.124951][ T9554] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 314.131351][ T9554] sctp_connect_new_asoc+0x2f9/0x6a0 [ 314.136698][ T9554] ? __sctp_connect+0xd80/0xd80 [ 314.141602][ T9554] ? __local_bh_enable_ip+0x13a/0x1c0 [ 314.147032][ T9554] ? _local_bh_enable+0xa0/0xa0 [ 314.151945][ T9554] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 314.157815][ T9554] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 314.163684][ T9554] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 314.169285][ T9554] ? security_sctp_bind_connect+0x89/0xb0 [ 314.175163][ T9554] sctp_sendmsg+0x1519/0x27b0 [ 314.179908][ T9554] ? sctp_getsockopt+0xb60/0xb60 [ 314.184928][ T9554] ? aa_sk_perm+0x83c/0x970 [ 314.189486][ T9554] ? aa_af_perm+0x330/0x330 [ 314.194017][ T9554] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 314.200491][ T9554] ? sock_rps_record_flow+0x19/0x3f0 [ 314.205855][ T9554] ? inet_sendmsg+0x7e/0x2a0 [ 314.210504][ T9554] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 314.215846][ T9554] ? inet_send_prepare+0x250/0x250 [ 314.221013][ T9554] ____sys_sendmsg+0x61b/0x980 [ 314.225827][ T9554] ? __asan_memset+0x22/0x40 [ 314.230455][ T9554] ? __sys_sendmsg_sock+0x30/0x30 [ 314.235518][ T9554] ? __import_iovec+0x5f2/0x850 [ 314.240419][ T9554] ? import_iovec+0x73/0xa0 [ 314.244974][ T9554] ___sys_sendmsg+0x2a6/0x360 [ 314.249707][ T9554] ? get_pid_task+0x20/0x1e0 [ 314.254352][ T9554] ? __sys_sendmsg+0x2b0/0x2b0 [ 314.259179][ T9554] ? __lock_acquire+0x7d80/0x7d80 [ 314.264281][ T9554] __se_sys_sendmsg+0x1d0/0x2c0 [ 314.269179][ T9554] ? perf_trace_preemptirq_template+0x269/0x330 [ 314.275473][ T9554] ? __x64_sys_sendmsg+0x80/0x80 [ 314.280463][ T9554] ? lockdep_hardirqs_on+0x98/0x150 [ 314.285742][ T9554] do_syscall_64+0x55/0xb0 [ 314.290195][ T9554] ? clear_bhb_loop+0x40/0x90 [ 314.294911][ T9554] ? clear_bhb_loop+0x40/0x90 [ 314.299634][ T9554] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 314.305575][ T9554] RIP: 0033:0x7f871c39ce59 [ 314.310020][ T9554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 314.329659][ T9554] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 314.338133][ T9554] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 314.346135][ T9554] RDX: 00000000000080d1 RSI: 00002000000000c0 RDI: 0000000000000005 [ 314.354143][ T9554] RBP: 00007f871d2e4090 R08: 0000000000000000 R09: 0000000000000000 [ 314.362143][ T9554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 314.370155][ T9554] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 314.378179][ T9554] [ 314.605693][ T9562] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1362'. [ 314.641522][ T9562] netlink: 'syz.0.1362': attribute type 10 has an invalid length. [ 314.649568][ T9562] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1362'. [ 314.660581][ T9562] batman_adv: batadv0: Adding interface: vlan1 [ 314.671997][ T9562] batman_adv: batadv0: Interface activated: vlan1 [ 314.716030][ T9562] netlink: 'syz.0.1362': attribute type 1 has an invalid length. [ 314.723843][ T9562] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.1362'. [ 314.909146][ T9570] FAULT_INJECTION: forcing a failure. [ 314.909146][ T9570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 314.954609][ T9570] CPU: 0 PID: 9570 Comm: syz.0.1365 Not tainted syzkaller #0 [ 314.962074][ T9570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 314.972176][ T9570] Call Trace: [ 314.975514][ T9570] [ 314.978486][ T9570] dump_stack_lvl+0x18c/0x250 [ 314.983226][ T9570] ? show_regs_print_info+0x20/0x20 [ 314.988481][ T9570] ? load_image+0x420/0x420 [ 314.993032][ T9570] ? __lock_acquire+0x7d80/0x7d80 [ 314.998114][ T9570] ? snprintf+0xe9/0x140 [ 315.002407][ T9570] should_fail_ex+0x394/0x4c0 [ 315.007241][ T9570] _copy_to_user+0x2f/0xa0 [ 315.011713][ T9570] simple_read_from_buffer+0xe7/0x150 [ 315.017344][ T9570] proc_fail_nth_read+0x1e8/0x260 [ 315.022435][ T9570] ? proc_fault_inject_write+0x360/0x360 [ 315.028130][ T9570] ? fsnotify_perm+0x271/0x5e0 [ 315.032939][ T9570] ? proc_fault_inject_write+0x360/0x360 [ 315.038631][ T9570] vfs_read+0x298/0x990 [ 315.042888][ T9570] ? kernel_read+0x1e0/0x1e0 [ 315.047545][ T9570] ? __fget_files+0x28/0x460 [ 315.052197][ T9570] ? __fget_files+0x3fc/0x460 [ 315.056937][ T9570] ? __fdget_pos+0x2a3/0x330 [ 315.061583][ T9570] ? ksys_read+0x74/0x260 [ 315.065980][ T9570] ksys_read+0x151/0x260 [ 315.070291][ T9570] ? vfs_write+0x9a0/0x9a0 [ 315.074778][ T9570] ? lockdep_hardirqs_on+0x98/0x150 [ 315.080048][ T9570] do_syscall_64+0x55/0xb0 [ 315.084627][ T9570] ? clear_bhb_loop+0x40/0x90 [ 315.089330][ T9570] ? clear_bhb_loop+0x40/0x90 [ 315.094041][ T9570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 315.099989][ T9570] RIP: 0033:0x7f4e5075d68e [ 315.104439][ T9570] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 315.124074][ T9570] RSP: 002b:00007f4e5173bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 315.132519][ T9570] RAX: ffffffffffffffda RBX: 00007f4e5173c6c0 RCX: 00007f4e5075d68e [ 315.140519][ T9570] RDX: 000000000000000f RSI: 00007f4e5173c0a0 RDI: 0000000000000003 [ 315.148529][ T9570] RBP: 00007f4e5173c090 R08: 0000000000000000 R09: 0000000000000000 [ 315.156523][ T9570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 315.164528][ T9570] R13: 00007f4e50a16038 R14: 00007f4e50a15fa0 R15: 00007ffc7573bfc8 [ 315.172554][ T9570] [ 316.093425][ T9580] Ù: renamed from bond_slave_1 (while UP) [ 316.197530][ T9589] FAULT_INJECTION: forcing a failure. [ 316.197530][ T9589] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 316.242645][ T9589] CPU: 0 PID: 9589 Comm: syz.0.1372 Not tainted syzkaller #0 [ 316.250122][ T9589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 316.260238][ T9589] Call Trace: [ 316.263561][ T9589] [ 316.266534][ T9589] dump_stack_lvl+0x18c/0x250 [ 316.271277][ T9589] ? show_regs_print_info+0x20/0x20 [ 316.276531][ T9589] ? load_image+0x420/0x420 [ 316.281095][ T9589] ? __might_fault+0xaa/0x120 [ 316.285820][ T9589] ? __lock_acquire+0x7d80/0x7d80 [ 316.290897][ T9589] should_fail_ex+0x394/0x4c0 [ 316.295635][ T9589] _copy_from_user+0x2f/0xe0 [ 316.300278][ T9589] __sys_bpf+0x23e/0x890 [ 316.304591][ T9589] ? bpf_link_show_fdinfo+0x390/0x390 [ 316.310039][ T9589] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 316.316278][ T9589] __x64_sys_bpf+0x7c/0x90 [ 316.320755][ T9589] do_syscall_64+0x55/0xb0 [ 316.325229][ T9589] ? clear_bhb_loop+0x40/0x90 [ 316.329949][ T9589] ? clear_bhb_loop+0x40/0x90 [ 316.334688][ T9589] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 316.340682][ T9589] RIP: 0033:0x7f4e5079ce59 [ 316.345158][ T9589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 316.364822][ T9589] RSP: 002b:00007f4e5173c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 316.373291][ T9589] RAX: ffffffffffffffda RBX: 00007f4e50a15fa0 RCX: 00007f4e5079ce59 [ 316.381399][ T9589] RDX: 0000000000000028 RSI: 0000200000000280 RDI: 0000000000000012 [ 316.389502][ T9589] RBP: 00007f4e5173c090 R08: 0000000000000000 R09: 0000000000000000 [ 316.397528][ T9589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.405547][ T9589] R13: 00007f4e50a16038 R14: 00007f4e50a15fa0 R15: 00007ffc7573bfc8 [ 316.413592][ T9589] [ 317.392525][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.399024][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.605445][ T9616] netlink: 'syz.3.1380': attribute type 10 has an invalid length. [ 317.613633][ T9616] netlink: 2 bytes leftover after parsing attributes in process `syz.3.1380'. [ 318.536667][ T9620] netlink: 763 bytes leftover after parsing attributes in process `syz.2.1381'. [ 318.556528][ T9622] netlink: 'syz.1.1382': attribute type 9 has an invalid length. [ 318.583286][ T9622] netlink: 19787 bytes leftover after parsing attributes in process `syz.1.1382'. [ 318.700221][ T9626] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1383'. [ 318.840784][ T9632] FAULT_INJECTION: forcing a failure. [ 318.840784][ T9632] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 318.867818][ T9632] CPU: 0 PID: 9632 Comm: syz.2.1385 Not tainted syzkaller #0 [ 318.875284][ T9632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 318.885480][ T9632] Call Trace: [ 318.888807][ T9632] [ 318.891801][ T9632] dump_stack_lvl+0x18c/0x250 [ 318.896542][ T9632] ? show_regs_print_info+0x20/0x20 [ 318.901798][ T9632] ? load_image+0x420/0x420 [ 318.906377][ T9632] ? __lock_acquire+0x7d80/0x7d80 [ 318.911477][ T9632] ? snprintf+0xe9/0x140 [ 318.915776][ T9632] should_fail_ex+0x394/0x4c0 [ 318.920498][ T9632] _copy_to_user+0x2f/0xa0 [ 318.924950][ T9632] simple_read_from_buffer+0xe7/0x150 [ 318.930361][ T9632] proc_fail_nth_read+0x1e8/0x260 [ 318.935524][ T9632] ? proc_fault_inject_write+0x360/0x360 [ 318.941193][ T9632] ? fsnotify_perm+0x271/0x5e0 [ 318.946000][ T9632] ? proc_fault_inject_write+0x360/0x360 [ 318.951698][ T9632] vfs_read+0x298/0x990 [ 318.955931][ T9632] ? kernel_read+0x1e0/0x1e0 [ 318.960583][ T9632] ? __fget_files+0x28/0x460 [ 318.965235][ T9632] ? __fget_files+0x3fc/0x460 [ 318.969956][ T9632] ? __fdget_pos+0x2a3/0x330 [ 318.974584][ T9632] ? ksys_read+0x74/0x260 [ 318.978953][ T9632] ksys_read+0x151/0x260 [ 318.983240][ T9632] ? vfs_write+0x9a0/0x9a0 [ 318.987715][ T9632] ? syscall_enter_from_user_mode+0x2e/0x80 [ 318.993660][ T9632] do_syscall_64+0x55/0xb0 [ 318.998125][ T9632] ? clear_bhb_loop+0x40/0x90 [ 319.002838][ T9632] ? clear_bhb_loop+0x40/0x90 [ 319.007575][ T9632] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 319.013537][ T9632] RIP: 0033:0x7f974f75d68e [ 319.018004][ T9632] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 319.037662][ T9632] RSP: 002b:00007f97506acfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 319.046113][ T9632] RAX: ffffffffffffffda RBX: 00007f97506ad6c0 RCX: 00007f974f75d68e [ 319.054151][ T9632] RDX: 000000000000000f RSI: 00007f97506ad0a0 RDI: 0000000000000007 [ 319.062167][ T9632] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 319.070174][ T9632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.078178][ T9632] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 319.086193][ T9632] [ 319.347911][ T9634] netlink: 'syz.1.1387': attribute type 10 has an invalid length. [ 319.636605][ T9643] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.1384'. [ 319.690647][ T9643] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.1384'. [ 319.727641][ T9636] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.1384'. [ 319.756225][ T9646] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.1384'. [ 319.777322][ T9636] netlink: 'syz.3.1384': attribute type 10 has an invalid length. [ 319.828571][ T9636] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1384'. [ 319.855639][ T9636] batman_adv: batadv0: Adding interface: veth1_virt_wifi [ 319.891112][ T9636] batman_adv: batadv0: The MTU of interface veth1_virt_wifi is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.980038][ T9636] batman_adv: batadv0: Interface activated: veth1_virt_wifi [ 320.854149][ T9664] FAULT_INJECTION: forcing a failure. [ 320.854149][ T9664] name failslab, interval 1, probability 0, space 0, times 0 [ 320.894490][ T9664] CPU: 1 PID: 9664 Comm: syz.1.1397 Not tainted syzkaller #0 [ 320.901969][ T9664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 320.912078][ T9664] Call Trace: [ 320.915393][ T9664] [ 320.918361][ T9664] dump_stack_lvl+0x18c/0x250 [ 320.923092][ T9664] ? show_regs_print_info+0x20/0x20 [ 320.928353][ T9664] ? load_image+0x420/0x420 [ 320.933001][ T9664] ? __might_sleep+0xe0/0xe0 [ 320.937653][ T9664] ? __lock_acquire+0x7d80/0x7d80 [ 320.942727][ T9664] should_fail_ex+0x394/0x4c0 [ 320.947488][ T9664] should_failslab+0x9/0x20 [ 320.952116][ T9664] slab_pre_alloc_hook+0x59/0x300 [ 320.957181][ T9664] ? lockdep_hardirqs_on+0x98/0x150 [ 320.962429][ T9664] kmem_cache_alloc_node+0x5e/0x310 [ 320.967664][ T9664] ? __alloc_skb+0x103/0x2c0 [ 320.972287][ T9664] __alloc_skb+0x103/0x2c0 [ 320.976741][ T9664] netlink_ack+0x377/0x1160 [ 320.981296][ T9664] ? netlink_dump+0xec0/0xec0 [ 320.986019][ T9664] ? ref_tracker_free+0x686/0x830 [ 320.991101][ T9664] netlink_rcv_skb+0x2b3/0x4c0 [ 320.995910][ T9664] ? rtnetlink_bind+0x80/0x80 [ 321.000628][ T9664] ? netlink_ack+0x1160/0x1160 [ 321.005465][ T9664] ? __lock_acquire+0x7d80/0x7d80 [ 321.010537][ T9664] ? netlink_deliver_tap+0x2e/0x1b0 [ 321.015778][ T9664] netlink_unicast+0x7b1/0x930 [ 321.020581][ T9664] netlink_sendmsg+0x8d0/0xbf0 [ 321.025394][ T9664] ? netlink_getsockopt+0x590/0x590 [ 321.030667][ T9664] ? aa_sock_msg_perm+0x94/0x150 [ 321.035649][ T9664] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 321.040969][ T9664] ? security_socket_sendmsg+0x80/0xa0 [ 321.046456][ T9664] ? netlink_getsockopt+0x590/0x590 [ 321.051713][ T9664] ____sys_sendmsg+0x61b/0x980 [ 321.056626][ T9664] ? __asan_memset+0x22/0x40 [ 321.061261][ T9664] ? __sys_sendmsg_sock+0x30/0x30 [ 321.066326][ T9664] ? __import_iovec+0x5f2/0x850 [ 321.071224][ T9664] ? import_iovec+0x73/0xa0 [ 321.075769][ T9664] ___sys_sendmsg+0x2a6/0x360 [ 321.080485][ T9664] ? get_pid_task+0x20/0x1e0 [ 321.085119][ T9664] ? __sys_sendmsg+0x2b0/0x2b0 [ 321.089928][ T9664] ? __lock_acquire+0x7d80/0x7d80 [ 321.095033][ T9664] __se_sys_sendmsg+0x1d0/0x2c0 [ 321.099919][ T9664] ? __x64_sys_sendmsg+0x80/0x80 [ 321.104905][ T9664] ? lockdep_hardirqs_on+0x98/0x150 [ 321.110154][ T9664] do_syscall_64+0x55/0xb0 [ 321.114614][ T9664] ? clear_bhb_loop+0x40/0x90 [ 321.119324][ T9664] ? clear_bhb_loop+0x40/0x90 [ 321.124031][ T9664] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 321.129961][ T9664] RIP: 0033:0x7f871c39ce59 [ 321.134403][ T9664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.154132][ T9664] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 321.162580][ T9664] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 321.170580][ T9664] RDX: 000000000004a046 RSI: 0000200000000040 RDI: 0000000000000003 [ 321.178576][ T9664] RBP: 00007f871d2e4090 R08: 0000000000000000 R09: 0000000000000000 [ 321.186569][ T9664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 321.194607][ T9664] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 321.202652][ T9664] [ 321.235730][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 321.532162][ T9671] netlink: 763 bytes leftover after parsing attributes in process `syz.3.1396'. [ 322.239566][ T9683] netlink: 'syz.1.1402': attribute type 16 has an invalid length. [ 322.265448][ T9683] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1402'. [ 322.493382][ T9682] netlink: 'syz.1.1402': attribute type 16 has an invalid length. [ 322.502519][ T9682] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1402'. [ 323.268141][ T9695] netlink: 'syz.3.1407': attribute type 10 has an invalid length. [ 323.293842][ T9696] delete_channel: no stack [ 323.306595][ T9696] delete_channel: no stack [ 323.682079][ T9708] FAULT_INJECTION: forcing a failure. [ 323.682079][ T9708] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 323.701910][ T9708] CPU: 0 PID: 9708 Comm: syz.3.1411 Not tainted syzkaller #0 [ 323.709395][ T9708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 323.719537][ T9708] Call Trace: [ 323.722901][ T9708] [ 323.725911][ T9708] dump_stack_lvl+0x18c/0x250 [ 323.730693][ T9708] ? show_regs_print_info+0x20/0x20 [ 323.735989][ T9708] ? load_image+0x420/0x420 [ 323.740590][ T9708] ? __lock_acquire+0x7d80/0x7d80 [ 323.745727][ T9708] should_fail_ex+0x394/0x4c0 [ 323.750515][ T9708] _copy_from_user+0x2f/0xe0 [ 323.755201][ T9708] __copy_msghdr+0x388/0x560 [ 323.759902][ T9708] ___sys_sendmsg+0x214/0x360 [ 323.764701][ T9708] ? __sys_sendmsg+0x2b0/0x2b0 [ 323.769623][ T9708] ? __lock_acquire+0x7d80/0x7d80 [ 323.774824][ T9708] __se_sys_sendmsg+0x1d0/0x2c0 [ 323.779776][ T9708] ? __x64_sys_sendmsg+0x80/0x80 [ 323.784862][ T9708] ? lockdep_hardirqs_on+0x98/0x150 [ 323.790161][ T9708] do_syscall_64+0x55/0xb0 [ 323.794663][ T9708] ? clear_bhb_loop+0x40/0x90 [ 323.799418][ T9708] ? clear_bhb_loop+0x40/0x90 [ 323.804182][ T9708] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 323.810161][ T9708] RIP: 0033:0x7fb98d59ce59 [ 323.814649][ T9708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.834351][ T9708] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 323.842860][ T9708] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 323.850915][ T9708] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 323.858997][ T9708] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 323.867045][ T9708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 323.875090][ T9708] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 323.883193][ T9708] [ 324.099848][ C1] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 324.421718][ T9718] netlink: 2418 bytes leftover after parsing attributes in process `syz.1.1414'. [ 325.438556][ T9734] netlink: 'syz.0.1420': attribute type 10 has an invalid length. [ 325.495562][ T9736] netlink: 'syz.2.1421': attribute type 10 has an invalid length. [ 325.842995][ T9747] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1425'. [ 326.639223][ T9766] FAULT_INJECTION: forcing a failure. [ 326.639223][ T9766] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 326.658958][ T9766] CPU: 0 PID: 9766 Comm: syz.1.1432 Not tainted syzkaller #0 [ 326.666404][ T9766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 326.676503][ T9766] Call Trace: [ 326.679826][ T9766] [ 326.682801][ T9766] dump_stack_lvl+0x18c/0x250 [ 326.687550][ T9766] ? show_regs_print_info+0x20/0x20 [ 326.692807][ T9766] ? load_image+0x420/0x420 [ 326.697358][ T9766] ? __might_fault+0xaa/0x120 [ 326.702165][ T9766] ? __lock_acquire+0x7d80/0x7d80 [ 326.707243][ T9766] should_fail_ex+0x394/0x4c0 [ 326.711984][ T9766] _copy_to_user+0x2f/0xa0 [ 326.716456][ T9766] bpf_test_finish+0x19f/0x650 [ 326.721276][ T9766] ? bpf_test_run+0x174/0x870 [ 326.726011][ T9766] ? convert_skb_to___skb+0x420/0x420 [ 326.731450][ T9766] ? slab_build_skb+0x25a/0x3e0 [ 326.736357][ T9766] bpf_prog_test_run_skb+0x1135/0x18f0 [ 326.741896][ T9766] ? cpu_online+0x60/0x60 [ 326.746288][ T9766] bpf_prog_test_run+0x31f/0x390 [ 326.751291][ T9766] __sys_bpf+0x49d/0x890 [ 326.755594][ T9766] ? bpf_link_show_fdinfo+0x390/0x390 [ 326.761123][ T9766] ? lock_chain_count+0x20/0x20 [ 326.766076][ T9766] __x64_sys_bpf+0x7c/0x90 [ 326.770544][ T9766] do_syscall_64+0x55/0xb0 [ 326.775010][ T9766] ? clear_bhb_loop+0x40/0x90 [ 326.779732][ T9766] ? clear_bhb_loop+0x40/0x90 [ 326.784477][ T9766] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 326.790436][ T9766] RIP: 0033:0x7f871c39ce59 [ 326.794917][ T9766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 326.814579][ T9766] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 326.823042][ T9766] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 326.831071][ T9766] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 326.839106][ T9766] RBP: 00007f871d2e4090 R08: 0000000000000000 R09: 0000000000000000 [ 326.847135][ T9766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 326.855159][ T9766] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 326.863197][ T9766] [ 327.397893][ T9781] netlink: 830 bytes leftover after parsing attributes in process `syz.1.1438'. [ 327.454799][ T9781] netlink: 'syz.1.1438': attribute type 10 has an invalid length. [ 329.676558][ T9781] bridge0: port 2(bridge_slave_1) entered disabled state [ 329.684955][ T9781] bridge0: port 1(bridge_slave_0) entered disabled state [ 329.781141][ T9781] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.788472][ T9781] bridge0: port 2(bridge_slave_1) entered forwarding state [ 329.796111][ T9781] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.803391][ T9781] bridge0: port 1(bridge_slave_0) entered forwarding state [ 329.877317][ T9781] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 329.892411][ T9791] netlink: 'syz.2.1442': attribute type 10 has an invalid length. [ 329.916369][ T9791] macvlan0: entered promiscuous mode [ 329.924801][ T9791] macvlan0: entered allmulticast mode [ 329.958338][ T9791] veth1_vlan: entered allmulticast mode [ 329.997946][ T9791] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 330.322288][ C0] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 331.222296][ T9807] netlink: 'syz.3.1448': attribute type 29 has an invalid length. [ 331.244740][ T9807] netlink: 'syz.3.1448': attribute type 3 has an invalid length. [ 331.257599][ T9807] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1448'. [ 331.331489][ T9813] netlink: 'syz.2.1451': attribute type 10 has an invalid length. [ 331.363210][ T9813] bridge0: port 3(hsr0) entered disabled state [ 331.369820][ T9813] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.377829][ T9813] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.485856][ T9813] bond0: (slave bridge0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 331.521849][ T9813] bridge0: port 3(hsr0) entered blocking state [ 331.528366][ T9813] bridge0: port 3(hsr0) entered forwarding state [ 331.535247][ T9813] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.542548][ T9813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.550243][ T9813] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.557622][ T9813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.572337][ T9813] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 331.857720][ T9830] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.1455'. [ 331.911789][ T9833] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 331.955067][ T9830] netlink: 'syz.2.1455': attribute type 10 has an invalid length. [ 331.970701][ T9830] veth1_vlan: left allmulticast mode [ 333.092597][ T9856] netlink: 'syz.3.1464': attribute type 10 has an invalid length. [ 333.122447][ T9856] bridge0: port 4(gretap0) entered disabled state [ 333.129221][ T9856] bridge0: port 3(hsr0) entered disabled state [ 333.135675][ T9856] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.143417][ T9856] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.173075][ T9856] bond0: (slave bridge0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 333.208114][ T9856] bridge0: port 4(gretap0) entered blocking state [ 333.214923][ T9856] bridge0: port 4(gretap0) entered forwarding state [ 333.221941][ T9856] bridge0: port 3(hsr0) entered blocking state [ 333.228340][ T9856] bridge0: port 3(hsr0) entered forwarding state [ 333.235060][ T9856] bridge0: port 2(bridge_slave_1) entered blocking state [ 333.242318][ T9856] bridge0: port 2(bridge_slave_1) entered forwarding state [ 333.249902][ T9856] bridge0: port 1(bridge_slave_0) entered blocking state [ 333.257193][ T9856] bridge0: port 1(bridge_slave_0) entered forwarding state [ 333.277253][ T9856] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 333.317673][ T9861] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1467'. [ 333.359525][ T9861] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1467'. [ 333.555042][ T9872] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.1470'. [ 333.708518][ T9872] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 333.730270][ T9872] netlink: 'syz.1.1470': attribute type 10 has an invalid length. [ 333.788931][ T9872] macvlan0: entered promiscuous mode [ 333.804574][ T9872] macvlan0: entered allmulticast mode [ 333.857595][ T9872] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 335.106737][ T9898] FAULT_INJECTION: forcing a failure. [ 335.106737][ T9898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 335.174413][ T9898] CPU: 0 PID: 9898 Comm: syz.3.1479 Not tainted syzkaller #0 [ 335.181886][ T9898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 335.192031][ T9898] Call Trace: [ 335.195359][ T9898] [ 335.198330][ T9898] dump_stack_lvl+0x18c/0x250 [ 335.203069][ T9898] ? show_regs_print_info+0x20/0x20 [ 335.208344][ T9898] ? load_image+0x420/0x420 [ 335.212925][ T9898] ? __might_fault+0xaa/0x120 [ 335.217669][ T9898] ? __lock_acquire+0x7d80/0x7d80 [ 335.222746][ T9898] should_fail_ex+0x394/0x4c0 [ 335.227495][ T9898] _copy_to_user+0x2f/0xa0 [ 335.231965][ T9898] bpf_test_finish+0x19f/0x650 [ 335.236789][ T9898] ? bpf_test_run+0x174/0x870 [ 335.241526][ T9898] ? convert_skb_to___skb+0x420/0x420 [ 335.246964][ T9898] ? slab_build_skb+0x25a/0x3e0 [ 335.251874][ T9898] bpf_prog_test_run_skb+0x1135/0x18f0 [ 335.257394][ T9898] ? cpu_online+0x60/0x60 [ 335.261782][ T9898] bpf_prog_test_run+0x31f/0x390 [ 335.266756][ T9898] __sys_bpf+0x49d/0x890 [ 335.271024][ T9898] ? bpf_link_show_fdinfo+0x390/0x390 [ 335.276444][ T9898] ? lock_chain_count+0x20/0x20 [ 335.281357][ T9898] __x64_sys_bpf+0x7c/0x90 [ 335.285806][ T9898] do_syscall_64+0x55/0xb0 [ 335.290263][ T9898] ? clear_bhb_loop+0x40/0x90 [ 335.294961][ T9898] ? clear_bhb_loop+0x40/0x90 [ 335.299670][ T9898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 335.305600][ T9898] RIP: 0033:0x7fb98d59ce59 [ 335.310051][ T9898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.329686][ T9898] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 335.338134][ T9898] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 335.346135][ T9898] RDX: 0000000000000048 RSI: 00002000000002c0 RDI: 000000000000000a [ 335.354130][ T9898] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 335.362126][ T9898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 335.370117][ T9898] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 335.378123][ T9898] [ 335.718338][ T9905] netlink: 'syz.0.1482': attribute type 10 has an invalid length. [ 335.738172][ T9905] bridge0: port 3(gretap0) entered disabled state [ 335.745026][ T9905] bridge0: port 2(bridge_slave_1) entered disabled state [ 335.752587][ T9905] bridge0: port 1(bridge_slave_0) entered disabled state [ 335.860037][ T9905] bridge0: port 3(gretap0) entered blocking state [ 335.866746][ T9905] bridge0: port 3(gretap0) entered forwarding state [ 335.873721][ T9905] bridge0: port 2(bridge_slave_1) entered blocking state [ 335.881029][ T9905] bridge0: port 2(bridge_slave_1) entered forwarding state [ 335.888614][ T9905] bridge0: port 1(bridge_slave_0) entered blocking state [ 335.895881][ T9905] bridge0: port 1(bridge_slave_0) entered forwarding state [ 336.067344][ T9905] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 337.494013][ T9916] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.1486'. [ 337.529177][ T9916] netlink: 'syz.0.1486': attribute type 4 has an invalid length. [ 337.563644][ T9916] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1486'. [ 337.728215][ C1] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:17, vlan:0) [ 337.836925][ T9925] syz.3.1490 (9925) used greatest stack depth: 17192 bytes left [ 337.964546][ T9929] netlink: 'syz.3.1491': attribute type 10 has an invalid length. [ 338.521957][ C1] bridge0: received packet on gretap0 with own address as source address (addr:aa:aa:aa:aa:aa:17, vlan:0) [ 339.545928][ T9936] team0: Port device team_slave_0 removed [ 340.242405][ T9967] FAULT_INJECTION: forcing a failure. [ 340.242405][ T9967] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 340.273614][ T9967] CPU: 1 PID: 9967 Comm: syz.3.1504 Not tainted syzkaller #0 [ 340.281071][ T9967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 340.291189][ T9967] Call Trace: [ 340.294519][ T9967] [ 340.297493][ T9967] dump_stack_lvl+0x18c/0x250 [ 340.302235][ T9967] ? show_regs_print_info+0x20/0x20 [ 340.307496][ T9967] ? load_image+0x420/0x420 [ 340.312053][ T9967] ? __might_fault+0xaa/0x120 [ 340.316787][ T9967] ? __lock_acquire+0x7d80/0x7d80 [ 340.321869][ T9967] should_fail_ex+0x394/0x4c0 [ 340.326617][ T9967] _copy_from_user+0x2f/0xe0 [ 340.331264][ T9967] ___sys_sendmsg+0x1c7/0x360 [ 340.336050][ T9967] ? __sys_sendmsg+0x2b0/0x2b0 [ 340.340919][ T9967] __se_sys_sendmsg+0x1d0/0x2c0 [ 340.345837][ T9967] ? perf_trace_preemptirq_template+0x269/0x330 [ 340.352139][ T9967] ? __x64_sys_sendmsg+0x80/0x80 [ 340.357154][ T9967] ? lockdep_hardirqs_on+0x98/0x150 [ 340.362420][ T9967] do_syscall_64+0x55/0xb0 [ 340.366889][ T9967] ? clear_bhb_loop+0x40/0x90 [ 340.371609][ T9967] ? clear_bhb_loop+0x40/0x90 [ 340.376334][ T9967] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 340.382268][ T9967] RIP: 0033:0x7fb98d59ce59 [ 340.386716][ T9967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 340.406348][ T9967] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 340.414806][ T9967] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 340.422806][ T9967] RDX: 0000000004000000 RSI: 0000200000000140 RDI: 0000000000000009 [ 340.430808][ T9967] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 340.438807][ T9967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 340.446821][ T9967] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 340.454831][ T9967] [ 340.526692][ T9965] netlink: 'syz.1.1503': attribute type 9 has an invalid length. [ 340.544672][ T9965] netlink: 144300 bytes leftover after parsing attributes in process `syz.1.1503'. [ 340.731302][ T9974] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.1506'. [ 340.755218][ T9974] netlink: 'syz.3.1506': attribute type 4 has an invalid length. [ 340.768387][ T9974] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1506'. [ 341.020448][ T9978] team0: Port device team_slave_0 removed [ 341.570361][ T9991] netlink: 'syz.1.1512': attribute type 1 has an invalid length. [ 341.584603][ T9991] netlink: 'syz.1.1512': attribute type 3 has an invalid length. [ 341.595933][ T9991] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1512'. [ 342.228967][T10005] FAULT_INJECTION: forcing a failure. [ 342.228967][T10005] name failslab, interval 1, probability 0, space 0, times 0 [ 342.267347][T10005] CPU: 1 PID: 10005 Comm: syz.0.1517 Not tainted syzkaller #0 [ 342.274911][T10005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 342.285032][T10005] Call Trace: [ 342.288370][T10005] [ 342.291351][T10005] dump_stack_lvl+0x18c/0x250 [ 342.296114][T10005] ? show_regs_print_info+0x20/0x20 [ 342.301467][T10005] ? load_image+0x420/0x420 [ 342.306047][T10005] ? __might_sleep+0xe0/0xe0 [ 342.310721][T10005] ? __lock_acquire+0x7d80/0x7d80 [ 342.315822][T10005] should_fail_ex+0x394/0x4c0 [ 342.320585][T10005] should_failslab+0x9/0x20 [ 342.325167][T10005] slab_pre_alloc_hook+0x59/0x300 [ 342.330266][T10005] ? aa_path_link+0xf80/0xf80 [ 342.335018][T10005] kmem_cache_alloc_node+0x5e/0x310 [ 342.340292][T10005] ? __alloc_skb+0x103/0x2c0 [ 342.344961][T10005] __alloc_skb+0x103/0x2c0 [ 342.349463][T10005] vhci_write+0xc2/0x460 [ 342.353798][T10005] vfs_write+0x474/0x9a0 [ 342.358133][T10005] ? file_end_write+0x250/0x250 [ 342.363067][T10005] ? __fget_files+0x3fc/0x460 [ 342.367823][T10005] ? __fdget_pos+0x1d8/0x330 [ 342.372459][T10005] ? ksys_write+0x74/0x260 [ 342.376929][T10005] ksys_write+0x151/0x260 [ 342.381326][T10005] ? __ia32_sys_read+0x90/0x90 [ 342.386239][T10005] ? lockdep_hardirqs_on+0x98/0x150 [ 342.391485][T10005] do_syscall_64+0x55/0xb0 [ 342.395939][T10005] ? clear_bhb_loop+0x40/0x90 [ 342.400665][T10005] ? clear_bhb_loop+0x40/0x90 [ 342.405382][T10005] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 342.411318][T10005] RIP: 0033:0x7f4e5079ce59 [ 342.415774][T10005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 342.435509][T10005] RSP: 002b:00007f4e5173c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 342.443991][T10005] RAX: ffffffffffffffda RBX: 00007f4e50a15fa0 RCX: 00007f4e5079ce59 [ 342.452005][T10005] RDX: 0000000000000012 RSI: 0000200000000140 RDI: 00000000000000ca [ 342.460021][T10005] RBP: 00007f4e5173c090 R08: 0000000000000000 R09: 0000000000000000 [ 342.468026][T10005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.476027][T10005] R13: 00007f4e50a16038 R14: 00007f4e50a15fa0 R15: 00007ffc7573bfc8 [ 342.484065][T10005] [ 343.071224][T10022] netlink: 63503 bytes leftover after parsing attributes in process `syz.2.1519'. [ 343.145976][T10017] netlink: 'syz.2.1519': attribute type 4 has an invalid length. [ 343.154157][T10017] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1519'. [ 343.638916][T10036] team0: Port device team_slave_0 removed [ 345.123460][ C1] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 345.272777][T10062] syz.3.1533 (10062) used greatest stack depth: 16488 bytes left [ 345.629368][T10069] netlink: 'syz.1.1542': attribute type 10 has an invalid length. [ 346.012670][T10077] netlink: 63503 bytes leftover after parsing attributes in process `syz.1.1538'. [ 346.067366][T10077] netlink: 'syz.1.1538': attribute type 4 has an invalid length. [ 346.091564][T10077] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1538'. [ 346.179799][T10082] netlink: 'syz.2.1540': attribute type 1 has an invalid length. [ 346.194495][T10082] netlink: 'syz.2.1540': attribute type 3 has an invalid length. [ 346.226336][T10082] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1540'. [ 346.902737][T10102] netlink: 'syz.3.1547': attribute type 10 has an invalid length. [ 346.967490][T10100] netlink: 'syz.1.1546': attribute type 10 has an invalid length. [ 347.017212][T10100] team0: Device vxcan1 is of different type [ 347.387508][T10110] FAULT_INJECTION: forcing a failure. [ 347.387508][T10110] name failslab, interval 1, probability 0, space 0, times 0 [ 347.466933][T10110] CPU: 0 PID: 10110 Comm: syz.2.1550 Not tainted syzkaller #0 [ 347.474485][T10110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 347.484589][T10110] Call Trace: [ 347.487914][T10110] [ 347.490889][T10110] dump_stack_lvl+0x18c/0x250 [ 347.495646][T10110] ? show_regs_print_info+0x20/0x20 [ 347.500893][T10110] ? load_image+0x420/0x420 [ 347.505466][T10110] ? __might_sleep+0xe0/0xe0 [ 347.510109][T10110] ? __lock_acquire+0x7d80/0x7d80 [ 347.515199][T10110] should_fail_ex+0x394/0x4c0 [ 347.519953][T10110] should_failslab+0x9/0x20 [ 347.524511][T10110] slab_pre_alloc_hook+0x59/0x300 [ 347.529600][T10110] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 347.535369][T10110] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 347.541140][T10110] __kmem_cache_alloc_node+0x53/0x250 [ 347.546598][T10110] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 347.552378][T10110] __kmalloc+0xa7/0x240 [ 347.556686][T10110] tomoyo_realpath_from_path+0xe6/0x5c0 [ 347.562284][T10110] ? tomoyo_domain+0xd6/0x120 [ 347.567030][T10110] tomoyo_path_number_perm+0x248/0x5e0 [ 347.572564][T10110] ? tomoyo_path_number_perm+0x217/0x5e0 [ 347.578255][T10110] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 347.583759][T10110] ? ksys_write+0x1d2/0x260 [ 347.588321][T10110] ? __fget_files+0x28/0x460 [ 347.592955][T10110] security_file_ioctl+0x70/0xa0 [ 347.597939][T10110] __se_sys_ioctl+0x48/0x170 [ 347.602562][T10110] do_syscall_64+0x55/0xb0 [ 347.607041][T10110] ? clear_bhb_loop+0x40/0x90 [ 347.611754][T10110] ? clear_bhb_loop+0x40/0x90 [ 347.616462][T10110] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 347.622384][T10110] RIP: 0033:0x7f974f79ce59 [ 347.626830][T10110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.646469][T10110] RSP: 002b:00007f975068c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 347.654910][T10110] RAX: ffffffffffffffda RBX: 00007f974fa16090 RCX: 00007f974f79ce59 [ 347.662905][T10110] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 0000000000000008 [ 347.670912][T10110] RBP: 00007f975068c090 R08: 0000000000000000 R09: 0000000000000000 [ 347.678917][T10110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 347.687002][T10110] R13: 00007f974fa16128 R14: 00007f974fa16090 R15: 00007ffdc5df7de8 [ 347.695010][T10110] [ 347.713302][T10107] netlink: 'syz.2.1550': attribute type 1 has an invalid length. [ 347.721991][T10110] ERROR: Out of memory at tomoyo_realpath_from_path. [ 347.733608][T10107] netlink: 'syz.2.1550': attribute type 3 has an invalid length. [ 347.747893][T10107] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1550'. [ 347.800999][T10119] netlink: 'syz.1.1551': attribute type 1 has an invalid length. [ 347.865642][T10119] netlink: 'syz.1.1551': attribute type 3 has an invalid length. [ 347.873448][T10119] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1551'. [ 348.207731][T10129] FAULT_INJECTION: forcing a failure. [ 348.207731][T10129] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 348.283929][T10129] CPU: 0 PID: 10129 Comm: syz.1.1555 Not tainted syzkaller #0 [ 348.291487][T10129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 348.301604][T10129] Call Trace: [ 348.304925][T10129] [ 348.307896][T10129] dump_stack_lvl+0x18c/0x250 [ 348.312633][T10129] ? show_regs_print_info+0x20/0x20 [ 348.317899][T10129] ? load_image+0x420/0x420 [ 348.322460][T10129] ? __might_fault+0xaa/0x120 [ 348.327190][T10129] ? __lock_acquire+0x7d80/0x7d80 [ 348.332284][T10129] should_fail_ex+0x394/0x4c0 [ 348.337025][T10129] _copy_from_user+0x2f/0xe0 [ 348.341739][T10129] ___sys_recvmsg+0x174/0x590 [ 348.346478][T10129] ? __sys_recvmsg+0x2a0/0x2a0 [ 348.351305][T10129] ? ksys_write+0x1d2/0x260 [ 348.355874][T10129] ? __fget_files+0x3fc/0x460 [ 348.360627][T10129] __x64_sys_recvmsg+0x21e/0x2f0 [ 348.365626][T10129] ? ___sys_recvmsg+0x590/0x590 [ 348.370596][T10129] ? lockdep_hardirqs_on+0x98/0x150 [ 348.375863][T10129] do_syscall_64+0x55/0xb0 [ 348.380333][T10129] ? clear_bhb_loop+0x40/0x90 [ 348.385060][T10129] ? clear_bhb_loop+0x40/0x90 [ 348.389792][T10129] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 348.395743][T10129] RIP: 0033:0x7f871c39ce59 [ 348.400388][T10129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.420052][T10129] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 348.428538][T10129] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 348.436563][T10129] RDX: 0000000040000004 RSI: 0000200000000ac0 RDI: 0000000000000003 [ 348.444589][T10129] RBP: 00007f871d2e4090 R08: 0000000000000000 R09: 0000000000000000 [ 348.452619][T10129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 348.460647][T10129] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 348.468692][T10129] [ 348.682273][T10136] netlink: 'syz.0.1557': attribute type 10 has an invalid length. [ 350.935248][T10172] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.1566'. [ 351.072393][T10174] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 351.080210][T10174] IPv6: NLM_F_CREATE should be set when creating new route [ 351.088321][T10174] IPv6: NLM_F_CREATE should be set when creating new route [ 351.096102][T10174] IPv6: NLM_F_CREATE should be set when creating new route [ 351.121272][T10174] validate_nla: 1 callbacks suppressed [ 351.121326][T10174] netlink: 'syz.2.1567': attribute type 9 has an invalid length. [ 351.164508][T10174] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.1567'. [ 351.559928][T10176] netlink: 'syz.2.1567': attribute type 10 has an invalid length. [ 351.929858][T10176] bond0: (slave veth1_to_bridge): Enslaving as an active interface with an up link [ 351.939791][T10179] netlink: 'syz.2.1567': attribute type 8 has an invalid length. [ 352.003721][T10175] netlink: 'syz.2.1567': attribute type 9 has an invalid length. [ 352.024124][T10175] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.1567'. [ 352.239843][T10192] netlink: 'syz.2.1572': attribute type 10 has an invalid length. [ 352.268978][T10192] team0: Device vxcan1 is of different type [ 352.595072][T10198] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 352.602802][T10198] IPv6: NLM_F_CREATE should be set when creating new route [ 352.611439][T10198] IPv6: NLM_F_CREATE should be set when creating new route [ 352.619177][T10198] IPv6: NLM_F_CREATE should be set when creating new route [ 352.687495][T10198] netlink: 'syz.3.1582': attribute type 9 has an invalid length. [ 352.696681][T10198] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.1582'. [ 353.116811][T10209] batman_adv: The newly added mac address (6e:3a:20:30:0a:62) already exists on: batadv_slave_0 [ 353.148719][T10205] netlink: 'syz.3.1582': attribute type 9 has an invalid length. [ 353.178317][T10209] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 353.189572][T10205] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.1582'. [ 353.211483][T10202] netlink: 'syz.3.1582': attribute type 10 has an invalid length. [ 353.387874][T10218] FAULT_INJECTION: forcing a failure. [ 353.387874][T10218] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.405772][T10218] CPU: 0 PID: 10218 Comm: syz.1.1581 Not tainted syzkaller #0 [ 353.413290][T10218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 353.423384][T10218] Call Trace: [ 353.426701][T10218] [ 353.429673][T10218] dump_stack_lvl+0x18c/0x250 [ 353.434405][T10218] ? show_regs_print_info+0x20/0x20 [ 353.439653][T10218] ? load_image+0x420/0x420 [ 353.444200][T10218] ? __might_fault+0xaa/0x120 [ 353.448929][T10218] ? __lock_acquire+0x7d80/0x7d80 [ 353.454004][T10218] should_fail_ex+0x394/0x4c0 [ 353.458744][T10218] _copy_from_user+0x2f/0xe0 [ 353.463385][T10218] sk_setsockopt+0x2b9/0x2b20 [ 353.468137][T10218] ? sockopt_capable+0x60/0x60 [ 353.472969][T10218] ? aa_sk_perm+0x83c/0x970 [ 353.477517][T10218] ? __fget_files+0x28/0x460 [ 353.482167][T10218] ? aa_af_perm+0x330/0x330 [ 353.486722][T10218] ? __fget_files+0x28/0x460 [ 353.491366][T10218] ? aa_sock_opt_perm+0x74/0x100 [ 353.496375][T10218] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 353.501978][T10218] ? security_socket_setsockopt+0x7e/0xa0 [ 353.507746][T10218] do_sock_setsockopt+0x11b/0x1a0 [ 353.512825][T10218] __x64_sys_setsockopt+0x182/0x200 [ 353.518083][T10218] do_syscall_64+0x55/0xb0 [ 353.522552][T10218] ? clear_bhb_loop+0x40/0x90 [ 353.527273][T10218] ? clear_bhb_loop+0x40/0x90 [ 353.531993][T10218] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 353.538043][T10218] RIP: 0033:0x7f871c39ce59 [ 353.542506][T10218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.562158][T10218] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 353.570638][T10218] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 353.578656][T10218] RDX: 000000000000000e RSI: 0000000000000001 RDI: 0000000000000003 [ 353.586669][T10218] RBP: 00007f871d2e4090 R08: 000000000000003b R09: 0000000000000000 [ 353.594677][T10218] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 353.602692][T10218] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 353.610727][T10218] [ 354.080970][T10202] bond0: (slave veth1_to_bridge): Enslaving as an active interface with an up link [ 354.110295][T10210] netlink: 'syz.3.1582': attribute type 8 has an invalid length. [ 356.029401][T10259] syz.0.1591[10259] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 356.029666][T10259] syz.0.1591[10259] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 356.344057][T10271] netlink: 'syz.1.1596': attribute type 10 has an invalid length. [ 356.524454][ C1] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 357.483445][T10285] FAULT_INJECTION: forcing a failure. [ 357.483445][T10285] name failslab, interval 1, probability 0, space 0, times 0 [ 357.534892][T10285] CPU: 0 PID: 10285 Comm: syz.2.1601 Not tainted syzkaller #0 [ 357.542455][T10285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 357.552562][T10285] Call Trace: [ 357.555893][T10285] [ 357.558863][T10285] dump_stack_lvl+0x18c/0x250 [ 357.563604][T10285] ? show_regs_print_info+0x20/0x20 [ 357.568851][T10285] ? load_image+0x420/0x420 [ 357.573414][T10285] ? __might_sleep+0xe0/0xe0 [ 357.578058][T10285] ? __lock_acquire+0x7d80/0x7d80 [ 357.583135][T10285] should_fail_ex+0x394/0x4c0 [ 357.587879][T10285] should_failslab+0x9/0x20 [ 357.592440][T10285] slab_pre_alloc_hook+0x59/0x300 [ 357.597523][T10285] ? kvmalloc_node+0x70/0x180 [ 357.602253][T10285] ? kvmalloc_node+0x70/0x180 [ 357.607001][T10285] __kmem_cache_alloc_node+0x53/0x250 [ 357.612428][T10285] ? kvmalloc_node+0x70/0x180 [ 357.617167][T10285] __kmalloc_node+0xa6/0x240 [ 357.621815][T10285] kvmalloc_node+0x70/0x180 [ 357.626374][T10285] page_pool_create+0x1eb/0x5c0 [ 357.631283][T10285] bpf_test_run_xdp_live+0x203/0x1b30 [ 357.636805][T10285] ? 0xffffffffa0004740 [ 357.641030][T10285] ? 0xffffffffa0004740 [ 357.645232][T10285] ? bpf_dispatcher_change_prog+0xc94/0xf10 [ 357.651194][T10285] ? xdp_convert_md_to_buff+0x330/0x330 [ 357.656877][T10285] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 357.663198][T10285] ? _copy_from_user+0xa5/0xe0 [ 357.668020][T10285] ? bpf_test_init+0x119/0x140 [ 357.672834][T10285] ? xdp_convert_md_to_buff+0x5b/0x330 [ 357.678365][T10285] bpf_prog_test_run_xdp+0x7d8/0x1140 [ 357.683798][T10285] ? __lock_acquire+0x7d80/0x7d80 [ 357.688891][T10285] ? dev_put+0x80/0x80 [ 357.693037][T10285] ? dev_put+0x80/0x80 [ 357.697175][T10285] bpf_prog_test_run+0x31f/0x390 [ 357.702165][T10285] __sys_bpf+0x49d/0x890 [ 357.706462][T10285] ? bpf_link_show_fdinfo+0x390/0x390 [ 357.711902][T10285] ? lock_chain_count+0x20/0x20 [ 357.716827][T10285] __x64_sys_bpf+0x7c/0x90 [ 357.721291][T10285] do_syscall_64+0x55/0xb0 [ 357.725757][T10285] ? clear_bhb_loop+0x40/0x90 [ 357.730479][T10285] ? clear_bhb_loop+0x40/0x90 [ 357.735207][T10285] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 357.741158][T10285] RIP: 0033:0x7f974f79ce59 [ 357.745620][T10285] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 357.765277][T10285] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 357.773751][T10285] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 357.781772][T10285] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 357.789789][T10285] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 357.797802][T10285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 357.805818][T10285] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 357.813881][T10285] [ 357.831032][T10285] page_pool_create() gave up with errno -12 [ 358.060379][T10294] netlink: 'syz.0.1603': attribute type 19 has an invalid length. [ 358.664672][ C0] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 359.953702][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.067756][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.085708][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.116122][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.152075][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.199103][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.240022][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.409381][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.462339][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 360.494939][T10342] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1618'. [ 362.098004][T10390] FAULT_INJECTION: forcing a failure. [ 362.098004][T10390] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 362.131085][T10390] CPU: 1 PID: 10390 Comm: syz.0.1631 Not tainted syzkaller #0 [ 362.138643][T10390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 362.148741][T10390] Call Trace: [ 362.152148][T10390] [ 362.155125][T10390] dump_stack_lvl+0x18c/0x250 [ 362.159975][T10390] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 362.166192][T10390] ? show_regs_print_info+0x20/0x20 [ 362.171483][T10390] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 362.177703][T10390] should_fail_ex+0x394/0x4c0 [ 362.182430][T10390] _copy_from_user+0x2f/0xe0 [ 362.187072][T10390] generic_map_update_batch+0x58c/0x800 [ 362.192660][T10390] ? rcu_read_unlock+0xa0/0xa0 [ 362.197466][T10390] ? __fdget+0x180/0x210 [ 362.201741][T10390] ? rcu_read_unlock+0xa0/0xa0 [ 362.206533][T10390] bpf_map_do_batch+0x3f2/0x600 [ 362.211411][T10390] ? bpf_lsm_audit_rule_free+0x10/0x10 [ 362.216906][T10390] __sys_bpf+0x381/0x890 [ 362.221176][T10390] ? bpf_link_show_fdinfo+0x390/0x390 [ 362.226593][T10390] ? lock_chain_count+0x20/0x20 [ 362.231570][T10390] __x64_sys_bpf+0x7c/0x90 [ 362.236016][T10390] do_syscall_64+0x55/0xb0 [ 362.240467][T10390] ? clear_bhb_loop+0x40/0x90 [ 362.245173][T10390] ? clear_bhb_loop+0x40/0x90 [ 362.249871][T10390] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 362.255797][T10390] RIP: 0033:0x7f4e5079ce59 [ 362.260245][T10390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 362.279968][T10390] RSP: 002b:00007f4e5173c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 362.288498][T10390] RAX: ffffffffffffffda RBX: 00007f4e50a15fa0 RCX: 00007f4e5079ce59 [ 362.296493][T10390] RDX: 0000000000000038 RSI: 0000200000000380 RDI: 000000000000001a [ 362.304491][T10390] RBP: 00007f4e5173c090 R08: 0000000000000000 R09: 0000000000000000 [ 362.312487][T10390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 362.320485][T10390] R13: 00007f4e50a16038 R14: 00007f4e50a15fa0 R15: 00007ffc7573bfc8 [ 362.328587][T10390] [ 364.173076][ C0] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 365.912639][T10458] FAULT_INJECTION: forcing a failure. [ 365.912639][T10458] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.931473][T10458] CPU: 1 PID: 10458 Comm: syz.0.1654 Not tainted syzkaller #0 [ 365.939008][T10458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 365.949120][T10458] Call Trace: [ 365.952455][T10458] [ 365.955436][T10458] dump_stack_lvl+0x18c/0x250 [ 365.960183][T10458] ? show_regs_print_info+0x20/0x20 [ 365.965429][T10458] ? load_image+0x420/0x420 [ 365.969969][T10458] ? __lock_acquire+0x7d80/0x7d80 [ 365.975025][T10458] ? snprintf+0xe9/0x140 [ 365.979297][T10458] should_fail_ex+0x394/0x4c0 [ 365.984012][T10458] _copy_to_user+0x2f/0xa0 [ 365.988471][T10458] simple_read_from_buffer+0xe7/0x150 [ 365.993885][T10458] proc_fail_nth_read+0x1e8/0x260 [ 365.999030][T10458] ? proc_fault_inject_write+0x360/0x360 [ 366.004716][T10458] ? fsnotify_perm+0x271/0x5e0 [ 366.009509][T10458] ? proc_fault_inject_write+0x360/0x360 [ 366.015178][T10458] vfs_read+0x298/0x990 [ 366.019376][T10458] ? kernel_read+0x1e0/0x1e0 [ 366.023997][T10458] ? __fget_files+0x28/0x460 [ 366.028627][T10458] ? __fget_files+0x3fc/0x460 [ 366.033361][T10458] ? __fdget_pos+0x2a3/0x330 [ 366.037989][T10458] ? ksys_read+0x74/0x260 [ 366.042354][T10458] ksys_read+0x151/0x260 [ 366.046634][T10458] ? vfs_write+0x9a0/0x9a0 [ 366.051092][T10458] ? lockdep_hardirqs_on+0x98/0x150 [ 366.056325][T10458] do_syscall_64+0x55/0xb0 [ 366.060771][T10458] ? clear_bhb_loop+0x40/0x90 [ 366.065488][T10458] ? clear_bhb_loop+0x40/0x90 [ 366.070194][T10458] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 366.076123][T10458] RIP: 0033:0x7f4e5075d68e [ 366.080561][T10458] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 366.100192][T10458] RSP: 002b:00007f4e5173bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 366.108673][T10458] RAX: ffffffffffffffda RBX: 00007f4e5173c6c0 RCX: 00007f4e5075d68e [ 366.116691][T10458] RDX: 000000000000000f RSI: 00007f4e5173c0a0 RDI: 0000000000000005 [ 366.124690][T10458] RBP: 00007f4e5173c090 R08: 0000000000000000 R09: 0000000000000000 [ 366.132689][T10458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 366.140696][T10458] R13: 00007f4e50a16038 R14: 00007f4e50a15fa0 R15: 00007ffc7573bfc8 [ 366.148707][T10458] [ 367.589854][T10480] FAULT_INJECTION: forcing a failure. [ 367.589854][T10480] name failslab, interval 1, probability 0, space 0, times 0 [ 367.626653][T10480] CPU: 1 PID: 10480 Comm: syz.0.1659 Not tainted syzkaller #0 [ 367.634200][T10480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 367.644308][T10480] Call Trace: [ 367.647622][T10480] [ 367.650579][T10480] dump_stack_lvl+0x18c/0x250 [ 367.655288][T10480] ? show_regs_print_info+0x20/0x20 [ 367.660517][T10480] ? load_image+0x420/0x420 [ 367.665053][T10480] ? __might_sleep+0xe0/0xe0 [ 367.669678][T10480] ? __lock_acquire+0x7d80/0x7d80 [ 367.674738][T10480] should_fail_ex+0x394/0x4c0 [ 367.679456][T10480] should_failslab+0x9/0x20 [ 367.683990][T10480] slab_pre_alloc_hook+0x59/0x300 [ 367.689046][T10480] ? kvmalloc_node+0x70/0x180 [ 367.693752][T10480] ? kvmalloc_node+0x70/0x180 [ 367.698465][T10480] __kmem_cache_alloc_node+0x53/0x250 [ 367.703872][T10480] ? dev_addr_init+0x17c/0x240 [ 367.708726][T10480] ? kvmalloc_node+0x70/0x180 [ 367.713447][T10480] __kmalloc_node+0xa6/0x240 [ 367.718099][T10480] kvmalloc_node+0x70/0x180 [ 367.722643][T10480] alloc_netdev_mqs+0x8ba/0x1040 [ 367.727632][T10480] ? mr_dump+0x6e0/0x6e0 [ 367.731943][T10480] __ip_tunnel_create+0x303/0x4d0 [ 367.737020][T10480] ? ip_tunnel_init_net+0x7b0/0x7b0 [ 367.742256][T10480] ? bpf_lsm_capable+0x9/0x10 [ 367.746976][T10480] ? security_capable+0x89/0xb0 [ 367.751867][T10480] ip_tunnel_ctl+0xc36/0x1900 [ 367.756586][T10480] ip_tunnel_siocdevprivate+0x138/0x1f0 [ 367.762158][T10480] ? dev_ioctl+0x83c/0x1140 [ 367.766695][T10480] ? ip_tunnel_update+0xae0/0xae0 [ 367.771754][T10480] ? dev_ifsioc+0x957/0xc40 [ 367.776299][T10480] dev_ioctl+0x84c/0x1140 [ 367.780662][T10480] sock_ioctl+0x74c/0x7e0 [ 367.785029][T10480] ? sock_poll+0x3e0/0x3e0 [ 367.789488][T10480] ? bpf_lsm_file_ioctl+0x9/0x10 [ 367.794449][T10480] ? security_file_ioctl+0x80/0xa0 [ 367.799592][T10480] ? sock_poll+0x3e0/0x3e0 [ 367.804038][T10480] __se_sys_ioctl+0xfd/0x170 [ 367.808661][T10480] do_syscall_64+0x55/0xb0 [ 367.813111][T10480] ? clear_bhb_loop+0x40/0x90 [ 367.817903][T10480] ? clear_bhb_loop+0x40/0x90 [ 367.822628][T10480] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 367.828568][T10480] RIP: 0033:0x7f4e5079ce59 [ 367.833017][T10480] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.852653][T10480] RSP: 002b:00007f4e5171b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 367.861133][T10480] RAX: ffffffffffffffda RBX: 00007f4e50a16090 RCX: 00007f4e5079ce59 [ 367.869128][T10480] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 0000000000000006 [ 367.877128][T10480] RBP: 00007f4e5171b090 R08: 0000000000000000 R09: 0000000000000000 [ 367.885131][T10480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 367.893126][T10480] R13: 00007f4e50a16128 R14: 00007f4e50a16090 R15: 00007ffc7573bfc8 [ 367.901138][T10480] [ 368.268592][T10495] batadv0: entered promiscuous mode [ 369.978040][T10551] FAULT_INJECTION: forcing a failure. [ 369.978040][T10551] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 370.008348][T10551] CPU: 1 PID: 10551 Comm: syz.3.1683 Not tainted syzkaller #0 [ 370.015887][T10551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 370.025988][T10551] Call Trace: [ 370.029308][T10551] [ 370.032273][T10551] dump_stack_lvl+0x18c/0x250 [ 370.037008][T10551] ? show_regs_print_info+0x20/0x20 [ 370.042274][T10551] ? load_image+0x420/0x420 [ 370.046829][T10551] ? __might_fault+0xaa/0x120 [ 370.051552][T10551] ? __lock_acquire+0x7d80/0x7d80 [ 370.056637][T10551] should_fail_ex+0x394/0x4c0 [ 370.061381][T10551] _copy_from_user+0x2f/0xe0 [ 370.066024][T10551] ___sys_sendmsg+0x1c7/0x360 [ 370.070756][T10551] ? get_pid_task+0x20/0x1e0 [ 370.075424][T10551] ? __sys_sendmsg+0x2b0/0x2b0 [ 370.080274][T10551] ? __lock_acquire+0x7d80/0x7d80 [ 370.085375][T10551] __se_sys_sendmsg+0x1d0/0x2c0 [ 370.090281][T10551] ? __x64_sys_sendmsg+0x80/0x80 [ 370.095289][T10551] ? lockdep_hardirqs_on+0x98/0x150 [ 370.100551][T10551] do_syscall_64+0x55/0xb0 [ 370.105016][T10551] ? clear_bhb_loop+0x40/0x90 [ 370.109745][T10551] ? clear_bhb_loop+0x40/0x90 [ 370.114476][T10551] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 370.120421][T10551] RIP: 0033:0x7fb98d59ce59 [ 370.124887][T10551] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.144538][T10551] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 370.153004][T10551] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 370.161022][T10551] RDX: 00000000000400c0 RSI: 0000200000001a40 RDI: 0000000000000003 [ 370.169039][T10551] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 370.177054][T10551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 370.185076][T10551] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 370.193113][T10551] [ 370.877935][T10569] netlink: 'syz.2.1691': attribute type 21 has an invalid length. [ 371.023301][T10573] FAULT_INJECTION: forcing a failure. [ 371.023301][T10573] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 371.039102][T10573] CPU: 1 PID: 10573 Comm: syz.2.1692 Not tainted syzkaller #0 [ 371.046615][T10573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 371.056710][T10573] Call Trace: [ 371.060029][T10573] [ 371.062989][T10573] dump_stack_lvl+0x18c/0x250 [ 371.067716][T10573] ? show_regs_print_info+0x20/0x20 [ 371.072944][T10573] ? load_image+0x420/0x420 [ 371.077486][T10573] ? __might_fault+0xaa/0x120 [ 371.082196][T10573] ? __lock_acquire+0x7d80/0x7d80 [ 371.087249][T10573] should_fail_ex+0x394/0x4c0 [ 371.091960][T10573] _copy_from_user+0x2f/0xe0 [ 371.096584][T10573] ___sys_sendmsg+0x1c7/0x360 [ 371.101301][T10573] ? __sys_sendmsg+0x2b0/0x2b0 [ 371.106106][T10573] ? ktime_get+0x7f/0x280 [ 371.110467][T10573] ? trace_call_bpf+0xc3/0x6c0 [ 371.115290][T10573] __se_sys_sendmsg+0x1d0/0x2c0 [ 371.120171][T10573] ? perf_trace_preemptirq_template+0x269/0x330 [ 371.126457][T10573] ? __x64_sys_sendmsg+0x80/0x80 [ 371.131447][T10573] ? lockdep_hardirqs_on+0x98/0x150 [ 371.136693][T10573] do_syscall_64+0x55/0xb0 [ 371.141154][T10573] ? clear_bhb_loop+0x40/0x90 [ 371.145889][T10573] ? clear_bhb_loop+0x40/0x90 [ 371.150596][T10573] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 371.156524][T10573] RIP: 0033:0x7f974f79ce59 [ 371.160992][T10573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 371.180629][T10573] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 371.189169][T10573] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 371.197194][T10573] RDX: 000000000000f7e5 RSI: 0000200000000080 RDI: 0000000000000007 [ 371.205277][T10573] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 371.213276][T10573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 371.221266][T10573] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 371.229278][T10573] [ 371.500745][T10576] netlink: 'syz.2.1693': attribute type 29 has an invalid length. [ 371.513402][T10576] netlink: 'syz.2.1693': attribute type 29 has an invalid length. [ 371.525030][T10576] netlink: 'syz.2.1693': attribute type 29 has an invalid length. [ 372.229216][T10600] __nla_validate_parse: 20 callbacks suppressed [ 372.229241][T10600] netlink: 830 bytes leftover after parsing attributes in process `syz.1.1702'. [ 372.395678][ C0] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 373.152714][T10621] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1708'. [ 373.731298][T10630] C: renamed from team_slave_0 (while UP) [ 373.757697][T10630] netlink: 'syz.3.1712': attribute type 3 has an invalid length. [ 373.780438][ T5782] Bluetooth: hci0: unknown advertising packet type: 0x20 [ 373.780488][ T5782] Bluetooth: hci0: Malformed LE Event: 0x02 [ 373.820973][T10630] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1712'. [ 373.831911][T10630] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 373.973584][T10635] netlink: 'syz.0.1714': attribute type 21 has an invalid length. [ 374.387573][ C1] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 375.127057][T10650] batadv0: entered promiscuous mode [ 375.741484][T10670] netlink: 'syz.1.1725': attribute type 21 has an invalid length. [ 376.033787][ C0] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 376.526445][T10680] FAULT_INJECTION: forcing a failure. [ 376.526445][T10680] name failslab, interval 1, probability 0, space 0, times 0 [ 376.542732][T10680] CPU: 0 PID: 10680 Comm: syz.2.1728 Not tainted syzkaller #0 [ 376.550265][T10680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 376.560366][T10680] Call Trace: [ 376.563681][T10680] [ 376.566643][T10680] dump_stack_lvl+0x18c/0x250 [ 376.571385][T10680] ? show_regs_print_info+0x20/0x20 [ 376.576628][T10680] ? load_image+0x420/0x420 [ 376.581177][T10680] ? __might_sleep+0xe0/0xe0 [ 376.585900][T10680] ? __lock_acquire+0x7d80/0x7d80 [ 376.590968][T10680] should_fail_ex+0x394/0x4c0 [ 376.595704][T10680] should_failslab+0x9/0x20 [ 376.600254][T10680] slab_pre_alloc_hook+0x59/0x300 [ 376.605322][T10680] ? kvmalloc_node+0x70/0x180 [ 376.610044][T10680] ? kvmalloc_node+0x70/0x180 [ 376.614760][T10680] __kmem_cache_alloc_node+0x53/0x250 [ 376.620177][T10680] ? kvmalloc_node+0x70/0x180 [ 376.624898][T10680] __kmalloc_node+0xa6/0x240 [ 376.629538][T10680] kvmalloc_node+0x70/0x180 [ 376.634086][T10680] page_pool_create+0x1eb/0x5c0 [ 376.638992][T10680] bpf_test_run_xdp_live+0x203/0x1b30 [ 376.644417][T10680] ? bpf_dispatcher_xdp+0x800/0x1000 [ 376.649740][T10680] ? bpf_dispatcher_xdp+0x800/0x1000 [ 376.655061][T10680] ? bpf_dispatcher_change_prog+0xc94/0xf10 [ 376.661012][T10680] ? xdp_convert_md_to_buff+0x330/0x330 [ 376.666641][T10680] ? trace_raw_output_bpf_test_finish+0xd0/0xd0 [ 376.673020][T10680] ? _copy_from_user+0xa5/0xe0 [ 376.677835][T10680] ? bpf_test_init+0x119/0x140 [ 376.682644][T10680] ? xdp_convert_md_to_buff+0x5b/0x330 [ 376.688151][T10680] bpf_prog_test_run_xdp+0x7d8/0x1140 [ 376.693566][T10680] ? __lock_acquire+0x7d80/0x7d80 [ 376.698653][T10680] ? dev_put+0x80/0x80 [ 376.702775][T10680] ? dev_put+0x80/0x80 [ 376.706899][T10680] bpf_prog_test_run+0x31f/0x390 [ 376.711885][T10680] __sys_bpf+0x49d/0x890 [ 376.716176][T10680] ? bpf_link_show_fdinfo+0x390/0x390 [ 376.721608][T10680] ? lock_chain_count+0x20/0x20 [ 376.726512][T10680] __x64_sys_bpf+0x7c/0x90 [ 376.730966][T10680] do_syscall_64+0x55/0xb0 [ 376.735425][T10680] ? clear_bhb_loop+0x40/0x90 [ 376.740132][T10680] ? clear_bhb_loop+0x40/0x90 [ 376.744861][T10680] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 376.750805][T10680] RIP: 0033:0x7f974f79ce59 [ 376.755266][T10680] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.774922][T10680] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 376.783375][T10680] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 376.791386][T10680] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 376.799394][T10680] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 376.807394][T10680] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 376.815399][T10680] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 376.823423][T10680] [ 376.855374][T10680] page_pool_create() gave up with errno -12 [ 377.117290][T10696] FAULT_INJECTION: forcing a failure. [ 377.117290][T10696] name failslab, interval 1, probability 0, space 0, times 0 [ 377.130349][T10696] CPU: 0 PID: 10696 Comm: syz.1.1734 Not tainted syzkaller #0 [ 377.137854][T10696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 377.148040][T10696] Call Trace: [ 377.151372][T10696] [ 377.154357][T10696] dump_stack_lvl+0x18c/0x250 [ 377.159117][T10696] ? show_regs_print_info+0x20/0x20 [ 377.164405][T10696] ? load_image+0x420/0x420 [ 377.169054][T10696] ? skb_network_protocol+0x529/0x790 [ 377.174486][T10696] should_fail_ex+0x394/0x4c0 [ 377.179227][T10696] should_failslab+0x9/0x20 [ 377.183837][T10696] slab_pre_alloc_hook+0x59/0x300 [ 377.189043][T10696] kmem_cache_alloc+0x5a/0x2c0 [ 377.193854][T10696] ? skb_clone+0x1eb/0x370 [ 377.198328][T10696] skb_clone+0x1eb/0x370 [ 377.202596][T10696] ? dev_queue_xmit_nit+0x204/0xba0 [ 377.207920][T10696] dev_queue_xmit_nit+0x23f/0xba0 [ 377.212976][T10696] ? dev_queue_xmit_nit+0x2d/0xba0 [ 377.218133][T10696] dev_hard_start_xmit+0x150/0x790 [ 377.223284][T10696] ? __dev_queue_xmit+0x275/0x3630 [ 377.228434][T10696] __dev_queue_xmit+0x198c/0x3630 [ 377.233508][T10696] ? __dev_queue_xmit+0x275/0x3630 [ 377.238685][T10696] ? netdev_core_pick_tx+0x370/0x370 [ 377.244003][T10696] ? ref_tracker_alloc+0x347/0x4b0 [ 377.249136][T10696] ? __copy_skb_header+0xa3/0x4a0 [ 377.254191][T10696] ? __asan_memcpy+0x40/0x70 [ 377.258841][T10696] ? __skb_clone+0x5c/0x6c0 [ 377.263376][T10696] ? __skb_clone+0x446/0x6c0 [ 377.268096][T10696] ? skb_clone+0x21f/0x370 [ 377.272543][T10696] __netlink_deliver_tap+0x579/0x7f0 [ 377.278397][T10696] ? netlink_deliver_tap+0x2e/0x1b0 [ 377.283622][T10696] netlink_deliver_tap+0x19c/0x1b0 [ 377.288756][T10696] netlink_unicast+0x77b/0x930 [ 377.293551][T10696] netlink_sendmsg+0x8d0/0xbf0 [ 377.298345][T10696] ? netlink_getsockopt+0x590/0x590 [ 377.303585][T10696] ? aa_sock_msg_perm+0x94/0x150 [ 377.308556][T10696] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 377.313873][T10696] ? security_socket_sendmsg+0x80/0xa0 [ 377.319356][T10696] ? netlink_getsockopt+0x590/0x590 [ 377.324586][T10696] ____sys_sendmsg+0x61b/0x980 [ 377.329384][T10696] ? __asan_memset+0x22/0x40 [ 377.334007][T10696] ? __sys_sendmsg_sock+0x30/0x30 [ 377.339055][T10696] ? __import_iovec+0x5f2/0x850 [ 377.343935][T10696] ? import_iovec+0x73/0xa0 [ 377.348466][T10696] ___sys_sendmsg+0x2a6/0x360 [ 377.353164][T10696] ? get_pid_task+0x20/0x1e0 [ 377.357788][T10696] ? __sys_sendmsg+0x2b0/0x2b0 [ 377.362623][T10696] ? __lock_acquire+0x7d80/0x7d80 [ 377.367692][T10696] __se_sys_sendmsg+0x1d0/0x2c0 [ 377.372570][T10696] ? __x64_sys_sendmsg+0x80/0x80 [ 377.377564][T10696] ? lockdep_hardirqs_on+0x98/0x150 [ 377.382797][T10696] do_syscall_64+0x55/0xb0 [ 377.387273][T10696] ? clear_bhb_loop+0x40/0x90 [ 377.392062][T10696] ? clear_bhb_loop+0x40/0x90 [ 377.396766][T10696] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 377.402697][T10696] RIP: 0033:0x7f871c39ce59 [ 377.407134][T10696] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.426762][T10696] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 377.435211][T10696] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 377.443208][T10696] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 377.451215][T10696] RBP: 00007f871d2e4090 R08: 0000000000000000 R09: 0000000000000000 [ 377.459206][T10696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 377.467193][T10696] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 377.475201][T10696] [ 377.633927][ C1] bridge0: received packet on gretap0 with own address as source address (addr:02:00:00:00:00:00, vlan:0) [ 378.762501][T10728] FAULT_INJECTION: forcing a failure. [ 378.762501][T10728] name failslab, interval 1, probability 0, space 0, times 0 [ 378.828344][T10728] CPU: 1 PID: 10728 Comm: syz.3.1742 Not tainted syzkaller #0 [ 378.835894][T10728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 378.845993][T10728] Call Trace: [ 378.849310][T10728] [ 378.852287][T10728] dump_stack_lvl+0x18c/0x250 [ 378.854895][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.857004][T10728] ? show_regs_print_info+0x20/0x20 [ 378.863910][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.868470][T10728] ? load_image+0x420/0x420 [ 378.868503][T10728] ? __might_sleep+0xe0/0xe0 [ 378.868531][T10728] ? __lock_acquire+0x7d80/0x7d80 [ 378.889000][T10728] should_fail_ex+0x394/0x4c0 [ 378.893741][T10728] should_failslab+0x9/0x20 [ 378.898300][T10728] slab_pre_alloc_hook+0x59/0x300 [ 378.903389][T10728] ? rtnl_newlink+0x10d/0x2170 [ 378.908220][T10728] __kmem_cache_alloc_node+0x53/0x250 [ 378.913646][T10728] ? rtnl_newlink+0x10d/0x2170 [ 378.918464][T10728] kmalloc_trace+0x2a/0xe0 [ 378.922938][T10728] rtnl_newlink+0x10d/0x2170 [ 378.927627][T10728] ? __mutex_lock+0x919/0xc80 [ 378.932389][T10728] ? __lock_acquire+0x7d80/0x7d80 [ 378.937461][T10728] ? do_raw_spin_lock+0x11f/0x2b0 [ 378.942538][T10728] ? rtnl_setlink+0x4e0/0x4e0 [ 378.947281][T10728] ? __rwlock_init+0x150/0x150 [ 378.952109][T10728] ? do_raw_spin_unlock+0x121/0x230 [ 378.957366][T10728] ? __mutex_lock+0x923/0xc80 [ 378.962112][T10728] ? __mutex_lock+0x4d2/0xc80 [ 378.966891][T10728] ? rtnetlink_rcv_msg+0x7ed/0xf90 [ 378.972055][T10728] ? mutex_lock_nested+0x20/0x20 [ 378.977068][T10728] ? rtnl_setlink+0x4e0/0x4e0 [ 378.981820][T10728] rtnetlink_rcv_msg+0x843/0xf90 [ 378.986831][T10728] ? rtnetlink_rcv_msg+0x220/0xf90 [ 378.992004][T10728] ? rtnetlink_bind+0x80/0x80 [ 378.996748][T10728] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 379.002811][T10728] ? lock_chain_count+0x20/0x20 [ 379.007721][T10728] ? __local_bh_enable_ip+0x13a/0x1c0 [ 379.013133][T10728] ? lockdep_hardirqs_on+0x98/0x150 [ 379.018401][T10728] ? __local_bh_enable_ip+0x13a/0x1c0 [ 379.023823][T10728] ? _local_bh_enable+0xa0/0xa0 [ 379.028733][T10728] ? __dev_queue_xmit+0x275/0x3630 [ 379.033901][T10728] ? __dev_queue_xmit+0x1bc2/0x3630 [ 379.039173][T10728] ? __dev_queue_xmit+0x275/0x3630 [ 379.044389][T10728] ? ref_tracker_free+0x686/0x830 [ 379.049485][T10728] netlink_rcv_skb+0x235/0x4c0 [ 379.054304][T10728] ? rtnetlink_bind+0x80/0x80 [ 379.059125][T10728] ? netlink_ack+0x1160/0x1160 [ 379.063952][T10728] ? __lock_acquire+0x7d80/0x7d80 [ 379.069035][T10728] ? netlink_deliver_tap+0x2e/0x1b0 [ 379.074283][T10728] netlink_unicast+0x7b1/0x930 [ 379.079109][T10728] netlink_sendmsg+0x8d0/0xbf0 [ 379.083940][T10728] ? netlink_getsockopt+0x590/0x590 [ 379.089218][T10728] ? aa_sock_msg_perm+0x94/0x150 [ 379.094220][T10728] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 379.099563][T10728] ? security_socket_sendmsg+0x80/0xa0 [ 379.105065][T10728] ? netlink_getsockopt+0x590/0x590 [ 379.110310][T10728] ____sys_sendmsg+0x61b/0x980 [ 379.115140][T10728] ? __asan_memset+0x22/0x40 [ 379.119793][T10728] ? __sys_sendmsg_sock+0x30/0x30 [ 379.124865][T10728] ? __import_iovec+0x5f2/0x850 [ 379.129773][T10728] ? import_iovec+0x73/0xa0 [ 379.134324][T10728] ___sys_sendmsg+0x2a6/0x360 [ 379.139050][T10728] ? get_pid_task+0x20/0x1e0 [ 379.143697][T10728] ? __sys_sendmsg+0x2b0/0x2b0 [ 379.148543][T10728] ? __lock_acquire+0x7d80/0x7d80 [ 379.153650][T10728] __se_sys_sendmsg+0x1d0/0x2c0 [ 379.158560][T10728] ? __x64_sys_sendmsg+0x80/0x80 [ 379.163572][T10728] ? lockdep_hardirqs_on+0x98/0x150 [ 379.168832][T10728] do_syscall_64+0x55/0xb0 [ 379.173297][T10728] ? clear_bhb_loop+0x40/0x90 [ 379.178016][T10728] ? clear_bhb_loop+0x40/0x90 [ 379.182752][T10728] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 379.188704][T10728] RIP: 0033:0x7fb98d59ce59 [ 379.193170][T10728] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.212828][T10728] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 379.221296][T10728] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 379.229351][T10728] RDX: 0000000000008000 RSI: 0000200000000040 RDI: 000000000000000a [ 379.237381][T10728] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 379.245403][T10728] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 379.253418][T10728] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 379.261474][T10728] [ 380.611454][T10764] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 380.812121][T10766] netlink: 'syz.2.1752': attribute type 10 has an invalid length. [ 380.832566][T10766] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1752'. [ 381.034816][T10771] FAULT_INJECTION: forcing a failure. [ 381.034816][T10771] name failslab, interval 1, probability 0, space 0, times 0 [ 381.160059][T10771] CPU: 0 PID: 10771 Comm: syz.3.1753 Not tainted syzkaller #0 [ 381.167613][T10771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 381.177715][T10771] Call Trace: [ 381.181037][T10771] [ 381.184006][T10771] dump_stack_lvl+0x18c/0x250 [ 381.188740][T10771] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 381.194961][T10771] ? show_regs_print_info+0x20/0x20 [ 381.200218][T10771] ? load_image+0x420/0x420 [ 381.204779][T10771] should_fail_ex+0x394/0x4c0 [ 381.209551][T10771] should_failslab+0x9/0x20 [ 381.214115][T10771] slab_pre_alloc_hook+0x59/0x300 [ 381.219194][T10771] ? trace_call_bpf+0xc3/0x6c0 [ 381.224004][T10771] kmem_cache_alloc_node+0x5e/0x310 [ 381.229234][T10771] ? trace_call_bpf+0xc3/0x6c0 [ 381.234023][T10771] ? __alloc_skb+0x103/0x2c0 [ 381.238652][T10771] __alloc_skb+0x103/0x2c0 [ 381.243098][T10771] alloc_skb_with_frags+0xcd/0x7a0 [ 381.248257][T10771] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 381.254092][T10771] sock_alloc_send_pskb+0x883/0x9a0 [ 381.259330][T10771] ? sock_kzfree_s+0x50/0x50 [ 381.263942][T10771] ? lockdep_hardirqs_on+0x98/0x150 [ 381.269182][T10771] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 381.275417][T10771] rawv6_send_hdrinc+0x2fc/0x1660 [ 381.280488][T10771] ? txopt_get+0x3f0/0x3f0 [ 381.284935][T10771] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 381.291146][T10771] rawv6_sendmsg+0x128f/0x1740 [ 381.295946][T10771] ? compat_rawv6_ioctl+0x70/0x70 [ 381.301031][T10771] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 381.307283][T10771] ? aa_sk_perm+0x83c/0x970 [ 381.311822][T10771] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 381.318031][T10771] ? inet_sendmsg+0x7e/0x2a0 [ 381.322738][T10771] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 381.328056][T10771] ? inet_send_prepare+0x250/0x250 [ 381.333199][T10771] ____sys_sendmsg+0x61b/0x980 [ 381.338002][T10771] ? __asan_memset+0x22/0x40 [ 381.342620][T10771] ? __sys_sendmsg_sock+0x30/0x30 [ 381.347675][T10771] ? __import_iovec+0x3fa/0x850 [ 381.352556][T10771] ? import_iovec+0x73/0xa0 [ 381.357088][T10771] ___sys_sendmsg+0x2a6/0x360 [ 381.361805][T10771] ? __sys_sendmsg+0x2b0/0x2b0 [ 381.366642][T10771] __se_sys_sendmsg+0x1d0/0x2c0 [ 381.371522][T10771] ? __x64_sys_sendmsg+0x80/0x80 [ 381.376508][T10771] ? syscall_enter_from_user_mode+0x2e/0x80 [ 381.382447][T10771] do_syscall_64+0x55/0xb0 [ 381.386890][T10771] ? clear_bhb_loop+0x40/0x90 [ 381.391593][T10771] ? clear_bhb_loop+0x40/0x90 [ 381.396396][T10771] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 381.402322][T10771] RIP: 0033:0x7fb98d59ce59 [ 381.406770][T10771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 381.426410][T10771] RSP: 002b:00007fb98e537028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 381.434853][T10771] RAX: ffffffffffffffda RBX: 00007fb98d815fa0 RCX: 00007fb98d59ce59 [ 381.442848][T10771] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 381.450841][T10771] RBP: 00007fb98e537090 R08: 0000000000000000 R09: 0000000000000000 [ 381.458836][T10771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 381.466829][T10771] R13: 00007fb98d816038 R14: 00007fb98d815fa0 R15: 00007ffcecc35758 [ 381.474838][T10771] [ 383.195963][T10806] netlink: 830 bytes leftover after parsing attributes in process `syz.2.1762'. [ 383.227942][T10804] netlink: 'syz.3.1761': attribute type 10 has an invalid length. [ 383.244926][T10804] netlink: 2 bytes leftover after parsing attributes in process `syz.3.1761'. [ 383.430829][T10808] netlink: 'syz.1.1764': attribute type 10 has an invalid length. [ 383.440834][T10808] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1764'. [ 383.452315][T10808] hsr0: entered promiscuous mode [ 383.548564][T10808] bridge0: port 3(hsr0) entered blocking state [ 383.568717][T10808] bridge0: port 3(hsr0) entered disabled state [ 383.582891][T10808] hsr0: entered allmulticast mode [ 383.591194][T10808] hsr_slave_0: entered allmulticast mode [ 383.598264][T10808] hsr_slave_1: entered allmulticast mode [ 383.654944][T10808] bridge0: port 3(hsr0) entered blocking state [ 383.662809][T10808] bridge0: port 3(hsr0) entered forwarding state [ 385.241399][T10836] netlink: 'syz.2.1775': attribute type 10 has an invalid length. [ 385.265301][T10836] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1775'. [ 385.488967][T10843] netlink: 'syz.0.1778': attribute type 10 has an invalid length. [ 385.499285][T10843] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1778'. [ 385.510480][T10843] hsr0: entered promiscuous mode [ 385.526990][T10843] bridge0: port 4(hsr0) entered blocking state [ 385.541152][T10843] bridge0: port 4(hsr0) entered disabled state [ 385.548234][T10843] hsr0: entered allmulticast mode [ 385.553695][T10843] hsr_slave_0: entered allmulticast mode [ 385.560016][T10843] hsr_slave_1: entered allmulticast mode [ 385.623031][T10843] bridge0: port 4(hsr0) entered blocking state [ 385.633111][T10843] bridge0: port 4(hsr0) entered forwarding state [ 386.661703][T10856] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1783'. [ 386.738821][T10856] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 386.789199][T10856] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 386.835220][T10856] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 386.860400][T10856] bond0 (unregistering): (slave bridge0): last VLAN challenged slave left bond - VLAN blocking is removed [ 386.898907][T10856] bridge0: port 4(hsr0) entered disabled state [ 386.905849][T10856] bridge0: port 3(gretap0) entered disabled state [ 386.913874][T10856] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.922582][T10856] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.011724][T10856] bond0 (unregistering): Released all slaves [ 387.977930][T10876] netlink: 'syz.0.1789': attribute type 10 has an invalid length. [ 387.987169][T10876] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1789'. [ 388.426230][T10887] netlink: 'syz.0.1794': attribute type 9 has an invalid length. [ 388.488697][T10887] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.1794'. [ 389.900237][T10921] FAULT_INJECTION: forcing a failure. [ 389.900237][T10921] name failslab, interval 1, probability 0, space 0, times 0 [ 389.981534][T10921] CPU: 1 PID: 10921 Comm: syz.2.1803 Not tainted syzkaller #0 [ 389.989098][T10921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 389.999206][T10921] Call Trace: [ 390.002526][T10921] [ 390.005504][T10921] dump_stack_lvl+0x18c/0x250 [ 390.010242][T10921] ? show_regs_print_info+0x20/0x20 [ 390.015526][T10921] ? load_image+0x420/0x420 [ 390.020077][T10921] ? __might_sleep+0xe0/0xe0 [ 390.024716][T10921] ? __lock_acquire+0x7d80/0x7d80 [ 390.029807][T10921] should_fail_ex+0x394/0x4c0 [ 390.034554][T10921] should_failslab+0x9/0x20 [ 390.039110][T10921] slab_pre_alloc_hook+0x59/0x300 [ 390.044190][T10921] ? sctp_transport_new+0x7e/0x630 [ 390.049364][T10921] __kmem_cache_alloc_node+0x53/0x250 [ 390.054809][T10921] ? sctp_transport_new+0x7e/0x630 [ 390.059984][T10921] kmalloc_trace+0x2a/0xe0 [ 390.064448][T10921] sctp_transport_new+0x7e/0x630 [ 390.069530][T10921] sctp_assoc_add_peer+0x24e/0x1350 [ 390.074797][T10921] sctp_connect_new_asoc+0x323/0x6a0 [ 390.080148][T10921] ? __sctp_connect+0xd80/0xd80 [ 390.085049][T10921] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 390.090905][T10921] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 390.096750][T10921] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 390.102326][T10921] ? security_sctp_bind_connect+0x89/0xb0 [ 390.108080][T10921] sctp_sendmsg+0x1519/0x27b0 [ 390.112799][T10921] ? sctp_getsockopt+0xb60/0xb60 [ 390.117775][T10921] ? aa_sk_perm+0x83c/0x970 [ 390.122315][T10921] ? aa_af_perm+0x330/0x330 [ 390.126840][T10921] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 390.133284][T10921] ? sock_rps_record_flow+0x19/0x3f0 [ 390.138611][T10921] ? inet_sendmsg+0x7e/0x2a0 [ 390.143235][T10921] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 390.148573][T10921] ? inet_send_prepare+0x250/0x250 [ 390.153725][T10921] ____sys_sendmsg+0x61b/0x980 [ 390.158527][T10921] ? __asan_memset+0x22/0x40 [ 390.163149][T10921] ? __sys_sendmsg_sock+0x30/0x30 [ 390.168197][T10921] ? __import_iovec+0x5f2/0x850 [ 390.173083][T10921] ? import_iovec+0x73/0xa0 [ 390.177611][T10921] ___sys_sendmsg+0x2a6/0x360 [ 390.182317][T10921] ? __sys_sendmsg+0x2b0/0x2b0 [ 390.187127][T10921] ? ktime_get+0x7f/0x280 [ 390.191507][T10921] __se_sys_sendmsg+0x1d0/0x2c0 [ 390.196384][T10921] ? perf_trace_preemptirq_template+0x269/0x330 [ 390.202665][T10921] ? __x64_sys_sendmsg+0x80/0x80 [ 390.207656][T10921] ? lockdep_hardirqs_on+0x98/0x150 [ 390.212892][T10921] do_syscall_64+0x55/0xb0 [ 390.217336][T10921] ? clear_bhb_loop+0x40/0x90 [ 390.222058][T10921] ? clear_bhb_loop+0x40/0x90 [ 390.226774][T10921] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 390.232698][T10921] RIP: 0033:0x7f974f79ce59 [ 390.237145][T10921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.256772][T10921] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 390.265296][T10921] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 390.273295][T10921] RDX: 00000000000080d1 RSI: 00002000000000c0 RDI: 000000000000000a [ 390.281288][T10921] RBP: 00007f97506ad090 R08: 0000000000000000 R09: 0000000000000000 [ 390.289287][T10921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 390.297281][T10921] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 390.305294][T10921] [ 391.346478][T10945] FAULT_INJECTION: forcing a failure. [ 391.346478][T10945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 391.362961][T10945] CPU: 1 PID: 10945 Comm: syz.1.1810 Not tainted syzkaller #0 [ 391.370526][T10945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 391.380641][T10945] Call Trace: [ 391.383988][T10945] [ 391.386973][T10945] dump_stack_lvl+0x18c/0x250 [ 391.391722][T10945] ? show_regs_print_info+0x20/0x20 [ 391.397013][T10945] ? load_image+0x420/0x420 [ 391.401589][T10945] ? __lock_acquire+0x7d80/0x7d80 [ 391.406676][T10945] ? __lock_acquire+0x7d80/0x7d80 [ 391.411816][T10945] should_fail_ex+0x394/0x4c0 [ 391.416581][T10945] _copy_from_user+0x2f/0xe0 [ 391.421256][T10945] perf_copy_attr+0x16a/0x820 [ 391.426019][T10945] __se_sys_perf_event_open+0x11b/0x1c60 [ 391.431738][T10945] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 391.437472][T10945] ? mutex_unlock+0x10/0x10 [ 391.442043][T10945] ? __fget_files+0x3fc/0x460 [ 391.446800][T10945] ? __x64_sys_perf_event_open+0xc0/0xc0 [ 391.452529][T10945] ? lock_chain_count+0x20/0x20 [ 391.457460][T10945] ? lockdep_hardirqs_on+0x98/0x150 [ 391.462719][T10945] ? __x64_sys_perf_event_open+0x20/0xc0 [ 391.468422][T10945] do_syscall_64+0x55/0xb0 [ 391.472901][T10945] ? clear_bhb_loop+0x40/0x90 [ 391.477649][T10945] ? clear_bhb_loop+0x40/0x90 [ 391.482391][T10945] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 391.488354][T10945] RIP: 0033:0x7f871c39ce59 [ 391.492856][T10945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 391.512805][T10945] RSP: 002b:00007f871d2e4028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 391.521335][T10945] RAX: ffffffffffffffda RBX: 00007f871c615fa0 RCX: 00007f871c39ce59 [ 391.529385][T10945] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000200000001100 [ 391.537416][T10945] RBP: 00007f871d2e4090 R08: 0000000000000003 R09: 0000000000000000 [ 391.545445][T10945] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 391.553508][T10945] R13: 00007f871c616038 R14: 00007f871c615fa0 R15: 00007ffc2d1580b8 [ 391.561578][T10945] [ 392.533862][T10970] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1821'. [ 392.582718][T10970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 392.721611][T10970] bond0 (unregistering): (slave cÙ): Releasing backup interface [ 392.769629][T10970] bond0 (unregistering): (slave geneve0): Releasing backup interface [ 392.819558][T10970] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 392.860995][T10970] bond0 (unregistering): (slave bridge0): last VLAN challenged slave left bond - VLAN blocking is removed [ 392.875825][T10970] bridge0: port 4(gretap0) entered disabled state [ 392.882965][T10970] bridge0: port 3(hsr0) entered disabled state [ 392.890054][T10970] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.898317][T10970] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.942099][T10970] bond0 (unregistering): (slave veth1_to_bridge): Releasing backup interface [ 392.974878][T10970] bond0 (unregistering): Released all slaves [ 393.699723][T11001] FAULT_INJECTION: forcing a failure. [ 393.699723][T11001] name failslab, interval 1, probability 0, space 0, times 0 [ 393.720205][T11001] CPU: 1 PID: 11001 Comm: syz.0.1831 Not tainted syzkaller #0 [ 393.727833][T11001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 393.737921][T11001] Call Trace: [ 393.741243][T11001] [ 393.744211][T11001] dump_stack_lvl+0x18c/0x250 [ 393.748941][T11001] ? show_regs_print_info+0x20/0x20 [ 393.754203][T11001] ? load_image+0x420/0x420 [ 393.758767][T11001] ? __might_sleep+0xe0/0xe0 [ 393.763413][T11001] ? __lock_acquire+0x7d80/0x7d80 [ 393.768487][T11001] ? __lock_acquire+0x1262/0x7d80 [ 393.773570][T11001] should_fail_ex+0x394/0x4c0 [ 393.778323][T11001] should_failslab+0x9/0x20 [ 393.782879][T11001] slab_pre_alloc_hook+0x59/0x300 [ 393.787968][T11001] kmem_cache_alloc_node+0x5e/0x310 [ 393.793228][T11001] ? __alloc_skb+0x103/0x2c0 [ 393.797869][T11001] __alloc_skb+0x103/0x2c0 [ 393.802336][T11001] alloc_skb_with_frags+0xcd/0x7a0 [ 393.807510][T11001] ? trace_event_raw_event_lock+0x240/0x240 [ 393.813467][T11001] ? __ipv6_dev_get_saddr+0x404/0x430 [ 393.818898][T11001] sock_alloc_send_pskb+0x883/0x9a0 [ 393.824166][T11001] ? sock_kzfree_s+0x50/0x50 [ 393.828809][T11001] ? ip6_dst_lookup_tail+0xd65/0x1660 [ 393.834237][T11001] rawv6_send_hdrinc+0x2fc/0x1660 [ 393.839323][T11001] ? txopt_get+0x7a/0x3f0 [ 393.843705][T11001] ? txopt_get+0x3f0/0x3f0 [ 393.848163][T11001] ? txopt_get+0x344/0x3f0 [ 393.852620][T11001] ? fl6_sock_lookup+0xc0/0xc0 [ 393.857435][T11001] rawv6_sendmsg+0x128f/0x1740 [ 393.862265][T11001] ? compat_rawv6_ioctl+0x70/0x70 [ 393.867348][T11001] ? aa_sk_perm+0x83c/0x970 [ 393.871904][T11001] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 393.878390][T11001] ? inet_sendmsg+0x7e/0x2a0 [ 393.883041][T11001] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 393.888373][T11001] ? inet_send_prepare+0x250/0x250 [ 393.893713][T11001] ____sys_sendmsg+0x61b/0x980 [ 393.898534][T11001] ? __asan_memset+0x22/0x40 [ 393.903178][T11001] ? __sys_sendmsg_sock+0x30/0x30 [ 393.908278][T11001] ? __import_iovec+0x3fa/0x850 [ 393.913189][T11001] ? import_iovec+0x73/0xa0 [ 393.917740][T11001] ___sys_sendmsg+0x2a6/0x360 [ 393.922479][T11001] ? __sys_sendmsg+0x2b0/0x2b0 [ 393.927316][T11001] ? __lock_acquire+0x7d80/0x7d80 [ 393.932422][T11001] __se_sys_sendmsg+0x1d0/0x2c0 [ 393.937325][T11001] ? __x64_sys_sendmsg+0x80/0x80 [ 393.942327][T11001] ? lockdep_hardirqs_on+0x98/0x150 [ 393.947603][T11001] do_syscall_64+0x55/0xb0 [ 393.952082][T11001] ? clear_bhb_loop+0x40/0x90 [ 393.956822][T11001] ? clear_bhb_loop+0x40/0x90 [ 393.961554][T11001] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 393.967601][T11001] RIP: 0033:0x7f4e5079ce59 [ 393.972067][T11001] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.991726][T11001] RSP: 002b:00007f4e5173c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 394.000203][T11001] RAX: ffffffffffffffda RBX: 00007f4e50a15fa0 RCX: 00007f4e5079ce59 [ 394.008218][T11001] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 394.016240][T11001] RBP: 00007f4e5173c090 R08: 0000000000000000 R09: 0000000000000000 [ 394.024273][T11001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 394.032310][T11001] R13: 00007f4e50a16038 R14: 00007f4e50a15fa0 R15: 00007ffc7573bfc8 [ 394.040351][T11001] [ 410.229186][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 410.244784][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 410.252920][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 410.262261][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 410.271422][ T51] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 410.279392][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 410.513187][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 410.523942][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 410.532309][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 410.541250][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 410.549762][ T51] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 410.557652][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 410.696029][ T5782] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 410.711361][ T5782] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 410.719459][ T5782] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 410.734660][ T5782] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 410.742586][ T5782] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 410.762215][ T5782] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 412.344617][ T5782] Bluetooth: hci4: command tx timeout [ 412.674851][ T5782] Bluetooth: hci5: command tx timeout [ 412.824575][ T5782] Bluetooth: hci6: command tx timeout [ 414.424579][ T5782] Bluetooth: hci4: command tx timeout [ 414.744706][ T5782] Bluetooth: hci5: command tx timeout [ 414.923559][ T5782] Bluetooth: hci6: command tx timeout [ 416.504562][ T5782] Bluetooth: hci4: command tx timeout [ 416.842583][ T5782] Bluetooth: hci5: command tx timeout [ 416.984471][ T5782] Bluetooth: hci6: command tx timeout [ 418.594530][ T5782] Bluetooth: hci4: command tx timeout [ 418.904586][ T5782] Bluetooth: hci5: command tx timeout [ 419.064533][ T5782] Bluetooth: hci6: command tx timeout [ 425.355408][ T51] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 425.372994][ T51] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 425.381103][ T51] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 425.397821][ T51] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 425.412224][ T51] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 425.422327][ T51] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 427.464575][ T51] Bluetooth: hci7: command tx timeout [ 429.544375][ T51] Bluetooth: hci7: command tx timeout [ 431.624562][ T51] Bluetooth: hci7: command tx timeout [ 433.704594][ T51] Bluetooth: hci7: command tx timeout [ 470.863999][ T5087] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 470.874793][ T5087] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 470.882806][ T5087] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 470.891371][ T5087] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 470.899317][ T5087] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 470.907202][ T5087] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 470.985387][ T51] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 471.001105][ T51] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 471.009281][ T51] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 471.023477][ T51] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 471.032314][ T51] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 471.040346][ T51] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 471.596651][ T5782] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 471.606612][ T5782] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 471.614934][ T5782] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 471.623219][ T5782] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 471.632625][ T5782] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3 [ 471.640652][ T5782] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 472.994580][ T5782] Bluetooth: hci8: command tx timeout [ 473.153456][ T5782] Bluetooth: hci9: command tx timeout [ 473.714731][ T5782] Bluetooth: hci10: command tx timeout [ 475.064470][ T5782] Bluetooth: hci8: command tx timeout [ 475.243532][ T5782] Bluetooth: hci9: command tx timeout [ 475.794743][ T5782] Bluetooth: hci10: command tx timeout [ 477.154456][ T5782] Bluetooth: hci8: command tx timeout [ 477.323562][ T5782] Bluetooth: hci9: command tx timeout [ 477.864392][ T5782] Bluetooth: hci10: command tx timeout [ 479.240377][ T5782] Bluetooth: hci8: command tx timeout [ 479.404232][ T5782] Bluetooth: hci9: command tx timeout [ 479.944544][ T5782] Bluetooth: hci10: command tx timeout [ 485.575663][ T51] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 485.590613][ T51] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 485.599680][ T51] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 485.616278][ T51] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 485.639760][ T51] Bluetooth: hci11: unexpected cc 0x0c25 length: 249 > 3 [ 485.649884][ T51] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 487.723524][ T51] Bluetooth: hci11: command tx timeout [ 489.808419][ T51] Bluetooth: hci11: command tx timeout [ 491.883515][ T51] Bluetooth: hci11: command tx timeout [ 493.953563][ T51] Bluetooth: hci11: command tx timeout [ 498.594203][ C0] rcu: INFO: rcu_preempt self-detected stall on CPU [ 498.601063][ C0] rcu: 0-....: (1 GPs behind) idle=dc84/1/0x4000000000000000 softirq=34772/34773 fqs=4271 [ 498.612337][ C0] rcu: hardirqs softirqs csw/system [ 498.618796][ C0] rcu: number: 1040401 0 0 [ 498.625276][ C0] rcu: cputime: 14762 37727 73 ==> 52490(ms) [ 498.633107][ C0] rcu: (t=10500 jiffies g=44169 q=1759 ncpus=2) [ 498.639473][ C0] CPU: 0 PID: 10991 Comm: syz.2.1827 Not tainted syzkaller #0 [ 498.646944][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 498.657023][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 498.663549][ C0] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 4b e4 ce f6 65 8b 05 1c 33 76 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 498.683183][ C0] RSP: 0018:ffffc90000007a40 EFLAGS: 00000206 [ 498.689263][ C0] RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: e422819977466100 [ 498.697243][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: 0000000000000001 [ 498.705222][ C0] RBP: ffffc90000007ad0 R08: ffffffff911bc557 R09: 1ffffffff22378aa [ 498.713211][ C0] R10: dffffc0000000000 R11: fffffbfff22378ab R12: dffffc0000000000 [ 498.721189][ C0] R13: 1ffff92000000f5c R14: ffffffff8d8c34d8 R15: 1ffff92000000f48 [ 498.729168][ C0] FS: 00007f97506ad6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 498.738108][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 498.744697][ C0] CR2: 00007f4e515456b8 CR3: 000000001929e000 CR4: 00000000003506f0 [ 498.752696][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 498.760670][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 498.768649][ C0] Call Trace: [ 498.771933][ C0] [ 498.774783][ C0] ? _raw_spin_unlock+0x40/0x40 [ 498.779654][ C0] ? __asan_memcpy+0x40/0x70 [ 498.784258][ C0] ? blake2s_update+0x22c/0x420 [ 498.789212][ C0] mix_interrupt_randomness+0x1ef/0x2e0 [ 498.794767][ C0] ? random_pm_notification+0x210/0x210 [ 498.800341][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 498.806343][ C0] call_timer_fn+0x189/0x540 [ 498.810946][ C0] ? random_pm_notification+0x210/0x210 [ 498.816513][ C0] ? call_timer_fn+0xd2/0x540 [ 498.821215][ C0] ? __run_timers+0x810/0x810 [ 498.825908][ C0] ? random_pm_notification+0x210/0x210 [ 498.831463][ C0] __run_timers+0x570/0x810 [ 498.835995][ C0] ? detach_timer+0x2b0/0x2b0 [ 498.840692][ C0] run_timer_softirq+0x67/0xf0 [ 498.845490][ C0] handle_softirqs+0x27d/0x820 [ 498.850278][ C0] ? read_tsc+0x9/0x20 [ 498.854373][ C0] ? ktime_get+0x24b/0x280 [ 498.858898][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 498.863684][ C0] ? do_softirq+0x1a0/0x1a0 [ 498.868529][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 498.873758][ C0] __irq_exit_rcu+0xd3/0x190 [ 498.878377][ C0] ? irq_exit_rcu+0x20/0x20 [ 498.882903][ C0] irq_exit_rcu+0x9/0x20 [ 498.887161][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 498.892821][ C0] [ 498.895764][ C0] [ 498.898706][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 498.904858][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 498.910175][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 498.929797][ C0] RSP: 0018:ffffc900033169a0 EFLAGS: 00000206 [ 498.935870][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: e422819977466100 [ 498.943853][ C0] RDX: 0000000000000002 RSI: ffffffff8acadce0 RDI: ffffffff8b1c7be0 [ 498.951850][ C0] RBP: ffffc90003316aa8 R08: dffffc0000000000 R09: 1ffffffff274b701 [ 498.959833][ C0] R10: dffffc0000000000 R11: fffffbfff274b702 R12: 1ffff92000662d40 [ 498.967809][ C0] R13: ffffffff8cfa2e38 R14: 0000000000000246 R15: dffffc0000000000 [ 498.975834][ C0] ? lock_chain_count+0x20/0x20 [ 498.980704][ C0] ? read_lock_is_recursive+0x20/0x20 [ 498.986091][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 498.992279][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 498.997496][ C0] _raw_spin_lock+0x2e/0x40 [ 499.002014][ C0] ? pgd_free+0x2c/0x160 [ 499.006287][ C0] pgd_free+0x2c/0x160 [ 499.010386][ C0] __mmdrop+0xb4/0x3d0 [ 499.014463][ C0] finish_task_switch+0x3da/0x8f0 [ 499.019521][ C0] __schedule+0x15b6/0x4660 [ 499.024054][ C0] ? verify_lock_unused+0x140/0x140 [ 499.029284][ C0] ? asan.module_dtor+0x20/0x20 [ 499.034165][ C0] ? mark_lock+0x94/0x320 [ 499.038516][ C0] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 499.045737][ C0] ? lock_chain_count+0x20/0x20 [ 499.050684][ C0] ? preempt_schedule+0xc0/0xd0 [ 499.055548][ C0] preempt_schedule_common+0x82/0xc0 [ 499.060856][ C0] preempt_schedule+0xc0/0xd0 [ 499.065552][ C0] ? schedule_preempt_disabled+0x20/0x20 [ 499.071214][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 499.077394][ C0] preempt_schedule_thunk+0x1a/0x30 [ 499.082611][ C0] _raw_spin_unlock_irqrestore+0x111/0x120 [ 499.088459][ C0] ? _raw_spin_unlock+0x40/0x40 [ 499.093329][ C0] ? stack_trace_save+0xaa/0x100 [ 499.098294][ C0] ? stack_trace_snprint+0xf0/0xf0 [ 499.103453][ C0] __stack_depot_save+0x575/0x660 [ 499.108494][ C0] kasan_set_track+0x5f/0x70 [ 499.113090][ C0] ? kasan_set_track+0x4e/0x70 [ 499.117874][ C0] ? kasan_save_free_info+0x28/0x40 [ 499.123097][ C0] ? ____kasan_slab_free+0x126/0x1f0 [ 499.128400][ C0] ? slab_free_freelist_hook+0x130/0x1a0 [ 499.134050][ C0] ? __kmem_cache_free+0xba/0x1f0 [ 499.139097][ C0] ? skb_release_data+0x609/0x7f0 [ 499.144136][ C0] ? consume_skb+0xb2/0x110 [ 499.148650][ C0] ? netlink_broadcast_filtered+0x103c/0x1130 [ 499.154742][ C0] ? nlmsg_notify+0xe3/0x1a0 [ 499.159341][ C0] ? fib_table_delete+0xcd2/0xfc0 [ 499.164394][ C0] ? fib_magic+0x2ee/0x3b0 [ 499.168821][ C0] ? fib_del_ifaddr+0x1018/0x14c0 [ 499.173851][ C0] ? fib_inetaddr_event+0xbb/0x1d0 [ 499.178986][ C0] ? notifier_call_chain+0x18f/0x380 [ 499.184285][ C0] ? blocking_notifier_call_chain+0x6a/0x90 [ 499.190190][ C0] ? __inet_del_ifa+0xaac/0x1090 [ 499.195141][ C0] ? devinet_ioctl+0x146c/0x1d70 [ 499.200111][ C0] ? inet_ioctl+0x42b/0x560 [ 499.204650][ C0] ? sock_do_ioctl+0xfc/0x310 [ 499.209386][ C0] ? sock_ioctl+0x5be/0x7e0 [ 499.213910][ C0] ? __se_sys_ioctl+0xfd/0x170 [ 499.218684][ C0] ? do_syscall_64+0x55/0xb0 [ 499.223285][ C0] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 499.229406][ C0] ? __kmem_cache_free+0xba/0x1f0 [ 499.234452][ C0] kasan_save_free_info+0x28/0x40 [ 499.239525][ C0] ____kasan_slab_free+0x126/0x1f0 [ 499.244647][ C0] slab_free_freelist_hook+0x130/0x1a0 [ 499.250125][ C0] ? skb_release_data+0x609/0x7f0 [ 499.255160][ C0] __kmem_cache_free+0xba/0x1f0 [ 499.260045][ C0] skb_release_data+0x609/0x7f0 [ 499.264919][ C0] consume_skb+0xb2/0x110 [ 499.269263][ C0] netlink_broadcast_filtered+0x103c/0x1130 [ 499.275185][ C0] nlmsg_notify+0xe3/0x1a0 [ 499.279635][ C0] fib_table_delete+0xcd2/0xfc0 [ 499.284517][ C0] ? nexthop_get_nhc_lookup+0x400/0x400 [ 499.290101][ C0] ? l3mdev_fib_table+0x18/0x160 [ 499.295184][ C0] ? fib_new_table+0x10a/0x2d0 [ 499.299961][ C0] fib_magic+0x2ee/0x3b0 [ 499.304216][ C0] ? fib_add_ifaddr+0x5d0/0x5d0 [ 499.309090][ C0] fib_del_ifaddr+0x1018/0x14c0 [ 499.313954][ C0] ? inetaddr_event+0xf0/0x150 [ 499.318732][ C0] ? is_eth_active_slave_of_bonding_rcu+0x260/0x260 [ 499.325339][ C0] ? fib_del_ifaddr+0x2f6/0x14c0 [ 499.330285][ C0] fib_inetaddr_event+0xbb/0x1d0 [ 499.335255][ C0] notifier_call_chain+0x18f/0x380 [ 499.340385][ C0] blocking_notifier_call_chain+0x6a/0x90 [ 499.346119][ C0] __inet_del_ifa+0xaac/0x1090 [ 499.350906][ C0] devinet_ioctl+0x146c/0x1d70 [ 499.355723][ C0] ? inet_ifa_byprefix+0x2a0/0x2a0 [ 499.360867][ C0] ? _copy_from_user+0xa5/0xe0 [ 499.365647][ C0] ? get_user_ifreq+0x12b/0x180 [ 499.370511][ C0] inet_ioctl+0x42b/0x560 [ 499.374857][ C0] ? tomoyo_path_number_perm+0x217/0x5e0 [ 499.380498][ C0] ? inet_shutdown+0x370/0x370 [ 499.385275][ C0] ? slab_free_freelist_hook+0x130/0x1a0 [ 499.390919][ C0] ? tomoyo_path_number_perm+0x4b7/0x5e0 [ 499.396557][ C0] ? __kmem_cache_free+0xba/0x1f0 [ 499.401600][ C0] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 499.407076][ C0] sock_do_ioctl+0xfc/0x310 [ 499.411597][ C0] ? sock_show_fdinfo+0xb0/0xb0 [ 499.416476][ C0] sock_ioctl+0x5be/0x7e0 [ 499.420822][ C0] ? sock_poll+0x3e0/0x3e0 [ 499.425269][ C0] ? bpf_lsm_file_ioctl+0x9/0x10 [ 499.430216][ C0] ? security_file_ioctl+0x80/0xa0 [ 499.435343][ C0] ? sock_poll+0x3e0/0x3e0 [ 499.439769][ C0] __se_sys_ioctl+0xfd/0x170 [ 499.444374][ C0] do_syscall_64+0x55/0xb0 [ 499.448800][ C0] ? clear_bhb_loop+0x40/0x90 [ 499.453481][ C0] ? clear_bhb_loop+0x40/0x90 [ 499.458163][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 499.464072][ C0] RIP: 0033:0x7f974f79ce59 [ 499.468499][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 499.488115][ C0] RSP: 002b:00007f97506ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 499.496560][ C0] RAX: ffffffffffffffda RBX: 00007f974fa15fa0 RCX: 00007f974f79ce59 [ 499.504538][ C0] RDX: 0000200000000040 RSI: 000000000000891c RDI: 0000000000000008 [ 499.512531][ C0] RBP: 00007f974f832e6f R08: 0000000000000000 R09: 0000000000000000 [ 499.520511][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 499.528663][ C0] R13: 00007f974fa16038 R14: 00007f974fa15fa0 R15: 00007ffdc5df7de8 [ 499.536658][ C0] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 500.155641][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.162069][ T1292] ieee802154 phy1 wpan1: encryption failed: -22