last executing test programs: 15.40551458s ago: executing program 1 (id=2): bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="1e0000000000000005000000ef00e7ff04"], 0x50) 12.980401932s ago: executing program 1 (id=31): unshare(0x20400) shutdown(0xffffffffffffffff, 0x1) 12.885682566s ago: executing program 32 (id=31): unshare(0x20400) shutdown(0xffffffffffffffff, 0x1) 940.663183ms ago: executing program 3 (id=353): pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r0, 0x5452, &(0x7f00000000c0)=0x704) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000000)="fc", 0x1) splice(r2, 0x0, r1, 0x0, 0x1100000000f336, 0x8) 860.411844ms ago: executing program 3 (id=356): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0xa, 0x200, 0x7, 0x1}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0x18, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000218110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000cf98e95db7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0xfca804a0, 0xe, 0x0, &(0x7f00000002c0)="b8000005000000005baf2312bbc2", 0x0, 0x12000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 860.091434ms ago: executing program 2 (id=358): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0xf, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xa3f, 0x0, 0x0, 0x0, 0x7fffffff}, {}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0x3, 0x18, 0xfffffffffffffffc, 0x0, 0x0, '\x00', 0x0, 0x38, 0xffffffffffffffff, 0x8, 0x0, 0x2d, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x8b) 811.041133ms ago: executing program 3 (id=360): r0 = socket(0x840000000002, 0x3, 0x100) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_int(r0, 0x0, 0x1, 0x0, 0x0) 810.895174ms ago: executing program 2 (id=361): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0xb, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, &(0x7f0000000280)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x11}, 0x94) 730.475562ms ago: executing program 2 (id=363): r0 = socket(0x11, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'bond0\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4c, 0x0, 0x0, 0x0, 0x3, 0x3, 0x9, 0x0, 0x2, 0x4, [0x6, 0x0, 0xc60, 0xffffffff, 0x0, 0x0, 0x0, 0x8]}}) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) 658.245334ms ago: executing program 2 (id=364): pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000480)=[{&(0x7f0000000000)='/', 0x1}], 0x1, 0x1) writev(r0, &(0x7f0000002880)=[{&(0x7f00000001c0)="b3403f477490d03d36b73d3df0d8a542fb861605abae336c35b9056a1df739d066465b8bb4d68d139bb5f8282fc098f4717a1897849cfbb30479288a67a062aaacde607f44f1", 0x46}, {&(0x7f00000002c0)="a6043a4361bddb934c666f58c0", 0xd}, {&(0x7f00000003c0)="a78bb376a65e9778d54ecdfc1c2c588e19e68c1aa706bbc3799cdb1a5b3fed4c18730df24550f0b0a5e955e52dbd69311f6dd8ddd8c5076443da4f9653ca4917e88fcb3ca8bd02ad29fbf2dcc7", 0x4d}, {&(0x7f0000000640)="477d6e3e5fce1cff84a0d03a7829858bf6171a29c4d3d88157424f12acf343d6bd0318accd52ef5c42e157d575b1c3b4112dd90b121fa6ca10f7f0e428ce90a5994c385a4f70459e2e00a833093679db779f9d22d304a3e660bac937a2995e179c46edb578ec8404a8c487a154c6c6dad09f01ab23f469379112603d1621d567756c36a340259919c571473fc3fccae8969052f0ac526e562c585dcf6efcc525b1c8c1ab", 0xa4}, {&(0x7f0000001580)="dce24f2f11ceea735d2e4674145526b5dd1ff3c19886ba0a84c5426c0fcc710fc189dd90ff37563b9cea9f33cae77cd2dc3185131f884c80dac1577960c4bd6988ed23dd66ea9df46779ba12ca28bb4e8b1f7439888669072d5226f0ae6667170973f855d40b0cdb23b563d81e4ff9e1c9526396081f8b14adc8be328090da583db0b72f20e488993f9fedcbcc1ed5401fe415fd0d5c44d96e0bd7e82b1f55d35696627d9693d125b192deb911dfcdcf99df6ab2e936e61b45845f6f12d6f10279df867571044da83331053cbf9c90e92b90070638d7063d02a23cf01542e021cd2e2460529258b04843b50931777b92f5862f2a02174bf69972ee0eee724cd731a5f324da20bf85d2454505e4860659991c2ac3bfe10b212b9a6b364db998213bf3259e6fcbf2f0c4892f6063499cd7561c1591668c4bf2f19513cff463dcee4cf4c90ab01b3b51fa034cbe19c26e6a48e86c67cf6b14aa9b6cb3fd7388044f9bf28eccfade44b6afb9059d960cfee0ed5840f57201649bf509417e7f240abc5a652e7ef1480dd72c20d5b178d0818bfe27059c5cde4db9b9ac77caa391253a83fa33ab51d7a55cc1fdd71491e82202fd51883e459fa2756c2e001d18dffbcc5339b0a42b13bc72115d9f8834e5af7259bb2f982264472365374ab109118bed2b0de7dd7cea9bbb4f2f7c480335e8ab32c51e08892022fe4a957b1059a2bc19c1f62f63333991266e380f10e2f2153237ec6e2ac7737ed6211933fb7ed10a0a025da3cc1886a7e6f1ca9b175a4123cfb34d5463b590a15a6530c0d2a089e2b69dc76454556356348981e7037b46d1331ba4519878ace16102c3c4f77ec01b4b4c97187d36b9df72d8e1e0c853993de16f8fb32752b5e9c87bf2251569081bbf6acae8402dc93c0086943d0c66fcf7e6eee0794e063ec8e898839a3675363a097821046c86f9d3b53273be42f35fe0b159f834bc32baded2afe8ee857af9002b76f5a75c4a527ac62bd0061e6c12c0c41fb7d0b8c4b6276a3bcf901f180e3eed2310ea507caafe86c2530316cfde51abd1400bf439c0c309c62618a76858083e419442b59b5b45d390294e8cef267256f92ba818991a54d7abcda722e7d3f48f12be61df2e141cb2082655f2980fba369a0a63dca41ec4a9882ebbb1593a63f1fed7aea6f50d41ea9d1b3af2491c1bd83dcdf2676ca05aefa67790d576c81e02d80ec92cb83731b3a648c9a97d8519b468775bd85e42db0b0d44172e81ecbb78d5952e22f245a5ad52aa52885f06e071dc7f5c4fcd78bb2d959963316f42eb43dbb7ea2969428fc3ebe442b3f8e4a082f2e489d3d89ba46e21e67032caf7ae7ba3e8c52e9b76718e8bb485859278daed83b7eb195eaeee6fcf6d4e864376cf1b2a4d35c201d18d548a108109f099993d1428ad472fca64b7333a1da6a8f518d5a604ec5cccdf1d85079d3aa98f8a5a068fc9d388543ed1b2029047676cebf2c58fa9d0d32b568c65344a56db0796464e4a41568444763882ea53d75e0323fce64482e8e0c63fd913d90577bee641e596b61ce037c6180b8c7f192b93940635ddce6c3025a0fdc7c828b68872c88cfa56ef4739919f370e52ccd943477a87901c120b43735e0628ccd5a95b726fa5bc6ec62af8e3b394a00ade137df31142bd7e3940d4b2b323ad44af7d9ddf78407506e82d5062d54aa39286afdbc1731430ed1a0a62bf8db80e7d4f02aec4cc08d91e0a570f18e3853fed80b0caef8ead3844b76cf718e29aaf74030d79b4833b5dbefba39b3c00c9b925d82447f63f2ba2115f189534400280962af27d110688a772cddac11f16abb1cc6df623b4a38fb6d0fb36261edace04fc8308afb3792db0117d5f62948a53c0c735c56a6fea4683695e3592d32e43fcfbd5ed69a73c55cfce274f7621a18a48a03af1acdf16ef80262bf8d27c930cec9bb5cea61bb9065c2f097785ca40f5d47396cfd86f46bc1b0d14502768a6bcea167822cbdc5735be2a2676e8e79222b0b1fb905ab4acd396ba4674d1eef1f57e3e261805c60f2d1afa4b2ca740530e1353bc405214a796434e15b25a099a06fe4ada4f5959478dc9986475e2c10269c31bc1673030b08780aeb33879015e89339298d3392af56e1f14c414bcc4919ec8450e663fe8f66e7f3975e6cc047e908da40a1bd840dbe0ae94f6e8ec6dd0e571a27d9b244808b5034b5a92095c9688393d81f37bb52d7d7c3987e75084ccc93dd469d18ff32a4848da5eb222636617a84ad8b6cf5a08838398920c7cc19e92fb3035f394129d552a75d314ab4200be0f503e749a3b6a70f50ff0fe8126ba64bfee2cfc351206acccecd9d94bb120cc5b09bdecabe0068d0a664e6bd56cdede3ed46a5080cfff531b02ad0e56af266c3689b7724e41f692694cd727ac9706fd81fe5752ac9acd450be9677c51483d1ad63b0a44b31aa0a1ed32954e44fa40a859cb241e97d4e1d7a9dba4a7e941c72b3599c41cd9a0d56cf647d9ac1c2d96fe9311a515c64b6cb3ed595499c770e83ee378c2ac45b7296c756867c649a14f22221354e5dd4c540bcdc89f58a87a26de62c1a42b60f150e1d30ea269aaede1d575b9ee4ce2096365c234a67fff331f7c3d41e1e386122e8807447dfaef222d1f3d806f1fad0f85ab95e2b12740bdc31e292622b3049a9a44c7f7509433c2edb28b7d4661293ecb2041f146171c5cf5be6042f7dbb0af3fb7be4a4c3c6ed504e09490ce285c96268af6699be03e04afdbda13c1d4f7bd24cf2243522430f7396f0c707a6352653176b99445a9a33fa4f39937ccfd6d66a129741460ec46923e118d6d0be3b4fad7bcaf0183bdb7eab62abfd2eeeffaee099f02d0518c8f7b6477dd312a1fd186746c273dbbaa9a0d22143cba2aaadcd57987ae3885fcd91a7efc929fb815c0ed4e6dba8a1ac1cfe3a84e6dfd62ad3f24d91da4313e8219aae3e9f92329d55c1078d19087471c6b087614670d8c2776d87883798649634391d1e8c14ca820cc7d81adc27c2a4afe6eb3bac4479b475f89ef34408bcb9e9511a235c0a6c247fb0c509e8f228a59f0ca4a27ef0d70c21756bc485ac8d9979be9253292ca1486cedbf887911cfd6e9fd5edac2b6c479e836419aa22887617a1dd97ab0b0f0656e694134e44f557fe6631b649c04ae4159fbcd52786a993c6cf5da364e2c533021074126e154eeeab9d665f991a4b5ab7c4ba87e222fd6d582995c9f4fe29226ebffa4225a2afdfa73bb6e89a0194a37961c718deb9fe646842a10ba412940cd645a91b847015b5d745173555389de46c2f618e3b9f50d95ebb0f8b011a911bfa8220fb83f848d927c3e0d61983be3f0375327d6e186933634901070a260d225373e28b65ddce1f10d32ccfb46084f8eed8f5e9f6152a4373eb4e90d5ce192d7893b495bcfce0e47418bbef04f765d222384ced23ad328b3546d19fc0e1dd5953cc7abc7e7c0148d8cabb66627473ad9a99fd64ffcc0f17ec91cdf42a2d9b8cf5ad0910af8cd3afb7d465fbc0d12ec30af181d9da4594898bc054e341c706ac0e536add1719cdc1b022c51b04a7d9a0e4b14f2bd0b8618a5c81a247f329e973b64dea447d4cbedeab5cd971a307c0fd1a2ce3c96468f4d30f9f7526f40a7bf7f5de933dd272fea707a8e694a4dbdf927a3de6d39098d102fb698329c2c243809866071d3e3d220d9049713a4bd4088116e88bc0fe544ad469a32858b34aadde1189ea9ea4acd413ce716c1644c450b7ff29ec69399e62caf92b512961531999b9db2662a48030eb1256949cfed231c76c9d6dd139ee3b62fd1ffca5e927203a2f33b11d7eabf44ef73ebce607cd6d05cf2b45fe3504c5648c699ca327af1c9479181baa267cf659155a4488b971c9e3ec7e9d3d513b587144c8779bbc679476be17411f69fcd0ee79550b7cd34e38c9c3650fb338e0f2645d9947f7aecebb606fc0a9d7bdedb5d02a316e4f72607188f61b67956705c2d58088f3857db30e17e3af3f310e59c0f23a4155bee63fef9197b2b4bac37c06c577644b4b76690fe1a2ef4f54e9de877da062c81c440e1cfb4453ede9403baa7b372612663974f67640102ab162ad33f1101f8bc35947ee263fd8a2c857a2103c566f7c1128d9d127fca84471da4f543a101060a661fe3886c91a6a6202f4598fa722e296b68fee2b498c99f1ca81c86326def51628a76723b061b02036e7df5898f845c60c15f0c179b2b6abdb0424d638b8395004aca70a6c6f0111c050bf6a4564eb1956d29e4276a0135a39311fcc8a00b77b92213ab6ae0a0564cc9b8805344bf5cc5db1a88b953e218e2f3a28cb2f18ffaa6b217c56f96c24a8a3cc04a261f726987c0eec6635ff2c16223ab579aae684b456ac76190864881a77a3e34bb38f249786ecebfee50290cbd3913db6e83c8050f2500af492f11a200d4b68e3fe42aabc462d82d3482f986b36fe1a56d71197b56ef97211a324da8f1a56814290864580cdd53fe405d216753b564a17e43c0420ec086b4b64e37cd40aab514fa493392368a57fd0ecd037a8a02502ead8195c2d6abf100413d54c9745145631064f37a861d68678ad9a0054cc0afbadc9050e8a8b5dccefea661bf04a3ecf1d0189e19ba41e4560e593d2a592f03cd1c0da01e9ec87990adfe4724c4874941deb87a5a1a2b35c69e95f288310c0ea7f43f132fd99cbb677b7da3d5792f59fb435ccbc275a88b6f56e15174b249a261afda57fe00a46f1d8e5d23c7d527aabfa412182411cea2234304984f11747915da1bf0bf8e6beb5af63f4b5c9abc6f59a5030342e1fadb079b43cc9d80ec21b93156d921d1cb7b679eeafc4ff71f8d39bdfcb9615687c1155c0e255e9e9da49bb84e6442bbfbd66d697b98ddaf1411bc17c30887b8afce90d3ab43765b39128f1b26cb07e3185a0c424daba78e44ba03910ea7f95a2613551153e86ae4578066651921291ef4ffdc551506258f7dc47511d461637635c84c9982fd7f63f9e78df2e612f4399dca40e7b4ff6d49aec7fe3f4a370b879dbb2e39779d53cce11d7bbfbe19dce490ad70ccb99805f6bef19827889b73e128a8c30296d85185bb6ccd76d6e1cc0d3019223657026d79be4046c7ee8bfd5b3a8886878f82c76af714736faf99c146256a1d13f35ae518da04dc6a8968b68a98e4a4bee8583e403d49125b350daa0509b04aae6d9e46ca412657c8a3c050f2b081eeb791bc6e73926727e816480edc1de9519ba49fdcd8ccc26fd4ba87dcb18abbc4bd82785616b2ff704fefd817acb94f17cff55d545b01c7527345c29f7acb459e8f4bc46f0", 0xebd}], 0x5) 658.103854ms ago: executing program 2 (id=365): r0 = socket(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000000)=0xc, 0x4) 471.554089ms ago: executing program 2 (id=368): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvfrom$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f0000000fc0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) 397.619405ms ago: executing program 3 (id=370): r0 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000240)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f7f8900000ec00000000101ff0000000309ff5bffff00c7", 0x48}], 0x1) 320.689922ms ago: executing program 3 (id=372): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) close(0x3) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r2, &(0x7f0000004d00), 0x3fffffffffffe8f, 0x4000f50) sendmsg$nl_route_sched(r0, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0) 211.629081ms ago: executing program 0 (id=374): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{0x0}], 0x1) 159.297144ms ago: executing program 0 (id=375): r0 = socket(0x10, 0x803, 0x0) bind$netlink(r0, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfd, 0x8000000}, 0xc) 159.015695ms ago: executing program 0 (id=376): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000007"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 99.113991ms ago: executing program 0 (id=377): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x10, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 98.882068ms ago: executing program 0 (id=378): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000200000004"], 0x48) close(0x3) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200000100000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x41, 0x0}, 0x10) 202.539µs ago: executing program 0 (id=379): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001b00)=ANY=[@ANYBLOB="1c0000003d00010325bd7000fbdbdf250500eeff070003"], 0x1c}, 0x1, 0x0, 0x0, 0x200448d3}, 0x50) 0s ago: executing program 3 (id=380): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)={0x38, r2, 0x1, 0x70bd2c, 0x0, {{0x2}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x2, 0x25}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}]]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:5189' (ED25519) to the list of known hosts. syzkaller login: [ 42.259030][ T5518] cgroup: Unknown subsys name 'net' [ 42.366174][ T5518] cgroup: Unknown subsys name 'cpuset' [ 42.373931][ T5518] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 43.950527][ T5518] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 48.174250][ T5593] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 48.177405][ T5593] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 48.178736][ T5593] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 48.184384][ T5593] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 48.187171][ T5593] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 48.235461][ T4994] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 48.244017][ T56] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 48.244565][ T56] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 48.248145][ T56] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 48.254317][ T5603] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 48.258861][ T5601] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 48.263305][ T5601] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 48.267397][ T5601] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 48.270919][ T5601] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 48.274915][ T5601] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 48.775941][ T5591] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.776401][ T5591] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.776591][ T5591] bridge_slave_0: entered allmulticast mode [ 48.778055][ T5591] bridge_slave_0: entered promiscuous mode [ 48.781682][ T5591] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.781750][ T5591] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.781856][ T5591] bridge_slave_1: entered allmulticast mode [ 48.782835][ T5591] bridge_slave_1: entered promiscuous mode [ 48.850718][ T5591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.853097][ T5591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.894765][ T5591] team0: Port device team_slave_0 added [ 48.908759][ T5591] team0: Port device team_slave_1 added [ 48.943688][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.943742][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.943759][ T5591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.946153][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.946163][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.946178][ T5591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.022679][ T5598] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.025885][ T5598] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.028919][ T5598] bridge_slave_0: entered allmulticast mode [ 49.032753][ T5598] bridge_slave_0: entered promiscuous mode [ 49.055843][ T5598] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.059719][ T5598] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.062399][ T5598] bridge_slave_1: entered allmulticast mode [ 49.065092][ T5598] bridge_slave_1: entered promiscuous mode [ 49.079031][ T5591] hsr_slave_0: entered promiscuous mode [ 49.079695][ T5591] hsr_slave_1: entered promiscuous mode [ 49.102707][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.103009][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.103322][ T5597] bridge_slave_0: entered allmulticast mode [ 49.105058][ T5597] bridge_slave_0: entered promiscuous mode [ 49.136351][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.136476][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.137602][ T5597] bridge_slave_1: entered allmulticast mode [ 49.139004][ T5597] bridge_slave_1: entered promiscuous mode [ 49.151308][ T5598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.176192][ T5598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.240462][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.244132][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.260074][ T5598] team0: Port device team_slave_0 added [ 49.278847][ T5598] team0: Port device team_slave_1 added [ 49.290199][ T5597] team0: Port device team_slave_0 added [ 49.292714][ T5597] team0: Port device team_slave_1 added [ 49.344442][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.344501][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.344557][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.364915][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.368093][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.379377][ T5598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.380412][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.380420][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.380430][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.424843][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.428323][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.439941][ T5598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.492649][ T5597] hsr_slave_0: entered promiscuous mode [ 49.493488][ T5597] hsr_slave_1: entered promiscuous mode [ 49.494211][ T5597] debugfs: 'hsr0' already exists in 'hsr' [ 49.494273][ T5597] Cannot create hsr debugfs directory [ 49.574554][ T5598] hsr_slave_0: entered promiscuous mode [ 49.575770][ T5598] hsr_slave_1: entered promiscuous mode [ 49.576630][ T5598] debugfs: 'hsr0' already exists in 'hsr' [ 49.576646][ T5598] Cannot create hsr debugfs directory [ 49.707263][ T5591] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 49.716669][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.719491][ T5591] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 49.724704][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.750936][ T5591] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 49.757506][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.760545][ T5591] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 49.765679][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.890013][ T5597] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 49.897594][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.898314][ T5597] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 49.904307][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.908636][ T5597] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 49.918764][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.919515][ T5597] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 49.924942][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.009166][ T5598] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 50.015934][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.016647][ T5598] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 50.023220][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.035106][ T5598] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 50.040980][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.042010][ T5598] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 50.046060][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.058710][ T5591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.100243][ T5591] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.114114][ T29] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.114213][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.128299][ T29] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.128378][ T29] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.161172][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.195138][ T5597] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.208924][ T29] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.209032][ T29] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.230177][ T5598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.233832][ T4994] Bluetooth: hci0: command tx timeout [ 50.238881][ T1110] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.238966][ T1110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.280117][ T5598] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.312692][ T4994] Bluetooth: hci1: command tx timeout [ 50.312732][ T5601] Bluetooth: hci2: command tx timeout [ 50.317985][ T1110] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.318115][ T1110] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.329559][ T959] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.329642][ T959] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.371280][ T5598] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 50.572816][ T5591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.596655][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.661069][ T5598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.666868][ T5591] veth0_vlan: entered promiscuous mode [ 50.670938][ T5597] veth0_vlan: entered promiscuous mode [ 50.680468][ T5591] veth1_vlan: entered promiscuous mode [ 50.687216][ T5597] veth1_vlan: entered promiscuous mode [ 50.731341][ T5598] veth0_vlan: entered promiscuous mode [ 50.742253][ T5591] veth0_macvtap: entered promiscuous mode [ 50.747289][ T5597] veth0_macvtap: entered promiscuous mode [ 50.750466][ T5591] veth1_macvtap: entered promiscuous mode [ 50.756462][ T5598] veth1_vlan: entered promiscuous mode [ 50.759685][ T5597] veth1_macvtap: entered promiscuous mode [ 50.778866][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.797349][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.806943][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.811118][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.829451][ T5598] veth0_macvtap: entered promiscuous mode [ 50.855990][ T5598] veth1_macvtap: entered promiscuous mode [ 50.912735][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.932249][ T5650] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.932399][ T5650] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.932424][ T5650] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.932447][ T5650] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.932470][ T5650] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.932492][ T5650] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.932514][ T5650] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.932545][ T5650] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.949741][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.991914][ T5633] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.992354][ T5633] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.992802][ T5633] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.993010][ T5633] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.037658][ T1110] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.037712][ T1110] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.090143][ T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.090195][ T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.112094][ T1110] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.112144][ T1110] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.162301][ T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.162352][ T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.176360][ T5597] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 51.213007][ T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.213053][ T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.268943][ T29] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.268980][ T29] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.550843][ T5715] tipc: Started in network mode [ 51.550885][ T5715] tipc: Node identity ac1414aa, cluster identity 4711 [ 51.552856][ T5712] Zero length message leads to an empty skb [ 51.561370][ T5715] tipc: New replicast peer: 172.20.20.187 [ 51.567672][ T5715] tipc: Enabled bearer , priority 10 [ 51.789399][ T5722] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.790152][ T5722] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.812245][ T5722] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 52.065087][ T5591] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 52.065133][ T5591] CPU: 0 UID: 0 PID: 5591 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 52.065159][ T5591] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 52.065165][ T5591] Call Trace: [ 52.065169][ T5591] [ 52.065172][ T5591] dump_stack_lvl+0xe8/0x150 [ 52.065188][ T5591] dump_header+0xd3/0x4b0 [ 52.065199][ T5591] oom_kill_process+0x3ab/0x9e0 [ 52.065210][ T5591] out_of_memory+0x1064/0x1480 [ 52.065218][ T5591] ? try_charge_memcg+0xc32/0x15e0 [ 52.065231][ T5591] ? __pfx_out_of_memory+0x10/0x10 [ 52.065239][ T5591] ? do_raw_spin_unlock+0x4d/0x200 [ 52.065252][ T5591] try_charge_memcg+0xcdf/0x15e0 [ 52.065267][ T5591] ? __pfx_try_charge_memcg+0x10/0x10 [ 52.065282][ T5591] ? charge_memcg+0x47/0x310 [ 52.065291][ T5591] charge_memcg+0x1dd/0x310 [ 52.065300][ T5591] ? mem_cgroup_swapin_charge_folio+0x2b/0x390 [ 52.065307][ T5591] mem_cgroup_swapin_charge_folio+0x25a/0x390 [ 52.065317][ T5591] swap_cache_alloc_folio+0x4de/0x990 [ 52.065331][ T5591] swap_cache_read_folio+0x44/0x120 [ 52.065342][ T5591] swap_cluster_readahead+0x392/0x630 [ 52.065355][ T5591] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 52.065373][ T5591] swapin_readahead+0x1a3/0xc50 [ 52.065387][ T5591] ? __pfx_swapin_readahead+0x10/0x10 [ 52.065398][ T5591] ? swap_table_get+0x1e/0x260 [ 52.065407][ T5591] ? swap_table_get+0x1e/0x260 [ 52.065415][ T5591] ? swap_table_get+0x1e/0x260 [ 52.065424][ T5591] ? swap_table_get+0x216/0x260 [ 52.065434][ T5591] ? swap_cache_get_folio+0x2e7/0x2f0 [ 52.065445][ T5591] do_swap_page+0x3fb/0x4c10 [ 52.065461][ T5591] ? __lock_acquire+0x6df/0x2e50 [ 52.065467][ T5591] ? do_swap_page+0x126/0x4c10 [ 52.065476][ T5591] ? __pfx_do_swap_page+0x10/0x10 [ 52.065484][ T5591] ? __pte_offset_map+0x1ae/0x240 [ 52.065494][ T5591] ? pte_offset_map_rw_nolock+0xea/0x160 [ 52.065504][ T5591] handle_mm_fault+0x1398/0x3750 [ 52.065517][ T5591] ? handle_mm_fault+0xf1/0x3750 [ 52.065530][ T5591] ? __pfx_handle_mm_fault+0x10/0x10 [ 52.065538][ T5591] ? lock_vma_under_rcu+0x45a/0x500 [ 52.065557][ T5591] do_user_addr_fault+0xa4f/0x1340 [ 52.065568][ T5591] ? trace_page_fault_user+0x84/0x1e0 [ 52.065576][ T5591] exc_page_fault+0x6a/0xc0 [ 52.065587][ T5591] asm_exc_page_fault+0x26/0x30 [ 52.065595][ T5591] RIP: 0033:0x7ff02af5e98e [ 52.065603][ T5591] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 52.065609][ T5591] RSP: 002b:00007fffeb1e1f18 EFLAGS: 00010246 [ 52.065617][ T5591] RAX: 0000000000000000 RBX: 0000555574195500 RCX: 00007ff02af5e98e [ 52.065622][ T5591] RDX: 00007fffeb1e1f70 RSI: 0000000000000000 RDI: 0000000000000000 [ 52.065626][ T5591] RBP: 00007fffeb1e1fdc R08: 0000000000000000 R09: 0000000000000000 [ 52.065631][ T5591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 52.065635][ T5591] R13: 00000000000927c0 R14: 000000000000c7f0 R15: 00007fffeb1e2030 [ 52.065646][ T5591] [ 52.065683][ T5591] memory: usage 307200kB, limit 307200kB, failcnt 2197 [ 52.065706][ T5591] memory+swap: usage 307284kB, limit 9007199254740988kB, failcnt 0 [ 52.065728][ T5591] kmem: usage 307200kB, limit 9007199254740988kB, failcnt 0 [ 52.065771][ T5591] Memory cgroup stats for /syz1: [ 52.065982][ T5591] cache 0 [ 52.066002][ T5591] rss 0 [ 52.066022][ T5591] rss_huge 0 [ 52.066042][ T5591] shmem 0 [ 52.066067][ T5591] mapped_file 0 [ 52.119168][ T5591] dirty 0 [ 52.119179][ T5591] writeback 0 [ 52.119183][ T5591] workingset_refault_anon 0 [ 52.119187][ T5591] workingset_refault_file 0 [ 52.119192][ T5591] swap 86016 [ 52.119196][ T5591] swapcached 86016 [ 52.119200][ T5591] pgpgin 2069 [ 52.119204][ T5591] pgpgout 2069 [ 52.119208][ T5591] pgfault 53 [ 52.119212][ T5591] pgmajfault 1 [ 52.119216][ T5591] inactive_anon 0 [ 52.119220][ T5591] active_anon 0 [ 52.119224][ T5591] inactive_file 0 [ 52.119228][ T5591] active_file 0 [ 52.119232][ T5591] unevictable 0 [ 52.119236][ T5591] hierarchical_memory_limit 314572800 [ 52.119241][ T5591] hierarchical_memsw_limit 9223372036854771712 [ 52.119246][ T5591] total_cache 0 [ 52.119250][ T5591] total_rss 0 [ 52.119254][ T5591] total_rss_huge 0 [ 52.119257][ T5591] total_shmem 0 [ 52.119261][ T5591] total_mapped_file 0 [ 52.119265][ T5591] total_dirty 0 [ 52.119269][ T5591] total_writeback 0 [ 52.119274][ T5591] total_workingset_refault_anon 0 [ 52.119278][ T5591] total_workingset_refault_file 0 [ 52.119282][ T5591] total_swap 86016 [ 52.119286][ T5591] total_swapcached 86016 [ 52.119290][ T5591] total_pgpgin 2069 [ 52.119294][ T5591] total_pgpgout 2069 [ 52.119298][ T5591] total_pgfault 53 [ 52.119302][ T5591] total_pgmajfault 1 [ 52.119306][ T5591] total_inactive_anon 0 [ 52.119310][ T5591] total_active_anon 0 [ 52.119315][ T5591] total_inactive_file 0 [ 52.119319][ T5591] total_active_file 0 [ 52.119323][ T5591] total_unevictable 0 [ 52.119327][ T5591] anon_cost 0 [ 52.119331][ T5591] file_cost 0 [ 52.119336][ T5591] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.2,pid=5707,uid=0 [ 52.119648][ T5591] Memory cgroup out of memory: Killed process 5707 (syz.1.2) total-vm:104228kB, anon-rss:1276kB, file-rss:21580kB, shmem-rss:0kB, UID:0 pgtables:116kB oom_score_adj:1000 [ 52.180253][ T5720] infiniband syz2: set down [ 52.180265][ T5720] infiniband syz2: added ipvlan1 [ 52.270402][ T5733] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13'. [ 52.303188][ T5735] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14'. [ 52.312181][ T5601] Bluetooth: hci0: command tx timeout [ 52.314670][ T5720] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 52.314724][ T5720] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 52.314767][ T5720] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 52.374339][ T5720] RDS/IB: syz2: added [ 52.376528][ T5720] smc: adding ib device syz2 with port count 1 [ 52.382506][ T5720] smc: ib device syz2 port 1 has no pnetid [ 52.392690][ T5601] Bluetooth: hci2: command tx timeout [ 52.392948][ T4994] Bluetooth: hci1: command tx timeout [ 52.568669][ T5591] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 52.568714][ T5591] CPU: 0 UID: 0 PID: 5591 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 52.568737][ T5591] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 52.568763][ T5591] Call Trace: [ 52.568767][ T5591] [ 52.568771][ T5591] dump_stack_lvl+0xe8/0x150 [ 52.568786][ T5591] dump_header+0xd3/0x4b0 [ 52.568797][ T5591] oom_kill_process+0x3ab/0x9e0 [ 52.568808][ T5591] out_of_memory+0x1064/0x1480 [ 52.568816][ T5591] ? try_charge_memcg+0xc32/0x15e0 [ 52.568830][ T5591] ? __pfx_out_of_memory+0x10/0x10 [ 52.568838][ T5591] ? do_raw_spin_unlock+0x4d/0x200 [ 52.568852][ T5591] try_charge_memcg+0xcdf/0x15e0 [ 52.568866][ T5591] ? __pfx_try_charge_memcg+0x10/0x10 [ 52.568882][ T5591] ? charge_memcg+0x47/0x310 [ 52.568891][ T5591] charge_memcg+0x1dd/0x310 [ 52.568899][ T5591] ? mem_cgroup_swapin_charge_folio+0x2b/0x390 [ 52.568907][ T5591] mem_cgroup_swapin_charge_folio+0x25a/0x390 [ 52.568916][ T5591] swap_cache_alloc_folio+0x4de/0x990 [ 52.568931][ T5591] swap_cache_read_folio+0x44/0x120 [ 52.568942][ T5591] swap_cluster_readahead+0x392/0x630 [ 52.568954][ T5591] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 52.568972][ T5591] swapin_readahead+0x1a3/0xc50 [ 52.568986][ T5591] ? __pfx_swapin_readahead+0x10/0x10 [ 52.568998][ T5591] ? swap_table_get+0x1e/0x260 [ 52.569006][ T5591] ? swap_table_get+0x1e/0x260 [ 52.569014][ T5591] ? swap_table_get+0x1e/0x260 [ 52.569023][ T5591] ? swap_table_get+0x216/0x260 [ 52.569033][ T5591] ? swap_cache_get_folio+0x2e7/0x2f0 [ 52.569044][ T5591] do_swap_page+0x3fb/0x4c10 [ 52.569065][ T5591] ? __lock_acquire+0x6df/0x2e50 [ 52.569072][ T5591] ? do_swap_page+0x126/0x4c10 [ 52.569081][ T5591] ? __pfx_do_swap_page+0x10/0x10 [ 52.569089][ T5591] ? __pte_offset_map+0x1ae/0x240 [ 52.569099][ T5591] ? pte_offset_map_rw_nolock+0xea/0x160 [ 52.569109][ T5591] handle_mm_fault+0x1398/0x3750 [ 52.569122][ T5591] ? handle_mm_fault+0xf1/0x3750 [ 52.569135][ T5591] ? __pfx_handle_mm_fault+0x10/0x10 [ 52.569143][ T5591] ? lock_vma_under_rcu+0x45a/0x500 [ 52.569163][ T5591] do_user_addr_fault+0xa4f/0x1340 [ 52.569174][ T5591] ? trace_page_fault_user+0x84/0x1e0 [ 52.569183][ T5591] exc_page_fault+0x6a/0xc0 [ 52.569194][ T5591] asm_exc_page_fault+0x26/0x30 [ 52.569201][ T5591] RIP: 0033:0x7ff02af5e98e [ 52.569210][ T5591] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 52.569216][ T5591] RSP: 002b:00007fffeb1e1f18 EFLAGS: 00010246 [ 52.569224][ T5591] RAX: 0000000000000000 RBX: 0000555574195500 RCX: 00007ff02af5e98e [ 52.569229][ T5591] RDX: 00007fffeb1e1f70 RSI: 0000000000000000 RDI: 0000000000000000 [ 52.569234][ T5591] RBP: 00007fffeb1e1fdc R08: 0000000000000000 R09: 0000000000000000 [ 52.569238][ T5591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 52.569243][ T5591] R13: 00000000000927c0 R14: 000000000000c7f0 R15: 00007fffeb1e2030 [ 52.569254][ T5591] [ 52.569292][ T5591] memory: usage 307200kB, limit 307200kB, failcnt 2808 [ 52.569315][ T5591] memory+swap: usage 307280kB, limit 9007199254740988kB, failcnt 0 [ 52.569339][ T5591] kmem: usage 307196kB, limit 9007199254740988kB, failcnt 0 [ 52.569361][ T5591] Memory cgroup stats for /syz1: [ 52.569478][ T5591] cache 0 [ 52.569499][ T5591] rss 0 [ 52.569522][ T5591] rss_huge 0 [ 52.569542][ T5591] shmem 0 [ 52.569562][ T5591] mapped_file 0 [ 52.569583][ T5591] dirty 0 [ 52.569603][ T5591] writeback 0 [ 52.569623][ T5591] workingset_refault_anon 2 [ 52.569643][ T5591] workingset_refault_file 0 [ 52.606321][ T5591] swap 81920 [ 52.606330][ T5591] swapcached 94208 [ 52.606332][ T5591] pgpgin 2071 [ 52.606335][ T5591] pgpgout 2070 [ 52.606337][ T5591] pgfault 56 [ 52.606340][ T5591] pgmajfault 2 [ 52.606342][ T5591] inactive_anon 0 [ 52.606345][ T5591] active_anon 4096 [ 52.606347][ T5591] inactive_file 0 [ 52.606350][ T5591] active_file 0 [ 52.606352][ T5591] unevictable 0 [ 52.606355][ T5591] hierarchical_memory_limit 314572800 [ 52.606357][ T5591] hierarchical_memsw_limit 9223372036854771712 [ 52.606360][ T5591] total_cache 0 [ 52.606363][ T5591] total_rss 0 [ 52.606365][ T5591] total_rss_huge 0 [ 52.606367][ T5591] total_shmem 0 [ 52.606370][ T5591] total_mapped_file 0 [ 52.606372][ T5591] total_dirty 0 [ 52.606375][ T5591] total_writeback 0 [ 52.606377][ T5591] total_workingset_refault_anon 2 [ 52.606380][ T5591] total_workingset_refault_file 0 [ 52.606382][ T5591] total_swap 81920 [ 52.606385][ T5591] total_swapcached 94208 [ 52.606387][ T5591] total_pgpgin 2071 [ 52.606390][ T5591] total_pgpgout 2070 [ 52.606392][ T5591] total_pgfault 56 [ 52.606395][ T5591] total_pgmajfault 2 [ 52.606397][ T5591] total_inactive_anon 0 [ 52.606400][ T5591] total_active_anon 4096 [ 52.606402][ T5591] total_inactive_file 0 [ 52.606405][ T5591] total_active_file 0 [ 52.606407][ T5591] total_unevictable 0 [ 52.606410][ T5591] anon_cost 0 [ 52.606412][ T5591] file_cost 0 [ 52.606415][ T5591] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz-executor,pid=5591,uid=0 [ 52.606487][ T5591] Memory cgroup out of memory: Killed process 5591 (syz-executor) total-vm:98208kB, anon-rss:1288kB, file-rss:21788kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:0 [ 52.682668][ T5703] tipc: Node number set to 2886997162 [ 52.704420][ T5708] syz.1.2 (5708) used greatest stack depth: 20168 bytes left [ 53.544095][ T5779] netlink: 'syz.0.29': attribute type 4 has an invalid length. [ 53.548414][ T5779] openvswitch: netlink: IPv4 tun info is not correct [ 53.567217][ T5707] syz.1.2 (5707) used greatest stack depth: 19752 bytes left [ 53.701273][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.782803][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.853540][ T5784] netlink: 'syz.2.33': attribute type 30 has an invalid length. [ 53.857225][ T5784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.33'. [ 53.872912][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.880448][ T5784] bond0: option arp_missed_max: invalid value (0) [ 53.884118][ T5784] bond0: option arp_missed_max: allowed values 1 - 255 [ 53.961349][ T4994] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.965591][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.970153][ T4994] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.975657][ T4994] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.980342][ T4994] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.982050][ T5791] syz.0.34 uses obsolete (PF_INET,SOCK_PACKET) [ 53.990189][ T4994] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 54.153859][ T13] bridge_slave_1: left allmulticast mode [ 54.153931][ T13] bridge_slave_1: left promiscuous mode [ 54.160461][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.189173][ T13] bridge_slave_0: left allmulticast mode [ 54.192810][ T13] bridge_slave_0: left promiscuous mode [ 54.196213][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.436867][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 54.443584][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 54.447570][ T13] bond0 (unregistering): Released all slaves [ 54.452525][ T5339] 8021q: adding VLAN 0 to HW filter on device eth1 [ 54.473045][ T5601] Bluetooth: hci2: command tx timeout [ 54.475504][ T4994] Bluetooth: hci1: command tx timeout [ 54.677672][ T5339] 8021q: adding VLAN 0 to HW filter on device eth2 [ 54.925236][ T5847] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 54.942940][ T5339] 8021q: adding VLAN 0 to HW filter on device eth3 [ 55.158108][ T5860] netlink: 4 bytes leftover after parsing attributes in process `syz.0.52'. [ 55.226541][ T13] hsr_slave_0: left promiscuous mode [ 55.229069][ T13] hsr_slave_1: left promiscuous mode [ 55.229870][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 55.229893][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 55.235784][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 55.235801][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 55.246170][ T13] veth1_macvtap: left promiscuous mode [ 55.246216][ T13] veth0_macvtap: left promiscuous mode [ 55.246360][ T13] veth1_vlan: left promiscuous mode [ 55.246418][ T13] veth0_vlan: left promiscuous mode [ 55.509093][ T13] team0 (unregistering): Port device team_slave_1 removed [ 55.530832][ T13] team0 (unregistering): Port device team_slave_0 removed [ 55.610951][ T5339] 8021q: adding VLAN 0 to HW filter on device eth4 [ 55.871568][ T5789] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.871735][ T5789] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.872012][ T5789] bridge_slave_0: entered allmulticast mode [ 55.873149][ T5789] bridge_slave_0: entered promiscuous mode [ 55.874666][ T5789] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.874786][ T5789] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.874844][ T5789] bridge_slave_1: entered allmulticast mode [ 55.875868][ T5789] bridge_slave_1: entered promiscuous mode [ 55.906755][ T5789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.914666][ T5789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.973352][ T5789] team0: Port device team_slave_0 added [ 55.979050][ T5789] team0: Port device team_slave_1 added [ 56.006217][ T5893] netlink: 4 bytes leftover after parsing attributes in process `syz.0.62'. [ 56.015809][ T5893] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 56.025992][ T5893] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 56.043670][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 56.043725][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.043778][ T5789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 56.065923][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 56.065956][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 56.066000][ T5789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.079034][ T4994] Bluetooth: hci0: command tx timeout [ 56.163864][ T5789] hsr_slave_0: entered promiscuous mode [ 56.164396][ T5789] hsr_slave_1: entered promiscuous mode [ 56.299104][ T5789] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 56.309026][ T5789] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 56.309671][ T5789] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 56.319373][ T5789] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 56.320102][ T5789] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 56.327976][ T5789] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 56.329825][ T5789] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 56.339217][ T5789] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 56.434868][ T5789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.462017][ T5789] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.487064][ T959] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.487162][ T959] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.488063][ T959] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.488100][ T959] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.551672][ T5601] Bluetooth: hci2: command tx timeout [ 56.554031][ T4994] Bluetooth: hci1: command tx timeout [ 56.843074][ T5789] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.889683][ T5789] veth0_vlan: entered promiscuous mode [ 56.897213][ T5948] syzkaller0: entered promiscuous mode [ 56.897272][ T5948] syzkaller0: entered allmulticast mode [ 56.900171][ T5789] veth1_vlan: entered promiscuous mode [ 56.962794][ T5789] veth0_macvtap: entered promiscuous mode [ 56.971129][ T5789] veth1_macvtap: entered promiscuous mode [ 57.019037][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.024675][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.125437][ T5962] block nbd0: not configured, cannot reconfigure [ 57.139886][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.143991][ T5633] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.144114][ T5633] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.144139][ T5633] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.144162][ T5633] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.163497][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.210236][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.210281][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.215341][ T5968] netlink: 4 bytes leftover after parsing attributes in process `syz.0.88'. [ 58.027611][ T6049] netlink: 24 bytes leftover after parsing attributes in process `syz.0.126'. [ 58.151549][ T4994] Bluetooth: hci0: command tx timeout [ 58.514842][ T6096] netlink: 279 bytes leftover after parsing attributes in process `syz.3.150'. [ 58.514907][ T6096] veth0_to_bond: default FDB implementation only supports local addresses [ 59.278551][ T6153] syzkaller0: entered promiscuous mode [ 59.278592][ T6153] syzkaller0: entered allmulticast mode [ 59.737105][ T6164] netlink: 8 bytes leftover after parsing attributes in process `syz.0.180'. [ 59.737170][ T6164] netlink: 12 bytes leftover after parsing attributes in process `syz.0.180'. [ 59.792036][ T5633] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 4352 - 0 [ 59.792118][ T5633] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 4352 - 0 [ 59.792183][ T5633] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 4352 - 0 [ 59.792203][ T5633] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 4352 - 0 [ 60.180583][ T6184] netlink: 'syz.0.190': attribute type 1 has an invalid length. [ 60.185423][ T6184] netlink: 212 bytes leftover after parsing attributes in process `syz.0.190'. [ 60.188955][ T6184] netlink: 'syz.0.190': attribute type 1 has an invalid length. [ 60.232513][ T4994] Bluetooth: hci0: command tx timeout [ 60.808829][ T6224] 8021q: adding VLAN 0 to HW filter on device bond1 [ 60.815852][ T6227] netlink: 'syz.3.207': attribute type 32 has an invalid length. [ 60.888914][ T6232] netlink: 4 bytes leftover after parsing attributes in process `syz.0.209'. [ 61.036870][ T6246] netlink: 'syz.3.216': attribute type 3 has an invalid length. [ 61.160266][ T6254] warning: `syz.0.220' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 61.417062][ T6268] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 62.327612][ T4994] Bluetooth: hci0: command tx timeout [ 62.519493][ T6311] raw_sendmsg: syz.0.245 forgot to set AF_INET. Fix it! [ 63.110272][ T6356] Illegal XDP return value 4294967274 on prog (id 67) dev syz_tun, expect packet loss! [ 63.251124][ T6362] xt_hashlimit: size too large, truncated to 1048576 [ 64.200638][ T6443] netlink: 'syz.0.302': attribute type 3 has an invalid length. [ 64.635712][ T1297] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 64.703028][ T1297] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 64.825915][ T5633] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 64.993754][ T6502] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input4 [ 65.238716][ T6526] netlink: 60 bytes leftover after parsing attributes in process `syz.2.336'. [ 65.244463][ T6526] netlink: 60 bytes leftover after parsing attributes in process `syz.2.336'. [ 65.652079][ T6556] tipc: Enabled bearer , priority 10 [ 65.841924][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 65.842067][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 66.392461][ T5704] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 66.708700][ T6635] ------------[ cut here ]------------ [ 66.713899][ T6635] UBSAN: shift-out-of-bounds in net/wireless/chan.c:1831:49 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 66.726514][ T6635] shift exponent -22 is negative [ 66.730241][ T6635] CPU: 0 UID: 0 PID: 6635 Comm: syz.3.380 Not tainted syzkaller #0 PREEMPT(full) [ 66.730280][ T6635] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 66.730288][ T6635] Call Trace: ** replaying previous printk message ** [ 66.730288][ T6635] Call Trace: [ 66.730292][ T6635] [ 66.730296][ T6635] dump_stack_lvl+0xe8/0x150 [ 66.730313][ T6635] ubsan_epilogue+0xa/0x30 [ 66.730322][ T6635] __ubsan_handle_shift_out_of_bounds+0x36d/0x400 [ 66.730338][ T6635] ? __ieee80211_get_radio_mask+0x406/0x420 [ 66.730354][ T6635] cfg80211_set_monitor_channel+0x38a/0x8d0 [ 66.730368][ T6635] __nl80211_set_channel+0x340/0x990 [ 66.730383][ T6635] ? __pfx___nl80211_set_channel+0x10/0x10 [ 66.730393][ T6635] ? __pfx_netdev_run_todo+0x10/0x10 [ 66.730404][ T6635] ? __mutex_unlock_slowpath+0x731/0x900 [ 66.730420][ T6635] nl80211_set_wiphy+0x127c/0x3050 [ 66.730433][ T6635] ? __rtnl_unlock+0xc8/0xf0 [ 66.730442][ T6635] ? netdev_run_todo+0xfda/0x1060 [ 66.730450][ T6635] ? nl80211_pre_doit+0x5e/0x890 [ 66.730460][ T6635] ? __pfx_netdev_run_todo+0x10/0x10 [ 66.730470][ T6635] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 66.730481][ T6635] ? __nla_parse+0x40/0x60 [ 66.730492][ T6635] ? nl80211_pre_doit+0x53d/0x890 [ 66.730502][ T6635] genl_family_rcv_msg_doit+0x233/0x340 [ 66.730516][ T6635] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 66.730531][ T6635] ? bpf_lsm_capable+0x9/0x20 [ 66.730542][ T6635] ? security_capable+0x7e/0x2c0 [ 66.730581][ T6635] genl_rcv_msg+0x614/0x7a0 [ 66.730607][ T6635] ? __pfx_genl_rcv_msg+0x10/0x10 [ 66.730626][ T6635] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 66.730635][ T6635] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 66.730643][ T6635] ? __pfx_nl80211_post_doit+0x10/0x10 [ 66.730651][ T6635] ? __pfx_ref_tracker_free+0x10/0x10 [ 66.730659][ T6635] ? __asan_memcpy+0x40/0x70 [ 66.730670][ T6635] ? __skb_clone+0x5c/0x6c0 [ 66.730680][ T6635] netlink_rcv_skb+0x226/0x4a0 [ 66.730690][ T6635] ? __pfx_genl_rcv_msg+0x10/0x10 [ 66.730701][ T6635] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 66.730715][ T6635] ? down_read+0x2be/0x330 [ 66.730724][ T6635] genl_rcv+0x28/0x40 [ 66.730734][ T6635] netlink_unicast+0x7bd/0x940 [ 66.730746][ T6635] netlink_sendmsg+0x813/0xb40 [ 66.730759][ T6635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.730771][ T6635] ? apparmor_socket_sendmsg+0x98/0x360 [ 66.730783][ T6635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.730792][ T6635] sock_sendmsg_nosec+0x13a/0x180 [ 66.730805][ T6635] ____sys_sendmsg+0x54e/0x850 [ 66.730815][ T6635] ? __pfx_____sys_sendmsg+0x10/0x10 [ 66.730827][ T6635] ? import_iovec+0x73/0xa0 [ 66.730837][ T6635] ___sys_sendmsg+0x2a5/0x360 [ 66.730844][ T6635] ? __lock_acquire+0x6df/0x2e50 [ 66.730861][ T6635] ? __pfx____sys_sendmsg+0x10/0x10 [ 66.730877][ T6635] ? futex_wait+0x2a2/0x390 [ 66.730934][ T6635] ? __fget_files+0x2a/0x420 [ 66.730952][ T6635] ? __fget_files+0x3a2/0x420 [ 66.730974][ T6635] __x64_sys_sendmsg+0x1b1/0x290 [ 66.730991][ T6635] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 66.731018][ T6635] do_syscall_64+0x166/0x520 [ 66.731035][ T6635] ? trace_irq_disable+0x3b/0x140 [ 66.731049][ T6635] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.731065][ T6635] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.731077][ T6635] RIP: 0033:0x7fbeb4b9e159 [ 66.731088][ T6635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 66.731095][ T6635] RSP: 002b:00007fbeb5aef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 66.731105][ T6635] RAX: ffffffffffffffda RBX: 00007fbeb4e25fa0 RCX: 00007fbeb4b9e159 [ 66.731110][ T6635] RDX: 0000000004040000 RSI: 0000200000000040 RDI: 0000000000000003 [ 66.731116][ T6635] RBP: 00007fbeb4c3506b R08: 0000000000000000 R09: 0000000000000000 [ 66.731120][ T6635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 66.731125][ T6635] R13: 00007fbeb4e26038 R14: 00007fbeb4e25fa0 R15: 00007ffe46366df8 [ 66.731138][ T6635] [ 66.742638][ T6635] ---[ end trace ]--- [ 66.742653][ T6635] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 66.894844][ T6635] CPU: 0 UID: 0 PID: 6635 Comm: syz.3.380 Not tainted syzkaller #0 PREEMPT(full) [ 66.897686][ T6635] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 66.900701][ T6635] Call Trace: [ 66.901711][ T6635] [ 66.902593][ T6635] vpanic+0x56d/0xa60 [ 66.903877][ T6635] ? __pfx_vpanic+0x10/0x10 [ 66.905330][ T6635] ? irqentry_exit+0x218/0x910 [ 66.907536][ T6635] panic+0xc5/0xd0 [ 66.909634][ T6635] ? __pfx_panic+0x10/0x10 [ 66.911754][ T6635] ? __pfx__printk+0x10/0x10 [ 66.913606][ T6635] check_panic_on_warn+0x89/0xb0 [ 66.915792][ T6635] __ubsan_handle_shift_out_of_bounds+0x36d/0x400 [ 66.918267][ T6635] ? __ieee80211_get_radio_mask+0x406/0x420 [ 66.921049][ T6635] cfg80211_set_monitor_channel+0x38a/0x8d0 [ 66.923791][ T6635] __nl80211_set_channel+0x340/0x990 [ 66.926367][ T6635] ? __pfx___nl80211_set_channel+0x10/0x10 [ 66.928864][ T6635] ? __pfx_netdev_run_todo+0x10/0x10 [ 66.930765][ T6635] ? __mutex_unlock_slowpath+0x731/0x900 [ 66.932777][ T6635] nl80211_set_wiphy+0x127c/0x3050 [ 66.934805][ T6635] ? __rtnl_unlock+0xc8/0xf0 [ 66.936790][ T6635] ? netdev_run_todo+0xfda/0x1060 [ 66.938807][ T6635] ? nl80211_pre_doit+0x5e/0x890 [ 66.940817][ T6635] ? __pfx_netdev_run_todo+0x10/0x10 [ 66.943028][ T6635] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 66.945487][ T6635] ? __nla_parse+0x40/0x60 [ 66.947708][ T6635] ? nl80211_pre_doit+0x53d/0x890 [ 66.950031][ T6635] genl_family_rcv_msg_doit+0x233/0x340 [ 66.952752][ T6635] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 66.955595][ T6635] ? bpf_lsm_capable+0x9/0x20 [ 66.957582][ T6635] ? security_capable+0x7e/0x2c0 [ 66.959459][ T6635] genl_rcv_msg+0x614/0x7a0 [ 66.961222][ T6635] ? __pfx_genl_rcv_msg+0x10/0x10 [ 66.963297][ T6635] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 66.965672][ T6635] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 66.968005][ T6635] ? __pfx_nl80211_post_doit+0x10/0x10 [ 66.970257][ T6635] ? __pfx_ref_tracker_free+0x10/0x10 [ 66.972377][ T6635] ? __asan_memcpy+0x40/0x70 [ 66.974677][ T6635] ? __skb_clone+0x5c/0x6c0 [ 66.976713][ T6635] netlink_rcv_skb+0x226/0x4a0 [ 66.978862][ T6635] ? __pfx_genl_rcv_msg+0x10/0x10 [ 66.981078][ T6635] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 66.983359][ T6635] ? down_read+0x2be/0x330 [ 66.985139][ T6635] genl_rcv+0x28/0x40 [ 66.986759][ T6635] netlink_unicast+0x7bd/0x940 [ 66.988830][ T6635] netlink_sendmsg+0x813/0xb40 [ 66.990811][ T6635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.992969][ T6635] ? apparmor_socket_sendmsg+0x98/0x360 [ 66.994700][ T6635] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.996347][ T6635] sock_sendmsg_nosec+0x13a/0x180 [ 66.998036][ T6635] ____sys_sendmsg+0x54e/0x850 [ 66.999592][ T6635] ? __pfx_____sys_sendmsg+0x10/0x10 [ 67.001467][ T6635] ? import_iovec+0x73/0xa0 [ 67.003263][ T6635] ___sys_sendmsg+0x2a5/0x360 [ 67.005201][ T6635] ? __lock_acquire+0x6df/0x2e50 [ 67.007197][ T6635] ? __pfx____sys_sendmsg+0x10/0x10 [ 67.009235][ T6635] ? futex_wait+0x2a2/0x390 [ 67.010929][ T6635] ? __fget_files+0x2a/0x420 [ 67.012671][ T6635] ? __fget_files+0x3a2/0x420 [ 67.014273][ T6635] __x64_sys_sendmsg+0x1b1/0x290 [ 67.015919][ T6635] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 67.018021][ T6635] do_syscall_64+0x166/0x520 [ 67.019684][ T6635] ? trace_irq_disable+0x3b/0x140 [ 67.021439][ T6635] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.023799][ T6635] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.025923][ T6635] RIP: 0033:0x7fbeb4b9e159 [ 67.027719][ T6635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 67.034318][ T6635] RSP: 002b:00007fbeb5aef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 67.037265][ T6635] RAX: ffffffffffffffda RBX: 00007fbeb4e25fa0 RCX: 00007fbeb4b9e159 [ 67.040400][ T6635] RDX: 0000000004040000 RSI: 0000200000000040 RDI: 0000000000000003 [ 67.043015][ T6635] RBP: 00007fbeb4c3506b R08: 0000000000000000 R09: 0000000000000000 [ 67.045798][ T6635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 67.048761][ T6635] R13: 00007fbeb4e26038 R14: 00007fbeb4e25fa0 R15: 00007ffe46366df8 [ 67.051990][ T6635] [ 67.054238][ T6635] Kernel Offset: disabled [ 67.055976][ T6635] Rebooting in 86400 seconds.. VM DIAGNOSIS: 01:06:33 Registers: info registers vcpu 0 CPU#0 RAX=ffffffff82435f86 RBX=0000000000000001 RCX=ffff88811499bc00 RDX=0000000000000000 RSI=0000000000000001 RDI=000000000011cab3 RBP=ffffc900027e7690 RSP=ffffc900027e7350 R8 =ffffea000472acc7 R9 =1ffffd40008e5598 R10=dffffc0000000000 R11=fffff940008e5599 R12=1ffff110229a8ab2 R13=00007f65659ff000 R14=000000000011cab3 R15=00007f65658b2000 RIP=ffffffff82435fe4 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f6566af96c0 ffffffff 00c00000 GS =0000 ffff88818d6d8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffdf14f97e8 CR3=00000001ba6c0000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 00007f9b5695d560 XMM02=00007f9b55df25e8 00007f9b55df2618 XMM03=00007f9b55df2600 00007f9b55df25e0 XMM04=00007f9b5695d020 00007f9b55df25c0 XMM05=00007f9b55df25d0 00007f9b55df2610 XMM06=00007f9b55df25f8 00007f9b55df25c8 XMM07=00007f9b55df2600 00007f9b55df25e0 XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 0000000000000000 XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000 XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000 XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000001 RBX=0000000000000206 RCX=0000000000000046 RDX=ffffc90004466e01 RSI=ffffffff8e6fd4c2 RDI=ffffffff8c6d9480 RBP=ffff88811145c7d8 RSP=ffffc90004466d50 R8 =ffffc900044670c8 R9 =0000000000000000 R10=ffffc90004466eb8 R11=fffff5200088cdd9 R12=0000000000000001 R13=0000000000000001 R14=ffffffff8ed5c6e0 R15=ffff88811145bc00 RIP=ffffffff81a34e56 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff8882a8cd8000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f8528f57e20 CR3=000000000eb48000 CR4=000006f0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00007ffe17549b20 00007ffe17549b20 XMM01=00007f85283f2823 00007f85283f2823 XMM02=0000000000000000 00000000000000ff XMM03=0000000000000000 0000000000000000 XMM04=0000000000000000 0000000000ff0000 XMM05=0140a08080100001 8004010000000806 XMM06=060160da04808208 0001e00300100001 XMM07=d00300100001c003 02100001b0037010 XMM08=000e900302080003 e8034e040003e403 XMM09=7220666535353830 6239666666666666 XMM10=646f6d5f44495f45 5551494e555f5f20 XMM11=66666666660a3139 3733315f6f666e69 XMM12=0000000000080000 01000000ffffffd0 XMM13=0000000000010000 01000000ffffffe0 XMM14=0000000000000200 01000000fffffff0 XMM15=0100000000000008 0007000800100008